[
https://issues.apache.org/jira/browse/WICKET-6682?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16900383#comment-16900383
]
ASF subversion and git services commented on WICKET-6682:
---------------------------------------------------------
Commit 4027b5456031dae79af7ca0a14a1fe59719653ad in wicket's branch
refs/heads/master from Andrew Kondratev
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=4027b54 ]
WICKET-6682 add CSP nonce support
reverts WICKET-4777 since all markup attributes have to be encoded
this closes #376
> Improve JavaScriptContentHeaderItem and JavaScriptUtils to support nonce
> ------------------------------------------------------------------------
>
> Key: WICKET-6682
> URL: https://issues.apache.org/jira/browse/WICKET-6682
> Project: Wicket
> Issue Type: Improvement
> Components: wicket
> Affects Versions: 8.5.0, 9.0.0-M2
> Reporter: Andrew Kondratev
> Assignee: Sven Meier
> Priority: Major
> Labels: security
>
> One of easy wins for content security policy would be a support of _nonce_
> for inline JavaScript header injections.
> [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#Unsafe_inline_script]
> *Criteria*
> * Set up some kind of request unique nonce provider
> * Make it possible for JavaScript header items to have provided nonce
> * Add provided nonce to the `Content-Security-Policy: script-src` header
> See in code:
> org.apache.wicket.core.util.string.JavaScriptUtils#writeOpenTag
> org.apache.wicket.markup.head.JavaScriptContentHeaderItem#render
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
