Why CSP evaluator warn No bypass found make sure that this URL doesnt serve JSONP replies or Angular libraries if I put script-src *.somesite.com?

Question

I understand the reason why CSP warns about JSONP endpoint because if my site has XSS vuln, having a JSONP endpoint should cause my site to be xss. But why Angular libraries? Can anyone demonstrate a payload that uses Angular library to cause xss?

Answer 1

Some samples

You can trigger an Angular handler similarly to how you would with JSONP.

Since whitelisting domains can have a range of these bypasses, specially if they are widely used things like CDNs or APIs (common to host Angular, JSONP or redirects), they would usually render your policies useless.

Depending on your use case, the list of domains in a policy can grow very large and make it difficult to maintain and monitor for these bypasses.

Instead, it is recommended that you use CSP nonces. Explained by the authors of CSP Mitigator here