[WICKET-6813] Setting child-src does not update frame-src after initial assignment

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 9.0.0-M5, 9.0.0
• Fix Version/s: 9.1.0
• Component/s: wicket-core
• Assignee: Emond Papegaaij
• Reporter: Mark Snijder
• Created: 10/Aug/20 11:52
• Updated: 10/Aug/20 12:22
• Resolved: 10/Aug/20 12:22

Description

When configuring CHILD_SRC Wicket also configures FRAME_SRC (CSPHeaderConfiguration.doAddDirective) however it only does this when FRAME_SRC is not set.

Since unsafeInline() sets CHILD_SRC to 'self', adding other CHILD_SRC directive values will not update the FRAME_SRC value anymore. The CSP settings in the code below causes a Refused to frame 'https://docs.google.com/' because it violates the following Content Security Policy directive: "frame-src 'self'". error.

 getCspSettings().blocking()
	.unsafeInline()
	.add(CSPDirective.SCRIPT_SRC, "https://apis.google.com/")
	.add(CSPDirective.CHILD_SRC, "https://docs.google.com/");

A workaround is to add FRAME_SRC yourself manually to the code above (.add(CSPDirective.FRAME_SRC, "https://docs.google.com/")) but I would have expected the code to work without adding this.

Issue Links

• is duplicated by: WICKET-6812 CSPHeaderConfiguration only copies first value from child-src to frame-src