Audit lab

Think of a home safety inspector with a clipboard. They do not redesign your house. They tick five boxes (smoke alarm, gas, wiring, locks, escape route), give a score, and hand you a short list of fixes. This lab is that clipboard for CSP.

The five checks

Each check is worth 20 points, for a score out of 100. Use allows and effective_sources from watched.leg3a_csp, which already apply the fallback rules (Lesson 64). Compare sources lower-cased. Keywords keep their single quotes inside the Python string, so object-src 'none' comes back as ["'none'"], not ['none']. The test page is ORIGIN = "https://shopd.example".

The five policies

FIVE_POLICIES holds five realistic headers: an old shop that allows everything, a blog with script-src 'self' https:, a policy that only sets framing, a strict nonce-based policy, and this site's own (shortened). Try to predict each score before you run the code.

Here is an honest result in advance: floati.life's policy loses the framing points. That is not a hole on the real site, because it sends X-Frame-Options: DENY instead (Lesson 68), and this rubric only reads CSP. The lesson: a score is a tool for asking questions, not a verdict. The policy also keeps 'unsafe-eval', which the rubric does not score, for the in-browser Python.

Fixing the weakest

fix(header) should change as little as possible:

1. If the header already scores 100, return it unchanged.
2. Otherwise parse_policy it. Take the effective script sources (effective_sources(policy, "script-src"), which may come from default-src), drop any in DANGEROUS (compare lower-cased), and set script-src to what is left, or ["'self'"] if nothing is left. Named hosts and nonces survive.
3. Only for checks that failed: set object-src to ["'none'"], base-uri to ["'self'"], frame-ancestors to ["'self'"].
4. Leave every other directive as it was, and join back with "; ", each directive written as its name and sources separated by spaces.

Dropping 'unsafe-eval' is right for a shop that does not need it. On a real site, check first: some tools, like the Python runner here, truly need it. Write that decision down instead of quietly keeping it.

A common misconception: "a score of 100 means the site is safe". This rubric checks five common gaps. It does not see a nonce reused on every page, a trusted CDN that hosts anyone's files, or DOM injection that Trusted Types would catch. Use it to find the obvious problems fast, then read the policy properly.

// JavaScript
function parsePolicy(header) {
  const policy = {};
  for (const part of header.split(";")) {
    const [name, ...sources] = part.trim().split(/\s+/);
    if (name && !(name.toLowerCase() in policy)) policy[name.toLowerCase()] = sources;
  }
  return policy;
}

// Go
policy := map[string][]string{}
for _, part := range strings.Split(header, ";") {
    bits := strings.Fields(part)
    if len(bits) == 0 { continue }
    name := strings.ToLower(bits[0])
    if _, seen := policy[name]; !seen { policy[name] = bits[1:] }
}

// Rust
let mut policy = std::collections::HashMap::new();
for part in header.split(';') {
    let mut bits = part.split_whitespace();
    if let Some(name) = bits.next() {
        policy.entry(name.to_lowercase()).or_insert(bits.collect::<Vec<_>>());
    }
}