WPIntell

Source evidence

default-src ‘self’; img-src *; media-src * data:;

No unsafe-inline · support · 2024-10-10T16:01:00+00:00

No unsafe-inline plugin evidence original source source API
neutralsentiment
highseverity
0.69relevance
4replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 35 rows with source links

14.3% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

30 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
fuzzy21 resolved
We are report only now, but it looks like the plugin is adding this x-content-security-policy: default-src ‘self’; img-src *; media-src * data:; to the header. Yet, we do have some img-src specified. Do the * get removed when we go to enforcing? Aren’t the X- older style anyhow? Please, post a link to the page with this issue and let me know what do you have in your Base Rules’ tab. This plugin has a function to reduce img-src to * if the CSP policy header generated is too long (see: https://github.com/MocioF/No-unsafe-inline/blob/2aa46f952220aba9648dac86bf092d7a86a8bcd4/public/class-no-unsafe-inline-public.php#L400 ), but I think you are deploying a CSP with another mechanism or plugin. This site is internal, so cannot show it. View post on imgur.com View post on imgur.com This reply was modified 1 year, 7 months ago by fuzzy21 . Sorry @fuzzy21 , but this plugin does never deploy the x-content-security-policy HTTP header, but only the Content-Security-Policy or the Content-Security-Policy-Report-Only headers. I found another csp plugin that I was testing, sorry for the noise.

Comments

4 shown
Giuseppe 2024-10-12T09:24:00+00:00

Please, post a link to the page with this issue and let me know what do you have in your Base Rules’ tab. This plugin has a function to reduce img-src to * if the CSP policy header generated is too long (see: https://github.com/MocioF/No-unsafe-inline/blob/2aa46f952220aba9648dac86bf092d7a86a8bcd4/public/class-no-unsafe-inline-public.php#L400 ), but I think you are deploying a CSP with another mechanism or plugin.

fuzzy21 2024-10-14T14:03:00+00:00

This site is internal, so cannot show it. View post on imgur.com View post on imgur.com This reply was modified 1 year, 7 months ago by fuzzy21 .

Giuseppe 2024-10-14T22:23:00+00:00

Sorry @fuzzy21 , but this plugin does never deploy the x-content-security-policy HTTP header, but only the Content-Security-Policy or the Content-Security-Policy-Report-Only headers.

fuzzy21 2024-10-15T15:53:00+00:00

I found another csp plugin that I was testing, sorry for the noise.