Need help with csp-evaluator?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

google
195 Stars 32 Forks Apache License 2.0 38 Commits 8 Opened issues

Services available

!
?

Need anything else?

Contributors list

# 48,118
Shell
React N...
React
end-to-...
11 commits
# 93,264
JavaScr...
Shell
CSS
applica...
5 commits
# 321,935
JavaScr...
Shell
HTML
React
2 commits
# 144,637
JavaScr...
PHP
1 commit
# 445,089
JavaScr...
CSS
contact...
Shell
1 commit

CSP Evaluator Core Library

Introduction


Please note: this is not an official Google product.

CSP Evaluator allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against cross-site scripting attacks. It assists with the process of reviewing CSP policies, and helps identify subtle CSP bypasses which undermine the value of a policy. CSP Evaluator checks are based on a large-scale study and are aimed to help developers to harden their CSP and improve the security of their applications. This tool is provided only for the convenience of developers and Google provides no guarantees or warranties for this tool.

CSP Evaluator comes with a built-in list of common CSP allowlist bypasses which reduce the security of a policy. This list only contains popular bypasses and is by no means complete.

The CSP Evaluator library + frontend is deployed here: https://csp-evaluator.withgoogle.com/

Installing

This library is published to

https://www.npmjs.com/package/csp_evaluator
. You can install it via:
npm install csp_evaluator

Building

To build, run:

npm install && tsc --build

Testing

To run unit tests, run:

npm install && npm test

Example Usage

import {CspEvaluator} from "csp_evaluator/dist/evaluator.js";
import {CspParser} from "csp_evaluator/dist/parser.js";

const parsed = new CspParser("script-src https://google.com").csp; console.log(new CspEvaluator(parsed).evaluate());

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.