You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by so...@apache.org on 2020/05/25 04:20:46 UTC
[wicket] 01/01: [WICKET-6789] 'base-uri' is added to CSPDirective
enum
This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch WICKET-6789-csp-base-uri
in repository https://gitbox.apache.org/repos/asf/wicket.git
commit d073abe1589a691e0377e7c1604fae9de50f0fc4
Author: Maxim Solodovnik <so...@gmail.com>
AuthorDate: Mon May 25 11:19:55 2020 +0700
[WICKET-6789] 'base-uri' is added to CSPDirective enum
---
.../java/org/apache/wicket/csp/CSPDirective.java | 7 +--
.../apache/wicket/csp/CSPHeaderConfiguration.java | 55 ++++++++++++----------
2 files changed, 33 insertions(+), 29 deletions(-)
diff --git a/wicket-core/src/main/java/org/apache/wicket/csp/CSPDirective.java b/wicket-core/src/main/java/org/apache/wicket/csp/CSPDirective.java
index c998f41..a2cd2c2 100644
--- a/wicket-core/src/main/java/org/apache/wicket/csp/CSPDirective.java
+++ b/wicket-core/src/main/java/org/apache/wicket/csp/CSPDirective.java
@@ -44,6 +44,7 @@ public enum CSPDirective
MEDIA_SRC("media-src"),
CHILD_SRC("child-src"),
FRAME_ANCESTORS("frame-ancestors"),
+ BASE_URI("base-uri"),
/**
* This directive was deprecated in CSP 2, but no longer in 3. Wicket will automatically add a
* {@code frame-src} directive when {@code child-src} is added.
@@ -133,7 +134,7 @@ public enum CSPDirective
/**
* Check if {@code value} can be added to the list of other values. By default, it checks for
* conflicts with wildcards and none and it checks if values are valid uris.
- *
+ *
* @param value
* The value to add.
* @param existingDirectiveValues
@@ -161,14 +162,14 @@ public enum CSPDirective
+ "a 'none', can't add " + value);
}
}
-
+
if (value instanceof CSPDirectiveSandboxValue)
{
throw new IllegalArgumentException(
"A -src directive can't contain any of the sandbox directive values, like "
+ value);
}
-
+
value.checkValidityForSrc();
}
diff --git a/wicket-core/src/main/java/org/apache/wicket/csp/CSPHeaderConfiguration.java b/wicket-core/src/main/java/org/apache/wicket/csp/CSPHeaderConfiguration.java
index 8823ca7..131c138 100644
--- a/wicket-core/src/main/java/org/apache/wicket/csp/CSPHeaderConfiguration.java
+++ b/wicket-core/src/main/java/org/apache/wicket/csp/CSPHeaderConfiguration.java
@@ -16,6 +16,7 @@
*/
package org.apache.wicket.csp;
+import static org.apache.wicket.csp.CSPDirective.BASE_URI;
import static org.apache.wicket.csp.CSPDirective.CHILD_SRC;
import static org.apache.wicket.csp.CSPDirective.CONNECT_SRC;
import static org.apache.wicket.csp.CSPDirective.DEFAULT_SRC;
@@ -45,7 +46,7 @@ import org.apache.wicket.request.cycle.RequestCycle;
* This configuration is constructed using the available {@link CSPDirective}s. An number of default
* profiles is provided. These profiles can be used as a basis for a specific CSP. Extra directives
* can be added or existing directives modified.
- *
+ *
* @author papegaaij
* @see <a href="https://www.w3.org/TR/CSP2/">https://www.w3.org/TR/CSP2</a>
* @see <a href=
@@ -54,25 +55,25 @@ import org.apache.wicket.request.cycle.RequestCycle;
public class CSPHeaderConfiguration
{
public static final String CSP_VIOLATION_REPORTING_URI = "cspviolation";
-
+
private final Map<CSPDirective, List<CSPRenderable>> directives = new EnumMap<>(CSPDirective.class);
private boolean addLegacyHeaders = false;
-
+
private boolean nonceEnabled = false;
-
+
private String reportUriMountPath = null;
/**
* Removes all directives from the CSP, returning an empty configuration.
- *
+ *
* @return {@code this} for chaining.
*/
public CSPHeaderConfiguration disabled()
{
return clear();
}
-
+
/**
* Builds a CSP configuration with the following directives: {@code default-src 'none';}
* {@code script-src 'self' 'unsafe-inline' 'unsafe-eval';}
@@ -81,13 +82,13 @@ public class CSPHeaderConfiguration
* {@code frame-src 'self'}. This will allow resources to be loaded from {@code 'self'} (the
* current host). In addition, unsafe inline Javascript, {@code eval()} and inline CSS is
* allowed.
- *
+ *
* It is recommended to not allow {@code unsafe-inline} or {@code unsafe-eval}, because those
* can be used to trigger XSS attacks in your application (often in combination with another
* bug). Because older application often rely on inline scripting and styling, this CSP can be
* used as a stepping stone for older Wicket applications, before switching to {@link #strict}.
