The return of script-sample?

(late to the party)

I was discussing data-mining capabilities provided from gathering CSP reports with a colleague, and we talked about how only Firefox's implementation will send a script-sample containing 45 characters of the script. We had discussed using the script-samples to build a list of payloads injected and feed them into a WAF like mod-security for signature detection. 

Ignoring stances on WAFs and malicious script detection, was there a reason that script-sample in the CSP report was not included in the spec? It helps in identifying legit injections (in the case that unsafe-inline is disabled) and those created by plugins/infected browsers (Chrome makes this easier to filter based on chrome-extensions: which I believe are automatically ignored in Chrome canary). I do see a potential privacy issue here, but if you're not allowing inline script the script-sample certainly won't contain sensitive literals. 

- Neil

Received on Wednesday, 5 December 2012 03:18:00 UTC