CSP in <meta> is not analyzed when sent together with CSP in header

[AntoniRoszak]

Steps:

1. Scan page: https://shop.rockwool.com

Observation:

• Page scores 120 with most CSP directives listed as "none".

Expectation:

• Page should score 110, as there are more directives in tag. They are analyzed by code, but discarded.

Problem appeared in commit a422b3a - when I check out master before this commit, the combined policy is analyzed properly.

CSP header data:
upgrade-insecure-requests; frame-ancestors 'self'

@april

[mirunacurtean]

This appears to be fixed in 2023.

[AntoniRoszak]

Yes, but this is because in this case, CSP was moved to HTTP header. So the problem is no longer visible on the listed page.
Unfortunately I don't know any other page that could be used for problem reproduction.