Description

Detects insecure Content Security Policy (CSP) configurations that allow unsafe inline scripts in Kotlin applications. Using 'unsafe-inline' in CSP headers weakens the application's defense against Cross-Site Scripting (XSS) attacks by allowing potentially malicious inline scripts to execute.

Detection Strategy

• Identifies response.setHeader method calls in Kotlin code

• Verifies if the header being set is 'Content-Security-Policy'

• Checks if the CSP value contains 'unsafe-inline' directive

• Reports a vulnerability when CSP is configured to allow unsafe inline scripts

Vulnerable code example

import javax.servlet.http.HttpServletResponse

fun setInsecureCSP(response: HttpServletResponse) {
    // Vulnerable: 'unsafe-inline' allows execution of inline scripts, bypassing CSP protections
    response.setHeader("Content-Security-Policy", "script-src 'self' 'unsafe-inline'")
}

✅ Secure code example

import javax.servlet.http.HttpServletResponse
import java.security.SecureRandom
import java.util.Base64

fun setSecureCSP(response: HttpServletResponse) {
    // Generate cryptographically secure nonce for script execution
    val nonce = generateNonce()
    // Secure: Uses nonce and strict-dynamic instead of unsafe-inline...