Description

Detects unsafe usage of wildcards (*) in Content Security Policy (CSP) directives that could weaken security protections. Overly permissive wildcards in CSP directives can allow malicious resources to be loaded, potentially enabling cross-site scripting (XSS) or other injection attacks.

Detection Strategy

• Examines HTTP response headers for Content-Security-Policy headers

• Analyzes CSP directives for wildcard (*) patterns that create overly broad permissions

• Reports a vulnerability when CSP directives use wildcards in ways that significantly reduce security effectiveness

• Checks combined/multiple CSP headers if present in the response