search

google / csp-evaluator

https://csp-evaluator.withgoogle.com
Apache License 2.0
315 stars 45 forks source link

Don't recommend trusted-types if CSP blocks scripts #43

Open Seirdy opened 2 years ago

Seirdy commented 2 years ago

If a CSP has script-src: none or equivalent to forbid script loading, or if it has a sandbox directive to forbid script execution, the CSP evaluator shouldn't recommend requires-trusted-types-for: script because there is no script execution happening in the first place.

Seirdy commented 2 years ago

I considered making this issue about skipping the trusted-types recommendation even if scripts are present if they don't mess with DOM XSS sinks. I decided against this because adding the necessary script parsing logic to the CSP Evaluator would complicate things.