[PR] WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy [struts]

["g0w6y (via GitHub)" <gi...@apache.org>]

g0w6y opened a new pull request, #1983:
URL: https://github.com/apache/struts/pull/1983

   Fixes [WW-5753](https://issues.apache.org/jira/browse/WW-5753)
   
   `StrutsResourceIsolationPolicy` accepted a cross-site request that was a navigation or a GET. The documented policy and the Fetch Metadata reference policy require a navigation and a GET, so a cross-site form POST and cross-site GET `fetch()`, `<script>` and `<img>` requests passed.
   
   The check now uses `&&`. Same-origin, same-site, header-less and cross-site top-level GET navigation requests are still accepted.
   
   Two regression tests in `FetchMetadataInterceptorTest` fail without the change.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5753 Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart merged PR #1983:
URL: https://github.com/apache/struts/pull/1983


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org