aboutsummaryrefslogtreecommitdiff
path: root/test-suite/challenges/42-strict-csp-evaluate.html
AgeCommit message (Collapse)Author
2026-05-310.15.29: CSP bypass via CDP Runtime.evaluate for ↵Tianren Dong
evaluate/snapshot/waitFor/initScript - evaluateInTab/executeInTab now run through CDP Runtime.evaluate instead of new Function() in MAIN world, so chrome_evaluate/chrome_snapshot work on pages that block unsafe-eval (github.com, many bank/SaaS apps). Preserves value markers (undefined/function/symbol/bigint/Error), DOMRect expansion, and the expression/statement fallback; keeps {ok,value} error envelope. - page.waitFor polls via service-worker-side CDP evaluation. - chrome_navigate initScript uses Page.addScriptToEvaluateOnNewDocument. - Add npm test (test-suite/unit/csp-eval.test.mjs) and in-browser regression challenge 42 strict-csp-evaluate; update challenge 39 notes + docs/primer.