Description

Detects unsafe usage of inline JavaScript scripts that violate Content Security Policy (CSP) best practices. This creates security risks by allowing arbitrary script execution, potentially enabling cross-site scripting (XSS) attacks. CSP is designed to prevent such attacks by controlling script execution sources.

Detection Strategy

• Identifies JavaScript inline script usage in HTML elements and attributes

• Checks for script content directly embedded in HTML rather than loaded from approved external sources

• Detects event handlers with inline JavaScript code in HTML attributes (like onclick="...")

• Reports violations when inline scripts are found that would be blocked by strict CSP rules

Vulnerable code example

const express = require('express');
const helmet = require('helmet');
const app = express();

// Vulnerable: Using unsafe-inline allows execution of arbitrary scripts
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],...

✅ Secure code example

const express = require('express');
const helmet = require('helmet');
const crypto = require('crypto');
const app = express();

// Generate unique nonce per request
app.use((req, res, next) => {
  res.locals.nonce = crypto.randomBytes(16).toString('base64');...