CODEWITHSUNDEEP
wildcardcontent-security-policyzap
Ram Eswar
Ram Eswar

Reputation: 13

Unable to find the Wildcard directive in my CSP

I conducted a ZAP assessment on my application, I received a flag 'CSP: Wildcard Directive' which has high confidence level. Still, I have not been able to locate the source of the wildcard directive. The CSP I use now:

script-src 'self' 'nonce-randomNonce' https://maps.googleapis.com/ https://lh3.ggpht.com/; style-src 'self' 'nonce-randomNonce' https://fonts.googleapis.com/; font-src 'self' https://fonts.googleapis.com/; img-src 'self' https://maps.gstatic.com/ ; worker-src 'self' blob:; connect-src 'self' https://maps.googleapis.com/;

Some notes:

Can someone find what is responsible for Wildcard Directive flag, or what is it that I am missing?

Thanks!

Upvotes: 1

Views: 111

Answers (1)

kingthorin
kingthorin

Reputation: 1528

There are a set of CSP directives that do not fall back to default source. If you haven't defined them it's the same as setting *

If you check the "Other Info" of the alert you should see specifics.

The following directives don't use default-src as a fallback. Remember that failing to set them is the same as allowing anything:

  • base-uri
  • form-action
  • frame-ancestors
  • plugin-types
  • report-uri
  • sandbox

Upvotes: 1

Related Questions