P018 BrowserPolicyLoosened
- Applies to
- Pull requests, through the GitHub App
- Severity
- Warning (fails the check under fail-on-warnings)
- Summary
- A change loosens the Content-Security-Policy or CORS policy.
- Flags
- Added 'unsafe-inline', 'unsafe-eval', AllowAnyOrigin() and Access-Control-Allow-Origin set to * in code and config files outside test files. Comment lines are skipped. Generated files (<auto-generated in the first 10 lines) are skipped.
Before
"script-src 'self' 'unsafe-inline'"After
$"script-src 'self' 'nonce-{nonce}'"Fix
- Use nonces or hashes instead of 'unsafe-inline' or 'unsafe-eval', and list allowed origins instead of any origin.