csp-evaluator-cli
A command line tool that wraps csp-evaluator.
Installation
$ npm install -g @einride/csp-evaluator-cli
Usage
CLI interface strives to mimic CSP Evaluator online tool. It takes Content Security Policy as a string, and outputs findings based on that into stdout.
Output format
There are three supported output formats:
- human (default)
Mimics CSP Evaluator online tool output.
> csp validate "script-src https://google.com"
! Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?
script-src:
? https://google.com: No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.
- json
JSON is passed as is from csp-evaluator output.
> csp validate --output-format=json "script-src https://google.com"
[{"type":300,"description":"Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?","severity":10,"directive":"object-src"},{"type":305,"description":"No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.","severity":50,"directive":"script-src","value":"https://google.com"}]
- json-pretty
Same as json, but with indentations.
> csp validate --output-format=json-pretty "script-src https://google.com"
[
{
"type": 300,
"description": "Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?",
"severity": 10,
"directive": "object-src"
},
{
"type": 305,
"description": "No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.",
"severity": 50,
"directive": "script-src",
"value": "https://google.com"
}
]
Exit codes
Exit code is always 0, except for a case when a policy contains syntax errors.
> csp validate "script https://google.com"
! Missing object-src allows the injection of plugins which can execute JavaScript. Can you set it to 'none'?
! script-src directive is missing.
x Directive "script" is not a known CSP directive.
> $?
> 1
Input
- As an argument
> csp validate "script-src https://google.com"
- From stdin
> echo "script-src https://google.com" | csp validate -
- From a file
> echo "script-src https://google.com" > policy.txt
> csp validate policy.txt
Contribute
See Contributing Guide.
Security Policy
See Security Policy.