search

nico3333fr / CSP-useful

Collection of scripts, thoughts about CSP (Content Security Policy)
MIT License
487 stars 59 forks source link

Remove misconfigured WTFs #71

Closed Zenexer closed 5 years ago

Zenexer commented 5 years ago

Many of the WTFs are just the result of misconfigured CSP directives. For example:

Those are both lacking 'self' for style-src, so their styles are getting blocked.

A good chunk of the script-sample entries fall into this category. Anything with blocked-uri: self should be considered to be a misconfiguration--the developer is simply missing 'self'.

nico3333fr commented 5 years ago

No, these styles are not present on the website and self is defined in CSP headers.

MaceWindu commented 5 years ago

actually first one is probably from this extension https://github.com/daidaiworm/vimium

see this file https://searchcode.com/codesearch/view/26916074/

MaceWindu commented 5 years ago

Looking at second one I suspect it is also some SEO/malware extension to spam forums with SEO links as this snippet could be found alot on different message boards and it it adds extra styles to seo-related links.

MaceWindu commented 5 years ago

Close as explained?

nico3333fr commented 5 years ago

@MaceWindu yes, closed :)