<!DOCTYPE html>
<html>
<head>
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>
  <script src="/security/contentSecurityPolicy/resources/cascade-helper.js"></script>
  <meta http-equiv="content-security-policy" content="img-src 'none'">
</head>
<body>
<script>
  async_test(t => {
    assert_blocked_image_in_document(t, document, "http://example.test:8000/resources/square.png?img-in-top-level");
  }, "Image loaded in top-level blocked.");

  async_test(t => {
    window.addEventListener("message", t.step_func(e => {
      assert_equals(e.data, "blocked");
      t.done();
    }));

    window.open("data:text/html,<script>" + 
                "  var i = document.createElement('img');" +
                "  i.onload = _ => opener.postMessage('loaded', '*');" +
                "  i.onerror = _ => opener.postMessage('blocked', '*');" +
                "  i.src = 'http://example.test:8000/resources/square.png?data-frame'" +
                "</scr" + "ipt>");
  }, "Image loaded via data: window blocked.");
</script>
</body>
</html>