Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Content security policy: malformed syntax due to values in sandbox directive

Pierre | Last updated: May 29, 2024 11:22AM UTC

Burp version 2024.4.4 Found an issue in the Live audit, when browsing on a site which had CSP header with a sandbox directive and values (which are optional but valid cf. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox), the CSP header was wrongly reported as malformed. Issue detail Malformed syntax in the policy means the following directives, which do not conform to the CSP specification, will not be enforced: Directive sandbox should have no value The CSP header in question: Content-Security-Policy: default-src 'self'; script-src 'self' https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com; frame-src 'self' https://www.google.com; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors https://*.REDACTED.com ; sandbox allow-forms allow-same-origin allow-scripts allow-popups; base-uri 'self';upgrade-insecure-requests;

Syed, PortSwigger Agent | Last updated: May 30, 2024 09:07AM UTC

Hi Pierre,

Thank you for your message.

I have validated this with our internal team and it seems to be a bug in the scan check. I have already raised an internal ticket to fix this. Thanks for reporting this.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.