(wicket) 01/03: WICKET-7205: Resolve IRequestHandlerDelegate-Chain in CSP-Processing

[pe...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

pedrosans pushed a commit to branch wicket-10.x
in repository https://gitbox.apache.org/repos/asf/wicket.git

commit 00f2e01032023a67da610906094095317984eb5d
Author: Schäfer, H.H. (Hans Hosea) <Ha...@ing.de>
AuthorDate: Tue Sep 8 13:12:59 2026 +0200

    WICKET-7205: Resolve IRequestHandlerDelegate-Chain in CSP-Processing
---
 .../org/apache/wicket/csp/CSPHeaderWriterTest.java | 55 ++++++++++++++++++++++
 .../wicket/request/IRequestHandlerDelegate.java    |  6 +--
 2 files changed, 58 insertions(+), 3 deletions(-)

diff --git a/wicket-core-tests/src/test/java/org/apache/wicket/csp/CSPHeaderWriterTest.java b/wicket-core-tests/src/test/java/org/apache/wicket/csp/CSPHeaderWriterTest.java
index e491144992..ad3edefdcb 100644
--- a/wicket-core-tests/src/test/java/org/apache/wicket/csp/CSPHeaderWriterTest.java
+++ b/wicket-core-tests/src/test/java/org/apache/wicket/csp/CSPHeaderWriterTest.java
@@ -20,16 +20,24 @@ import org.apache.wicket.MarkupContainer;
 import org.apache.wicket.RestartResponseException;
 import org.apache.wicket.core.request.handler.PageProvider;
 import org.apache.wicket.core.request.handler.RenderPageRequestHandler;
+import org.apache.wicket.core.request.mapper.MountedMapper;
 import org.apache.wicket.markup.IMarkupResourceStreamProvider;
 import org.apache.wicket.markup.head.CssHeaderItem;
 import org.apache.wicket.markup.head.IHeaderResponse;
 import org.apache.wicket.markup.html.WebPage;
+import org.apache.wicket.markup.html.form.login.MockHomePage;
 import org.apache.wicket.markup.html.link.StatelessLink;
 import org.apache.wicket.protocol.http.BufferedWebResponse;
 import org.apache.wicket.protocol.http.WebApplication;
 import org.apache.wicket.protocol.http.mock.MockHttpServletResponse;
 import org.apache.wicket.protocol.http.servlet.ServletWebRequest;
+import org.apache.wicket.request.IRequestCycle;
+import org.apache.wicket.request.IRequestHandler;
+import org.apache.wicket.request.IRequestHandlerDelegate;
+import org.apache.wicket.request.IRequestMapper;
+import org.apache.wicket.request.Request;
 import org.apache.wicket.request.Response;
+import org.apache.wicket.request.Url;
 import org.apache.wicket.request.cycle.RequestCycle;
 import org.apache.wicket.request.http.WebResponse;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
@@ -115,6 +123,53 @@ class CSPHeaderWriterTest extends WicketTestCase
 			STYLE_SRC.getValue());
 	}
 
+	@Test
+	void addCspDirectiveToStatelessPageEvenIfWrappedInMultipleIRequestHandlerDelegates()
+	{
+		tester.getApplication().mount(new MountedMapper("withdelegate/page", NoopMockPage.class)
+		{
+			@Override
+			public IRequestHandler mapRequest(final Request request)
+			{
+				final IRequestHandler requestHandler = super.mapRequest(request);
+				final IRequestHandler result;
+				if (requestHandler instanceof RenderPageRequestHandler renderPageRequestHandler && NoopMockPage.class.equals(renderPageRequestHandler.getPageClass()))
+				{
+					result = new NoopIRequestHandlerDelegate(new NoopIRequestHandlerDelegate(renderPageRequestHandler));
+				} else {
+					result = requestHandler;
+				}
+				return result;
+			}
+		});
+		tester.startPage(NoopMockPage.class);
+
+		assertThat(tester.getLastRenderedPage()).isInstanceOf(NoopMockPage.class);
+		assertThat(tester.getLastResponse().getHeader("Content-Security-Policy")).contains(
+		  STYLE_SRC.getValue());
+	}
+
+	public static class NoopMockPage extends MockHomePage {
+	}
+
+	static class NoopIRequestHandlerDelegate implements IRequestHandlerDelegate {
+		private final IRequestHandler delegate;
+
+		NoopIRequestHandlerDelegate(final IRequestHandler delegate) {
+			this.delegate = delegate;
+		}
+
+		@Override
+		public IRequestHandler getDelegateHandler() {
+			return delegate;
+		}
+
+		@Override
+		public void respond(final IRequestCycle requestCycle) {
+			delegate.respond(requestCycle);
+		}
+	}
+
 	public static class Page extends WebPage implements IMarkupResourceStreamProvider
 	{
 		@Override
diff --git a/wicket-request/src/main/java/org/apache/wicket/request/IRequestHandlerDelegate.java b/wicket-request/src/main/java/org/apache/wicket/request/IRequestHandlerDelegate.java
index de3803dd99..9c4909332f 100644
--- a/wicket-request/src/main/java/org/apache/wicket/request/IRequestHandlerDelegate.java
+++ b/wicket-request/src/main/java/org/apache/wicket/request/IRequestHandlerDelegate.java
@@ -29,11 +29,11 @@ public interface IRequestHandlerDelegate extends IRequestHandler
 	/**
 	 * @return the innermost delegated {@link IRequestHandler}
 	 */
-	static IRequestHandler unwrap(IRequestHandler handler)
+	static IRequestHandler unwrap(final IRequestHandler handler)
 	{
-		if (handler instanceof IRequestHandlerDelegate)
+		if (handler instanceof IRequestHandlerDelegate requestHandlerDelegate)
 		{
-			return ((IRequestHandlerDelegate)handler).getDelegateHandler();
+			return unwrap(requestHandlerDelegate.getDelegateHandler());
 		}
 		return handler;
 	}