fix(csp): detect scheme-only sources (e.g. https:) as permissive in sensitive directives

[dmchaledev]

$(cat <<'EOF'

Problem

The CSP wildcard check in checkCSP only tested for a literal * token:

return sources !== undefined && sources.includes('*');

But script-src https: is equally permissive — it allows loading scripts from any HTTPS origin, exactly like script-src *. A site with this policy would receive no penalty today, even though it provides no meaningful XSS restriction.

The helper isPermissiveSource (already defined in rules.ts) correctly identifies both bare wildcards and scheme-only sources, but it was never wired into the CSP check.

Fix

Replace sources.includes('*') with sources.some(isPermissiveSource) so that scheme-only sources (https:, http:, data:, blob:, etc.) in sensitive directives are penalised the same way bare wildcards are.

Affected directives: default-src, script-src, connect-src, form-action, frame-src, worker-src. Low-risk directives (img-src, style-src, etc.) remain unaffected — permissive sources there are intentionally allowed.

The finding message is updated to "Wildcard or scheme-only source…" so existing tests that match on Wildcard continue to pass.

Tests

Five new test cases added (85 total, all passing):

• https: in script-src is flagged and scores −5
• data: in connect-src is flagged
• https: in img-src is not flagged (low-risk allow-list unchanged)
• Existing * wildcard tests unchanged

Test plan

• npm test → 85/85 pass
• Existing score assertions all unaffected
• New cases match expected scores

https://claude.ai/code/session_0175hVv1zu7D7wBhtyoWi5LF
EOF
)

---

Generated by Claude Code