google / csp-evaluator

https://csp-evaluator.withgoogle.com
Apache License 2.0
335 stars 46 forks source link

Frame Ancestors are allowed to have non-leading wildcards #58

Open HandyHat opened 1 year ago

HandyHat commented 1 year ago

As described on MDN (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors#sources), any wildcards used in a source for the frame-ancestors directive must be leading. However, CSP Evaluator does not flag when a non-leading wildcard is used, and instead says it is all good: image