yeukhon / csp-validator Goto Github PK

by returning bool and reason we can implement #2 quite easily.

The following policy:

default-src 'self';
frame-src https://login.persona.org;
img-src *;
media-src 'self' mediastream:;
script-src 'self' https://login.persona.org;

... results in the following error:

{
  'errors': [
     {'directive_name': 'media-src', 'reason': 'mediastream: is an invalid source expression.'}],
  'valid': False}

Are mediastream urls valid?

if user inputs non-1.0 spec compliant policy such as “allow ‘self’ ; options inline-script eval-script” we should give a warning and continue to invalidate such input.

We loop through the source list in match_source_expression, but sadly we return True immediately and ignore the rest. It's okay to stop for the False, but we should continue for (at least at this time) the True case.

Currently report-uri fails because it is matched against a source. Instead it source match against a uri.

I called the deprecated eval-script inline-eval. The correction is the other way around.

For non-compliance and unsafe policy, we should add them to warning.

In essence, we can expand the output to this:

{
   'valid':  true/false,
   'errors': [ ],
   'warnings': [ ]
}

So that you can simply run python setup.py test.

according to ian's blog post here: https://blog.mozilla.org/security/2013/06/11/content-security-policy-1-0-lands-in-firefox/

We currently only validate directive! I forgot to add source list validation to validate. sigh

The output contains %s in the error statement.