Introduced placeholder support for Headers tag attributes

Added the functionality to allow the disabled and defaults-disabled
attribute of <header> tag to accept a placeholder and resolve it during
parsing.

- Updated the spring-security .rnc files starting from 4.2 up to 5.2
with xsd:token type instead of boolean
- Added unit tests for headers.disabled and headers.defaults-disabled
attributes with placeholder
- Modified the HeadersBeanDefinitionParser to support resolving
placeholders
- Updated spring.schemas to point to latest spring-security-5.2.xsd

Fixes gh-6547

config/src/test/java/org/springframework/security/config/http/HttpHeadersConfigTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -45,6 +45,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
  * @author Rob Winch
  * @author Tim Ysewyn
  * @author Josh Cummings
+ * @author Rafiullah Hamedy
  */
 public class HttpHeadersConfigTests {
 
@@ -79,6 +80,45 @@ public class HttpHeadersConfigTests {
 				.andExpect(excludesDefaults());
 	}
 
+	@Test
+	public void requestWhenHeadersDisabledViaPlaceholderThenResponseExcludesAllSecureHeaders()
+			throws Exception {
+
+		System.setProperty("security.headers.disabled", "true");
+
+		this.spring.configLocations(this.xml("DisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+			.andExpect(status().isOk())
+			.andExpect(excludesDefaults());
+	}
+
+	@Test
+	public void requestWhenHeadersEnabledViaPlaceholderThenResponseIncludesAllSecureHeaders()
+			throws Exception {
+
+		System.setProperty("security.headers.disabled", "false");
+
+		this.spring.configLocations(this.xml("DisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+			.andExpect(status().isOk())
+			.andExpect(includesDefaults());
+	}
+
+	@Test
+	public void requestWhenHeadersDisabledRefMissingPlaceholderThenResponseIncludesAllSecureHeaders()
+			throws Exception {
+
+		System.clearProperty("security.headers.disabled");
+
+		this.spring.configLocations(this.xml("DisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+			.andExpect(status().isOk())
+			.andExpect(includesDefaults());
+	}
+
 	@Test
 	public void configureWhenHeadersDisabledHavingChildElementThenAutowireFails() {
 		assertThatThrownBy(() ->
@@ -139,6 +179,45 @@ public class HttpHeadersConfigTests {
 				.andExpect(excludesDefaults());
 	}
 
+	@Test
+	public void requestWhenDefaultsDisabledWithPlaceholderTrueThenExcludesAllSecureHeaders()
+			throws Exception {
+
+		System.setProperty("security.headers.defaults.disabled", "true");
+
+		this.spring.configLocations(this.xml("DefaultsDisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+				.andExpect(status().isOk())
+				.andExpect(excludesDefaults());
+	}
+
+	@Test
+	public void requestWhenDefaultsDisabledWithPlaceholderFalseThenIncludeAllSecureHeaders()
+			throws Exception {
+
+		System.setProperty("security.headers.defaults.disabled", "false");
+
+		this.spring.configLocations(this.xml("DefaultsDisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+				.andExpect(status().isOk())
+				.andExpect(includesDefaults());
+	}
+
+	@Test
+	public void requestWhenDefaultsDisabledWithPlaceholderMissingThenIncludeAllSecureHeaders()
+			throws Exception {
+
+		System.clearProperty("security.headers.defaults.disabled");
+
+		this.spring.configLocations(this.xml("DefaultsDisabledWithPlaceholder")).autowire();
+
+		this.mvc.perform(get("/").secure(true))
+				.andExpect(status().isOk())
+				.andExpect(includesDefaults());
+	}
+
 	@Test
 	public void requestWhenUsingContentTypeOptionsThenDefaultsToNoSniff()
 			throws Exception {