[WICKET-6682] Improve JavaScriptContentHeaderItem and JavaScriptUtils to support nonce

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.5.0, 9.0.0-M2
• Fix Version/s: 9.0.0-M4
• Component/s: wicket
• Labels: security
• Assignee: Sven Meier
• Reporter: Andrew Kondratev
• Created: 06/Jul/19 08:39
• Updated: 27/Sep/19 16:38
• Resolved: 27/Sep/19 16:38

Description

One of easy wins for content security policy would be a support of nonce for inline JavaScript header injections.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#Unsafe_inline_script

Criteria

• Set up some kind of request unique nonce provider
• Make it possible for JavaScript header items to have provided nonce
• Add provided nonce to the `Content-Security-Policy: script-src` header

See in code:
org.apache.wicket.core.util.string.JavaScriptUtils#writeOpenTag
org.apache.wicket.markup.head.JavaScriptContentHeaderItem#render

Issue Links

• is a child of: WICKET-5406 Better Content Security Policy Support
• is depended upon by: WICKET-6703 Eliminate window.eval from wicket-ajax-jquery
• relates to: WICKET-6686 Clean up header items infrastructure (conditionals)
• relates to: WICKET-6688 Add alternative RPC response to substitute the append java script in ajax response
• relates to: WICKET-6321 Support Integrity and Crossorigin attributes for JavaScriptUrlReferenceHeaderItem
• relates to: WICKET-6687 Cleanup the code from attribute inline styles and attribute inline scripts
• links to: GitHub Pull Request #374
• links to: GitHub Pull Request #376