Fun with reflected XSS in Javascript

Unsafe input:

Safe input:

Unsafe input with output escaping:

Example XSS attack strings:

• <script>alert(1)</script> – blocked by CSP
• <img src="x"; onerror="alert(1)"> – allowed by CSP script-src-attr directive

Output: