Add Sec audit for using CSP about lighthouse HOT 3 CLOSED

Hey @Garbee! Thanks for the suggestion. I think we definitely want to consider these kinds of rules alongside other security ones (like serving on TLS, for example).

So this audit would look for unsafe-eval and unsafe-inline, right? Noodling here over whether there are other things CSP-related that would be worth folding in. I'm no CSP boffin, though, so suggestions welcome!

from lighthouse.

Yup, those are the two unsafe rules. The only other two things possible are wildcards * in a domain, since they allow any given subdomain to send content. Then there is deprecated rules such as frame-src.

I'm working on a patch to the DevTools Sec Panel with this kind of parsing. But, this tool provides another opportunity to get this information in front of developers. If you want a full parser that functions in most cases 😉 is in this CR. The third_party/WebKit/Source/devtools/front_end/sdk/CSPParser.js file.

from lighthouse.

Ideally, I'd like to defer to what lands in CSPParser and the warnings surfaced in DevTools.

We can use that easily in Lighthouse once its in place.

In the meantime I've added an entry to goto.google.com/lighthouse-rules for CSP to track this. I'll close the issue as it's not in the immediate milestone for lighthouse

from lighthouse.