Unsafe eval script
security.headers.unsafe_eval_script
- Outcome class
- Automatic. An automated check that can report a confirmed violation.
- Area
- Security, response headers
What the rule checks
Scope. Applies to responses with at least one enforced Content-Security-Policy header; without one (or with only a report-only policy) there is no policy to judge.
Expectation. Fails when the effective script source list allows 'unsafe-eval' (in every policy of the list). Without an enforced CSP the check does not apply (that is the missing_header finding).
Source. CSP Level 3, 'Directives' (script-src, style-src and object-src fall back to default-src; base-uri and frame-ancestors have no fallback), 'Does a source list allow all inline behavior for type?' ('unsafe-inline' is ignored next to a nonce or hash), 'Policy lists' (every policy is enforced); Google CSP Evaluator
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case security_csp_policy_list_both_weak. The case is a set of response headers; there is no page.
The server sends no header the check looks at.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYThis page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.