ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create rule S7039: Content Security Policies should be restrictive (NET-24) (#4188)

Browse Source
This commit is contained in:
github-actions[bot] 2024-08-23 14:19:27 +02:00 committed by GitHub
parent b2b19cb731
commit 54c37571c0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 45 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/S7039/csharp/metadata.json Normal file
View File

@ -0,0 +1,2 @@
{
}

43
rules/S7039/csharp/rule.adoc Normal file
View File

@ -0,0 +1,43 @@
== Why is this an issue?
include::../rationale.adoc[]
include::../impact.adoc[]
== How to fix it
=== Code examples
==== Noncompliant code example
[source,csharp,diff-id=1,diff-type=noncompliant]
----
using System.Web;
public async Task InvokeAsync(HttpContext context)
{
context.Response.Headers.ContentSecurityPolicy = "script-src 'self' 'unsafe-inline';"; // Noncompliant
}
----
==== Compliant solution
[source,csharp,diff-id=1,diff-type=compliant]
----
using System.Web;
public async Task InvokeAsync(HttpContext context)
{
context.Response.Headers.ContentSecurityPolicy = "script-src 'self' 'sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';";
}
----
=== How does this work?
include::../common/fix/least_privilege.adoc[]
== Resources
include::../common/resources/docs.adoc[]
include::../common/resources/standards.adoc[]