This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch WW-5215-csp-session
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 74d4e2371616f4e51fe9986f916271554080ddd1
Author: Lukasz Lenart
AuthorDate: Tue Aug 23 20:31:39 2022 +0200
WW-5215 Checks is session was already created before applying CSP settings
---
.../struts2/interceptor/csp/CspInterceptor.java| 5 +-
.../struts2/interceptor/csp/CspSettings.java | 9 +++
.../interceptor/csp/DefaultCspSettings.java| 83 +++-
.../struts2/interceptor/CspInterceptorTest.java| 91 --
4 files changed, 112 insertions(+), 76 deletions(-)
diff --git
a/core/src/main/java/org/apache/struts2/interceptor/csp/CspInterceptor.java
b/core/src/main/java/org/apache/struts2/interceptor/csp/CspInterceptor.java
index 250179636..ca77436cc 100644
--- a/core/src/main/java/org/apache/struts2/interceptor/csp/CspInterceptor.java
+++ b/core/src/main/java/org/apache/struts2/interceptor/csp/CspInterceptor.java
@@ -23,6 +23,7 @@ import
com.opensymphony.xwork2.interceptor.AbstractInterceptor;
import com.opensymphony.xwork2.interceptor.PreResultListener;
import java.net.URI;
import java.util.Optional;
+import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
@@ -36,6 +37,7 @@ import javax.servlet.http.HttpServletResponse;
* @see DefaultCspSettings
**/
public final class CspInterceptor extends AbstractInterceptor implements
PreResultListener {
+
private final CspSettings settings = new DefaultCspSettings();
@Override
@@ -45,8 +47,9 @@ public final class CspInterceptor extends AbstractInterceptor
implements PreResu
}
public void beforeResult(ActionInvocation invocation, String resultCode) {
+HttpServletRequest request =
invocation.getInvocationContext().getServletRequest();
HttpServletResponse response =
invocation.getInvocationContext().getServletResponse();
-settings.addCspHeaders(response);
+settings.addCspHeaders(request, response);
}
public void setReportUri(String reportUri) {
diff --git
a/core/src/main/java/org/apache/struts2/interceptor/csp/CspSettings.java
b/core/src/main/java/org/apache/struts2/interceptor/csp/CspSettings.java
index 9699ab291..adf5b5072 100644
--- a/core/src/main/java/org/apache/struts2/interceptor/csp/CspSettings.java
+++ b/core/src/main/java/org/apache/struts2/interceptor/csp/CspSettings.java
@@ -18,6 +18,7 @@
*/
package org.apache.struts2.interceptor.csp;
+import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
@@ -42,9 +43,17 @@ public interface CspSettings {
String HTTPS = "https:";
String CSP_REPORT_TYPE = "application/csp-report";
+/**
+ * @deprecated use {@link #addCspHeaders(HttpServletRequest,
HttpServletResponse)} instead
+ */
+@Deprecated
void addCspHeaders(HttpServletResponse response);
+
+void addCspHeaders(HttpServletRequest request, HttpServletResponse
response);
+
// sets the uri where csp violation reports will be sent
void setReportUri(String uri);
+
// sets CSP headers in enforcing mode when true, and report-only when false
void setEnforcingMode(boolean value);
}
diff --git
a/core/src/main/java/org/apache/struts2/interceptor/csp/DefaultCspSettings.java
b/core/src/main/java/org/apache/struts2/interceptor/csp/DefaultCspSettings.java
index 5a99c0a5b..7ab70d226 100644
---
a/core/src/main/java/org/apache/struts2/interceptor/csp/DefaultCspSettings.java
+++
b/core/src/main/java/org/apache/struts2/interceptor/csp/DefaultCspSettings.java
@@ -18,13 +18,14 @@
*/
package org.apache.struts2.interceptor.csp;
-import com.opensymphony.xwork2.ActionContext;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.security.SecureRandom;
import java.util.Base64;
-import java.util.Map;
-import java.util.function.Supplier;
+import java.util.Objects;
import static java.lang.String.format;
@@ -37,50 +38,61 @@ import static java.lang.String.format;
*/
public class DefaultCspSettings implements CspSettings {
-private final SecureRandom sRand = new SecureRandom();
+private final static Logger LOG =
LogManager.getLogger(DefaultCspSettings.class);
-// this supplier computes a policy format
-private final Supplier lazyPolicyBuilder = new Supplier() {
-@Override
-public String get() {
-StringBuilder policyFormatBuilder = new StringBuilder()
-.append(OBJECT_SRC)
-.append(format(" '%s'; ", NONE))
-.append(SCRIPT_SRC)
-.append(" 'nonce-%s' ") // nonce placeholder
-.append(format("'%s' ", STRICT_DYNAMIC))
-.append(f
