audunru / reporting-api / 35428261399

96%

push

github

feat(csp)!: exclude non-conformant CSP reports by default (#36)

The /reports endpoint is public by necessity, so scanners posting
arbitrary JSON to well-known report-uri paths were logged as if they
were real violations. A genuine report always carries both an
effective directive and a blocked URL.

Closes #33

BREAKING CHANGE: LogCspViolation::shouldExclude() now excludes reports
without both effectiveDirective and blockedURL. Subclasses that
override shouldExclude() should call parent::shouldExclude() first to
keep the filter.

1 of 1 new or added line in 1 file covered. (100.0%)

284 of 296 relevant lines covered (95.95%)

4.45 hits per line