Include eval hashes in CSP reports if the hashes in v1 flag is enabled

carlosjoan91 · chromium-wpt-export-bot · commit 1aec529a3da1 · 2025-07-08T15:16:05.000-07:00
Bug: 428158604 Change-Id: I354ad3f72476b81648641ab0d842e7f6bd2aa52a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6663042 Reviewed-by: Mason Freed <masonf@chromium.org> Auto-Submit: Carlos IL <carlosil@chromium.org> Commit-Queue: Carlos IL <carlosil@chromium.org> Cr-Commit-Position: refs/heads/main@{#1483999}
diff --git a/content-security-policy/unsafe-eval/tentative/eval-blocked-report-contains-hash.html b/content-security-policy/unsafe-eval/tentative/eval-blocked-report-contains-hash.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>eval-blocked-and-sends-report</title>
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src='../../support/logTest.sub.js?logs=["PASS: eval() blocked"]'></script>
+    <script src="../../support/alertAssert.sub.js?alerts=[]"></script>
+</head>
+
+<body>
+    <script>
+    try {
+      eval("alert_assert('FAIL')");
+    } catch (e) {
+      log('PASS: eval() blocked');
+    }
+    </script>
+    <script async defer src='../../support/checkReport.sub.js?reportField=eval-hash&reportValue=eval-sha256-59RYbtpsgpNknZwNEVJ55z9MzqclgnRZLLIunfpEiL4='></script>
+    <div id="log"></div>
+</body>
+
+</html>
diff --git a/content-security-policy/unsafe-eval/tentative/eval-blocked-report-contains-hash.html.sub.headers b/content-security-policy/unsafe-eval/tentative/eval-blocked-report-contains-hash.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-blocked-report-contains-hash={{$id:uuid()}};
+Content-Security-Policy: script-src 'self' 'unsafe-inline'; report-uri /reporting/resources/report.py?op=put&reportID={{$id}}
