Re: CSP: setAttribute allows eval from string

On 16 June 2011 15:46, Eduardo Vela <sirdarckcat@gmail.com> wrote:

> Its by design.
>
> This also works with inline-scripts enabled:
>
> document.write("<script>alert(1)</script>")
>

That's slightly different though, you're writing HTML but in my previous
example it's clearly executing a string as JS but I take your point