lukaszlenart opened a new pull request, #1927: URL: https://github.com/apache/struts/pull/1927
Fixes [WW-5669](https://issues.apache.org/jira/browse/WW-5669) ## What was wrong `StrutsConstants.STRUTS_CSP_NONCE_SOURCE` is `struts.csp.nonce.source`, but `default.properties` shipped the setting as `struts.csp.nonceSource`. Nothing ever read the camel-case name, so a deployment that copied it into its own configuration got session-scoped nonces regardless of the value. One correction to the ticket: the setting *was* configurable all along under the constant's name — `<constant name="struts.csp.nonce.source" value="request"/>` reaches both `DefaultCspSettings` (setter injection via `container.inject`) and `StrutsCspNonceReader` (constructor injection). The new `testCanonicalKeyStoresNonceInRequest` passes on `main` unchanged; only `testLegacyKeyStoresNonceInRequest` was red. ## Change - `CspNonceSource.resolve(canonical, legacy)` is the single place the value is decided: `struts.csp.nonce.source` wins, then the deprecated `struts.csp.nonceSource` (one WARN per JVM pointing at the new name), otherwise `SESSION`. Both consumers call it instead of each carrying its own `valueOf`. - `StrutsCspNonceReader` gains a two-argument `@Inject` constructor with per-parameter keys; the one-argument constructor stays and delegates. - `DefaultCspSettings` keeps `setNonceSource` and adds a deprecated `setLegacyNonceSource`; the value is resolved in `addCspHeaders` because setter order is not guaranteed. - `StrutsConstants.STRUTS_CSP_NONCE_SOURCE_LEGACY` added as `@Deprecated(since = "7.4.0", forRemoval = true)`; `STRUTS_CSP_NONCE_SOURCE` gets the Javadoc it was missing. - `default.properties`: the dead line becomes a commented `# struts.csp.nonce.source=session`. It has to be commented, not active — an active canonical default would always win and the legacy name could never take effect. Code default is already `SESSION` in both consumers, so nothing changes for deployments that set neither. ## Behaviour change to call out This is the path the ticket itself flags: a deployment carrying `struts.csp.nonceSource=request` switches from session-scoped to request-scoped CSP nonces on upgrade without touching its files. The WARN log and a Version Notes / Migration Guide line are the mitigation; the docs PR (struts-site) documents the setting for the first time and states the switch plainly. ## Tests - `CspNonceSourceConfigTest` — container-level: canonical key, legacy key, and the default each end with the nonce in the right place and read back by the `CspNonceReader` bean; also asserts `default.properties` no longer binds the legacy key. - `CspNonceSourceTest` — precedence, blank handling, case-insensitivity, unknown value rejected. - `StrutsCspNonceReaderTest` — the previously untested reader paths (missing session without creating one, missing request attribute). `mvn test -DskipAssembly -pl core,plugins/javatemplates`: 3318 + 80 tests, 0 failures. ## Follow-ups (not in this PR) - WW ticket at 8.0.0 to remove `STRUTS_CSP_NONCE_SOURCE_LEGACY`, `setLegacyNonceSource` and the second constructor parameter. - Backport to `support/struts-6-x-x` (bug exists since 6.8.0). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
