You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by lo...@apache.org on 2014/05/16 16:21:08 UTC
svn commit: r1595204 - in /myfaces/tobago/trunk:
tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/
tobago-core/src/main/java/org/apache/myfaces/tobago/config/
tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/
tobago-core/src/ma...
Author: lofwyr
Date: Fri May 16 14:21:08 2014
New Revision: 1595204
URL: http://svn.apache.org/r1595204
Log:
TOBAGO-1395: Set Content Type Options header to nosniff
- patch applied
- doing some enhancements
Modified:
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/AjaxUtils.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/config/TobagoConfig.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/AjaxResponseRenderer.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigFragment.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigImpl.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigSorter.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/util/ResponseUtils.java
myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/servlet/ResourceServlet.java
myfaces/tobago/trunk/tobago-core/src/main/resources/org/apache/myfaces/tobago/config/tobago-config-2.0.xsd
myfaces/tobago/trunk/tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java
myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-2.0.xml
myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-untidy-2.0.xml
myfaces/tobago/trunk/tobago-theme/tobago-theme-standard/src/main/java/org/apache/myfaces/tobago/renderkit/html/standard/standard/tag/PageRenderer.java
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/AjaxUtils.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/AjaxUtils.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/AjaxUtils.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/ajax/AjaxUtils.java Fri May 16 14:21:08 2014
@@ -20,7 +20,9 @@
package org.apache.myfaces.tobago.ajax;
+import org.apache.myfaces.tobago.config.TobagoConfig;
import org.apache.myfaces.tobago.internal.ajax.AjaxInternalUtils;
+import org.apache.myfaces.tobago.internal.util.Deprecation;
import org.apache.myfaces.tobago.internal.util.ResponseUtils;
import org.apache.myfaces.tobago.util.ComponentUtils;
import org.slf4j.Logger;
@@ -120,6 +122,7 @@ public final class AjaxUtils {
* @deprecated since 2.0.0. Is no longer needed
*/
public static boolean redirect(final FacesContext facesContext, final String url) throws IOException {
+ Deprecation.LOG.warn("should not be called...");
if (!isAjaxRequest(facesContext)) {
return false;
}
@@ -128,6 +131,9 @@ public final class AjaxUtils {
final Writer writer = httpServletResponse.getWriter();
final String contentType = "application/json; charset=UTF-8";
ResponseUtils.ensureContentTypeHeader(facesContext, contentType);
+ if (TobagoConfig.getInstance(facesContext).isSetNosniffHeader()) {
+ ResponseUtils.ensureNosniffHeader(httpServletResponse);
+ }
ResponseUtils.ensureNoCacheHeader(facesContext);
redirectInternal(writer, url);
writer.close();
@@ -139,6 +145,7 @@ public final class AjaxUtils {
* @deprecated since 2.0.0. Is no longer needed
*/
private static void redirectInternal(final Writer writer, final String url) throws IOException {
+ Deprecation.LOG.warn("should not be called...");
writer.flush(); // is needed in some cases, e. g. TOBAGO-1094
writer.write("{\n \"tobagoAjaxResponse\": true,\n");
writer.write(" \"responseCode\": 302,\n");
@@ -152,6 +159,7 @@ public final class AjaxUtils {
* @deprecated since 2.0.0. Is no longer needed
*/
public static void redirect(final HttpServletResponse response, final String url) throws IOException {
+ Deprecation.LOG.warn("should not be called...");
final PrintWriter writer = response.getWriter();
final String contentType = "application/json; charset=UTF-8";
ResponseUtils.ensureContentTypeHeader(response, contentType);
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/config/TobagoConfig.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/config/TobagoConfig.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/config/TobagoConfig.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/config/TobagoConfig.java Fri May 16 14:21:08 2014
@@ -75,4 +75,6 @@ public abstract class TobagoConfig {
public abstract ContentSecurityPolicy getContentSecurityPolicy();
+ public abstract boolean isSetNosniffHeader();
+
}
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/AjaxResponseRenderer.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/AjaxResponseRenderer.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/AjaxResponseRenderer.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/ajax/AjaxResponseRenderer.java Fri May 16 14:21:08 2014
@@ -20,6 +20,7 @@
package org.apache.myfaces.tobago.internal.ajax;
import org.apache.myfaces.tobago.component.Attributes;
+import org.apache.myfaces.tobago.config.TobagoConfig;
import org.apache.myfaces.tobago.internal.util.FacesContextUtils;
import org.apache.myfaces.tobago.internal.util.ResponseUtils;
import org.apache.myfaces.tobago.internal.util.StringUtils;
@@ -123,6 +124,9 @@ public class AjaxResponseRenderer {
sb.append("; charset=");
sb.append(charset);
ResponseUtils.ensureContentTypeHeader(facesContext, sb.toString());
+ if (TobagoConfig.getInstance(facesContext).isSetNosniffHeader()) {
+ ResponseUtils.ensureNosniffHeader(facesContext);
+ }
}
private void writeResponse(final FacesContext facesContext, final RenderKit renderKit, final boolean reloadRequired)
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigFragment.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigFragment.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigFragment.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigFragment.java Fri May 16 14:21:08 2014
@@ -20,7 +20,6 @@
package org.apache.myfaces.tobago.internal.config;
import org.apache.myfaces.tobago.context.ThemeImpl;
-import org.apache.myfaces.tobago.internal.util.Deprecation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -44,6 +43,7 @@ public class TobagoConfigFragment {
private Boolean checkSessionSecret;
private Boolean preventFrameAttacks;
private ContentSecurityPolicy contentSecurityPolicy;
+ private Boolean setNosniffHeader;
private List<ThemeImpl> themeDefinitions;
private URL url;
@@ -84,12 +84,6 @@ public class TobagoConfigFragment {
return resourceDirs;
}
- /** @deprecated since 1.5.0 */
- @Deprecated
- public void setAjaxEnabled(final String value) {
- Deprecation.LOG.error("Ajax is always enabled!");
- }
-
public RenderersConfig getRenderersConfig() {
return renderersConfig;
}
@@ -162,16 +156,12 @@ public class TobagoConfigFragment {
this.contentSecurityPolicy = contentSecurityPolicy;
}
- /** @deprecated since 1.5.0 */
- @Deprecated
- public void setFixResourceOrder(final String value) {
- Deprecation.LOG.error("Config fix-resource-order not longer supported. (Is always activated).");
+ public Boolean getSetNosniffHeader() {
+ return setNosniffHeader;
}
- /** @deprecated since 1.5.0 */
- @Deprecated
- public void setFixLayoutTransparency(final String value) {
- Deprecation.LOG.error("Config fix-layout-transparency not longer supported. (Is always activated).");
+ public void setSetNosniffHeader(final Boolean setNosniffHeader) {
+ this.setNosniffHeader = setNosniffHeader;
}
public URL getUrl() {
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigImpl.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigImpl.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigImpl.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigImpl.java Fri May 16 14:21:08 2014
@@ -33,7 +33,6 @@ import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.servlet.ServletContext;
-import java.net.URL;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashSet;
@@ -59,7 +58,7 @@ public class TobagoConfigImpl extends To
private boolean checkSessionSecret;
private boolean preventFrameAttacks;
private ContentSecurityPolicy contentSecurityPolicy;
- private URL url;
+ private boolean setNosniffHeader;
private Map<String, String> defaultValidatorInfo;
public TobagoConfigImpl() {
@@ -69,6 +68,7 @@ public class TobagoConfigImpl extends To
createSessionSecret = true;
checkSessionSecret = true;
preventFrameAttacks = true;
+ setNosniffHeader = true;
contentSecurityPolicy = new ContentSecurityPolicy(ContentSecurityPolicy.Mode.OFF.getValue());
}
@@ -283,6 +283,14 @@ public class TobagoConfigImpl extends To
return contentSecurityPolicy;
}
+ public boolean isSetNosniffHeader() {
+ return setNosniffHeader;
+ }
+
+ public void setSetNosniffHeader(final boolean setNosniffHeader) {
+ this.setNosniffHeader = setNosniffHeader;
+ }
+
public Map<String, String> getDefaultValidatorInfo() {
// TODO: if the startup hasn't found a FacesContext and Application, this may depend on the order of the listeners.
@@ -313,8 +321,6 @@ public class TobagoConfigImpl extends To
builder.append(createSessionSecret);
builder.append(", \ncheckSessionSecret=");
builder.append(checkSessionSecret);
- builder.append(", \nurl=");
- builder.append(url);
// to see only different (ignore alternative names for the same theme)
builder.append(", \nthemes=");
final Set<Theme> all = new HashSet<Theme>(availableThemes.values());
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java Fri May 16 14:21:08 2014
@@ -60,6 +60,7 @@ public class TobagoConfigParser extends
private static final int CREATE_SESSION_SECRET = 413906616;
private static final int CHECK_SESSION_SECRET = 275994924;
private static final int PREVENT_FRAME_ATTACKS = 270456726;
+ private static final int SET_NOSNIFF_HEADER = -1238451304;
private static final int CONTENT_SECURITY_POLICY = 1207440139;
private static final int DIRECTIVE = -962590641;
private static final int RENDERERS = 1839650832;
@@ -210,6 +211,7 @@ public class TobagoConfigParser extends
case CREATE_SESSION_SECRET:
case CHECK_SESSION_SECRET:
case PREVENT_FRAME_ATTACKS:
+ case SET_NOSNIFF_HEADER:
case DIRECTIVE:
case THEME_DEFINITIONS:
case DISPLAY_NAME:
@@ -295,6 +297,10 @@ public class TobagoConfigParser extends
tobagoConfig.setPreventFrameAttacks(Boolean.parseBoolean(text));
break;
+ case SET_NOSNIFF_HEADER:
+ tobagoConfig.setSetNosniffHeader(Boolean.parseBoolean(text));
+ break;
+
case DIRECTIVE:
tobagoConfig.getContentSecurityPolicy().getDirectiveList().add(text);
break;
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigSorter.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigSorter.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigSorter.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigSorter.java Fri May 16 14:21:08 2014
@@ -110,6 +110,10 @@ public class TobagoConfigSorter implemen
result.getContentSecurityPolicy().merge(fragment.getContentSecurityPolicy());
}
+ if (fragment.getSetNosniffHeader() != null) {
+ result.setSetNosniffHeader(fragment.getSetNosniffHeader());
+ }
+
// theme definition
// todo
/*
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/util/ResponseUtils.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/util/ResponseUtils.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/util/ResponseUtils.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/util/ResponseUtils.java Fri May 16 14:21:08 2014
@@ -130,4 +130,16 @@ public final class ResponseUtils {
}
}
}
+
+ public static void ensureNosniffHeader(final FacesContext facesContext) {
+ final Object response = facesContext.getExternalContext().getResponse();
+ if (response instanceof HttpServletResponse) {
+ final HttpServletResponse servletResponse = (HttpServletResponse) response;
+ ensureNosniffHeader(servletResponse);
+ }
+ }
+
+ public static void ensureNosniffHeader(final HttpServletResponse servletResponse) {
+ servletResponse.setHeader("X-Content-Type-Options", "nosniff");
+ }
}
Modified: myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/servlet/ResourceServlet.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/servlet/ResourceServlet.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/servlet/ResourceServlet.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/java/org/apache/myfaces/tobago/servlet/ResourceServlet.java Fri May 16 14:21:08 2014
@@ -24,6 +24,7 @@ import org.apache.myfaces.tobago.config.
import org.apache.myfaces.tobago.context.Theme;
import org.apache.myfaces.tobago.internal.util.IoUtils;
import org.apache.myfaces.tobago.internal.util.MimeTypeUtils;
+import org.apache.myfaces.tobago.internal.util.ResponseUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -74,6 +75,7 @@ public class ResourceServlet extends Htt
private Long expires;
private int bufferSize;
private Set<String> resourceDirs = new HashSet<String>();
+ private boolean nosniffHeader;
@Override
public void init(final ServletConfig servletConfig) throws ServletException {
@@ -103,6 +105,7 @@ public class ResourceServlet extends Htt
LOG.error("Caught: " + e.getMessage(), e);
}
}
+ nosniffHeader = tobagoConfig.isSetNosniffHeader();
}
private void addResourceDir(final List<Theme> themes) {
@@ -145,6 +148,9 @@ public class ResourceServlet extends Htt
final String contentType = MimeTypeUtils.getMimeTypeForFile(requestURI);
if (contentType != null) {
response.setContentType(contentType);
+ if (nosniffHeader) {
+ ResponseUtils.ensureNosniffHeader(response);
+ }
} else {
final String message = "Unsupported mime type of resource='" + resource + "'";
LOG.warn(message + " (because of security reasons)");
Modified: myfaces/tobago/trunk/tobago-core/src/main/resources/org/apache/myfaces/tobago/config/tobago-config-2.0.xsd
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/main/resources/org/apache/myfaces/tobago/config/tobago-config-2.0.xsd?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/main/resources/org/apache/myfaces/tobago/config/tobago-config-2.0.xsd (original)
+++ myfaces/tobago/trunk/tobago-core/src/main/resources/org/apache/myfaces/tobago/config/tobago-config-2.0.xsd Fri May 16 14:21:08 2014
@@ -66,6 +66,7 @@
<xs:element name="create-session-secret" type="xs:boolean" minOccurs="0" default="true"/>
<xs:element name="check-session-secret" type="xs:boolean" minOccurs="0" default="true"/>
<xs:element name="prevent-frame-attacks" type="xs:boolean" minOccurs="0" default="true"/>
+ <xs:element name="set-nosniff-header" type="xs:boolean" minOccurs="0" default="true"/>
<xs:element name="content-security-policy" type="tobago:content-security-policy-type" minOccurs="0"/>
<xs:element name="renderers" type="tobago:renderers-type" minOccurs="0"/>
<xs:element name="theme-definitions" type="tobago:theme-definitions-type" minOccurs="0"/>
Modified: myfaces/tobago/trunk/tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java (original)
+++ myfaces/tobago/trunk/tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java Fri May 16 14:21:08 2014
@@ -100,6 +100,8 @@ public class TobagoConfigParserUnitTest
Assert.assertEquals(0, theme2.getResources().getStyleList().size());
Assert.assertEquals(0, theme2.getProductionResources().getScriptList().size());
Assert.assertEquals(0, theme2.getProductionResources().getStyleList().size());
+
+ Assert.assertFalse("set-nosniff-header", fragment.getSetNosniffHeader());
}
@Test
Modified: myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-2.0.xml
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-2.0.xml?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-2.0.xml (original)
+++ myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-2.0.xml Fri May 16 14:21:08 2014
@@ -47,6 +47,7 @@
<create-session-secret>false</create-session-secret>
<check-session-secret>false</check-session-secret>
<prevent-frame-attacks>false</prevent-frame-attacks>
+ <set-nosniff-header>false</set-nosniff-header>
<content-security-policy mode="on">
<directive>default-src 'self'</directive>
Modified: myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-untidy-2.0.xml
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-untidy-2.0.xml?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-untidy-2.0.xml (original)
+++ myfaces/tobago/trunk/tobago-core/src/test/resources/tobago-config-untidy-2.0.xml Fri May 16 14:21:08 2014
@@ -84,6 +84,8 @@
<prevent-frame-attacks>
false
</prevent-frame-attacks>
+ <set-nosniff-header>
+ false </set-nosniff-header>
<content-security-policy mode="on">
<directive>
Modified: myfaces/tobago/trunk/tobago-theme/tobago-theme-standard/src/main/java/org/apache/myfaces/tobago/renderkit/html/standard/standard/tag/PageRenderer.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/trunk/tobago-theme/tobago-theme-standard/src/main/java/org/apache/myfaces/tobago/renderkit/html/standard/standard/tag/PageRenderer.java?rev=1595204&r1=1595203&r2=1595204&view=diff
==============================================================================
--- myfaces/tobago/trunk/tobago-theme/tobago-theme-standard/src/main/java/org/apache/myfaces/tobago/renderkit/html/standard/standard/tag/PageRenderer.java (original)
+++ myfaces/tobago/trunk/tobago-theme/tobago-theme-standard/src/main/java/org/apache/myfaces/tobago/renderkit/html/standard/standard/tag/PageRenderer.java Fri May 16 14:21:08 2014
@@ -175,6 +175,9 @@ public class PageRenderer extends PageRe
final String contentType = writer.getContentTypeWithCharSet();
ResponseUtils.ensureContentTypeHeader(facesContext, contentType);
+ if (tobagoConfig.isSetNosniffHeader()) {
+ ResponseUtils.ensureNosniffHeader(facesContext);
+ }
final String clientId = page.getClientId(facesContext);
final ClientProperties client = ClientProperties.getInstance(facesContext);
final ProjectStage projectStage = tobagoConfig.getProjectStage();