5

Google provides a CSP evaluator to validate if a given content-security policy is well set up (github, validator). However, if one uses 'unsafe-inline' in the style-src directive this is reported as 'all good' (See image below).

Does this not (mostly) defeat the purpose of defining a style source? As far as I understand an attacker would be able to inject CSS. Not as big of an issue as JavaScript execution, but I would not report it with a green checkmark. What am I missing here?

Results from the CSP evaluator.

Improve this question
1
  • 1
    My guess is it just doesn't consider styles to be a high-risk issue compared to XSS. It doesn't even complain if you omit style-src and default-src entirely as long as script-src is configured correctly.
    – Ajedi32
    Sep 9, 2021 at 20:48

1 Answer 1

Reset to default
0

I agree with you this should not be a green checkmark. A coding mistake that would allow for style injection could still be abused for website defacing and possibly phishing attacks. I expect you could count this as a medium finding.

Looking at the repository, there are more issues that should get some attention, but I think it is not a priority of Google at this time.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .