(In reply to Frederik Braun [:freddy] from comment #2) > I believe the test case is confusing and doing three things at the same time. > * The nonced script is fine as inline-script because of the nonce > * The content of the nonced script ends up calling `eval()` which is not fine because the CSP lacks `unsafe-eval`. Remove the call of `eval` to simplify the test. > * The `onclick` event handler violates `script-src` (which is the fallback directive if no `script-src-attr` or `script-src-elem` are present). > > Why do you believe that the inline script in `onclick=...` should be allowed? It should be forbidden. It's only confusing that Firefox emits a CSP violation when loading the document and Chrome emits a CSP violation only when clicking, not before.
Bug 1926025 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(In reply to Frederik Braun [:freddy] from comment #2) > I believe the test case is confusing and doing three things at the same time. > * The nonced script is fine as inline-script because of the nonce > * The content of the nonced script ends up calling `eval()` which is not fine because the CSP lacks `unsafe-eval`. Removed the call of `eval` to simplify the test. > * The `onclick` event handler violates `script-src` (which is the fallback directive if no `script-src-attr` or `script-src-elem` are present). > > Why do you believe that the inline script in `onclick=...` should be allowed? It should be forbidden. It's only confusing that Firefox emits a CSP violation when loading the document and Chrome emits a CSP violation only when clicking, not before.