[BUGFIX] Replace CSP mutation mode extend by inherit & append
MutationMode::Extend has some ambiguity when being invoked multiple times on modified ancestor source collections. This change introduces the new MutationMode::InheritOnce, MutationMode::InheritAgain and MutationMode::Append. The implicit behavior of MutationMode::Extend changes from the combination of MutationMode::InheritAgain + MutationMode::Append to MutationMode::InheritOnce + MutationMode::Append to avoid side effects with more configurations modifying the policy. Static mutations loaded from ContentSecurityPolicies.php are ordered accordoring to the packages dependency hierarchy. That is the reason, the configuration from ext:core had to be moved to both ext:backend and ext:frontend. Resolves: #101797 Releases: main, 12.4 Change-Id: I7ab8e9d3f5635783d026f585f15c27ff62189959 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81574 Reviewed-by:Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
core-ci <typo3@b13.com>
Showing
- typo3/sysext/backend/Configuration/ContentSecurityPolicies.php 18 additions, 0 deletions.../sysext/backend/Configuration/ContentSecurityPolicies.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/MutationMode.php 30 additions, 4 deletions...e/Classes/Security/ContentSecurityPolicy/MutationMode.php
- typo3/sysext/core/Classes/Security/ContentSecurityPolicy/Policy.php 38 additions, 8 deletions...xt/core/Classes/Security/ContentSecurityPolicy/Policy.php
- typo3/sysext/core/Configuration/ContentSecurityPolicies.php 0 additions, 44 deletionstypo3/sysext/core/Configuration/ContentSecurityPolicies.php
- typo3/sysext/core/Documentation/Changelog/12.3/Feature-99499-IntroduceContent-Security-PolicyHandling.rst 8 additions, 0 deletions...eature-99499-IntroduceContent-Security-PolicyHandling.rst
- typo3/sysext/core/Tests/Functional/Security/ContentSecurityPolicy/PolicyTest.php 54 additions, 0 deletions.../Functional/Security/ContentSecurityPolicy/PolicyTest.php
- typo3/sysext/frontend/Configuration/ContentSecurityPolicies.php 18 additions, 0 deletions...sysext/frontend/Configuration/ContentSecurityPolicies.php
Please register or sign in to comment