Protocol: Unsafe Eval or Inline in Content Security Policy¶

Identifier: csp_unsafe_eval

Scanner(s) Support¶

Description¶

A Content-Security-Policy that includes 'unsafe-eval', 'unsafe-inline' in script-src, or 'unsafe-inline' in style-src substantially weakens XSS defenses. These keywords allow dynamic code evaluation, inline JavaScript execution, or inline CSS that CSP is designed to block, making it easier for attackers to run injected payloads even when a policy is present.

How we test: We parse the Content-Security-Policy response header and detect permissive source expressions such as 'unsafe-eval' in script directives, 'unsafe-inline' in script-src, or 'unsafe-inline' in style-src.

References:

• OWASP Content Security Policy Cheat Sheet
• OWASP Web Security Testing Guide: Test for Content Security Policy
• CWE-79: Cross-site Scripting
• Content Security Policy Level 3

Configuration¶

Example¶

Example configuration:

---
security_tests:
  csp_unsafe_eval:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.