Why only 'unsafe-inline' of 'script-src' is reported as a high
severity finding? From what I understood also 'script-src-elem'
'unsafe-inline' could be dangerous
This is not a mistake, Google is doing it deliberately.
I). 'unsafe-inline' has three attack vectors:
- inline blocks
- inline event handlers in tags like
script-src-elem 'unsafe-inline' is really safer than
script-src 'unsafe-inline', since it reduces the number of attack vectors from 3 to one.
Besides, "classic" XSS with
<script></script> insertion is a rarity, webmasters no longer make such childish mistakes.
The most common XSS is with insufficient escaping of quotes and injecting tags with
onclick='...' attributes and
script-src-elem 'unsafe-inline' defends from those.
II). If you do a little research of
csp-evaluator.withgoogle.com, you will realize that this is more of an educational toy than a real test of CSP safety.
Google csp-evaluator simply reacts to familiar words or their absence, it does not performs check of CSP rules with relation to each other. For example
script-src 'unsafe-inline'; sandbox; will trigger 'High severity finding' in scripts, although
sandbox ; rule completely disallows all scripts.
csp-evaluator.withgoogle.com this is more a "political" move then real vulnerability checker. Google just educates webmasters to make attention to some common mistakes and tries at the subconscious level to consolidate the idea that Chrome is safer than others.
script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' rule is wrong,
'unsafe-eval' is not supported in the
script-src-elem directive. But
csp-evaluator keeps a silent abt this.