Bugzilla

STR:

0. Download the attached example.
1. Start a local web server, e.g. via `python3 -m http.server`.
2. Open the example with a hash, e.g.: `http://0.0.0.0:8000/x.html#alert(1)`.
3. Open the developer console to observe the logged errors.

Actual: Firefox's (current release) logs:

```
Uncaught EvalError: call to eval() blocked by CSP
    <anonymous> http://0.0.0.0:8000/x.html#alert(1):5
x.html:5:1
Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'nonce-x'” (Missing 'unsafe-eval') x.html:5:1
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src 'nonce-x'”
Source: location.href = malicious
```

Expected: no CSP violation for the event handler. That's also Chrome's behavior.

STR:

0. Download the attached example.
1. Start a local web server, e.g. via `python3 -m http.server`.
2. Open the example with a hash, e.g.: `http://0.0.0.0:8000/x.html#alert(1)`.
3. Open the developer console to observe the logged errors.

Actual: Firefox's (current release) logs:

```
Uncaught EvalError: call to eval() blocked by CSP
    <anonymous> http://0.0.0.0:8000/x.html#alert(1):5
x.html:5:1
Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'nonce-x'” (Missing 'unsafe-eval') x.html:5:1
Content-Security-Policy: The page’s settings blocked an event handler (script-src-attr) from being executed because it violates the following directive: “script-src 'nonce-x'”
Source: location.href = malicious
```

Expected: no CSP violation for the event handler. That's also Chrome's behavior.

Credits to https://github.com/w3c/webappsec-csp/issues/322#issuecomment-811135901 for inspiring the example.