ALERT: PASS: Case 3 was not blocked by a CSP.
CONSOLE MESSAGE: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

ALERT: PASS: Case 2 was blocked by a CSP.
CONSOLE ERROR: line 46: Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

ALERT: PASS: Case 1 was not evaluated in main world.
ALERT: undefined
Test a script that bypasses the main world's CSP to see if its *content* bypasses the main world as well (it should not).