* Using a CSP with unsafe directives is still more secure than using no CSP at all.
- *
+ *
* @return {@code this} for chaining.
*/
public CSPHeaderConfiguration unsafeInline()
@@ -99,7 +100,8 @@ public class CSPHeaderConfiguration
.add(CONNECT_SRC, SELF)
.add(FONT_SRC, SELF)
.add(MANIFEST_SRC, SELF)
- .add(CHILD_SRC, SELF);
+ .add(CHILD_SRC, SELF)
+ .add(BASE_URI, SELF);
}
/**
@@ -111,7 +113,7 @@ public class CSPHeaderConfiguration
* (the current host). Scripts and styles are only allowed when rendered with the correct nonce.
* Wicket will automatically add the nonces to the {@code script} and {@code link} (CSS)
* elements and to the headers.
- *
+ *
* @return {@code this} for chaining.
*/
public CSPHeaderConfiguration strict()
@@ -123,18 +125,19 @@ public class CSPHeaderConfiguration
.add(CONNECT_SRC, SELF)
.add(FONT_SRC, SELF)
.add(MANIFEST_SRC, SELF)
- .add(CHILD_SRC, SELF);
+ .add(CHILD_SRC, SELF)
+ .add(BASE_URI, SELF);
}
/**
* Configures the CSP to report violations back at the application.
- *
+ *
* WARNING: CSP reporting can generate a lot of traffic. A single page load can trigger multiple
* violations and flood your logs or even DDoS your server. In addition, it is an open endpoint
* for your application and can be used by an attacker to flood your application logs. Do not
* enable this feature on a production application unless you take the needed precautions to
* prevent this.
- *
+ *
* @return {@code this} for chaining
* @see <a href=
* "https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp">https://scotthelme.co.uk/just-how-much-traffic-can-you-generate-using-csp</a>
@@ -146,13 +149,13 @@ public class CSPHeaderConfiguration
/**
* Configures the CSP to report violations at the specified relative URI.
- *
+ *
* WARNING: CSP reporting can generate a lot of traffic. A single page load can trigger multiple
* violations and flood your logs or even DDoS your server. In addition, it is an open endpoint
* for your application and can be used by an attacker to flood your application logs. Do not
* enable this feature on a production application unless you take the needed precautions to
* prevent this.
- *
+ *
* @param mountPath
* The path to report the violations at.
* @return {@code this} for chaining
@@ -163,10 +166,10 @@ public class CSPHeaderConfiguration
{
return add(REPORT_URI, new RelativeURICSPValue(mountPath));
}
-
+
/**
* Returns the report URI mount path.
- *
+ *
* @return the report URI mount path.
*/
String getReportUriMountPath()
@@ -176,7 +179,7 @@ public class CSPHeaderConfiguration
/**
* True when the {@link CSPDirectiveSrcValue#NONCE} is used in one of the directives.
- *
+ *
* @return When any of the directives contains a nonce.
*/
public boolean isNonceEnabled()
@@ -186,7 +189,7 @@ public class CSPHeaderConfiguration
/**
* True when legacy headers should be added.
- *
+ *
* @return True when legacy headers should be added.
*/
public boolean isAddLegacyHeaders()
@@ -196,7 +199,7 @@ public class CSPHeaderConfiguration
/**
* Enable legacy {@code X-Content-Security-Policy} headers for older browsers, such as IE.
- *
+ *
* @param addLegacyHeaders
* True when the legacy headers should be added.
* @return {@code this} for chaining
@@ -209,7 +212,7 @@ public class CSPHeaderConfiguration
/**
* Removes the given directive from the configuration.
- *
+ *
* @param directive
* The directive to remove.
* @return {@code this} for chaining
@@ -222,7 +225,7 @@ public class CSPHeaderConfiguration
/**
* Adds the given values to the CSP directive on this configuraiton.
- *
+ *
* @param directive
* The directive to add the values to.
* @param values
@@ -241,7 +244,7 @@ public class CSPHeaderConfiguration
/**
* Adds a free-form value to a directive for the CSP header. This is primarily meant to used for
* URIs.
- *
+ *
* @param directive
* The directive to add the values to.
* @param values
@@ -267,7 +270,7 @@ public class CSPHeaderConfiguration
/**
* Removes all CSP directives from the configuration.
- *
+ *
* @return {@code this} for chaining.
*/
public CSPHeaderConfiguration clear()
@@ -275,7 +278,7 @@ public class CSPHeaderConfiguration
directives.clear();
return recalculateState();
}
-
+
private CSPHeaderConfiguration recalculateState()
{
nonceEnabled = directives.values()
@@ -313,7 +316,7 @@ public class CSPHeaderConfiguration
/**
* Renders this {@code CSPHeaderConfiguration} into an HTTP header. The returned String will be
* in the form {@code "key1 value1a value1b; key2 value2a; key3 value3a value3b value3c"}.
- *
+ *
* @param settings
* The {@link ContentSecurityPolicySettings} that renders the header.
* @param cycle