I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website).
Content-Security-Policy: "default-src 'self'; script-src 'self' data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' *.example.com; font-src *; connect-src 'self' *example.com"
My questions are:
1) Won't whitelisting unsafe-inline
and unsafe-eval
kind of defeat the whole CSP?
2) If 'unsafe-inline' is allowed or whitelisted as above, can someone call a JavaScript from an external website, say www.xxxxxx.com that is not whitelisted in script-src
directive and there-by defeat the whole purpose of CSP? Eg: <script src="www.xxxxxx.com/bad.js">
I went through this question here and going by the answers, it does look like the above CSP is not good.