[
https://issues.apache.org/jira/browse/WW-5754?focusedWorklogId=1053258&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053258
]
ASF GitHub Bot logged work on WW-5754:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 17:04
Start Date: 07/Nov/26 17:04
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #2123:
URL: https://github.com/apache/struts/pull/2123#issuecomment-6710382913
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=2123)
**Quality Gate passed**
Issues
 [0 New
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=2123&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=2123&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=2123&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [100.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=2123&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=2123&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1053258)
Time Spent: 40m (was: 0.5h)
> Fetch Metadata policy rejects cross-site POST and HEAD navigations since
> WW-5753
> --------------------------------------------------------------------------------
>
> Key: WW-5754
> URL: https://issues.apache.org/jira/browse/WW-5754
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Follow-up to [WW-5753|https://issues.apache.org/jira/browse/WW-5753] (PR
> [#1983|https://github.com/apache/struts/pull/1983]).
> After WW-5753, {{StrutsResourceIsolationPolicy.isAllowedTopLevelNavigation}}
> accepts a cross-site request only when {{Sec-Fetch-Mode}} is {{navigate}}
> *and* the method is {{GET}}. {{FetchMetadataInterceptor}} is part of
> {{defaultStack}}, so with the default configuration the following now get a
> 403. Every release since 6.0.0 accepted them:
> * Cross-site POST navigations, for example a SAML or OIDC {{form_post}}
> response to an action, or a payment gateway posting the user back to the
> application.
> * Cross-site {{HEAD}} navigations. The [Fetch Metadata interceptor
> documentation|https://struts.apache.org/core-developers/fetch-metadata-interceptor]
> lists {{HEAD}} alongside {{GET}} as an accepted method.
> The only way out today is {{exemptedPaths}}. It is matched against
> {{request.getContextPath()}} ({{FetchMetadataInterceptor}}), so any entry
> exempts the whole web application, not a single action.
> h2. Options
> # Accept a cross-site request when {{Sec-Fetch-Mode}} is {{navigate}},
> whatever the method, as long as the destination is not {{object}} or
> {{embed}}. Cross-site subresource requests stay rejected, and form-post and
> redirect-back flows keep working.
> # Keep the GET-only rule, add {{HEAD}}, and document the change as breaking
> in the 7.5.0 Version Notes and the Migration Guide, with a supported way to
> exempt individual actions.
> h2. Also
> * Decide whether {{exemptedPaths}} should be matched against the request path
> (servlet path plus path info) rather than the context path.
> * {{FetchMetadataInterceptorTest.testValidTopLevelNavigation}} sends no
> {{Sec-Fetch-Site}} header, so it returns at the empty-site check and never
> reaches the navigation branch. Make it set {{cross-site}}, or drop it in
> favour of {{testCrossSiteTopLevelGetNavigationAllowed}}.
> * Add tests for a cross-site POST navigation and a cross-site HEAD
> navigation, asserting whichever behaviour is chosen.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
