Skip to content

On main: csp-update #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

On main: csp-update #76

wants to merge 1 commit into from

Conversation

@jordan-dr
Copy link
Contributor

No description provided.

@dryrunsecurity
Copy link

DryRun Security

This pull request identifies a potential security vulnerability in the Rails application's Content Security Policy (CSP) configuration that could allow script execution from multiple sources, potentially enabling cross-site scripting (XSS) attacks.

💭 Unconfirmed Findings (1)
Vulnerability Potential Content Security Policy (CSP) Bypass
Description In the Rails application's content security policy configuration, script sources are currently allowed from :self and :https, which could create vulnerabilities by permitting script execution from multiple sources and potentially enabling cross-site scripting (XSS) attacks. The configuration is located in config/initializers/content_security_policy.rb and represents a security risk that should be more tightly controlled.

All finding details can be found in the DryRun Security Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jordan-dr