&gt;
	doSomething();
&lt;script&gt;</pre>
<p>That inline script will also be blocked by CSP by default. There are ways to allow it, such as <a href="/nonce/" title="CSP nonce"><code>nonce</code></a> and <a href="/hash/" title="CSP hash"><code>hash</code></a>. But the sledge hammer way to allow it would be to add <code>unsafe-inline</code> to your policy. Suppose we added it to our policy:</a>
<pre>script-src: 'self' 'unsafe-inline'</pre>
<p>Now, go back to our vulnerable example app and try this:</p>
<pre>/