Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a warning to the CSP validator for 'self' on script-src directives. #2672

Merged
merged 8 commits into from
May 6, 2024

Conversation

underdarknl
Copy link
Contributor

@underdarknl underdarknl commented Mar 18, 2024

This adds a warning to the CSP validator for 'self' on script-src directives.

Code Checklist

  • All the commits in this PR are properly PGP-signed and verified.
  • This PR only contains functionality relevant to the issue; tickets have been created for newly discovered issues.
  • I have written unit tests for the changes or fixes I made.
  • For any non-trivial functionality, I have added integration and/or end-to-end tests.
  • I have performed a self-review of my code and refactored it to the best of my abilities.

Communication

  • I have informed others of any required .env changes files if required and changed the .env-dist accordingly.
  • I have made corresponding changes to the documentation, if necessary.
  • I have included comments in the code to elaborate on what is not self-evident from the code itself, including references to issues and discussions online, or implicit behavior of an interface.

Checklist for code reviewers:

Copy-paste the checklist from the docs/source/templates folder into your comment.


Checklist for QA:

Copy-paste the checklist from the docs/source/templates folder into your comment.

This adds a warning to the CSP validator for 'self' on script-src directives.
@underdarknl underdarknl added enhancement New feature or request boefjes Issues related to boefjes labels Mar 18, 2024
@underdarknl underdarknl added this to the OpenKAT v1.16 milestone Mar 18, 2024
@underdarknl underdarknl requested a review from a team as a code owner March 18, 2024 19:00
@underdarknl underdarknl changed the title Update check_csp_header.py Add a warning to the CSP validator for 'self' on script-src directives. Mar 18, 2024
ammar92
ammar92 previously approved these changes Mar 19, 2024
Copy link
Contributor

@ammar92 ammar92 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me; just revert the mentioned spelling mistake and the test has to be updated

octopoes/bits/check_csp_header/check_csp_header.py Outdated Show resolved Hide resolved
@stephanie0x00
Copy link
Contributor

stephanie0x00 commented May 6, 2024

Checklist for QA:

  • I have checked out this branch, and successfully ran a fresh make reset.
  • I confirmed that there are no unintended functional regressions in this branch:
    • I have managed to pass the onboarding flow
    • Objects and Findings are created properly
    • Tasks are created and completed properly
  • I confirmed that the PR's advertised feature or hotfix works as intended.

What works:

Can confirm that the change is shown (item 4).

image

What doesn't work:

n/a

Bug or feature?:

n/a

@dekkers dekkers merged commit fc7a587 into main May 6, 2024
20 checks passed
@dekkers dekkers deleted the feat/csp-self-script-src-warning branch May 6, 2024 12:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
boefjes Issues related to boefjes enhancement New feature or request
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

4 participants