Lukas Weichselbaum lweichselbaum

## untrusted.html
<!DOCTYPE html>
<html>
<head>
  <title>Evil Site</title>
</head>

<body bgcolor="red">
  <h2>Evil Site Demo</h2>

  <!-- deduct via XSRF -->

## fetch-metadata-XSSI-demo.html
<!DOCTYPE html>
<script src="https://secmetadata.appspot.com/api/xssi"> </script>
<!-- alert() will reveal the secret if the current browser doesn't support Fetch Metadata request headers. -->
<script>alert(secret)</script>

## FF_CSP_BUG.html
<!DOCTYPE html>
<html>
<head>
  <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcd1234'">
</head>
<body>
  <script nonce='abcd1234'>
    var s = document.createElement('script');
    s.setAttribute('nonce', 'abcd1234');
    s.src = 'https://goo.gl/jEH8zk';  // redirects to jquery.
	<!DOCTYPE html>
	<html>
	<head>
	<title>Evil Site</title>
	</head>

	<body bgcolor="red">
	<h2>Evil Site Demo</h2>

	<!-- deduct via XSRF -->
	<!DOCTYPE html>
	<script src="https://secmetadata.appspot.com/api/xssi"> </script>
	<!-- alert() will reveal the secret if the current browser doesn't support Fetch Metadata request headers. -->
	<script>alert(secret)</script>