navigate-parent-to-blob.html

Enable keyboard shortcuts

<!DOCTYPE html>

<html>

  <head>

    <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">

  </head>

  <body>

    <script>

      const blob_payload = `

        <!doctype html>

         <script>

           var i = false;

           try {

             eval('i = true');

           } catch {}

           opener.postMessage(i ? "eval allowed" : "eval blocked", '*');

         </scr` + `ipt>

`;

      var blob_url = URL.createObjectURL(

          new Blob([blob_payload], { type: 'text/html' }));

      parent.location = blob_url;

    </script>

  </body>

</html>