svn commit: r1212864 - in /myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal: context/TrinidadPhaseListener.java renderkit/core/xhtml/HtmlRenderer.java

[gc...@apache.org]

Author: gcrawford
Date: Sat Dec 10 20:20:09 2011
New Revision: 1212864

URL: http://svn.apache.org/viewvc?rev=1212864&view=rev
Log:
TRINIDAD-2169 add framebusting support to handle clickjacking attacks

frameworks based on trinidad have their own framebusting support, but still hit the phaselistener, so move header code into HtmlRenderer so the trinidad setting is only used for trinidad pages.

Modified:
    myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java
    myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/HtmlRenderer.java

Modified: myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java?rev=1212864&r1=1212863&r2=1212864&view=diff
==============================================================================
--- myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java (original)
+++ myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java Sat Dec 10 20:20:09 2011
@@ -26,7 +26,6 @@ import javax.faces.event.PhaseListener;
 
 import org.apache.myfaces.trinidadinternal.config.xmlHttp.XmlHttpConfigurator;
 import org.apache.myfaces.trinidadinternal.renderkit.core.CoreRenderKit;
-import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils;
 
 /**
  * Performs some trinidad logic and provides some hooks.
@@ -90,31 +89,7 @@ public class TrinidadPhaseListener imple
     {
       FacesContext context = event.getFacesContext();
       markPostback(context);
-    }
-    else if (phaseId == PhaseId.RENDER_RESPONSE)
-    {    
-      // add response headers for framebusting if needed
-
-      FacesContext context = event.getFacesContext();
-      String frameBusting = FrameBustingUtils.getFrameBustingValue(context);        
-  
-      if (! FrameBustingUtils.FRAME_BUSTING_NEVER.equalsIgnoreCase(frameBusting))
-      {
-        // TODO: Mozilla has introduced CSP
-        //     https://wiki.mozilla.org/Security/CSP/Specification
-        // which we may want to support at some point
-        
-        // the X-Frame-Options header doesn't work on all browsers, but we're adding it anyway
-        if (FrameBustingUtils.FRAME_BUSTING_ALWAYS.equalsIgnoreCase(frameBusting))
-        {
-          context.getExternalContext().addResponseHeader("X-Frame-Options", "deny");
-        }
-        else
-        {
-          context.getExternalContext().addResponseHeader("X-Frame-Options", "sameorigin");
-        }
-      }
-    }    
+    } 
   }
 
 

Modified: myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/HtmlRenderer.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/HtmlRenderer.java?rev=1212864&r1=1212863&r2=1212864&view=diff
==============================================================================
--- myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/HtmlRenderer.java (original)
+++ myfaces/trinidad/trunk/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/HtmlRenderer.java Sat Dec 10 20:20:09 2011
@@ -31,6 +31,7 @@ import org.apache.myfaces.trinidad.bean.
 import org.apache.myfaces.trinidad.component.html.HtmlFrameBorderLayout;
 import org.apache.myfaces.trinidad.component.html.HtmlHtml;
 import org.apache.myfaces.trinidad.context.RenderingContext;
+import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils;
 
 
 /**
@@ -81,6 +82,34 @@ public class HtmlRenderer extends XhtmlR
     FacesBean        bean
     ) throws IOException
   {
+    
+    // add response headers for framebusting if needed
+    String frameBusting = FrameBustingUtils.getFrameBustingValue(context);        
+    
+    if (! FrameBustingUtils.FRAME_BUSTING_NEVER.equalsIgnoreCase(frameBusting))
+    {
+      try
+      {
+        // TODO: Mozilla has introduced CSP
+        //     https://wiki.mozilla.org/Security/CSP/Specification
+        // which we may want to support at some point
+        
+        // the X-Frame-Options header doesn't work on all browsers, but we're adding it anyway
+        if (FrameBustingUtils.FRAME_BUSTING_ALWAYS.equalsIgnoreCase(frameBusting))
+        {
+          context.getExternalContext().addResponseHeader("X-Frame-Options", "deny");
+        }
+        else
+        {
+          context.getExternalContext().addResponseHeader("X-Frame-Options", "sameorigin");
+        }
+      }
+      catch(UnsupportedOperationException uoe)
+      {
+        // framebusting is also supported in the BodyRenderer
+      }
+    }
+    
     ResponseWriter writer = context.getResponseWriter();
 
     String docType = getDocType(context, comp, bean);