CSP Deep Audit (csp-deep-audit)

Summary

Deep Content-Security-Policy analysis beyond header presence.

Classification

• Category: SECURITY
• Plugin id: csp-deep-audit
• Version: 1.0.0
• Target types: WEBSITE, API, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for csp-deep-audit.

Check	Typical severity	Why
No Content Security Policy	WARNING	No Content-Security-Policy or -Report-Only header on GET response — XSS surface not restricted by CSP.
CSP in report-only mode	INFO	Only Content-Security-Policy-Report-Only present — violations logged, not blocked.
unsafe-inline in script-src without nonce/hash/strict-dynamic	WARNING	Inline script allowance without compensating controls largely defeats XSS protection.
unsafe-eval in script-src	WARNING	Allows eval and similar — common XSS gadget enabler.
Wildcard (*) in any directive	WARNING	Source list * removes origin restriction for that directive.
HTTP scheme in directive values	INFO	http: or http://… in CSP allows mixed/downgrade resource loads.
Missing object-src	INFO	No object-src and default-src is not 'none'/'self' — plugins/objects not explicitly blocked.
Missing base-uri	INFO	Relative URL base can be hijacked via injected <base>.
Missing form-action	INFO	Forms could submit to attacker-controlled origins.
Missing frame-ancestors	INFO	Clickjacking protection relies on legacy X-Frame-Options unless set here.
Missing upgrade-insecure-requests	INFO	Mixed HTTP subresources on HTTPS pages not auto-upgraded by CSP.

How each check works

1. GET target — Read Content-Security-Policy or fall back to Content-Security-Policy-Report-Only.
2. Absent CSP — If no header: WARNING; optionally detect meta-tag CSP in HTML body (metrics only, still WARNING outcome).
3. Parse — Split policy into directives; map lowercase names to value lists.
4. script-src checks — unsafe-inline without nonce/hash/strict-dynamic → WARNING; unsafe-eval → WARNING.
5. Per-directive — * in values → WARNING; http:/http:// → INFO.
6. Missing directives — object-src (with default-src guard), base-uri, form-action, frame-ancestors, upgrade-insecure-requests (or legacy block-all-mixed-content) → INFO each.
7. Report-only — INFO finding when enforcement header missing but report-only present.

Caveats and concerns

• Single response — One GET; CDN vs app may send different CSP on other routes.
• Meta tag CSP — Detected but not deeply validated; still treated as weak vs header CSP.
• Nonce/hash not verified — Presence of 'nonce-…' in policy string satisfies inline check without validating deployment.
• No violation reporting — Does not inspect report-uri / report-to.
• API JSON responses — CSP may be irrelevant on pure JSON API targets but checks still run.

Source

packages/test-plugins/src/plugins/csp-deep-audit.ts