<filter-class>org.sonar.server.platform.web.CspFilter</filter-class>
<async-supported>true</async-supported>
</filter>
- <filter>
+ <filter>
+ <filter-name>CrossOriginFilter</filter-name>
+ <filter-class>org.sonar.server.platform.web.CrossOriginFilter</filter-class>
+ <async-supported>true</async-supported>
+ </filter>
+ <filter>
<filter-name>EndpointPathFilter</filter-name>
<filter-class>org.sonar.server.platform.web.EndpointPathFilter</filter-class>
<async-supported>true</async-supported>
<filter-name>CspFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
+ <filter-mapping>
+ <filter-name>CrossOriginFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
<filter-mapping>
<filter-name>UserSessionFilter</filter-name>
<url-pattern>/*</url-pattern>
--- /dev/null
+/*
+ * SonarQube
+ * Copyright (C) 2009-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package org.sonar.server.platform.web;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+
+public class CrossOriginFilter implements Filter {
+
+ private final Map<String, String> crossOriginHeaders = new HashMap<>();
+
+ @Override
+ public void init(FilterConfig filterConfig) throws ServletException {
+ crossOriginHeaders.put("Cross-Origin-Embedder-Policy", "require-corp");
+ crossOriginHeaders.put("Cross-Origin-Opener-Policy", "same-origin");
+ crossOriginHeaders.put("Cross-Origin-Resource-Policy", "same-origin");
+ }
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+ // Add policies to all HTTP headers
+ for (Map.Entry<String, String> entry : crossOriginHeaders.entrySet()) {
+ ((HttpServletResponse) response).setHeader(entry.getKey(), entry.getValue());
+ }
+
+ chain.doFilter(request, response);
+ }
+
+ @Override
+ public void destroy() {
+ // Not used
+ }
+
+}
--- /dev/null
+/*
+ * SonarQube
+ * Copyright (C) 2009-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+package org.sonar.server.platform.web;
+
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.junit.Before;
+import org.junit.Test;
+
+import static org.mockito.Mockito.RETURNS_MOCKS;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class CrossOriginFilterTest {
+
+ private static final String TEST_CONTEXT = "/sonarqube";
+ private final ServletContext servletContext = mock(ServletContext.class, RETURNS_MOCKS);
+ private final HttpServletResponse response = mock(HttpServletResponse.class);
+ private final FilterChain chain = mock(FilterChain.class);
+ private final CrossOriginFilter underTest = new CrossOriginFilter();
+ FilterConfig config = mock(FilterConfig.class);
+
+ @Before
+ public void setUp() throws ServletException {
+ when(servletContext.getContextPath()).thenReturn(TEST_CONTEXT);
+ }
+
+ @Test
+ public void doInit_whenCalled_shouldSetHeaders() throws Exception {
+ doInit();
+ HttpServletRequest request = newRequest("/");
+ underTest.doFilter(request, response, chain);
+ verify(response).setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+ verify(response).setHeader("Cross-Origin-Opener-Policy", "same-origin");
+ verify(response).setHeader("Cross-Origin-Resource-Policy", "same-origin");
+ verify(chain).doFilter(request, response);
+ }
+
+ private void doInit() throws ServletException {
+ underTest.init(config);
+ }
+
+ private HttpServletRequest newRequest(String path) {
+ HttpServletRequest req = mock(HttpServletRequest.class);
+ when(req.getMethod()).thenReturn("GET");
+ when(req.getRequestURI()).thenReturn(path);
+ when(req.getContextPath()).thenReturn("");
+ when(req.getServletContext()).thenReturn(this.servletContext);
+ return req;
+ }
+}
projects / sonarqube.git / commitdiff