Skip to content

simplifying eval utils #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juerkkil merged 1 commit into from
Nov 15, 2025
Merged

simplifying eval utils #38

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 17 additions & 14 deletions secheaders/eval_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@ def eval_x_xss_protection(contents: str) -> Tuple[int, list]:
#
# value '1' is dangerous because it can be used to block legit site features. If this header is defined, either
# one of the below values if recommended
if contents.lower() in ['1; mode=block', '0']:
values = [v.strip() for v in contents.split(';')]
if '0' in values or ('1' in values and 'mode=block' in values):
return EVAL_OK, []

return EVAL_WARN, []
Expand All @@ -44,23 +45,25 @@ def eval_csp(contents: str) -> Tuple[int, list]:
csp_parsed = csp_parser(contents)

for rule, values in UNSAFE_CSP_RULES.items():
if rule not in csp_parsed:
if '-src' in rule and 'default-src' in csp_parsed:
# fallback to default-src
for unsafe_src in values:
if unsafe_src in csp_parsed['default-src']:
csp_unsafe = True
csp_notes.append(
f"Directive {rule} not defined, and default-src contains unsafe source {unsafe_src}"
)
elif 'default-src' not in csp_parsed:
csp_notes.append(f"No directive {rule} nor default-src defined in the Content Security Policy")
csp_unsafe = True
else:
rule_defined = rule in csp_parsed
default_src_defined = 'default-src' in csp_parsed

if rule_defined:
for unsafe_src in values:
if unsafe_src in csp_parsed[rule]:
csp_notes.append(f"Unsafe source {unsafe_src} in directive {rule}")
csp_unsafe = True
elif '-src' in rule and default_src_defined:
for unsafe_src in values:
if unsafe_src in csp_parsed['default-src']:
csp_unsafe = True
csp_notes.append(
f"Directive {rule} not defined, and default-src contains unsafe source {unsafe_src}"
)
else:
if not default_src_defined:
csp_notes.append(f"No directive {rule} nor default-src defined in the Content Security Policy")
csp_unsafe = True

if csp_unsafe:
return EVAL_WARN, csp_notes
Expand Down