{"data":{"id":"magento2-37401","source":"github-pr","sourceRef":"magento/magento2#37401","title":"Missing Font CSP Paylater Popup","pr":{"number":37401,"url":"https://github.com/magento/magento2/pull/37401","author":"in-session","mergedAt":"2024-05-28T15:06:28Z","mergeCommit":"4bfee4101c461050c71e4274a1720758679c7ef3","headCommit":"087690e2666d9b6e5053f48727c843ce1510d614","baseRef":"2.4-develop","diffSha256":"de6349ec53833a8c9a8ebddfdbc540d8f2dd0a3c9d5bacdb64d7d38b57156bff"},"issues":[{"number":38624,"url":"https://github.com/magento/magento2/issues/38624","title":"[Issue] Missing Font CSP Paylater Popup","labels":["Area: Security","Component: Paypal","Issue: Confirmed","Priority: P3","Progress: done","Reproduced on 2.4.x","Triage: Dev.Experience"],"kind":"pr-derived"}],"fixedIn":"2.4.8","containingTags":["2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"conflict","2.4.8-p1":"conflict","2.4.8-p2":"conflict","2.4.8-p3":"conflict","2.4.8-p4":"conflict","2.4.8-p5":"conflict","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10"],"components":["magento/module-paypal"],"files":[{"path":"app/code/Magento/Paypal/etc/csp_whitelist.xml","change":"modified","package":"magento/module-paypal"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":6,"mergeBatched":false,"excluded":null,"sections":{"description":null,"stepsToReproduce":null,"expectedResult":null,"actualResult":null,"source":null},"signatures":[],"labels":{"area":["Security"],"component":["Paypal"],"priority":"P3","severity":null,"reportedOn":[]},"categories":["Payments"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"417b82bbadf1f78259df2ad9b9fdd551fe99b3738c7cb4c2b62db3296b6fedb3","isBugfix":0.9484,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9309,"feature":0.0389,"refactor":0.0102,"tests_only":0.0056,"docs_only":0.0066,"dependency":0.0078},"confidence":0.8419},"scope":{"score":0.1932,"probabilities":{"0":0.838,"1":0.1308,"2":0.0312},"confidence":0.5805},"risk":{"score":0.2494,"probabilities":{"0":0.8324,"1":0.0858,"2":0.0818},"confidence":0.5604},"area":{"choice":"checkout","probabilities":{"catalog":0.0061,"checkout":0.8493,"customer":0.0077,"admin":0.0115,"graphql_api":0.0044,"framework":0.0245,"frontend":0.069,"other":0.0275},"confidence":0.6888},"securityRelevant":0.6463,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0031,"2.4.0-p1":0.004,"2.4.1":0.0043,"2.4.1-p1":0.004,"2.4.2":0.0059,"2.4.2-p1":0.0067,"2.4.2-p2":0.0074,"2.4.3":0.0118,"2.4.3-p1":0.0104,"2.4.3-p2":0.0133,"2.4.3-p3":0.0061,"2.4.4":0.015,"2.4.4-p1":0.0102,"2.4.4-p10":0.0068,"2.4.4-p11":0.0081,"2.4.4-p12":0.0071,"2.4.4-p13":0.007,"2.4.4-p14":0.0094,"2.4.4-p15":0.0067,"2.4.4-p16":0.007,"2.4.4-p17":0.0067,"2.4.4-p18":0.0058,"2.4.4-p2":0.0025,"2.4.4-p3":0.0029,"2.4.4-p4":0.003,"2.4.4-p5":0.0038,"2.4.4-p6":0.0042,"2.4.4-p7":0.0043,"2.4.4-p8":0.0048,"2.4.4-p9":0.0039,"2.4.5":0.0147,"2.4.5-p1":0.0106,"2.4.5-p10":0.008,"2.4.5-p11":0.0118,"2.4.5-p12":0.0098,"2.4.5-p13":0.0083,"2.4.5-p14":0.0091,"2.4.5-p15":0.0078,"2.4.5-p16":0.0084,"2.4.5-p17":0.0069,"2.4.5-p2":0.0035,"2.4.5-p3":0.0047,"2.4.5-p4":0.0048,"2.4.5-p5":0.0047,"2.4.5-p6":0.0057,"2.4.5-p7":0.0061,"2.4.5-p8":0.0049,"2.4.5-p9":0.005,"2.4.6":0.0316,"2.4.6-p1":0.0203,"2.4.6-p10":0.0131,"2.4.6-p11":0.0138,"2.4.6-p12":0.0115,"2.4.6-p13":0.011,"2.4.6-p14":0.0106,"2.4.6-p15":0.0092,"2.4.6-p2":0.0043,"2.4.6-p3":0.0074,"2.4.6-p4":0.0107,"2.4.6-p5":0.0074,"2.4.6-p6":0.009,"2.4.6-p7":0.0093,"2.4.6-p8":0.007,"2.4.6-p9":0.0069,"2.4.7":0.0173,"2.4.7-p1":0.0151,"2.4.7-p10":0.0117,"2.4.7-p2":0.0078,"2.4.7-p3":0.0134,"2.4.7-p4":0.0148,"2.4.7-p5":0.011,"2.4.7-p6":0.014,"2.4.7-p7":0.0128,"2.4.7-p8":0.0092,"2.4.7-p9":0.0064,"2.4.8":0.0179,"2.4.8-p1":0.0162,"2.4.8-p2":0.0163,"2.4.8-p3":0.0168,"2.4.8-p4":0.0143,"2.4.8-p5":0.0125,"2.4.9":0.018,"unspecified":0.2404},"confidence":0.0554},"backportWorthy":{"score":1.494,"probabilities":{"0":0.1176,"1":0.2709,"2":0.6115},"confidence":0.1918}},"curated":{"title":"Paylater popup font and frame are refused by the Content Security Policy","description":"The Paylater popup refused to load the font and to frame www.paypalobjects.com because it violates the following Content Security Policy directive. The change in the Paypal csp_whitelist.xml adds www.paypalobjects.com as a host value to the policy with the PayPal hosts and to a new font-src policy.","categories":["Payments"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-37401 details"}