parameters: ( csp_object )
return_statement: return return_data
docstring: Much of this is taken from: https://github.com/moloch--/CSP-Bypass/
  	Credits to moloch--, he can't hang but he can code :)
  
  	return_data = [
  		{
  			"name": "",
  			"description": "",
  			"risk": "",
  		}
  	]
docstring_summary: Much of this is taken from: https://github.com/moloch--/CSP-Bypass/
  	Credits to moloch--, he can't hang but he can code :)
docstring_tokens: Much of this is taken from : https : // github . com / moloch -- / CSP - Bypass / Credits to moloch -- he can t hang but he can code : )
function: def get_csp_report( csp_object ):
  	"""
  	Much of this is taken from: https://github.com/moloch--/CSP-Bypass/
  	Credits to moloch--, he can't hang but he can code :)
  
  	return_data = [
  		{
  			"name": "",
  			"description": "",
  			"risk": "",
  		}
  	]
  	"""
  	return_data = []
  
  	""" Checks the current CSP header for unsafe content sources """
  	for directive in [SCRIPT_SRC]:
  		if UNSAFE_EVAL in csp_object[directive]:
  			return_data.append({
  				"name": "Unsafe Eval",
  				"description": "Extension allows unsafe evaluation of JavaScript via eval().",
  				"risk": "high"
  			})
  		if UNSAFE_INLINE in csp_object[directive]:
  			return_data.append({
  				"name": "Unsafe Inline",
  				"description": "Extension allows unsafe evaluation of JavaScript via inline <script>, and event handlers.",
  				"risk": "high"
  			})
  
  	"""
  	Check content sources for wildcards '*' note that wilcard subdomains
  	are checked by `wildcardSubdomainContentSourceCheck'
  	"""
  	for directive, sources in csp_object.iteritems():
  		if sources is None:
  			continue  # Skip unspecified directives in NO_FALLBACK
  		if any( src == "*" for src in sources ):
  			return_data.append({
  				"name": "Wildcard Source for Directive '" + directive + "'",
  				"description": "Wildcard sources specified for directive " + directive,
  				"risk": "medium",
  			})
  
  	""" Check content sources for wildcards subdomains '*.foo.com' """
  	for directive, sources in csp_object.iteritems():
  		if sources is None:
  			continue
  		# This check is a little hacky but should work well
  		# the shortest subdomain string should be like *.a.bc
  		if any("*" in src and 5 <= len(src) for src in sources):
  			return_data.append({
  				"name": "Wildcard Source for Directive '" + directive + "'",
  				"description": "Wildcard sources specified for directive " + directive,
  				"risk": "medium",
  			})
  
  	"""
  	Check for missing directives that do not inherit from `default-src'
  	"""
  	for directive in ContentSecurityPolicy.NO_FALLBACK:
  		if directive not in csp_object:
  			return_data.append({
  				"name": "Missing CSP Directive '" + directive + "'",
  				"description": "Lack of CSP directive '" + directive + "', which does not inherit from default-src.",
  				"risk": "low",
  			})
  
  	"""
  	Parses the CSP for known bypasses, this check is a little more
  	complicated, and calls into other subroutines.
  	"""
  	for directive, known_bypasses in CSP_KNOWN_BYPASSES.iteritems():
  		bypasses = _bypassCheckDirective( csp_object, directive, known_bypasses )
  		for bypass in bypasses:
  			return_data.append({
  				"name": "CSP Bypass Possible",
  				"description": "CSP allows a script source with known bypasses: '" + bypass[0] + "'.",
  				"risk": "high",
  				"bypass": bypass[1],
  			})
  
  	return return_data
function_tokens: def get_csp_report ( csp_object ) : return_data = [ ] """ Checks the current CSP header for unsafe content sources """ for directive in [ SCRIPT_SRC ] : if UNSAFE_EVAL in csp_object [ directive ] : return_data . append ( { "name" : "Unsafe Eval" , "description" : "Extension allows unsafe evaluation of JavaScript via eval()." , "risk" : "high" } ) if UNSAFE_INLINE in csp_object [ directive ] : return_data . append ( { "name" : "Unsafe Inline" , "description" : "Extension allows unsafe evaluation of JavaScript via inline <script>, and event handlers." , "risk" : "high" } ) """
  	Check content sources for wildcards '*' note that wilcard subdomains
  	are checked by `wildcardSubdomainContentSourceCheck'
  	""" for directive , sources in csp_object . iteritems ( ) : if sources is None : continue # Skip unspecified directives in NO_FALLBACK if any ( src == "*" for src in sources ) : return_data . append ( { "name" : "Wildcard Source for Directive '" + directive + "'" , "description" : "Wildcard sources specified for directive " + directive , "risk" : "medium" , } ) """ Check content sources for wildcards subdomains '*.foo.com' """ for directive , sources in csp_object . iteritems ( ) : if sources is None : continue # This check is a little hacky but should work well # the shortest subdomain string should be like *.a.bc if any ( "*" in src and 5 <= len ( src ) for src in sources ) : return_data . append ( { "name" : "Wildcard Source for Directive '" + directive + "'" , "description" : "Wildcard sources specified for directive " + directive , "risk" : "medium" , } ) """
  	Check for missing directives that do not inherit from `default-src'
  	""" for directive in ContentSecurityPolicy . NO_FALLBACK : if directive not in csp_object : return_data . append ( { "name" : "Missing CSP Directive '" + directive + "'" , "description" : "Lack of CSP directive '" + directive + "', which does not inherit from default-src." , "risk" : "low" , } ) """
  	Parses the CSP for known bypasses, this check is a little more
  	complicated, and calls into other subroutines.
  	""" for directive , known_bypasses in CSP_KNOWN_BYPASSES . iteritems ( ) : bypasses = _bypassCheckDirective ( csp_object , directive , known_bypasses ) for bypass in bypasses : return_data . append ( { "name" : "CSP Bypass Possible" , "description" : "CSP allows a script source with known bypasses: '" + bypass [ 0 ] + "'." , "risk" : "high" , "bypass" : bypass [ 1 ] , } ) return return_data