Skip welcome & menu and move to editor
Welcome to JS Bin
File
Add library
Share
Login or Register
Blog
Help
Load cached copy from
  • Run with JS
  • Save
  • Share
  • …
 
<!DOCTYPE html>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" value="trusted-types *">
<script src="https://rawgit.com/WICG/trusted-types/master/dist/es6/trustedtypes.build.js"></script>
<pre id="foo">
</pre>
<script>
  let testCase = 0;
​
  async function test(name, f) {
    try {
      const r = await f(++testCase);
      const msg = name + ' allowed: ' + r;
      console.log(msg);
      foo.innerText += msg + '\n';
      
    } catch(e) {
      const msg = name + ' blocked';
      console.log(msg);
      foo.innerText += msg + '\n';
      console.error(e);
    }
  }
  
  test('createHTMLDocument', (n) => {
    const d = document.implementation.createHTMLDocument('title');
    d.body.innerHTML = '<foo>'+n;
    return d.body.innerHTML;
  });
​
  test('DOMParser', (n) => {
    return new DOMParser().parseFromString('<foo>'+n, 'text/html').body.innerHTML;
  });
​
  test('DOMParser, manual modification', (n) => {
    const d = DOMParser().parseFromString('<foo>', 'text/html');
    d.body.innerHTML = n;
    return d.body.innerHTML;
  });
​
  function xhrGet(url, responseType="") {
    return new Promise(
        function (resolve, reject) {
            const request = new XMLHttpRequest();
            request.onload = function () {
                if (this.status === 200) {
                    // Success
                    resolve(this.response);
                } else {
                    // Something went wrong (404 etc.)
                    reject(new Error(this.statusText));
                }
            };
            request.onerror = function () {
                reject(new Error(
                    'XMLHttpRequest Error: '+this.statusText));
            };
            request.open('GET', url);
            request.responseType = responseType;
            request.send();
        });
  }
  
  test('xhr', async (n) => {
    const d = await xhrGet("data:text/html,<foo>"+n, "document");
    return d.body.innerHTML;
  });
​
  test('xhr, manual modification', async (n) => {
    const d = await xhrGet("data:text/html,<foo>"+n, "document");
    d.body.innerHTML = n;
    return d.body.innerHTML;
  });
​
​
</script>
 
​
 
​
Output

You can jump to the latest bin by adding /latest to your URL

Dismiss x
public
Bin info
anonymouspro
0viewers