[ https://issues.apache.org/jira/browse/WW-5400?focusedWorklogId=916761&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-916761 ]
ASF GitHub Bot logged work on WW-5400: -------------------------------------- Author: ASF GitHub Bot Created on: 28/Apr/24 14:41 Start Date: 28/Apr/24 14:41 Worklog Time Spent: 10m Work Description: lukaszlenart commented on code in PR #913: URL: https://github.com/apache/struts/pull/913#discussion_r1582193457 ########## core/src/main/java/org/apache/struts2/interceptor/csp/CspInterceptor.java: ########## @@ -54,8 +57,24 @@ public String intercept(ActionInvocation invocation) throws Exception { LOG.trace("Using CspSettings provided by the action: {}", action); applySettings(invocation, ((CspSettingsAware) action).getCspSettings()); } else { - LOG.trace("Using DefaultCspSettings with action: {}", action); - applySettings(invocation, new DefaultCspSettings()); + LOG.trace("Using {} with action: {}", defaultCspSettingsClassName, action); + + // if the defaultCspSettingsClassName is not a real class, throw an exception + try { + Class.forName(defaultCspSettingsClassName, false, Thread.currentThread().getContextClassLoader()); + } + catch (ClassNotFoundException e) { + throw new IllegalArgumentException("The defaultCspSettingsClassName must be a real class."); + } + + // if defaultCspSettingsClassName does not implement CspSettings, throw an exception + if (!CspSettings.class.isAssignableFrom(Class.forName(defaultCspSettingsClassName))) { + throw new IllegalArgumentException("The defaultCspSettingsClassName must implement CspSettings."); + } + + CspSettings cspSettings = (CspSettings) Class.forName(defaultCspSettingsClassName) + .getDeclaredConstructor().newInstance(); + applySettings(invocation, cspSettings); Review Comment: I wonder if we can move this code into `init()` method of the interceptor as right now a new instance is created per each invocation Issue Time Tracking ------------------- Worklog Id: (was: 916761) Time Spent: 1h 20m (was: 1h 10m) > CSP interceptor only allows very limited configuration > ------------------------------------------------------ > > Key: WW-5400 > URL: https://issues.apache.org/jira/browse/WW-5400 > Project: Struts 2 > Issue Type: Improvement > Components: Core Interceptors > Affects Versions: 6.3.0 > Reporter: Erica Kane > Priority: Major > Fix For: 6.5.0 > > Time Spent: 1h 20m > Remaining Estimate: 0h > > I have been trying to implement CSP on our website. The CSP interceptor > provides an elegant solution with the <s:script> and <s:link> tags. However, > I want to set my own base-uri. And perhaps make some other changes to the CSP > headers. > But these values are not accessible. Only the report-only and report-uri can > be changed. Even if one is willing to work at the Action level and implement > a new interface for all of them, I can't change the base-uri. I've seen > people on Stack Overflow disable it for this reason. I want to use it, but > could someone please explain how to set the base-uri globally? If not, I will > likely have to make my own. > P.S. I will update the documentation page. Nowhere in the description of the > interceptor does it mention the script and link tags, and without those, it > is useless! -- This message was sent by Atlassian Jira (v8.20.10#820010)