diff --git a/http/misconfiguration/csp-data-scheme-allowed.yaml b/http/misconfiguration/csp-data-scheme-allowed.yaml index ba1dd741c4a..1abd997a5d9 100644 --- a/http/misconfiguration/csp-data-scheme-allowed.yaml +++ b/http/misconfiguration/csp-data-scheme-allowed.yaml @@ -2,7 +2,7 @@ id: csp-data-scheme-allowed info: name: Content-Security-Policy `data:` Scheme - Allowed - author: ritik + author: ritikchaddha severity: low description: | Detected Content Security Policy (CSP) configurations that allow the 'data:' URI scheme.Allowing data: in CSP directives (especially script-src, default-src, object-src) can enable XSS attacks through techniques like iframe srcdoc with deferred scripts, bypassing CSP protections. This is a common CSP misconfiguration that weakens XSS defenses.