I have a website to do security testing. The CSP is as follows.

default-src * ;
style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://cdn.ckeditor.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
font-src 'self' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/

As per my understanding, default-src * ; loads everything such as script, html and so from any domain. Is it safe to do? The web app loads third party scripts, images and css from only the three domains as mentioned in the policy. In that case default-src 'self' would suffice?

Also, what threat usage of data: could create? Does it break the application if I remove that?


default-src *

This is now the default policy for all directives that are absent. This is not as secure as it could be.

Since there is no img-src directive, the value for default-src is used as img-src. This means that images can be loaded from any URL. This doesn't introduce a big security problem, since showing images is relatively benign.

There is also no object-src directive, so that also permits everything. This is a problem, since XSS can now load Flash application using an object tag.

Also, what threat usage of data: could create?

Any plaintext script can be rewritten as a data: URL, so allowing data URI's is equivalent to allowing any inline script. So this does not properly prevent against XSS.

Does it break the application if I remove that?

This depends whether the application uses the data URI for the normal functioning of the application. Some applications use this, although it is rare.

You can also check the CSP yourself using the CSP Evaluator tool.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.