Backport of CSP-related changes by jasondlee · Pull Request #5606 · eclipse-ee4j/mojarra

jasondlee · 2025-09-05T17:09:42Z

Backporting CSP-related changes from 5.x to the 4.0 branch.

jasondlee · 2025-09-30T13:31:56Z

@arjantijms @BalusC Any thoughts on this?

softwaresicario · 2025-10-16T16:18:43Z

Thanks for backporting this, first off!

Secondly, out of all the changes implemented, I can't seem to find the one addressing the need of unsafe-eval because of the use of faces.util.chain(this,event,'mojarra.ab(....

Any chance of any of the PR participants to point it out?

Thanks in advance for your time!

BalusC · 2025-10-18T10:57:08Z

LGTM :) But why exactly is Issue5576IT disabled?

Have you already ran the entire 4.0 TCK on this branch? Did it all pass?

(sorry for late response, I was vacationing)

jasondlee · 2025-11-18T15:45:26Z

Thanks for backporting this, first off!

Secondly, out of all the changes implemented, I can't seem to find the one addressing the need of unsafe-eval because of the use of faces.util.chain(this,event,'mojarra.ab(....

@fcarriedos Sorry. Work took me away from this for a bit. :) I thought I had ported everything. Can you point to what I missed? Definitely want to make sure we get it all. :)

softwaresicario · 2025-12-01T18:21:05Z

@jasondlee Thanks for coming back to me on this one!

I'm failing to see any specific change to address the issue described below, more specifically in the definition of faces.util.chain in faces.js to solve the issue described below.

Please let me know if I missed something, I am looking in the wrong place or any clarification is needed.

Context

When there is more than one event handler or more than one action per handler, faces.js chains invocations by creating new Function objects and invoking them, see:

mojarra/impl/src/main/resources/META-INF/resources/jakarta.faces/faces-uncompressed.js

Line 3527 in 1ae407c

var f = new Function("event", arguments[i]);

For this to work, the Content Security Policy forces the need for unsafe-eval (insecure and an obstacle to comply with a solid CSP). Otherwise the execution fails as shown in the screenshots.

I pushed this reproducer and I'm attaching some screenshots that hopefully help clarifying the issue.

Thanks in advance for your time! 🙇

jasondlee · 2025-12-01T18:46:34Z

@fcarriedos Thanks. I'll give that a look. My backport is, fwiw, a backport of all of the CSP-related changes from 5.x. I don't pretend to understand all of the changes, but I'll try to fix that. :)

BalusC · 2026-01-05T15:58:23Z

I fixed it in 5.0 #5631

@jasondlee you can now backport thas as well into your branch

jasondlee · 2026-01-05T20:24:21Z

I fixed it in 5.0 #5631

@jasondlee you can now backport thas as well into your branch

Thanks! On it...

jasondlee · 2026-01-07T16:19:59Z

I fixed it in 5.0 #5631
@jasondlee you can now backport thas as well into your branch

Thanks! On it...

@BalusC Should this be working in the master branch? I built that branch and integrated that impl jar (and the 5.0 API jar) into WildFly locally so I could verify behavior and correctness, but, ~~using @softwaresicario's reproducer above~~ using a reproducer on an internal bug report, it appears that commandLinks are broken if the CSP policy is applied.

Navigated to http://localhost:8080/reproducer-04209988/mytest.jsf
mytest.jsf:7 Executing inline script violates the following Content Security Policy directive 
'default-src 'self''.  Either the 'unsafe-inline' keyword, a hash 
('sha256-gRzq6dUwQTPnqxVhNkutQ5tMemn1eFOfoM1R3fr05Sc='), 
or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' 
was not explicitly set, so 'default-src' is used as a fallback. The action has been blocked.

BalusC · 2026-01-07T16:42:43Z

That's a separate issue. This was indeed not covered by "first step" work jakartaee/faces#2046

The h:outputScript doesn't yet support the nonce attribute. The renderers don't yet extract the (passthrough) nonce from faces.js or accept a nonce via e.g. context param. This is the next step which needs to be crystallized in jakartaee/faces#1590

BalusC · 2026-01-07T16:49:26Z

For now .. just use PrimeFaces with CSP enabled (see also its CspPhaseListener) and in Mojarra RenderKitUtils manually edit renderScript() method to add new attribute

        writer.writeAttribute("nonce", sameNonceAsUsedByPrimeFaces, "nonce");

The main incentive for this "first step" is to ensure that Faces 5.0 standard components work flawlessly with PrimeFaces with CSP enabled. This was previously not the case.

