google / google/csp-evaluator

*.googleapis.com warning could be simpler

Open
#71 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
404
Forks
59
PR merge metrics
No merged PRs in 30d

Description

The current explanation for why `*.googleapis.com` is dangerous is the following:
> ajax.googleapis.com is known to host JSONP endpoints and Angular libraries which allow to bypass this CSP.

I find this weirdly specific, since this rule allows a much broader point of entry than `ajax.googleapis.com`: `storage.googleapis.com` allows anyone to upload and serve any file, without any checks or restrictions, for example: https://storage.googleapis.com/bg-common/samples/evil.js

I believe the warning would be better worded like this
> `storage.googleapis.com` allows anyone to upload and serve any file, without any checks or restrictions.

This makes it more universal as it's not related to either angular or JSONP, which seem more niche and not necessarily relevant to the person reading

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.