Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2026-02-05 22:29:11 +01:00
Code Issues Packages Projects Releases Activity

Fix cypress by using new stage "TESTING"

Browse Source 
Cypress did not work because of the stricter security header. We introduced a new stage named "TESTING" which ignores this security headers and allow testing tools to work as intended.

Committed-by: Konstantin Schaper <konstantin.schaper@cloudogu.com>
This commit is contained in:
Eduard Heimbuch
2023-09-08 15:19:54 +02:00
parent 8352cf349c
commit 93a23466ff
5 changed files with 65 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
scm-webapp/src/main/java/sonia/scm/filter/SecurityHeadersFilter.java
View File

@@ -25,8 +25,11 @@
package sonia.scm.filter;
import sonia.scm.Priority;
import sonia.scm.SCMContextProvider;
import sonia.scm.Stage;
import sonia.scm.web.filter.HttpFilter;
import javax.inject.Inject;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
@@ -36,47 +39,57 @@ import java.io.IOException;
@Priority(7000)
@WebElement("*")
public class SecurityHeadersFilter extends HttpFilter {
private final SCMContextProvider contextProvider;
@Inject
public SecurityHeadersFilter(SCMContextProvider contextProvider) {
this.contextProvider = contextProvider;
}
@Override
protected void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
response.setHeader("X-Frame-Options", "deny");
response.setHeader("X-Content-Type-Options", "nosniff");
response.setHeader("Content-Security-Policy",
if (contextProvider.getStage() != Stage.TESTING) {
response.setHeader("X-Frame-Options", "deny");
response.setHeader("X-Content-Type-Options", "nosniff");
response.setHeader("Content-Security-Policy",
"form-action 'self'; " +
"object-src 'none'; " +
"frame-ancestors 'none'; " +
"block-all-mixed-content"
);
response.setHeader("Permissions-Policy",
"accelerometer=()," +
"ambient-light-sensor=()," +
"autoplay=()," +
"battery=()," +
"camera=()," +
"display-capture=()," +
"document-domain=()," +
"encrypted-media=()," +
"fullscreen=()," +
"gamepad=()," +
"geolocation=()," +
"gyroscope=()," +
"layout-animations=(self)," +
"legacy-image-formats=(self)," +
"magnetometer=()," +
"microphone=()," +
"midi=()," +
"oversized-images=(self)," +
"payment=()," +
"picture-in-picture=()," +
"publickey-credentials-get=()," +
"speaker-selection=()," +
"sync-xhr=(self)," +
"unoptimized-images=(self)," +
"unsized-media=(self)," +
"usb=()," +
"screen-wake-lock=()," +
"web-share=()," +
"xr-spatial-tracking=()"
);
"object-src 'none'; " +
"frame-ancestors 'none'; " +
"block-all-mixed-content"
);
response.setHeader("Permissions-Policy",
"accelerometer=()," +
"ambient-light-sensor=()," +
"autoplay=()," +
"battery=()," +
"camera=()," +
"display-capture=()," +
"document-domain=()," +
"encrypted-media=()," +
"fullscreen=()," +
"gamepad=()," +
"geolocation=()," +
"gyroscope=()," +
"layout-animations=(self)," +
"legacy-image-formats=(self)," +
"magnetometer=()," +
"microphone=()," +
"midi=()," +
"oversized-images=(self)," +
"payment=()," +
"picture-in-picture=()," +
"publickey-credentials-get=()," +
"speaker-selection=()," +
"sync-xhr=(self)," +
"unoptimized-images=(self)," +
"unsized-media=(self)," +
"usb=()," +
"screen-wake-lock=()," +
"web-share=()," +
"xr-spatial-tracking=()"
);
}
chain.doFilter(request, response);
}
}