The next step is indeed to provide a similar thing as CspPhaseListener via standard Faces and let Faces impl render script elements with nonce.

BalusC · 2026-01-09T09:48:56Z

@jasondlee I implemented it in #5644, when building that and the associated Faces branch, then simply add jakarta.faces.ENABLE_CSP_NONCE=true context param to web.xml (and remove the conflicting CspFilter from @softwaresicario's project)

You're free to add a com.sun.faces.enableCspNonce context param therefor in 4.0 (see WebConfiguration)

BalusC · 2026-01-12T09:26:53Z

FYI: 32c4302, this shall also need to be backported.

BalusC · 2026-01-13T09:40:32Z

And this https://github.com/eclipse-ee4j/mojarra/pull/5653/files also needs to be backported. That'll be the final part I think :)

BalusC · 2026-04-25T14:23:10Z

There were only a few inconsistencies which I ironed out: d890b5a

However, on second thought, I cannot accept the changes to API classes as that contaminates the 4.0 (and 4.1) API. It would basically falsely claim that these exist in 4.0 spec. These constants/methods have to remain impl-specific. Only when merging the changes into 5.0 branch then we can remove the impl-specific changes and rely on real spec/api based impl. In other words, ResourceHandler and ResourceHandlerWrapper have to be reverted, the constants/methods moved into ResourceHandlerImpl and the context parameters to be com.sun.faces prefixed instead of jakarta.faces. I will take care of this with help of Claude.

This change ensures that generated script elements are not rendered nested inside the element but only after the element as nested script elements violate html spec in case of <a> and <input> elements

BalusC · 2026-04-25T15:32:47Z

All backports are in place.
API changes have been reverted so it's impl specific only (will be "restored" in 5.0).
context params are com.sun.faces.enableCspNonce and com.sun.faces.cspPolicy (will be "restored" in 5.0).
IT test passes.

Ready for merge :)

com.sun.faces CSP related context params to jakarta.faces ones along with a deprecated warning

jasondlee · 2026-04-26T04:10:29Z

There were only a few inconsistencies which I ironed out: d890b5a

However, on second thought, I cannot accept the changes to API classes as that contaminates the 4.0 (and 4.1) API. It would basically falsely claim that these exist in 4.0 spec. These constants/methods have to remain impl-specific. Only when merging the changes into 5.0 branch then we can remove the impl-specific changes and rely on real spec/api based impl. In other words, ResourceHandler and ResourceHandlerWrapper have to be reverted, the constants/methods moved into ResourceHandlerImpl and the context parameters to be com.sun.faces prefixed instead of jakarta.faces. I will take care of this with help of Claude.

That's a good catch. Thanks for the clean up and the merge. I'll use this PR to create a backport for 4.1.

BalusC · 2026-04-26T13:00:49Z

@jasondlee it's already merged in 4.1: 54720bd

jasondlee · 2026-04-27T12:58:16Z

@jasondlee it's already merged in 4.1: 54720bd

Even better. Thanks for handling that, and all the help with this PR. :) If there are no objections, I'm going to release an update for both 4.x versions.

BalusC · 2026-04-27T13:23:15Z

TCK job in Eclipse CI is not working since changes in publishing flow due to migration of Sonatype to Maven Central (cc: @arjantijms ) so you need to manually run TCK beforehand for 4.0 as well as 4.1. If TCK passes for you then you only need to execute "build and stage" job (autoPublish flag is currently true so no additional action is needed).

jasondlee · 2026-04-27T13:34:54Z

Does this process still apply? https://github.com/eclipse-ee4j/mojarra/blob/master/RELEASE.md

BalusC · 2026-04-27T13:53:59Z

Nope. Only job 1 at Jenkins works. Job 1 currently basically already publishes (because of recently added autoPublish flag in pom.xml). Jobs 2 and 3 don't anymore work (they still rely on Sonatype) and should therefore be skipped. Full TCK should be executed manually at your machine (in confidence). All this is because of the migration from Sonatype Nexus to Maven Central about 8 months ago.

