wicket-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Peter Major (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WICKET-5406) Better Content Security Policy Support
Date Sat, 28 Jul 2018 22:59:00 GMT

    [ https://issues.apache.org/jira/browse/WICKET-5406?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16560919#comment-16560919
] 

Peter Major commented on WICKET-5406:
-------------------------------------

Lots has changed since the last update on this RFE. Would it be possible to revisit this and
provide a current standpoint on CSP support?

// Note that inline scripts are not covered by 'self'.

> Better Content Security Policy Support
> --------------------------------------
>
>                 Key: WICKET-5406
>                 URL: https://issues.apache.org/jira/browse/WICKET-5406
>             Project: Wicket
>          Issue Type: Improvement
>          Components: wicket
>            Reporter: Mario GroƟ
>            Priority: Minor
>              Labels: CSP, Content-Security-Policy, Cross-site-Scripting, Security
>
> A better support of the Content Security Policy (http://en.wikipedia.org/wiki/Content_Security_Policy)
would protect against cross-site scripting attacks and improve the security image of wicket.

> The main problem at the moment is the heavily used inline javascript code which interferes
with the whitelisting mechanism of script sources in the CSP and should be avoided .



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message