struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (Jira)" <>
Subject [jira] [Work logged] (WW-5084) Content Security Policy support
Date Sat, 22 Aug 2020 11:50:00 GMT


ASF GitHub Bot logged work on WW-5084:

                Author: ASF GitHub Bot
            Created on: 22/Aug/20 11:49
            Start Date: 22/Aug/20 11:49
    Worklog Time Spent: 10m 
      Work Description: salcho commented on a change in pull request #430:

File path: core/src/main/java/org/apache/struts2/action/
@@ -0,0 +1,38 @@
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.action;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+ * The default implementation of {@link CspReportAction} that simply logs the JSON object
+ * that contains the details of the CSP violation.
+ *
+ * @see CspReportAction
+ */
+public class DefaultCspReportAction extends CspReportAction {
+    protected static final Logger LOG = LogManager.getLogger(DefaultCspReportAction.class);
+    @Override
+    void processReport(String jsonCspReport) {

Review comment:
       Yes! This was indeed missing, thanks for pointing that out. I've now added `CspReportActionTest`
which documents what was explained above.

This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:

Issue Time Tracking

    Worklog Id:     (was: 473544)
    Time Spent: 4.5h  (was: 4h 20m)

> Content Security Policy support
> -------------------------------
>                 Key: WW-5084
>                 URL:
>             Project: Struts 2
>          Issue Type: New Feature
>          Components: Core Interceptors, Core Tags
>    Affects Versions: 2.6
>            Reporter: Santiago Diaz
>            Priority: Major
>             Fix For: 2.6
>          Time Spent: 4.5h
>  Remaining Estimate: 0h
> We'd like to add built-in Content Security Policy support to Struts2 to provide a major
security mechanism that developers can use to protect against common Cross-Site Scripting
vulnerabilities. Developers will have the ability to enable CSP in report-only or enforcement
> We will provide an out of the box tag that can be used by developers to use/import scripts
in their web applications, so that these will automatically get nonces that are compatible
with their Content Security policies.
> Finally, we will provide a built-in handler for CSP violation reports that will be used
to collect and provide textual explanations of these reports. This endpoint will be used by
developers to debug CSP violations and locate pieces of code that need to be refactored to
support strong policies.

This message was sent by Atlassian Jira

View raw message