[BUGFIX] Correctly represent CSP UriValue('*')
An entire wildcard `UriValue`, which is just `'*'`, was incorrectly encoded. In the scope of CSP `'*'` is valid. Using wildcards should be avoided in favor of being specific. Resolves: #100798 Releases: main, 12.4 Change-Id: Iaf13b1d2095a672653894a6da5f10ad7115a2538 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78933 Tested-by:Nikita Hovratov <nikita.h@live.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
Showing
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/UriValue.php 12 additions, 0 deletions.../core/Classes/Security/ContentSecurityPolicy/UriValue.php
- typo3/sysext/core/Tests/Unit/Security/ContentSecurityPolicy/UriValueTest.php 3 additions, 0 deletions...ests/Unit/Security/ContentSecurityPolicy/UriValueTest.php
Please register or sign in to comment