Rule Definition
One way to help protect your site from XSS is to restrict the web domains where scripts can be served from, as is made possible by Content Security Policy (CSP) headers. CSP headers allow the server to instruct the browser to only accept content served from specific domains, e.g. safedomain.com. The 'Content-Security-Policy' header can restrict the source of all content served, or just specific content types, such as images, media and scripts.

Remediation
Enable CSP header in XML configuration and JAVA configuration with "the content-security-policy" element.

Violation Code Sample

The CSP header is not enabled in XML configuration or with JAVA configuration
JAVA configuration:

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .headers() // Content Security Policy is not enabled
            .cacheControl()
            .frameOptions();

    }
}
------------------------------------------------
XML Configuration:

http
    headers // Content Security Policy is not enabled
        cache-control
        content-type-options
    headers
http

Fixed Code Sample

You can enable the CSP header using XML configuration with "the content-security-policy" element as shown below:

http

    headers
     content-security-policy
            policy-directives="script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/" />
                                report-only="true" /> // This enable the CSP 'report-only' header,
    headers

http
--------------------------------------
Similarly, you can enable the CSP header using Java configuration as shown below ( and enable the CSP 'report-only' header)

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .headers()
        .contentSecurityPolicy("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/") //CSP is enabled
        .reportOnly();
    }
}

https://cwe.mitre.org/data/definitions/1021.html https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)