[
https://issues.apache.org/jira/browse/WW-5754?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5754:
------------------------------
Fix Version/s: 6.13.0
> Fetch Metadata policy rejects cross-site POST and HEAD navigations since
> WW-5753
> --------------------------------------------------------------------------------
>
> Key: WW-5754
> URL: https://issues.apache.org/jira/browse/WW-5754
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
>
> Follow-up to [WW-5753|https://issues.apache.org/jira/browse/WW-5753] (PR
> [#1983|https://github.com/apache/struts/pull/1983]).
> After WW-5753, {{StrutsResourceIsolationPolicy.isAllowedTopLevelNavigation}}
> accepts a cross-site request only when {{Sec-Fetch-Mode}} is {{navigate}}
> *and* the method is {{GET}}. {{FetchMetadataInterceptor}} is part of
> {{defaultStack}}, so with the default configuration the following now get a
> 403. Every release since 6.0.0 accepted them:
> * Cross-site POST navigations, for example a SAML or OIDC {{form_post}}
> response to an action, or a payment gateway posting the user back to the
> application.
> * Cross-site {{HEAD}} navigations. The [Fetch Metadata interceptor
> documentation|https://struts.apache.org/core-developers/fetch-metadata-interceptor]
> lists {{HEAD}} alongside {{GET}} as an accepted method.
> The only way out today is {{exemptedPaths}}. It is matched against
> {{request.getContextPath()}} ({{FetchMetadataInterceptor}}), so any entry
> exempts the whole web application, not a single action.
> h2. Options
> # Accept a cross-site request when {{Sec-Fetch-Mode}} is {{navigate}},
> whatever the method, as long as the destination is not {{object}} or
> {{embed}}. Cross-site subresource requests stay rejected, and form-post and
> redirect-back flows keep working.
> # Keep the GET-only rule, add {{HEAD}}, and document the change as breaking
> in the 7.5.0 Version Notes and the Migration Guide, with a supported way to
> exempt individual actions.
> h2. Also
> * Decide whether {{exemptedPaths}} should be matched against the request path
> (servlet path plus path info) rather than the context path.
> * {{FetchMetadataInterceptorTest.testValidTopLevelNavigation}} sends no
> {{Sec-Fetch-Site}} header, so it returns at the empty-site check and never
> reaches the navigation branch. Make it set {{cross-site}}, or drop it in
> favour of {{testCrossSiteTopLevelGetNavigationAllowed}}.
> * Add tests for a cross-site POST navigation and a cross-site HEAD
> navigation, asserting whichever behaviour is chosen.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
