[
https://issues.apache.org/jira/browse/WW-5753?focusedWorklogId=1045230&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045230
]
ASF GitHub Bot logged work on WW-5753:
--------------------------------------
Author: ASF GitHub Bot
Created on: 01/Oct/26 18:40
Start Date: 01/Oct/26 18:40
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1984:
URL: https://github.com/apache/struts/pull/1984
Fixes [WW-5753](https://issues.apache.org/jira/browse/WW-5753)
Backport of #1983 to `support/struts-6-x-x`, cherry-picked as-is from
`1d92b07b0`.
`StrutsResourceIsolationPolicy` now accepts a cross-site request only when
it is a navigation and a GET, as the documented policy requires.
Handling of cross-site POST and HEAD navigations is tracked separately in
[WW-5754](https://issues.apache.org/jira/browse/WW-5754) (7.5.0 + 6.13.0).
`FetchMetadataInterceptorTest` passes on this branch (13 tests).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1045230)
Time Spent: 0.5h (was: 20m)
> Reject cross-site non-GET navigations and cross-site GET subresource requests
> in the Fetch Metadata policy
> ----------------------------------------------------------------------------------------------------------
>
> Key: WW-5753
> URL: https://issues.apache.org/jira/browse/WW-5753
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 7.3.0
> Reporter: Gouri Sankar A
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> StrutsResourceIsolationPolicy accepts a cross-site request when it is a
> navigation or a GET. The documented policy and the Fetch Metadata reference
> policy require a navigation and a GET, so a cross-site form POST and
> cross-site GET fetch(), script and img requests pass.
> FetchMetadataInterceptor is enabled in the defaultStack.
> The check should combine the navigation and method conditions with &&.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
