This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/master by this push:
new bb732b2251 Document that renders are not checked by resource isolation
bb732b2251 is described below
commit bb732b22519b5c8f501e7d6d064c4b073bdd903a
Author: Emond Papegaaij <[email protected]>
AuthorDate: Mon Aug 31 13:28:34 2026 +0200
Document that renders are not checked by resource isolation
ResourceIsolationRequestCycleListener excludes every render before the
policy loop runs, so a page reached as a subresource load, through fetch,
or inside an <object> or <embed> is not refused either. The previous
wording claimed such requests were refused for renders, which the code
has never done.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
SECURITY.md | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index 221a09de91..ff04890370 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -440,9 +440,11 @@ Two things sit deliberately outside that boundary:
- **Rendering a page is allowed.** A page may be reached by a simple top-level
navigation from anywhere, so that pages remain linkable from other sites.
Only
- the invocation of a listener is refused. Requests that are not top-level
- navigations — subresource loads, `fetch`, `<object>` and `<embed>` — are
- refused for renders too.
+ the invocation of a listener is refused. This holds for every render, not
only
+ for top-level navigations: a page reached as a subresource load, through
+ `fetch`, or inside an `<object>` or `<embed>` is not refused either, because
+ the listener does not consult a policy for renders at all. A page whose
render
+ alone discloses something sensitive cannot rely on this listener.
- **Sibling origins may be trusted explicitly.** `Sec-Fetch-Site: same-site`
means a different origin on the same registrable domain and scheme, such as
another subdomain, and is refused by default. A deployment that trusts every
