[
https://issues.apache.org/jira/browse/WW-5753?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5753:
------------------------------
Fix Version/s: 6.13.0
> Reject cross-site non-GET navigations and cross-site GET subresource requests
> in the Fetch Metadata policy
> ----------------------------------------------------------------------------------------------------------
>
> Key: WW-5753
> URL: https://issues.apache.org/jira/browse/WW-5753
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 7.3.0
> Reporter: Gouri Sankar A
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> StrutsResourceIsolationPolicy accepts a cross-site request when it is a
> navigation or a GET. The documented policy and the Fetch Metadata reference
> policy require a navigation and a GET, so a cross-site form POST and
> cross-site GET fetch(), script and img requests pass.
> FetchMetadataInterceptor is enabled in the defaultStack.
> The check should combine the navigation and method conditions with &&.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
