Update csp-data-scheme-allowed.yaml

http/misconfiguration/csp-data-scheme-allowed.yaml

@@ -0,0 +1,46 @@
+id: csp-data-scheme-allowed
+
+info:
+  name: Content-Security-Policy `data:` Scheme - Allowed
+  author: ritikchaddha
+  severity: low
+  description: |
+    Detected Content Security Policy (CSP) configurations that allow the 'data:' URI scheme.Allowing data: in CSP directives (especially script-src, default-src, object-src) can enable XSS attacks through techniques like iframe srcdoc with deferred scripts, bypassing CSP protections. This is a common CSP misconfiguration that weakens XSS defenses.
+  reference:
+    - https://tprynn.github.io/web/xss/appsec/csp/2019/04/11/dom-xss-data-uri.html
+    - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+    - https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+    - https://csp-evaluator.withgoogle.com/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
+    cvss-score: 3.4
+    cwe-id: CWE-1021
+  metadata:
+    verified: true
+    max-request: 1
+  tags: csp,misconfig,xss,data-uri
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+        case-insensitive: true
+
+      - type: regex
+        part: header
+        regex:
+          - '(?i)content-security-policy:.*data:'
+          - '(?i)script-src[^;]*data:'
+          - '(?i)default-src[^;]*data:'
+          - '(?i)object-src[^;]*data:'
+          - '(?i)style-src[^;]*data:'
+          - '(?i)img-src[^;]*data:'
+        condition: or