CS Fundamentals Trainer · JavaScript · Security
Under a CSP of script-src 'self' (without 'unsafe-eval'), calling eval('1 + 1') from a same-origin script throws an EvalError.
Under a CSP of `script-src 'self'` (without `'unsafe-eval'`), calling `eval('1 + 1')` from a same-origin script throws an `EvalError`.
Difficulty: medium