Content Security Policy Deployment Issues Related to Third-party Scripts among Builder-generated Websites and Other Websites

Content Security Policy (CSP) is a leading security mechanism for mitigating content injection attacks such as Cross-Site Scripting (XSS). However, CSPs are not widely deployed on websites, and deployed CSPs often have security issues or errors. In this paper, we investigate CSP deployment issues related to third-party scripts among builder-generated websites and other websites by conducting a web measurement study on Tranco top 100K websites. We construct a Google Chrome extension to automatically visit websites, simulate user interactions, and insert a specified CSP to collect CSP violations triggered by the accesses of resources used on websites. We focus on analyzing the usage of third-party scripts and the CSP deployment issues on websites based on the CSP violations triggered under the inserted CSP. We found that most analyzed websites would not encounter CSP deployment issues. Compared to other websites, builder-generated websites are more likely to contain third-party scripts which can lead to CSP deployment issues. Meanwhile, some web builders provide scripts that can lead to CSP deployment issues, which indicates that the choice of web builders can impact the CSP deployment on the corresponding websites. Furthermore, most CSPs that were already deployed on websites can be improved to be safer. For websites that did not deploy CSPs yet, most of them can deploy safe CSPs. Overall, our results can be helpful for promoting the proper deployment of CSPs.