From the RELEASE.md this thus means you can skip the following steps:

1
7-10
13-18

We still need to catch up the build scripts and RELEASE.md. We never had real time for this. I'll try to delegate this to Claude this week.

jasondlee · 2026-04-27T13:59:47Z

How does this draft look? https://github.com/eclipse-ee4j/mojarra/releases/edit/untagged-c5885c388e36ba86436a Not sure I've done that part before :)

BalusC · 2026-04-27T14:00:18Z

LGTM :)

BalusC · 2026-04-27T17:40:48Z

I'm currently testing 4.1.8 release with the new JenkinsFile: https://ci.eclipse.org/mojarra/job/mojarra-release/1/console

backport, below is Claude's observation: Under server-side state saving, ServerSideStateHelper.writeState calls externalContext.getSession(true) at WriteBehindStateWriter.flushToWriter time. If the rendered output already exceeds the response buffer (e.g. the CSP backport in 4.0.17 emits an extra <script>mojarra.ael(...)</script> per command, roughly doubling per-link bytes), the response is committed before flushToWriter runs, getSession(true) then fails with `IllegalStateException: Cannot create a session after the response has been committed`, aborting the render mid-form, so </form> and the jakarta.faces.ViewState hidden input never reach the client. FaceletViewHandlingStrategy already had a pre-render getSession() guard for exactly this reason, but it was strict-equality on STATE_SAVING_METHOD_SERVER, which disagreed with the helper-selection rule in ResponseStateManagerImpl (anything not STATE_SAVING_METHOD_CLIENT → ServerSideStateHelper). Configurations where STATE_SAVING_METHOD is unset or contains an unresolved placeholder (e.g. ${webapp.stateSavingMethod}) silently used the server helper but skipped the pre-create. Fix isServerStateSaving() to mirror the helper-selection rule (!STATE_SAVING_METHOD_CLIENT.equalsIgnoreCase(...)), and tighten the pre-create to only fire when actually needed: non-transient view, no existing session, server-side state saving, and the view contains at least one UIForm (verified via a short-circuit visitTree). This avoids gratuitous session creation for plain pages that have no form and would not write state anyway, which previously caused JSESSIONID URL rewriting side-effects. Fixes Issue1817IT regression introduced by the CSP backport.

…ses HtmlUnit which doesn't at all like ES6; rewrite faces-uncompressed.js to not anymore use ES6 specific syntax so YUI Compressor can digest it; fix backport regression in runStylesheets (2 lines were dropped?) and ensure this is covered by faces.ajax.test.ts

…e_4.0_tck' into 'make_sure_csp_backport_passes_the_4.1_tck'

jasondlee mentioned this pull request Sep 5, 2025

First step for jakartaee/faces#1590 #5601

Merged

jasondlee changed the base branch from master to 4.0 September 24, 2025 21:51

jasondlee marked this pull request as ready for review September 24, 2025 21:51

jasondlee requested review from BalusC and arjantijms September 24, 2025 21:52

jasondlee changed the title ~~Backportof CSP-related changes~~ Backport of CSP-related changes Sep 24, 2025

BalusC reviewed Oct 18, 2025

View reviewed changes

Comment thread impl/src/main/java/com/sun/faces/renderkit/RenderKitUtils.java Outdated

BalusC reviewed Oct 18, 2025

View reviewed changes

Comment thread impl/src/main/java/com/sun/faces/renderkit/RenderKitUtils.java Outdated

BalusC reviewed Oct 18, 2025

View reviewed changes

Comment thread impl/src/main/resources/META-INF/resources/jakarta.faces/faces-uncompressed.js

BalusC reviewed Oct 18, 2025

View reviewed changes

Comment thread impl/src/main/resources/META-INF/resources/jakarta.faces/faces-uncompressed.js Outdated

jasondlee force-pushed the csp branch from 61c0564 to 1ae407c Compare November 18, 2025 16:13

