# Object sources are restricted

- **Pattern:** `ab-001326` (`extension-permissions-security.content-security-policy.object-src-none`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001326
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001326)

## Why it matters

CWE-693 (Protection Mechanism Failure) captures the gap: an extension that restricts `script-src` but omits `object-src` still allows `<object>`, `<embed>`, and `<applet>` tags to load arbitrary plugins. Although Flash is dead, the attack vector persists because `object-src` defaulting to `default-src` is exploitable when `default-src` is permissive. OWASP A05 (Security Misconfiguration) applies: a CSP that looks correct but has an unconstrained fallback is misconfigured. Chrome's own CSP documentation explicitly recommends `object-src 'none'` as part of the minimal safe CSP for extension pages.

## Severity rationale

High because a missing explicit `object-src` directive allows plugin-based content injection via `<object>` and `<embed>` tags, bypassing an otherwise hardened `script-src` policy.

## Remediation

Add `object-src 'none'` explicitly to your extension pages CSP in `manifest.json` — do not rely on `default-src` fallback.

```json
"content_security_policy": {
  "extension_pages": "script-src 'self'; object-src 'none';"
}
```

Pair this with `script-src 'self'` so both directives are explicit. Auditors and the Chrome Web Store review team will flag any CSP where `object-src` is missing or permissive.

## Detection

- **ID:** `object-src-none`
- **Severity:** `high`
- **What to look for:** Quote the `object-src` directive from the CSP in `manifest.json`. Enumerate all CSP directives present and check whether `object-src` is explicitly set to `'none'` to block plugin-based content (Flash, Java applets).
- **Pass criteria:** `object-src` is explicitly set to `'none'` in the CSP. Quote the actual directive value found. At least 1 explicit `object-src` directive must be present — relying on `default-src` fallback alone is not sufficient for this check.
- **Fail criteria:** `object-src` is missing (falls back to default) or set to allow sources.
- **Skip (N/A) when:** Never — plugins are obsolete and dangerous.
- **Detail on fail:** `"CSP does not restrict object-src to 'none'."`
- **Remediation:** Flash and other plugins are obsolete and dangerous. Explicitly block them in `manifest.json`:

  ```json
  "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'none';" }
  ```
- **Cross-reference:** For script source restrictions that complement object-src, see the script-src-safe check in this category.

## External references

- cwe CWE-693
- owasp A05
- external chrome-csp-object-src — https://developer.chrome.com/docs/extensions/develop/concepts/content-security-policy

Taxons: injection-and-input-trust

HTML version: https://auditbuffet.com/patterns/ab-001326