[TASK] Use ConsumableNonce instead of blunt Nonce in CSP context
To identify whether a nonce values was actually used (consumed), `ConsumableNonce` instances are used, instead of `Nonce` objects. The new `ConsumableNonce` inherits from `ConsumableString`. As a result, the `<f:security.nonce>` view helper would increase the consumption counter. This is important for additional cache handling in the frontend rendering context. Resolves: #101751 Releases: main, 12.4 Change-Id: Iea147b0130e3d350f5913dc75f33af61c18e8af3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80235 Tested-by:core-ci <typo3@b13.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
Showing
- typo3/sysext/adminpanel/Classes/Controller/MainController.php 2 additions, 2 deletions...3/sysext/adminpanel/Classes/Controller/MainController.php
- typo3/sysext/adminpanel/Classes/Modules/Debug/Events.php 1 addition, 1 deletiontypo3/sysext/adminpanel/Classes/Modules/Debug/Events.php
- typo3/sysext/adminpanel/Classes/Utility/HtmlDumper.php 4 additions, 3 deletionstypo3/sysext/adminpanel/Classes/Utility/HtmlDumper.php
- typo3/sysext/adminpanel/Classes/Utility/ResourceUtility.php 5 additions, 4 deletionstypo3/sysext/adminpanel/Classes/Utility/ResourceUtility.php
- typo3/sysext/backend/Classes/Middleware/ContentSecurityPolicyHeaders.php 1 addition, 2 deletions...ckend/Classes/Middleware/ContentSecurityPolicyHeaders.php
- typo3/sysext/core/Classes/Core/RequestId.php 3 additions, 3 deletionstypo3/sysext/core/Classes/Core/RequestId.php
- typo3/sysext/core/Classes/Domain/ConsumableString.php 1 addition, 1 deletiontypo3/sysext/core/Classes/Domain/ConsumableString.php
- typo3/sysext/core/Classes/Http/Security/ReferrerEnforcer.php 2 additions, 2 deletionstypo3/sysext/core/Classes/Http/Security/ReferrerEnforcer.php
- typo3/sysext/core/Classes/Page/AssetRenderer.php 6 additions, 6 deletionstypo3/sysext/core/Classes/Page/AssetRenderer.php
- typo3/sysext/core/Classes/Page/ImportMap.php 2 additions, 2 deletionstypo3/sysext/core/Classes/Page/ImportMap.php
- typo3/sysext/core/Classes/Page/JavaScriptRenderer.php 3 additions, 3 deletionstypo3/sysext/core/Classes/Page/JavaScriptRenderer.php
- typo3/sysext/core/Classes/Page/PageRenderer.php 5 additions, 5 deletionstypo3/sysext/core/Classes/Page/PageRenderer.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/ConsumableNonce.php 41 additions, 0 deletions...lasses/Security/ContentSecurityPolicy/ConsumableNonce.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/ModelService.php 4 additions, 8 deletions...e/Classes/Security/ContentSecurityPolicy/ModelService.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/Policy.php 2 additions, 3 deletions...xt/core/Classes/Security/ContentSecurityPolicy/Policy.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/SourceKeyword.php 1 addition, 5 deletions.../Classes/Security/ContentSecurityPolicy/SourceKeyword.php
- typo3/sysext/core/Classes/Utility/DebugUtility.php 0 additions, 6 deletionstypo3/sysext/core/Classes/Utility/DebugUtility.php
- typo3/sysext/core/Tests/Functional/Security/ContentSecurityPolicy/PolicyTest.php 6 additions, 6 deletions.../Functional/Security/ContentSecurityPolicy/PolicyTest.php
- typo3/sysext/core/Tests/Unit/Http/Security/ReferrerEnforcerTest.php 5 additions, 6 deletions...xt/core/Tests/Unit/Http/Security/ReferrerEnforcerTest.php
- typo3/sysext/core/Tests/Unit/Page/ImportMapTest.php 10 additions, 10 deletionstypo3/sysext/core/Tests/Unit/Page/ImportMapTest.php
Please register or sign in to comment