[jira] [Commented] (WICKET-5406) Better Content Security Policy Support

["Martin Grigorov (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WICKET-5406?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13823718#comment-13823718 ] 

Martin Grigorov commented on WICKET-5406:
-----------------------------------------

Adding APIs to enable CSP for your pages is easier.
The main problem I see is that Wicket itself uses/needs inline JavaScript and eval/Function(body) for its Ajax stuff. So you will have to allow them if you want to use Wicket Ajax facilities.

CSS, object-src and image-src should be OK. 

> Better Content Security Policy Support
> --------------------------------------
>
>                 Key: WICKET-5406
>                 URL: https://issues.apache.org/jira/browse/WICKET-5406
>             Project: Wicket
>          Issue Type: Improvement
>          Components: wicket
>            Reporter: Mario Groß
>            Priority: Minor
>              Labels: CSP, Content-Security-Policy, Cross-site-Scripting, Security
>
> A better support of the Content Security Policy (http://en.wikipedia.org/wiki/Content_Security_Policy) would protect against cross-site scripting attacks and improve the security image of wicket. 
> The main problem at the moment is the heavily used inline javascript code which interferes with the whitelisting mechanism of script sources in the CSP and should be avoided .



--
This message was sent by Atlassian JIRA
(v6.1#6144)