google / google/csp-evaluator

Don't recommend trusted-types if CSP blocks scripts

Open
#43 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
404
Forks
59
PR merge metrics
No merged PRs in 30d

Description

If a CSP has `script-src: none` or equivalent to forbid script loading, or if it has a `sandbox` directive to forbid script execution, the CSP evaluator shouldn't recommend `requires-trusted-types-for: script` because there is no script execution happening in the first place.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.