CSP without default-src is incorrectly detected as secure

[Rob--W]

Describe the problem and steps to reproduce it:

The CSP validator's primary purpose is to reject CSP policies that permit remote code.
script-src is the primary directive to control that, and if that is not specified, default-src.
The validator correctly handles these two cases. But if default-src is missing, the default fallback is to be very permissive. This should be flagged as insecure CSP.

Test case, create manifest.json and lint the directory containing the following:

{
  "name": "x",
  "version": "1",
  "manifest_version": 2,
  "content_security_policy": "img-src 'none'"
}

What happened?

No warnings.

What did you expect to happen?

MANIFEST_CSP warning should be emitted, because this policy allows remote code.

Note: Firefox has a different CSP parser. Its current behavior given the above CSP is to ignore it and use the default CSP that rejects remote scripts. While that matches our intent, the rejection of the CSP means that the extension developer's intent to reject images (img-src 'none') is not respected.

Anything else we should know?

This issue happens because the implementation assumes that the CSP is secure by default, and rejects when an insecure directive is encountered. An empty CSP is not secure by default, which results in this bug.

[AlexandraMoga]

What happened?

MANIFEST_CSP warning should be emitted, because this policy allows remote code.

What did you expect to happen?

No warnings.

@Rob--W I think the expected vs actual results are inverted in your STR.

The old behavior, as seen on prod currently, is to emit no warnings for the mentioned CSP:

After the fix (linter 5.22.0), we are raising a warning, which should be the new expected behavior:

[Rob--W]

What happened?

MANIFEST_CSP warning should be emitted, because this policy allows remote code.

What did you expect to happen?

No warnings.

@Rob--W I think the expected vs actual results are inverted in your STR.

Thanks, I have edited the post and swapped the two. The verified behavior that you have observed is as desired.