Ruulian / CSPass

This tool allows to automatically test for Content Security Policy bypass payloads.

Home Page:https://0xhorizon.eu/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Issue when formatting CSP

T0t0-0r0 opened this issue · comments

Hi, after your presentation for TheBlackSide, I just wanted to try your tool briefly ^^.

There seems to be an issue when formatting CSP. When running your tool, I have this issue:
Traceback (most recent call last):
File "cspass.py", line 364, in
csps = page.format_csp()
File "cspass.py", line 192, in format_csp
csp[policyname] = " ".join(self.csp[policyname])
TypeError: 'str' object does not support item assignment

I did not read the code thoroughly and do not have a lot of time today, but I think you probably just have an indentation issue in format_csp function (seems to work on my tests when fixing it and it did not seem to break something else (I only saw one call to format_csp)) :
"csp = json.dumps(csp,indent=4 )" should not be in the for loop because then it is a string and no more a dictionary, so if you have more than one policy "policyname", it crashes. Just change its indentation (same as your "return csp" line just after).

Thanks for your tool :)

Hello thanks for the report!
It should be fixed now ^^