<!DOCTYPE html>
<html>
<head>
    <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcdefg' 'strict-dynamic'">
    <script src="/resources/testharness.js" nonce="abcdefg"></script>
    <script src="/resources/testharnessreport.js" nonce="abcdefg"></script>
</head>
<body>
    <script nonce="abcdefg">
        function generateURL(type) {
          return 'http://localhost:8000/security/contentSecurityPolicy/resources/loaded.js?' + type;
        }

        var loaded = {};
        var blocked = {};
        window.addEventListener("message", function (e) {
          loaded[e.data] = true;
        });
        document.addEventListener("securitypolicyviolation", function (e) {
          blocked[e.lineNumber] = true;
        });

        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append");
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("append")]);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Script injected via 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append-async");
          e.async = true;
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("append-async")]);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Async script injected via 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append-defer");
          e.defer = true;
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("append-defer")]);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Deferred script injected via 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt src='" + generateURL("write") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("write")], undefined);
            assert_true(blocked[65]);
          }, 1));
        }, "Script injected via 'document.write' is not allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt defer src='" + generateURL("write-defer") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("write-defer")], undefined);
            assert_true(blocked[73]);
          }, 1));
        }, "Deferred script injected via 'document.write' is not allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt async src='" + generateURL("write-async") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("write-async")], undefined);
            assert_true(blocked[81]);
          }, 1));
        }, "Async script injected via 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append");
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("defer-append")]);
                assert_equals(blocked[generateURL("defer-append")], undefined);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append-async");
          e.async = true;
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("defer-append-async")]);
                assert_equals(blocked[generateURL("defer-append-async")], undefined);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Async script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append-defer");
          e.defer = true;
          e.onload = t.step_func(function () {
              // Delay the check until after the postMessage has a chance to execute.
              setTimeout(t.step_func_done(function () {
                assert_true(loaded[generateURL("defer-append-defer")]);
                assert_equals(blocked[generateURL("defer-append-defer")], undefined);
              }, 1));
          });
          e.onerror = t.unreached_func("Error should not be triggered.");
          document.body.appendChild(e);
        }, "Deferred script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt src='" + generateURL("write") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("defer-write")], undefined);
            assert_true(blocked[134]);
          }, 1));
        }, "Script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt defer src='" + generateURL("defer-write-defer") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("write-defer")], undefined);
            assert_true(blocked[142]);
          }, 1));
        }, "Deferred script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");

        async_test(function (t) {
          document.write("<scr" + "ipt async src='" + generateURL("defer-write-async") + "'></scr" + "ipt>");
          setTimeout(t.step_func_done(function () {
            assert_equals(loaded[generateURL("defer-write-async")], undefined);
            assert_true(blocked[150]);
          }, 1));
        }, "Async script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
</body>
</html>