You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by ju...@apache.org on 2026/07/12 21:00:23 UTC
(jspwiki) 02/06: Move owasp filters configuration to web-fragment.xml at jspwiki-http
This is an automated email from the ASF dual-hosted git repository.
juanpablo-santos pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit da296a8f9ce154ccd44b972fe4ee61d5b94ea47d
Author: Juan Pablo Santos RodrÃguez <ju...@gmail.com>
AuthorDate: Sun Jul 12 21:04:46 2026 +0200
Move owasp filters configuration to web-fragment.xml at jspwiki-http
---
.../src/main/resources/META-INF/web-fragment.xml | 65 ++++++++++++++++++++++
jspwiki-war/src/main/webapp/WEB-INF/web.xml | 55 +-----------------
2 files changed, 66 insertions(+), 54 deletions(-)
diff --git a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml b/jspwiki-http/src/main/resources/META-INF/web-fragment.xml
index 606e68b10..ca276a2d6 100644
--- a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml
+++ b/jspwiki-http/src/main/resources/META-INF/web-fragment.xml
@@ -31,4 +31,69 @@
<filter-name>CsrfProtectionFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
+
+ <!-- optional set of servlet filters which inject OWASP recommended
+ http response headers into all outbound responses.
+ most have optional init parameters that can be used to customize the output
+ -->
+ <filter>
+ <filter-name>COEPFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.COEPFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>COEPFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
+ <filter-name>CORPFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.CORPFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>CORPFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
+ <filter-name>ContentTypeOptionsFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.ContentTypeOptionsFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>ContentTypeOptionsFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
+ <filter-name>CrossDomainFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.CrossDomainFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>CrossDomainFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
+ <filter-name>ReferrerPolicyFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.ReferrerPolicyFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>ReferrerPolicyFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
+ <filter-name>STSFilter</filter-name>
+ <filter-class>org.apache.wiki.http.filter.STSFilter</filter-class>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>STSFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
</web-fragment>
\ No newline at end of file
diff --git a/jspwiki-war/src/main/webapp/WEB-INF/web.xml b/jspwiki-war/src/main/webapp/WEB-INF/web.xml
index 97d3f4d2c..3a72d274a 100644
--- a/jspwiki-war/src/main/webapp/WEB-INF/web.xml
+++ b/jspwiki-war/src/main/webapp/WEB-INF/web.xml
@@ -86,59 +86,6 @@
<url-pattern>/wiki/*</url-pattern>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
- <!-- optional set of servlet filters which inject OWASP recommended
- http response headers into all outbound responses.
- most have optional init parameters that can be used to customize the output
- -->
- <filter>
- <filter-name>COEPFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.COEPFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>COEPFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <filter>
- <filter-name>CORPFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.CORPFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>CORPFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
-
- <filter>
- <filter-name>ContentTypeOptionsFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.ContentTypeOptionsFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>ContentTypeOptionsFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <filter>
- <filter-name>CrossDomainFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.CrossDomainFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>CrossDomainFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <filter>
- <filter-name>ReferrerPolicyFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.ReferrerPolicyFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>ReferrerPolicyFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <filter>
- <filter-name>STSFilter</filter-name>
- <filter-class>org.apache.wiki.http.filter.STSFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>STSFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
<session-config>
<session-timeout>10</session-timeout>
@@ -396,4 +343,4 @@
REMOVE ME TO ENABLE CONTAINER-MANAGED AUTH -->
-</web-app>
+</web-app>
\ No newline at end of file