Scripts or plugins may load from any host or from inline data.

CSP_WILDCARD_SOURCE · Severity: Warning

• WarningCSP_WILDCARD_SOURCE

  Scripts or plugins may load from any host or from inline data.

  The directive that governs scripts or plugins (script-src, object-src or the default-src fallback) allows *, a whole scheme such as https: or data:, so an attacker who can inject markup can load a script from a host of their choice. With 'strict-dynamic' and a nonce or hash, browsers ignore such sources for scripts, and the finding is not reported for script-src.

  Recommendation: List the exact hosts, or use nonces or hashes with 'strict-dynamic'.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).
• Warning CSP_NO_DEFAULT_SRC The policy has no default-src directive.

All findings