BalusC reviewed Nov 29, 2025

View reviewed changes

Comment thread test/issue5576/src/test/java/org/eclipse/mojarra/test/issue5576/Issue5576IT.java Outdated

jasondlee force-pushed the csp branch from 1ae407c to 3945b96 Compare December 1, 2025 18:44

BalusC mentioned this pull request Jan 5, 2026

jakartaee/faces#1590: faces.util.chain must also support CSP; while at it bumped versions to 5 #5631

Merged

jasondlee force-pushed the csp branch 2 times, most recently from f5e530c to 5e79df3 Compare February 10, 2026 20:28

BalusC added 3 commits April 25, 2026 10:33

Sync Spec1590IT as well

d6c7cb3

Revert API changes and keep CSP impl-specific (with help of Claude)

de6c62d

Add missing backports from 4241c65 and 082789b with help of Claude;

46a1be8

This change ensures that generated script elements are not rendered nested inside the element but only after the element as nested script elements violate html spec in case of <a> and <input> elements

BalusC merged commit 3e498a4 into eclipse-ee4j:4.0 Apr 25, 2026
2 checks passed

BalusC added a commit that referenced this pull request Apr 25, 2026

Merge #5606 from 4.0 into 4.1

54720bd

BalusC added a commit that referenced this pull request Apr 25, 2026

Merge #5606 from 4.1 into 5.0 and update FacesContextParam to map

badf957

com.sun.faces CSP related context params to jakarta.faces ones along with a deprecated warning

BalusC added this to the 4.0.15 milestone Apr 25, 2026

jasondlee deleted the csp branch April 27, 2026 13:35

BalusC added a commit that referenced this pull request Apr 28, 2026

Fix #5606: the h:commandLink script must be rendered AFTER end tag

790f631

BalusC added a commit that referenced this pull request Apr 28, 2026

Fix #5606: shouldWriteIdAttribute should always be true for UICommand

61bb884

BalusC added a commit that referenced this pull request Apr 28, 2026

Fix #5606: render="@ALL" must also run CSP scripts

846f274

BalusC added a commit that referenced this pull request Apr 28, 2026

Fix #5606: hasForm must skip iteration

b8f2b19

pzygielo pushed a commit to pzygielo/mojarra that referenced this pull request Apr 29, 2026

Fix eclipse-ee4j#5606: Merge branch 'make_sure_csp_backport_passes_th…

8700308

…e_4.0_tck' into 'make_sure_csp_backport_passes_the_4.1_tck'

Conversation

jasondlee commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jasondlee commented Sep 30, 2025

Uh oh!

softwaresicario commented Oct 16, 2025

Uh oh!

BalusC commented Oct 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasondlee commented Nov 18, 2025

Uh oh!

Uh oh!

softwaresicario commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Uh oh!

jasondlee commented Dec 1, 2025

Uh oh!

BalusC commented Jan 5, 2026

Uh oh!

jasondlee commented Jan 5, 2026

Uh oh!

jasondlee commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Jan 13, 2026

Uh oh!

BalusC commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BalusC commented Apr 25, 2026

Uh oh!

Uh oh!

jasondlee commented Apr 26, 2026

Uh oh!

BalusC commented Apr 26, 2026

Uh oh!

jasondlee commented Apr 27, 2026

Uh oh!

BalusC commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jasondlee commented Apr 27, 2026

Uh oh!

BalusC commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jasondlee commented Apr 27, 2026

Uh oh!

BalusC commented Apr 27, 2026

Uh oh!

BalusC commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jasondlee commented Sep 5, 2025 •

edited

Loading

softwaresicario commented Dec 1, 2025 •

edited

Loading

jasondlee commented Jan 7, 2026 •

edited

Loading

BalusC commented Jan 7, 2026 •

edited

Loading

BalusC commented Jan 7, 2026 •

edited

Loading

BalusC commented Jan 9, 2026 •

edited

Loading

BalusC commented Jan 12, 2026 •

edited

Loading

BalusC commented Apr 25, 2026 •

edited

Loading

BalusC commented Apr 27, 2026 •

edited

Loading

BalusC commented Apr 27, 2026 •

edited

Loading