default-src takes priority over script-src if it's parsed first

[jdm]

The following unit test fails:

#[test]
fn default_is_fallback() {
    let csp_list = CspList::parse("default-src self; script-src self 'unsafe-eval'", PolicySource::Header, PolicyDisposition::Enforce);
    let check_result = csp_list.is_js_evaluation_allowed();
    assert_eq!(check_result, CheckResult::Allowed);
}

default-src is only supposed to take effect if there's no more specific directive, as I understand it.

[jdm]

Yeah, step 5.2 of https://www.w3.org/TR/CSP/#can-compile-strings calls out checking for script-src, then looking at default-src if there is none.