blob: f5776da249cb66eb3e59e94db2cd8da86a602cdf [file] [log] [blame]
CONSOLE ERROR: line 4: The XSS Auditor refused to execute a script in 'http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter&disable-protection=1' because its source code was found within the request. The server sent a 'Content-Security-Policy' header requesting this behavior.
ALERT: Loaded http://127.0.0.1:8000/security/xssAuditor/resources/echo-intertag.pl?q=%3Cscript%3Ealert(String.fromCharCode(0x58,0x53,0x53))%3C/script%3E&csp=filter&disable-protection=1 into the IFrame.
Testing behavior when "reflected-xss" is set to filter, and "X-XSS-Protection" is set to allow.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
Page rendered here.