From 0899720f168c09d037e577109d7cab665fe1fb91 Mon Sep 17 00:00:00 2001 From: vasraz Date: Tue, 4 Oct 2022 18:16:26 +0100 Subject: Fix bug 'X-Frame-Options not configured: Lack of clickjacking protection' Add new Filter (ContentSecurityPolicyHeaderFilter) Signed-off-by: Vasyl Razinkov Change-Id: Ic8151df64e4b95b3d59b44a5f74dd12210f55e87 Issue-ID: SDC-4192 --- .../src/main/webapp/WEB-INF/web.xml | 11 ++++++- .../src/main/webapp/WEB-INF/web.xml | 11 ++++++- .../recipes/ON_5_setup_configuration.rb | 5 +--- .../templates/default/configuration.yaml.erb | 3 ++ openecomp-be/lib/openecomp-common-lib/pom.xml | 11 +++++++ .../filters/ContentSecurityPolicyHeaderFilter.java | 35 ++++++++++++++++++++++ 6 files changed, 70 insertions(+), 6 deletions(-) create mode 100644 openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/filters/ContentSecurityPolicyHeaderFilter.java (limited to 'openecomp-be') diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml b/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml index 9191a35786..b51399ca54 100644 --- a/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml +++ b/openecomp-be/api/openecomp-sdc-rest-webapp/notifications-fe/src/main/webapp/WEB-INF/web.xml @@ -4,7 +4,6 @@ xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> - contextConfigLocation @@ -15,6 +14,16 @@ org.openecomp.server.listeners.OnboardingAppStartupListener + + contentSecurityPolicyHeaderFilter + org.openecomp.sdc.common.filters.ContentSecurityPolicyHeaderFilter + true + + + contentSecurityPolicyHeaderFilter + /* + + cross-origin org.eclipse.jetty.servlets.CrossOriginFilter diff --git a/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml b/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml index 3cbfb1325e..eb8bd9e93f 100644 --- a/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml +++ b/openecomp-be/api/openecomp-sdc-rest-webapp/onboarding-rest-war/src/main/webapp/WEB-INF/web.xml @@ -4,7 +4,6 @@ xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> - contextConfigLocation @@ -25,6 +24,16 @@ org.openecomp.server.listeners.OnboardingAppStartupListener + + contentSecurityPolicyHeaderFilter + org.openecomp.sdc.common.filters.ContentSecurityPolicyHeaderFilter + true + + + contentSecurityPolicyHeaderFilter + /* + + PermissionsFilter org.openecomp.sdc.itempermissions.servlet.PermissionsFilter diff --git a/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/recipes/ON_5_setup_configuration.rb b/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/recipes/ON_5_setup_configuration.rb index 1cd2ed284f..526f2dd4b4 100644 --- a/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/recipes/ON_5_setup_configuration.rb +++ b/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/recipes/ON_5_setup_configuration.rb @@ -23,12 +23,11 @@ template "onboard-be-config" do :catalog_notification_url => node['ONBOARDING_BE']['catalog_notification_url'], :catalog_be_http_port => node['BE'][:http_port], :catalog_be_ssl_port => node['BE'][:https_port], + :permittedAncestors => "#{ENV['permittedAncestors']}", :catalog_be_fqdn => node['Nodes']['BE'] }) end - - template "VnfrepoConfiguration" do path "#{ENV['JETTY_BASE']}/config/onboarding-be/config-vnfrepo.yaml" source "vnfrepo-configuration.yaml.erb" @@ -41,7 +40,6 @@ template "VnfrepoConfiguration" do }) end - template "HelmValidatorConfiguration" do path "#{ENV['JETTY_BASE']}/config/onboarding-be/config-helmvalidator.yaml" source "helmvalidator-configuration.yaml.erb" @@ -58,7 +56,6 @@ template "HelmValidatorConfiguration" do }) end - template "ExternalTestingConfiguration" do path "#{ENV['JETTY_BASE']}/config/onboarding-be/externaltesting-configuration.yaml" source "externaltesting-configuration.yaml.erb" diff --git a/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/templates/default/configuration.yaml.erb b/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/templates/default/configuration.yaml.erb index ae07857585..93e0be9467 100644 --- a/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/templates/default/configuration.yaml.erb +++ b/openecomp-be/dist/sdc-onboard-backend-docker/artifacts/chef-repo/cookbooks/sdc-onboard-backend/templates/default/configuration.yaml.erb @@ -69,3 +69,6 @@ externalCsarStore: thresholdEntries: 10000 tempPath: "/home/onap/temp/" uploadPartSize: 200000000 + +#Space separated list of permitted ancestors +permittedAncestors: <%= @permittedAncestors %> diff --git a/openecomp-be/lib/openecomp-common-lib/pom.xml b/openecomp-be/lib/openecomp-common-lib/pom.xml index 43ec9c25f6..cb41e44001 100644 --- a/openecomp-be/lib/openecomp-common-lib/pom.xml +++ b/openecomp-be/lib/openecomp-common-lib/pom.xml @@ -25,6 +25,17 @@ openecomp-sdc-datatypes-lib ${project.version} + + javax.servlet + javax.servlet-api + ${servlet-api.version} + provided + + + javax.inject + javax.inject + ${javax.inject.version} + javax.ws.rs javax.ws.rs-api diff --git a/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/filters/ContentSecurityPolicyHeaderFilter.java b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/filters/ContentSecurityPolicyHeaderFilter.java new file mode 100644 index 0000000000..f7aa6f2da0 --- /dev/null +++ b/openecomp-be/lib/openecomp-common-lib/src/main/java/org/openecomp/sdc/common/filters/ContentSecurityPolicyHeaderFilter.java @@ -0,0 +1,35 @@ +/* + * ============LICENSE_START======================================================= + * SDC + * ================================================================================ + * Copyright (C) 2022 Nordix Foundation. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.openecomp.sdc.common.filters; + +import org.openecomp.sdc.common.CommonConfigurationManager; + +public class ContentSecurityPolicyHeaderFilter extends ContentSecurityPolicyHeaderFilterAbstract { + + @Override + protected String getPermittedAncestors() { + final CommonConfigurationManager commonConfigurationManager = CommonConfigurationManager.getInstance(); + if (commonConfigurationManager != null) { + return commonConfigurationManager.getConfigValue("permittedAncestors", ""); + } + return ""; + } +} -- cgit 1.2.3-korg