eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-22 21:55:39 +00:00
Code Activity

bug6101: use CORS filter origins also for Content-Security-Policy (CSP) frame-ancestors

Browse Source
This commit is contained in:
Axel Uhl
2025-03-13 16:32:25 +01:00
parent 0c6498939c
commit 93b5af3e57
15 changed files with 161 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java
+5 -1
View File
@@ -21,6 +21,7 @@ import org.osgi.framework.BundleContext;
import com.sap.sse.common.Util;
import com.sap.sse.common.Util.Pair;
import com.sap.sse.common.http.HttpHeaderUtil;
import com.sap.sse.common.mail.MailException;
import com.sap.sse.replication.ReplicableWithObjectInputStream;
import com.sap.sse.security.impl.ReplicableSecurityService;
@@ -851,8 +852,11 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
* @param allowedOrigins
* the origins, including their scheme (e.g., {@code https://www.example.com}) from which REST requests
* coming from that browser origin are to be permitted; {@code null} is handled like an empty array
* @throws IllegalArgumentException
* in case any of the {@code allowedOrigins} does not fulfill the criteria of
* {@link HttpHeaderUtil#isValidOriginHeaderValue(String)}.
*/
void setCORSFilterConfigurationAllowedOrigins(String serverName, String... allowedOrigins);
void setCORSFilterConfigurationAllowedOrigins(String serverName, String... allowedOrigins) throws IllegalArgumentException;
Pair<Boolean, Set<String>> getCORSFilterConfiguration(String serverName);
}
java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
+7 -1
View File
@@ -84,6 +84,7 @@ import org.scribe.oauth.OAuthService;
import com.sap.sse.ServerInfo;
import com.sap.sse.common.Util;
import com.sap.sse.common.Util.Pair;
import com.sap.sse.common.http.HttpHeaderUtil;
import com.sap.sse.common.mail.MailException;
import com.sap.sse.concurrent.LockUtil;
import com.sap.sse.concurrent.NamedReentrantReadWriteLock;
@@ -2234,7 +2235,12 @@ implements ReplicableSecurityService, ClearStateTestSupport {
}
@Override
public void setCORSFilterConfigurationAllowedOrigins(String serverName, String... allowedOrigins) {
public void setCORSFilterConfigurationAllowedOrigins(String serverName, String... allowedOrigins) throws IllegalArgumentException {
for (final String allowedOrigin : allowedOrigins) {
if (!HttpHeaderUtil.isValidOriginHeaderValue(allowedOrigin)) {
throw new IllegalArgumentException("\""+allowedOrigin+"\" is not a valid format for a CORS origin");
}
}
apply(s->s.internalSetCORSFilterConfigurationAllowedOrigins(serverName, allowedOrigins));
}