You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by GitBox <gi...@apache.org> on 2022/02/08 12:43:45 UTC

[GitHub] [sling-org-apache-sling-security] anchela opened a new pull request #6: SLING-11115 : Allow path exemptions for referrer filter

anchela opened a new pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6


   @cziegeler , i would appreciate if you had time to review the proposed addition to referrer-filter configuration and the corresponding exclusion during validation.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] cziegeler commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
cziegeler commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801646406



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       but checking excludedPaths for null is good as well




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] sonarcloud[bot] commented on pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#issuecomment-1032685142


   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; ![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL)
   
   [![100.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/100-16px.png '100.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list) [100.0% Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list)  
   [![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] sonarcloud[bot] commented on pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#issuecomment-1032570177


   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; ![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL)
   
   [![100.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/100-16px.png '100.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list) [100.0% Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list)  
   [![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] cziegeler merged pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
cziegeler merged pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] anchela commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
anchela commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801705230



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       sodele 




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] anchela commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
anchela commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801633415



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       sure -> done




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] cziegeler commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
cziegeler commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801605247



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       I would add a null check for excludedPath here, as a sanity check




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] cziegeler commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
cziegeler commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801729365



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       Thanks




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] sonarcloud[bot] commented on pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#issuecomment-1032614927


   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; ![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL)
   
   [![100.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/100-16px.png '100.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list) [100.0% Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list)  
   [![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] cziegeler commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
cziegeler commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801646008



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       ah sorry, I meant "excludedPath" :) so a string in the array might be null 




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] sonarcloud[bot] removed a comment on pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] removed a comment on pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#issuecomment-1032570177


   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; ![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL)
   
   [![100.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/100-16px.png '100.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list) [100.0% Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list)  
   [![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] sonarcloud[bot] removed a comment on pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] removed a comment on pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#issuecomment-1032614927


   Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; ![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-security&pullRequest=6&resolved=false&types=CODE_SMELL)
   
   [![100.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/100-16px.png '100.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list) [100.0% Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_coverage&view=list)  
   [![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-security&pullRequest=6&metric=new_duplicated_lines_density&view=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [sling-org-apache-sling-security] anchela commented on a change in pull request #6: SLING-11115 : Allow path exemptions for referrer filter

Posted by GitBox <gi...@apache.org>.
anchela commented on a change in pull request #6:
URL: https://github.com/apache/sling-org-apache-sling-security/pull/6#discussion_r801701557



##########
File path: src/main/java/org/apache/sling/security/impl/ReferrerFilter.java
##########
@@ -430,6 +448,22 @@ private boolean isValidRegexReferrer(HostInfo hostInfo) {
         return false;
     }
 
+    /**
+     * Returns <code>true</code> if the path info associated with the given request is contained in the configured excluded paths.
+     *
+     * @param request The request to check
+     * @return <code>true</code> if the path-info associate with the given request is contained in the configured excluded paths.
+     */
+    private boolean isExcludedPath(HttpServletRequest request) {
+        String path = request.getPathInfo();
+        for (final String excludedPath : this.excludedPaths) {
+            if (excludedPath.equals(path)) {

Review comment:
       :-)




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org