Re: CSP: setAttribute allows eval from string

Its by design.

This also works with inline-scripts enabled:

document.write("<script>alert(1)</script>")
On Jun 16, 2011 6:03 AM, "gaz Heyes" <gazheyes@gmail.com> wrote:
> Hey all
>
> CSP needs to account for event handlers when used with setAttribute as it
> allows strings to be eval'd
>
> <?php
> session_start();
> header("X-Content-Security-Policy: allow 'self'; options inline-script");
> ?>
> <script>
> window.onload=function() {
> document.links[0].setAttribute('onclick','alert(1)');
> }
> </script>
>
> <a href="#">test</a>
>
> Cheers
>
> Gareth