Add rule(s) to check the usage of the Content-Security-Policy HTTP header

[alrra]

• Check if the header is sent for non-HTML resources (e.g.: on images, fonts, etc.) - done in c55bdfb.
• Check for older deprecated version of the header are sent (i.e.:X-WebKit-CSP, X-Content-Security-Policy).

---

• TODO: Look into what other checks we can add for that this (e.g.: validate the content of the header, upgrade-insecure-requests)

---

See also:

• https://content-security-policy.com/

[Malvoz]

See also:

https://content-security-policy.com/

I don't think the owner is updating that site for CSP spec changes :(

The following resources are pretty sweet and indicates we could do with a new hint for when CSP is missing object-src 'none':

According to "Adopting a strict policy": https://csp.withgoogle.com/docs/strict-csp.html "setting object-src 'none' Prevents fetching and executing plugin resources embedded using <object>, <embed> or <applet> tags. The most common example is Flash.".

While the csp-evaluator (repo: https://github.com/google/csp-evaluator) reports:

Meanwhile I have updated object-src at MDN with the following description (if you're looking for inspiration for such a description):

[molant]

Thanks, great reply.

From the webappsec issue, I think this is great advice:

If you think that Content-Security-Policy is irrelevant for a particular document, and/or the server hasn't been configured to have a different CSP for a given response, then I would recommend sending Content-Security-Policy: base-uri 'none'; default-src 'none'. If you are using HTTP/2 then, after the first such response, this will be compressed to almost nothing for future responses.

What I'd suggest to you guys is to not raise the error for the case of small CSP headers that are disabling JS. Continue to raise the error for non-HTML CSP headers that are too long or impotent (implies poor server configuration as per your original intent here).

Originally posted by @chrisgraham in #3403 (comment)

[BillGoldstein]

Please review so as to allow CSP, etc., on SVG, as it can contain style, script, foreignObject.