Re: The return of script-sample?

On Tue, Dec 4, 2012 at 7:17 PM, neil matatall <neil@matatall.com> wrote:
> (late to the party)
>
> I was discussing data-mining capabilities provided from gathering CSP reports with a colleague, and we talked about how only Firefox's implementation will send a script-sample containing 45 characters of the script. We had discussed using the script-samples to build a list of payloads injected and feed them into a WAF like mod-security for signature detection.
>
> Ignoring stances on WAFs and malicious script detection, was there a reason that script-sample in the CSP report was not included in the spec? It helps in identifying legit injections (in the case that unsafe-inline is disabled) and those created by plugins/infected browsers (Chrome makes this easier to filter based on chrome-extensions: which I believe are automatically ignored in Chrome canary). I do see a potential privacy issue here, but if you're not allowing inline script the script-sample certainly won't contain sensitive literals.

That's certainly an interesting idea and something we should consider for 1.1.

Would you be willing to add it to
http://www.w3.org/Security/wiki/Content_Security_Policy under
"Proposals for Version 1.1"?

As a side note, we should consider updating this page and using it
more to organize the various 1.1 proposals...

Adam

Received on Thursday, 6 December 2012 02:49:53 UTC