Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Improve Content Security Policy Description

See original GitHub issue

Describe the bug The Content Security Policy Plugin description could use some tweaking to help users understand what it’s doing and or alerting on. The evidence provided is showing the existing CSP, but when it alerts, it’s unclear that it’s trying to tell you that a MISSING or overly lax setting is set in one of the headers. Today, the scanner (I think) is looking for these values existence and weakness of setting

script-src, style-src, img-src, frame-ancestors, connects-src, frame-src, font-src, media-src, object-src, manifest-src, worker-src, prefetch-src, form-action

https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/ContentSecurityPolicyScanRule.java

Feedback from users is that when A value or multiple values exist and are correct, the alert description and evidence make it seem like the value in the evidence is what is being alerted upon, even though it is likely correct.

To Reproduce Steps to reproduce the behavior:

Run scan with the CSP checker turned on with a website with a single CSP value
View the alert description and evidence
Become confused… 😃

Expected behavior The description of the alert possibly should mention what headers and values it’s looking for and indicate the evidence is pointing out MISSING settings and or weak values.

Software versions

ZAP: 2.11
Add-on: Content Security Policy Passive Scan Rule (https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/ContentSecurityPolicyScanRule.java)
OS: NA
Java: NA
Browser: NA

Would you like to help fix this issue? Maybe, if this is simply adding text to the description. 😃

Issue Analytics

State:
Created 2 years ago
Comments:6 (5 by maintainers)

Top GitHub Comments

1reaction

sgerlachcommented, Sep 30, 2021

Ahhhh I see the problem. It’s a dynamic description issue. Not a bug, alert happened the right way. CLosing

0reactions

github-actions[bot]commented, Dec 30, 2021

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Top Results From Across the Web

Content Security Policy (CSP) - HTTP - MDN Web Docs

Chrome Edge Content‑Security‑Policy Full support. Chrome25. more. Toggle history Full sup... base‑uri Full support. Chrome40. Toggle history Full sup... block‑all‑mixed‑content. Deprecated Full support. ChromeYes. Toggle history...

Content-Security-Policy Header CSP Reference & Examples

Content-Security-Policy is the name of a HTTP response header that modern browsers use to enhance the security of the document (or web page)....

What is Content Security Policy (CSP) | Header Examples

A Content Protection Policy (CSP) adds protection measures against XSS, clickjacking, and other code injection attacks. Learn how.

Content Security Policy - OWASP Cheat Sheet Series

A strict policy's role is to protect against classical stored, reflected, and some of the DOM XSS attacks and should be the optimal...

Using Content Security Policy (CSP) to Secure Web Applications

Enter Content Security Policy (CSP) – a standardized set of directives that tell the browser what content sources can be trusted and which ......