Public source map

security.headers.public_source_map

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, response headers

What the rule checks

Scope. Applies to documents that load external scripts or stylesheets.

Expectation. Fails when a script or stylesheet of the page names a source map (trailing sourceMappingURL comment) and that map URL answers 2xx. A named map that is not served (404) and an inline data: map pass. A page without external scripts or stylesheets: not applicable. If the page itself cannot be fetched (transport error, error status) or no asset answers, the check is not run (errored) — never 'no leak'. Method limitation: assets are taken from the served HTML, so scripts inserted after load are not inspected.

Source. ECMA-426 Source Map Format (sourceMappingURL linking); OWASP WSTG-INFO-05 (review webpage content for information leakage)

Detection: analyze_security; needs network.

Failing example

The check reports a violation here. Corpus case security_source_map_public. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Passing example

The check passes here and reports nothing. Corpus case security_source_map_inline. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.