Nexory opened a new pull request, #1698: URL: https://github.com/apache/wicket/pull/1698
CSPHeaderConfiguration.remove(CHILD_SRC) removed only child-src, but the frame-src copy that add(CHILD_SRC, ...) makes for older browsers stayed behind and pointed at the removed directive, so rendering the header threw an IllegalStateException and the page request failed. This change removes that copy together with child-src, keeps frame-src values that were added explicitly, and adds tests. This is a robustness fix for a public method of the CSP configuration, not a security fix. Today strict().remove(CHILD_SRC) is enough to trigger it: strict() adds child-src, which also creates frame-src as a ClonedCSPValue, remove() drops child-src only, and ClonedCSPValue.render() then throws "CSP directive CHILD_SRC not set, cannot clone its value." when the header is written. remove(CHILD_SRC) now also removes the copies of child-src from frame-src, and frame-src itself when nothing else is left in it. Values added to frame-src with add(FRAME_SRC, ...) stay, whether they were added before or after child-src, and remove(FRAME_SRC) does not touch child-src. ClonedCSPValue gets a package-private isCloneOf() so that remove() drops only its own copies. The Javadoc of remove() says so. An application that calls remove(CHILD_SRC) gets a header without child-src and frame-src instead of an exception. What I measured on current master (58ac5651): * Without the change two of the new tests fail with the IllegalStateException quoted above (2 of the 37 tests in ContentSecurityPolicySettingsTest); with it all 37 pass. * The other three new tests pass with and without the change. They pin an explicit frame-src set before child-src, remove(FRAME_SRC) leaving child-src alone, and a child-src added after the removal being copied into frame-src again. * When I break the lookup in remove() on purpose, so that it searches for copies of the wrong directive, the same two tests fail again. * mvn clean verify for wicket-core-tests with the modules it builds from (JDK 21 and Maven 3.9.15, the first leg of the CI matrix) ran 2784 tests with 0 failed and 19 skipped, against 2779 tests with 0 failed and 19 skipped on master without the change. The difference is the five new tests. * I did not run the other modules, -Pjs-test, or the newer JDK versions of the CI matrix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
