Sign in
chromium
/
external
/
github.com
/
WebKit
/
webkit
/
refs/heads/main
/
.
/
LayoutTests
/
http
/
wpt
/
content-security-policy
/
duplicate-body-hide-nonce-attribute.https.html
blob: 47083668841d0a5efe5d6330f6501d878cae80b2 [
file
] [
edit
]
<!DOCTYPE html>
<body>
<h1>
CSP Nonce Bypass
</h1>
Hello
<style>
body
[
nonce
*=
secret
]{
background
:
red
}
</style>
<body
<script
nonce
=
"secret"
src
=
"resources/dummy.js"
></script>
</body>
</html>