cli 评价员
环绕命令行工具 csp评估员。 。 。 .
安装
$ npm install -g @einride/csp-evaluator-cli
使用量
CLI 界面试图模仿 社区支助方案 评价员在线工具它把内容安全政策当作一串, 以及在此基础上得出的结果.
输出格式
有三种支持的产出格式:
- 人类 (默认)
缩写 社区支助方案 评价员在线工具 输出.
> csp validate "script-src https://google.com"
! Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?
script-src:
? https://google.com: No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.
- 乔森
JSON是经过的 csp评估员 输出.
> csp validate --output-format=json "script-src https://google.com"
[{"type":300,"description":"Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?","severity":10,"directive":"object-src"},{"type":305,"description":"No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.","severity":50,"directive":"script-src","value":"https://google.com"}]
- json - 漂亮
与 乔森,但缩入.
> csp validate --output-format=json-pretty "script-src https://google.com"
[
{
"type": 300,
"description": "Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?",
"severity": 10,
"directive": "object-src"
},
{
"type": 305,
"description": "No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.",
"severity": 50,
"directive": "script-src",
"value": "https://google.com"
}
]
退出代码
退出代码总是0,但当策略包含语法错误时除外.
> csp validate "script https://google.com"
! Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?
! script-src directive is missing.
x Directive "script" is not a known CSP directive.
> $?
> 1
投入
- 作为论据
> csp validate "script-src https://google.com"
- 从 stdin
> echo "script-src https://google.com" | csp validate -
- 从文件
> echo "script-src https://google.com" > policy.txt
> csp validate policy.txt
贡献
见 贡献指南。 。 。 .
安全政策
见 安全政策。 。 。 .