我正在使用OWASP ZAP 2.12.0自动测试ASP.NET Web应用程序的漏洞。它发出了一些CSP警报，我不知道为什么，因为CSP标头添加在Web.config中。需要帮助来解决发出的警报。

CSP标题

<httpProtocol>
    <customHeaders>
    <add name="Content-Security-Policy" 
        value="default-src 'self' 'unsafe-inline' http://localhost:50/master/child/; 
            script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:50/master/child/;
            img-src 'self' data: http://localhost:50/master/child/; 
            style-src 'self' 'unsafe-inline' http://localhost:50/master/child/;
            object-src 'self' http://localhost:50/master/child/;
            font-src 'self' data:;
            media-src 'self';
            frame-ancestors 'self';
            upgrade-insecure-requests;
            connect-src 'self';
            frame-src 'self';" />
    </customHeaders>
  </httpProtocol>

警报

Alerts (14)
CSP: Wildcard Directive (8)
GET: http://localhost:50/Master/Child/UI/App_Themes/images/ajax-loader.gif
GET: http://localhost:50/Master/Child/UI/App_Themes/Login/css/style.css
GET: http://localhost:50/Master/Child/UI/App_Themes/Styles/HTMLStyle.css
GET: http://localhost:50/Master/Child/UI/Login.aspx
GET: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches
GET: http://localhost:50/Master/Child/UI/Scripts/jquery-ui-1.8.16.min.js
POST: http://localhost:50/Master/Child/UI/Login.aspx
POST: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches

CSP: script-src unsafe-inline (8)
GET: http://localhost:50/Master/Child/UI/App_Themes/images/ajax-loader.gif
GET: http://localhost:50/Master/Child/UI/App_Themes/Login/css/style.css
GET: http://localhost:50/Master/Child/UI/App_Themes/Styles/HTMLStyle.css
GET: http://localhost:50/Master/Child/UI/Login.aspx
GET: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches
GET: http://localhost:50/Master/Child/UI/Scripts/jquery-ui-1.8.16.min.js
POST: http://localhost:50/Master/Child/UI/Login.aspx
POST: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches

CSP: style-src unsafe-inline (8)
GET: http://localhost:50/Master/Child/UI/App_Themes/images/ajax-loader.gif
GET: http://localhost:50/Master/Child/UI/App_Themes/Login/css/style.css
GET: http://localhost:50/Master/Child/UI/App_Themes/Styles/HTMLStyle.css
GET: http://localhost:50/Master/Child/UI/Login.aspx
GET: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches
GET: http://localhost:50/Master/Child/UI/Scripts/jquery-ui-1.8.16.min.js
POST: http://localhost:50/Master/Child/UI/Login.aspx
POST: http://localhost:50/Master/Child/UI/Login.aspx/GetBranches