This is an automated email from the ASF dual-hosted git repository. papegaaij pushed a commit to branch wicket-10.x in repository https://gitbox.apache.org/repos/asf/wicket.git
commit ee602a2c5e066d083bb89e01a23f6ca8bc3a9ca0 Author: Emond Papegaaij <[email protected]> AuthorDate: Mon Aug 3 22:06:48 2026 +0200 Document cross-origin isolation of listener invocations States the boundary the resource isolation listener is there to enforce: another origin may not invoke a listener on a page. Also records what sits deliberately outside it, so that neither is mistaken for a defect - a page may still be rendered by a simple top-level navigation from anywhere, and a deployment may choose to trust every origin on its own site. Notes that the listener is opt-in, and that CryptoMapper is not a substitute. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> (cherry picked from commit 1f7aad3cc03be78bc48fd1c2aceaa31f8bd6b11f) --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index b9b6420b11..1a152a6476 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -166,6 +166,31 @@ protected against modification depends entirely on the implementation in use, and the default implementation is not authenticated. Consult the javadoc of the `ICrypter` you configure and rely on no more than it states. +### Another origin may not invoke a listener + +Where `ResourceIsolationRequestCycleListener` is registered, a request originating +from another origin must not be able to invoke a listener on a page — a +`Link.onClick()`, a `Form.onSubmit()`, or an AJAX behaviour. A demonstrated way +for another origin to reach one is a vulnerability. + +Two things sit deliberately outside that boundary: + +- **Rendering a page is allowed.** A page may be reached by a simple top-level + navigation from anywhere, so that pages remain linkable from other sites. Only + the invocation of a listener is refused. Requests that are not top-level + navigations — subresource loads, `fetch`, `<object>` and `<embed>` — are + refused for renders too. +- **Sibling origins may be trusted explicitly.** `Sec-Fetch-Site: same-site` + means a different origin on the same registrable domain and scheme, such as + another subdomain, and is refused by default. A deployment that trusts every + origin on its own site can allow it; sibling-origin actions are then that + deployment's decision rather than a framework vulnerability. + +This listener is opt-in and is not registered by default. Without it Wicket +enforces no cross-origin boundary on listener invocation at all. `CryptoMapper` +raises the cost of forging a URL but is not a substitute for it, for the reason +below. + ### `CryptoMapper` is not an authorization mechanism `CryptoMapper` encrypts URLs so that page and component identifiers are not
