[jira] [Created] (WW-5753) Reject cross-site non-GET navigations and cross-site GET subresource requests in the Fetch Metadata policy

[Gouri Sankar A (Jira)]

Gouri Sankar A created WW-5753:
----------------------------------

             Summary: Reject cross-site non-GET navigations and cross-site GET 
subresource requests in the Fetch Metadata policy
                 Key: WW-5753
                 URL: https://issues.apache.org/jira/browse/WW-5753
             Project: Struts 2
          Issue Type: Bug
          Components: Core
    Affects Versions: 7.3.0
            Reporter: Gouri Sankar A


StrutsResourceIsolationPolicy accepts a cross-site request when it is a 
navigation or a GET. The documented policy and the Fetch Metadata reference 
policy require a navigation and a GET, so a cross-site form POST and cross-site 
GET fetch(), script and img requests pass. FetchMetadataInterceptor is enabled 
in the defaultStack.

The check should combine the navigation and method conditions with &&.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)