2

I'm evaluating a CSP policy using https://csp-evaluator.withgoogle.com/. The policy is configured as follow:

default-src 'self';object-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';script-src-elem 'self' 'unsafe-inline' 'unsafe-eval';script-src-attr 'self' 'unsafe-inline';

Why only 'unsafe-inline' of 'script-src' is reported as a high severity finding? From what I understood also 'script-src-elem' 'unsafe-inline' could be dangerous. What am I missing?

Improve this question

2 Answers 2

Reset to default
2

I don't think you are missing anything, this does seem to be an error in googles CSP evaluator.

script-src-elem is used to control the source of script tags (inline or external; see also the spec). You can test this yourself, eg with:

<?php
header("content-security-policy: script-src 'self'; script-src-elem 'self' 'unsafe-inline'")
?>
<script>alert(1);</script>

Viewed with Chrome, the payload will fire (Firefox does not support script-src-elem). If you remove unsafe-inline, the CSP will block the script.

So we can see that script-src-elem 'unsafe-inline' is indeed dangerous.

Improve this answer
1
  • of course, by "dangerous" we mean "not any safer than the default, so why are you using this safety feature at all?"
    – user253751
    Dec 29, 2020 at 18:37
1

Why only 'unsafe-inline' of 'script-src' is reported as a high severity finding? From what I understood also 'script-src-elem' 'unsafe-inline' could be dangerous

This is not a mistake, Google is doing it deliberately.

I). 'unsafe-inline' has three attack vectors:

  1. inline blocks <script></script>
  2. javascript navigation like <a href='javascript: ...'> and <iframe src='javascript: ...'>
  3. inline event handlers in tags like <tag onClick='javascript here'>

Rules script-src-elem 'unsafe-inline' is really safer than script-src 'unsafe-inline', since it reduces the number of attack vectors from 3 to one. Besides, "classic" XSS with <script></script> insertion is a rarity, webmasters no longer make such childish mistakes.
The most common XSS is with insufficient escaping of quotes and injecting tags with onclick='...' attributes and script-src-elem 'unsafe-inline' defends from those.

II). If you do a little research of csp-evaluator.withgoogle.com, you will realize that this is more of an educational toy than a real test of CSP safety. Google csp-evaluator simply reacts to familiar words or their absence, it does not performs check of CSP rules with relation to each other. For example script-src 'unsafe-inline'; sandbox; will trigger 'High severity finding' in scripts, although sandbox ; rule completely disallows all scripts.

csp-evaluator.withgoogle.com this is more a "political" move then real vulnerability checker. Google just educates webmasters to make attention to some common mistakes and tries at the subconscious level to consolidate the idea that Chrome is safer than others.

PS: The script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' rule is wrong, 'unsafe-eval' is not supported in the script-src-elem directive. But csp-evaluator keeps a silent abt this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .