You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by al...@apache.org on 2020/06/18 00:15:32 UTC
[nifi] branch master updated: NIFI-6094 - Added the
X-Content-Type-Options header to all web responses. (#4307)
This is an automated email from the ASF dual-hosted git repository.
alopresto pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/master by this push:
new 27b5bb7 NIFI-6094 - Added the X-Content-Type-Options header to all web responses. (#4307)
27b5bb7 is described below
commit 27b5bb7a209bdf12eb14e653d9d4c42f444018be
Author: thenatog <38...@users.noreply.github.com>
AuthorDate: Wed Jun 17 20:15:18 2020 -0400
NIFI-6094 - Added the X-Content-Type-Options header to all web responses. (#4307)
NIFI-6094 - Added the mime/content type for ttf files.
---
.../org/apache/nifi/web/server/JettyServer.java | 10 +++-
.../headers/XContentTypeOptionsFilter.java | 58 ++++++++++++++++++++++
.../security/headers/HTTPHeaderFiltersTest.java | 16 ++++++
3 files changed, 83 insertions(+), 1 deletion(-)
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/JettyServer.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/JettyServer.java
index 04df2bf..b9b9c84 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/JettyServer.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/JettyServer.java
@@ -85,6 +85,7 @@ import org.apache.nifi.web.NiFiWebConfigurationContext;
import org.apache.nifi.web.UiExtensionType;
import org.apache.nifi.web.security.headers.ContentSecurityPolicyFilter;
import org.apache.nifi.web.security.headers.StrictTransportSecurityFilter;
+import org.apache.nifi.web.security.headers.XContentTypeOptionsFilter;
import org.apache.nifi.web.security.headers.XFrameOptionsFilter;
import org.apache.nifi.web.security.headers.XSSProtectionFilter;
import org.apache.nifi.web.security.requests.ContentLengthFilter;
@@ -569,6 +570,7 @@ public class JettyServer implements NiFiServer, ExtensionUiLoader {
serverClasses.remove("org.slf4j.");
webappContext.setServerClasses(serverClasses.toArray(new String[0]));
webappContext.setDefaultsDescriptor(WEB_DEFAULTS_XML);
+ webappContext.getMimeTypes().addMimeMapping("ttf", "font/ttf");
// get the temp directory for this webapp
File tempDir = new File(props.getWebWorkingDirectory(), warFile.getName());
@@ -592,7 +594,13 @@ public class JettyServer implements NiFiServer, ExtensionUiLoader {
// add HTTP security headers to all responses
final String ALL_PATHS = "/*";
- ArrayList<Class<? extends Filter>> filters = new ArrayList<>(Arrays.asList(XFrameOptionsFilter.class, ContentSecurityPolicyFilter.class, XSSProtectionFilter.class));
+ ArrayList<Class<? extends Filter>> filters =
+ new ArrayList<>(Arrays.asList(
+ XFrameOptionsFilter.class,
+ ContentSecurityPolicyFilter.class,
+ XSSProtectionFilter.class,
+ XContentTypeOptionsFilter.class));
+
if(props.isHTTPSConfigured()) {
filters.add(StrictTransportSecurityFilter.class);
}
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/headers/XContentTypeOptionsFilter.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/headers/XContentTypeOptionsFilter.java
new file mode 100644
index 0000000..710f5ff
--- /dev/null
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/main/java/org/apache/nifi/web/security/headers/XContentTypeOptionsFilter.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.web.security.headers;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * A filter to apply the X-Content-Type-Options header.
+ *
+ */
+public class XContentTypeOptionsFilter implements Filter {
+ private static final String HEADER = "X-Content-Type-Options";
+ private static final String POLICY = "nosniff";
+
+ private static final Logger logger = LoggerFactory.getLogger(XContentTypeOptionsFilter.class);
+
+ @Override
+ public void doFilter(final ServletRequest req, final ServletResponse resp, final FilterChain filterChain)
+ throws IOException, ServletException {
+
+ final HttpServletResponse response = (HttpServletResponse) resp;
+ response.setHeader(HEADER, POLICY);
+
+ filterChain.doFilter(req, resp);
+ }
+
+ @Override
+ public void init(final FilterConfig config) {
+ }
+
+ @Override
+ public void destroy() {
+ }
+}
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/headers/HTTPHeaderFiltersTest.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/headers/HTTPHeaderFiltersTest.java
index 05a1231..4f5bd15 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/headers/HTTPHeaderFiltersTest.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/src/test/java/org/apache/nifi/web/security/headers/HTTPHeaderFiltersTest.java
@@ -133,5 +133,21 @@ public class HTTPHeaderFiltersTest {
assertEquals("1; mode=block", mockResponse.getHeader("X-XSS-Protection"));
}
+ @Test
+ public void testXContentTypeOptionsHeaderApplied() throws Exception {
+ // Arrange
+ FilterHolder xssFilter = new FilterHolder(new XContentTypeOptionsFilter());
+ HttpServletRequest mockRequest = Mockito.mock(HttpServletRequest.class);
+ MockHttpServletResponse mockResponse = new MockHttpServletResponse();
+ FilterChain mockFilterChain = Mockito.mock(FilterChain.class);
+
+ // Action
+ xssFilter.start();
+ xssFilter.initialize();
+ xssFilter.getFilter().doFilter(mockRequest, mockResponse, mockFilterChain);
+
+ // Verify
+ assertEquals("nosniff", mockResponse.getHeader("X-Content-Type-Options"));
+ }
}
\ No newline at end of file