app?name=&lt;script&gt;alert('xss');&lt;script&gt;</pre>
<p>We have reopened our XSS hole that was patched by adding CSP.</p>
<blockquote>
	Note: We are using <code>alert('xss')</code> as an example of a 
	function call in JavaScript to illustrate the weaknesses <code>unsafe-inline</code> adds. 
	In case you ever wondered why everyone is so concerned about the <code>alert</code> function, if you
	can execute an alert function call, an attacker can probably find a way to execute whatever JavaScript they want