Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default X-Xss-Protection header value to "0"

Browse Source 
Closes gh-9631
This commit is contained in:
Daniel Garnier-Moiroux
2022-10-06 12:00:31 +02:00
committed by Steve Riesenberg
parent dcda899c8c
commit 27059ced87
32 changed files with 123 additions and 655 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
web/src/main/java/org/springframework/security/web/header/writers/XXssProtectionHeaderWriter.java
View File

@@ -29,6 +29,7 @@ import org.springframework.util.Assert;
*
* @author Rob Winch
* @author Ankur Pathak
* @author Daniel Garnier-Moiroux
* @since 3.2
*/
public final class XXssProtectionHeaderWriter implements HeaderWriter {
@@ -41,7 +42,7 @@ public final class XXssProtectionHeaderWriter implements HeaderWriter {
* Create a new instance
*/
public XXssProtectionHeaderWriter() {
this.headerValue = HeaderValue.ENABLED_MODE_BLOCK;
this.headerValue = HeaderValue.DISABLED;
}
@Override
@@ -51,55 +52,6 @@ public final class XXssProtectionHeaderWriter implements HeaderWriter {
}
}
/**
* If true, will contain a value of 1. For example:
*
* <pre>
* X-XSS-Protection: 1
* </pre>
*
* or if {@link #setBlock(boolean)} is true
*
*
* <pre>
* X-XSS-Protection: 1; mode=block
* </pre>
*
* If false, will explicitly disable specify that X-XSS-Protection is disabled. For
* example:
*
* <pre>
* X-XSS-Protection: 0
* </pre>
* @param enabled the new value
* @deprecated use {@link XXssProtectionHeaderWriter#setHeaderValue(HeaderValue)}
* instead
*/
@Deprecated
public void setEnabled(boolean enabled) {
if (!enabled) {
this.headerValue = HeaderValue.DISABLED;
}
else if (this.headerValue == HeaderValue.DISABLED) {
this.headerValue = HeaderValue.ENABLED;
}
}
/**
* If false, will not specify the mode as blocked. In this instance, any content will
* be attempted to be fixed. If true, the content will be replaced with "#".
* @param block the new value
* @deprecated use {@link XXssProtectionHeaderWriter#setHeaderValue(HeaderValue)}
* instead
*/
@Deprecated
public void setBlock(boolean block) {
if (this.headerValue == HeaderValue.DISABLED && block) {
throw new IllegalArgumentException("Cannot set block to true with enabled false");
}
this.headerValue = block ? HeaderValue.ENABLED_MODE_BLOCK : HeaderValue.ENABLED;
}
/**
* Sets the value of the X-XSS-PROTECTION header.
* <p>

55
web/src/main/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriter.java
View File

@@ -41,7 +41,7 @@ public class XXssProtectionServerHttpHeadersWriter implements ServerHttpHeadersW
* Creates a new instance
*/
public XXssProtectionServerHttpHeadersWriter() {
this.headerValue = HeaderValue.ENABLED_MODE_BLOCK;
this.headerValue = HeaderValue.DISABLED;
updateDelegate();
}
@@ -51,57 +51,8 @@ public class XXssProtectionServerHttpHeadersWriter implements ServerHttpHeadersW
}
/**
* If true, will contain a value of 1. For example:
*
* <pre>
* X-XSS-Protection: 1
* </pre>
*
* or if {@link #setBlock(boolean)} is true
*
*
* <pre>
* X-XSS-Protection: 1; mode=block
* </pre>
*
* If false, will explicitly disable specify that X-XSS-Protection is disabled. For
* example:
*
* <pre>
* X-XSS-Protection: 0
* </pre>
* @param enabled the new value
* @deprecated use
* {@link XXssProtectionServerHttpHeadersWriter#setHeaderValue(HeaderValue)} instead
*/
@Deprecated
public void setEnabled(boolean enabled) {
if (!enabled) {
this.headerValue = HeaderValue.DISABLED;
}
else if (this.headerValue == HeaderValue.DISABLED) {
this.headerValue = HeaderValue.ENABLED;
}
updateDelegate();
}
/**
* If false, will not specify the mode as blocked. In this instance, any content will
* be attempted to be fixed. If true, the content will be replaced with "#".
* @param block the new value
* @deprecated use
* {@link XXssProtectionServerHttpHeadersWriter#setHeaderValue(HeaderValue)} instead
*/
@Deprecated
public void setBlock(boolean block) {
Assert.isTrue(this.headerValue != HeaderValue.DISABLED || !block,
"Cannot set block to true with enabled false");
this.headerValue = block ? HeaderValue.ENABLED_MODE_BLOCK : HeaderValue.ENABLED;
updateDelegate();
}
/**
* Sets the value of the X-XSS-PROTECTION header.
* Sets the value of the X-XSS-PROTECTION header. Defaults to
* {@link HeaderValue#DISABLED}
* <p>
* If {@link HeaderValue#DISABLED}, will specify that X-XSS-Protection is disabled.
* For example: