CSP allows unsafe inline script execution
ShipReady found the unsafe-inline source expression in the effective script policy without a nonce or script hash expression.
Why it matters
Allowing inline scripts broadly can reduce a Content Security Policy's ability to constrain script execution. The practical risk depends on the page, browser behavior, and other defenses; this configuration evidence is not proof that an inline-script attack succeeds.
How ShipReady detects it
What it inspects
ShipReady parses the enforcing Content-Security-Policy header and inspects effective script sources: script-src when present, otherwise the default-src fallback.
What triggers a finding
The rule triggers when the effective script sources contain the unsafe-inline token and contain no nonce or sha256, sha384, or sha512 script hash source expression.
What the evidence shows
The report identifies whether the matching sources came from script-src or the default-src fallback and records the script-source value observed by the parser.
Limits of this check
ShipReady does not execute page scripts, test an inline-script payload, inspect script-src-elem or script-src-attr, or analyze a separate Report-Only policy. It also does not model browser-specific CSP behavior or prove that an inline-script exploit is possible.
How to fix it
Replace broad inline allowance deliberately
Move required scripts to controlled external files where practical, or use carefully generated nonces or hashes for specific inline scripts.
Test the effective script policy
Exercise application flows after changing the policy and confirm legitimate scripts still load while unwanted inline execution is constrained.
How to verify the change
Verify the deployed script policy
Inspect the enforcing Content-Security-Policy header and determine the effective script sources, including default-src fallback when script-src is absent.
Expected: The effective script policy no longer contains an unnecessary broad unsafe-inline allowance, or uses the intended nonce or hash mechanism.
Related checks
- CSP permits unsafe string-to-code evaluationA policy can separately permit string-to-code evaluation; review that token when tightening the same effective script policy.
- CSP uses an overly broad script sourceA broad script source is a separate allowlist condition to inspect when tightening the same effective script policy.