Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default X-Xss-Protection header value to "0"

Browse Source 
Closes gh-9631
This commit is contained in:
Daniel Garnier-Moiroux
2022-10-06 12:00:31 +02:00
committed by Steve Riesenberg
parent dcda899c8c
commit 27059ced87
32 changed files with 123 additions and 655 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
web/src/test/java/org/springframework/security/web/header/writers/XXssProtectionHeaderWriterTests.java
View File

@@ -28,6 +28,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
/**
* @author Rob Winch
* @author Ankur Pathak
* @author Daniel Garnier-Moiroux
*
*/
public class XXssProtectionHeaderWriterTests {
@@ -49,43 +50,11 @@ public class XXssProtectionHeaderWriterTests {
@Test
public void writeHeaders() {
this.writer.writeHeaders(this.request, this.response);
assertThat(this.response.getHeaderNames()).hasSize(1);
assertThat(this.response.getHeaderValues("X-XSS-Protection")).containsOnly("1; mode=block");
}
@Test
public void writeHeadersNoBlock() {
this.writer.setBlock(false);
this.writer.writeHeaders(this.request, this.response);
assertThat(this.response.getHeaderNames()).hasSize(1);
assertThat(this.response.getHeaderValues("X-XSS-Protection")).containsOnly("1");
}
@Test
public void writeHeadersDisabled() {
this.writer.setBlock(false);
this.writer.setEnabled(false);
this.writer.writeHeaders(this.request, this.response);
assertThat(this.response.getHeaderNames()).hasSize(1);
assertThat(this.response.getHeaderValues("X-XSS-Protection")).containsOnly("0");
}
@Test
public void setEnabledFalseWithBlockTrue() {
this.writer.setEnabled(false);
this.writer.writeHeaders(this.request, this.response);
assertThat(this.response.getHeaderNames()).hasSize(1);
assertThat(this.response.getHeaderValues("X-XSS-Protection")).containsOnly("0");
}
@Test
public void setBlockTrueWithEnabledFalse() {
this.writer.setBlock(false);
this.writer.setEnabled(false);
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setBlock(true));
}
@Test
public void writeHeaderWhenNotPresent() {
String value = new String("value");

17
web/src/test/java/org/springframework/security/web/server/header/XXssProtectionServerHttpHeadersWriterTests.java
View File

@@ -46,23 +46,6 @@ public class XXssProtectionServerHttpHeadersWriterTests {
@Test
public void writeHeadersWhenNoHeadersThenWriteHeaders() {
this.writer.writeHttpHeaders(this.exchange);
assertThat(this.headers).hasSize(1);
assertThat(this.headers.get(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION))
.containsOnly("1 ; mode=block");
}
@Test
public void writeHeadersWhenBlockFalseThenWriteHeaders() {
this.writer.setBlock(false);
this.writer.writeHttpHeaders(this.exchange);
assertThat(this.headers).hasSize(1);
assertThat(this.headers.get(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION)).containsOnly("1");
}
@Test
public void writeHeadersWhenEnabledFalseThenWriteHeaders() {
this.writer.setEnabled(false);
this.writer.writeHttpHeaders(this.exchange);
assertThat(this.headers).hasSize(1);
assertThat(this.headers.get(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION)).containsOnly("0");