CSP blocks script execution, not HTML insertion

Today I learned that a Content Security Policy (CSP) blocks script execution but doesn't prevent HTML insertion. That means even if you inject a tag with onerror into the HTML, the tag stays in the DOM but the event never fires. CSP focuses on stopping potentially dangerous code from running, which makes web apps far more resistant to attacks. More on CSP.

<img src="invalid.jpg" onerror="alert('Ошибка загрузки!')" />

In this example, with a correctly configured CSP the alert won't fire, even though the img tag is present in the DOM.