sus.botdocs

Security finding

The Content-Security-Policy allows scripts from a host where anyone can publish

Security Warning Severity: Medium

Part of the audit Security headers. Finding id: security.cspOpenHosts.

What it costs you

Anyone can put a file on that host, so an attacker who can inject one script tag into your page can load their own code from it and the policy lets it run. The policy looks strict and protects as little as a wildcard.

What to do

Remove the shared host from the policy. Load the file from your own host, or allow it by nonce or hash instead of by host.

What it checks

  • Policy trusts a site anyone can publish on

How to fix it

Stop allowing the shared host

  1. List the files your pages load from [open host]. Copy each one to your own host, or put a nonce on the script tag that loads it.
  2. Remove [source] from [directive]. If you must keep the host, allow the exact file path only, for example https://[open host]/npm/library@1.2.3/dist/library.min.js.
  3. Send the new policy as Content-Security-Policy-Report-Only first, read the reports, then enforce it.

How to check: curl -sI [example url] | grep -i content-security-policy (no [open host] without a path in [directive])