blob: b9b3cfe03a5fc0852fc2a012cf67618eaa334502 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
def main(request, response):
policy = request.GET.first(b"policy")
return [(b"Content-Type", b"text/html"), (b"Content-Security-Policy", policy)], b"""
<!DOCTYPE html>
<html>
<script>
function check_eval(context) {
context.eval_check_variable = 0;
try {
id = context.eval("eval_check_variable + 1");
} catch (e) {
if (e instanceof EvalError) {
if (context.eval_check_variable === 0)
return "blocked";
else
return "EvalError exception, but eval was executed";
} else {
return "Unexpected exception: " + e.message;
}
}
return "allowed";
}
window.parent.postMessage({
evalInIframe: check_eval(window),
evalInParent: check_eval(parent),
});
</script>
</html>
"""
|
