User:BWolff (WMF)/CSP/7

So we put  in LocalSettings.php.

Now the following code should be fine from an XSS point of view (and is included on this page):

But no alert is generated. You can see instead that an error is generated in the javascript console. Additionally if you have MediaWiki debug logging enabled, a log entry is made in the  channel.

next