When using the report-only mode of the Content-Security-Policy, Chrome does not execute eval()
anymore.
For the following example, I would expect to get 2 reports (one for the inline-script and one for the eval
) and also, to see a pop-up. But only the 2 reports are displayed in the console.
Do I use the CSP wrong or is there a bug with the CSP report-only mode in Chrome?
<!DOCTYPE html>
<html>
<meta http-equiv="Content-Security-Policy-Report-Only" content="default-src 'self'; report-uri /dummy.html"/>
<meta http-equiv="X-Content-Security-Policy-Report-Only" content="default-src 'self'; report-uri /dummy.html"/>
<meta http-equiv="X-WebKit-CSP-Report-Only" content="default-src 'self'; report-uri /dummy.html"/>
<head>
<script>
eval('alert(1);');
</script>
</head>
</html>