"data" URL schemes can contain a ; when using the base64 extension.
When such scheme is used as a directive source, it seems that this ; trips the current CspParser, which wrongly splits the directive, as shown in the example below:
import { CspParser } from "csp_evaluator/dist/parser.js";
const example = "script-src 'nonce-xyz' data:image/png;base64,SGVsbG8sIFdvcmxkIQ== 'strict-dynamic'";
const { csp } = new CspParser(example);
console.log(csp)
"data" URL schemes can contain a
;
when using the base64 extension. When such scheme is used as a directive source, it seems that this;
trips the currentCspParser
, which wrongly splits the directive, as shown in the example below: