Skip to content

Commit 07f71e9

Browse files
rfc-strfc-st
committed
Feature: 1 new insecure check
Content-Security-Policy-Report-Only - Ignored Header
1 parent 982d926 commit 07f71e9

File tree

5 files changed

+41
-33
lines changed

5 files changed

+41
-33
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<a target="_blank" href="https://devguide.python.org/versions/" title="Minimum Python version required to run this tool"><img src="https://img.shields.io/badge/Python-%3E%3D3.9-blue?labelColor=343b41"></a>
77
<a target="_blank" href="LICENSE" title="License of this tool"><img src="https://img.shields.io/badge/License-MIT-blue.svg?labelColor=343b41"></a>
88
<a target="_blank" href="https://github.com/rfc-st/humble/releases" title="Latest release of this tool"><img src="https://img.shields.io/github/v/release/rfc-st/humble?display_name=release&label=Latest%20Release&labelColor=343b41"></a>
9-
<a target="_blank" href="https://github.com/rfc-st/humble/commits/master" title="Latest commit of this tool"><img src="https://img.shields.io/badge/Latest_Commit-2025--04--12-blue.svg?labelColor=343b41"></a>
9+
<a target="_blank" href="https://github.com/rfc-st/humble/commits/master" title="Latest commit of this tool"><img src="https://img.shields.io/badge/Latest_Commit-2025--04--16-blue.svg?labelColor=343b41"></a>
1010
<a target="_blank" href="https://pkg.kali.org/pkg/humble" title="Official tool in Kali Linux"><img src="https://img.shields.io/badge/Kali%20Linux-Tool-blue?labelColor=343b41"></a>
1111
<br />
1212
<a target="_blank" href="#" title="Featured on:"><img src="https://img.shields.io/badge/Featured%20on:-343b41"></a>
@@ -63,7 +63,7 @@
6363
:heavy_check_mark: 58 [checks](#checks-enabled-headers) for enabled security-related HTTP response headers.<br />
6464
:heavy_check_mark: 14 [checks](#checks-missing-headers) for missing security-related HTTP response headers (the ones I consider essential).<br />
6565
:heavy_check_mark: 1225 [checks](#checks-fingerprint-headers) for fingerprinting through HTTP response headers.<br />
66-
:heavy_check_mark: 136 [checks](#checks-deprecated-headersprotocols-and-insecure-values) for deprecated HTTP response headers/protocols or with insecure/wrong values.<br />
66+
:heavy_check_mark: 137 [checks](#checks-deprecated-headersprotocols-and-insecure-values) for deprecated HTTP response headers/protocols or with insecure/wrong values.<br />
6767
:heavy_check_mark: Checks compliance with OWASP <a href="https://owasp.org/www-project-secure-headers/#div-bestpractices" target="_blank">'Secure Headers Project'<a> Best Practices.<br />
6868
:heavy_check_mark: SSL/TLS checks: requires the **amazing** https://testssl.sh/.<br />
6969
:heavy_check_mark: Browser support references for enabled HTTP security headers: provided by https://caniuse.com/.<br />

‎additional/insecure.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ Content-Security-Policy: Unsafe Directive
5757
Content-Security-Policy: Unsafe Funcionality
5858
Content-Security-Policy: Unsafe Nonce
5959
Content-Security-Policy: Unsafe Values
60-
Content-Security-Policy-Report-Only: Deprecated Directives
60+
Content-Security-Policy-Report-Only: Ignored Directives
61+
Content-Security-Policy-Report-Only: Ignored Header
6162
Content-Type: Deprecated Values
6263
Content-Type: Incorrect Value - Response body
6364
Content-Type: Non-HTML MIME type

‎humble.py‎

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@
153153
XML_STRING = ('Ref: ', 'Value: ', 'Valor: ')
154154

155155
current_time = datetime.now().strftime("%Y/%m/%d - %H:%M:%S")
156-
local_version = datetime.strptime('2025-04-12', '%Y-%m-%d').date()
156+
local_version = datetime.strptime('2025-04-16', '%Y-%m-%d').date()
157157

158158

159159
class SSLContextAdapter(requests.adapters.HTTPAdapter):
@@ -1710,19 +1710,6 @@ def check_owasp_compliance(tmp_filename):
17101710
print_detail('[comp_experimental]', 2)
17111711

17121712

1713-
def print_owasp_missing_old(header_list):
1714-
print(linesep.join(['']*2))
1715-
print(f"{STYLE[0]}{get_detail('[comp_analysis]')}")
1716-
print(f' URL: {URL}')
1717-
print(f" {get_detail('[comp_ko_owasp]')}")
1718-
print(f"\n{STYLE[0]}{get_detail('[comp_rec]')}{STYLE[5]}")
1719-
if missing_owasp := [header for header in header_list if header not in
1720-
headers_l]:
1721-
for header in missing_owasp:
1722-
prefix = "(*) " if header.title() == "Permissions-Policy" else ""
1723-
print(f"{STYLE[1]} {prefix}{header.title()}{STYLE[5]}")
1724-
1725-
17261713
def print_owasp_missing(header_list):
17271714
print(linesep.join(['']*2))
17281715
print(f"{STYLE[0]}{get_detail('[comp_analysis]')}")
@@ -2215,7 +2202,8 @@ def custom_help_formatter(prog):
22152202
t_contdisp = ('filename', 'filename*')
22162203

22172204
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
2218-
t_cencoding = ('br', 'compress', 'deflate', 'gzip', 'x-gzip', 'zstd')
2205+
t_cencoding = ('br', 'compress', 'dcb', 'dcz', 'deflate', 'gzip', 'x-gzip',
2206+
'zstd')
22192207

22202208
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
22212209
# https://www.w3.org/TR/CSP2/ & https://www.w3.org/TR/CSP3/
@@ -2241,7 +2229,9 @@ def custom_help_formatter(prog):
22412229
'unsafe-hashes', 'nonce-', '127.0.0.1')
22422230

22432231
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
2244-
l_csp_ro_dep = ['violated-directive']
2232+
l_csp_ro_dep = ['block-all-mixed-content', 'disown-opener', 'plugin-types',
2233+
'prefetch-src', 'referrer', 'report-uri', 'require-sri-for',
2234+
'sandbox', 'violated-directive']
22452235

22462236
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
22472237
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
@@ -2505,16 +2495,19 @@ def custom_help_formatter(prog):
25052495
if re.search(RE_PATTERN[1], csp_h):
25062496
csp_check_ip(csp_h)
25072497

2508-
csp_ro_header = headers_l.get('content-security-policy-report-only', '')
2509-
if csp_ro_header and any(elem in csp_ro_header for elem in l_csp_ro_dep) and \
2510-
'17' not in skip_list:
2511-
print_detail_r('[icsiro_d]', is_red=True)
2512-
if not args.brief:
2513-
matches_csp_ro = [x for x in l_csp_ro_dep if x in csp_ro_header]
2514-
print_detail_l('[icsi_d_s]')
2515-
print(', '.join(matches_csp_ro))
2516-
print_detail('[icsiro_d_r]')
2517-
i_cnt[0] += 1
2498+
if 'content-security-policy-report-only' in headers_l and '17' not in \
2499+
skip_list:
2500+
csp_ro_header = headers_l['content-security-policy-report-only']
2501+
if any(elem in csp_ro_header for elem in l_csp_ro_dep):
2502+
print_detail_r('[icsiro_d]', is_red=True)
2503+
if not args.brief:
2504+
matches_csp_ro = [x for x in l_csp_ro_dep if x in csp_ro_header]
2505+
print_detail_l('[icsi_d_s]')
2506+
print(', '.join(f"'{x}'" for x in matches_csp_ro))
2507+
print_detail('[icsiro_d_r]')
2508+
i_cnt[0] += 1
2509+
if 'report-to' not in csp_ro_header:
2510+
print_details('[icsiroi_d]', '[icsiroi]', 'd', i_cnt)
25182511

25192512
ctype_header = headers_l.get('content-type', '')
25202513
if ctype_header and '18' not in skip_list:

‎l10n/details.txt‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -433,13 +433,20 @@
433433
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Trailer
434434

435435
[icsiro_d]
436-
Content-Security-Policy-Report-Only (Deprecated Directives)
436+
Content-Security-Policy-Report-Only (Ignored Directives)
437437

438438
[icsiro_d_r]
439439
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
440440

441441
[icsi_d_s]
442-
Avoid deprecated directives:
442+
Avoid deprecated or ignored directives:
443+
444+
[icsiroi_d]
445+
Content-Security-Policy-Report-Only (Ignored Header)
446+
447+
[icsiroi]
448+
Use the 'report-to' directive or this header has no effect.
449+
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
443450

444451
[itrailer_d_s]
445452
Avoid disallowed directives:

‎l10n/details_es.txt‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -434,13 +434,20 @@
434434
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Trailer
435435

436436
[icsiro_d]
437-
Content-Security-Policy-Report-Only (Directivas obsoletas)
437+
Content-Security-Policy-Report-Only (Directivas ignoradas)
438438

439439
[icsiro_d_r]
440440
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
441441

442442
[icsi_d_s]
443-
Evite directivas obsoletas:
443+
Evite directivas ignoradas u obsoletas:
444+
445+
[icsiroi_d]
446+
Content-Security-Policy-Report-Only (Cabecera ignorada)
447+
448+
[icsiroi]
449+
Utilice la directiva 'report-to' o esta cabecera no tendrá efecto.
450+
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
444451

445452
[itrailer_d_s]
446453
Evite directivas no permitidas:

0 commit comments

Comments
 (0)