TYPO3 Core

Given the following snippet in a csp.yaml:

inheritDefault: true
mutations:
  - mode: reduce
    directive: 'frame-src'
    sources:
      - "*.vimeo.com" 

This should remove the default source "*.vimeo.com", but it does not.

The problem seems to lie in the SourceCollection->without() method: Here two UriValue objects are compared via in_array which returns false (and negate to true). So the source is kept.