fix(csp): flag object-src wildcard as a high-risk misconfiguration

[dmchaledev]

Summary

• object-src * allows unrestricted plugin content (Flash, Java, ActiveX) that can execute scripts and fully bypass CSP — it is listed in the CSP spec as one of the directives that must be restricted to prevent script injection.
• Despite this, object-src was missing from the wildcardDirectives list in checkCSP, so a policy like default-src 'self'; script-src 'self'; object-src * silently scored 20/30 — a perfect CSP score — while leaving a critical gap.
• Fix: add object-src to wildcardDirectives alongside script-src, connect-src, etc.

Repro (before fix)

checkCSP({ 'content-security-policy': "default-src 'self'; script-src 'self'; object-src *; form-action 'self'" })
// score: 20, findings: [] — ← false clean bill of health

After fix

// score: 15, findings: ["Wildcard (*) source in object-src allows any origin"]

Test plan

• New test detects wildcard in object-src added to test/analyzer.test.ts
• All 83 tests pass (npm test)
• No behaviour change for policies that don't include an explicit object-src directive

https://claude.ai/code/session_01XNrf9CDh8K2SLvH7U5rPPs

---

Generated by Claude Code

[dmchaledev]

Closing as superseded by #84 (merged): this PR is based on a pre-#68 commit and only catches a bare * in object-src (sources.includes('*')), not bare-scheme sources like object-src https:. #84 adds object-src to the same isPermissiveSource-based check already merged for the other directives in #68, catching both cases. Part of the PR backlog cleanup in #102.

---

Generated by Claude Code