Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[1.2.x] Add content type options header #41572

Merged
merged 3 commits into from
Oct 31, 2023
Merged

[1.2.x] Add content type options header #41572

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b8c33cf
Add X-Content-Type-Options header
TharmiganK Oct 26, 2023
89f9e72
Add test cases
TharmiganK Oct 26, 2023
36ca003
Add a comment regarding the change
TharmiganK Oct 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions stdlib/http/src/main/java/org/ballerinalang/net/http/HttpConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,8 @@ public class HttpConstants {
public static final String SESSION = "Session";
public static final String HTTP_ONLY = "HttpOnly";
public static final String SECURE = "Secure";
public static final String X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options";
public static final String NO_SNIFF = "nosniff";

public static final String ALLOW_ORIGIN = "allowOrigins";
public static final String ALLOW_CREDENTIALS = "allowCredentials";
Expand Down
6 changes: 6 additions & 0 deletions stdlib/http/src/main/java/org/ballerinalang/net/http/HttpUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,7 @@
import static org.ballerinalang.net.http.HttpConstants.MUTUAL_SSL_CERTIFICATE;
import static org.ballerinalang.net.http.HttpConstants.MUTUAL_SSL_HANDSHAKE_RECORD;
import static org.ballerinalang.net.http.HttpConstants.NEVER;
import static org.ballerinalang.net.http.HttpConstants.NO_SNIFF;
import static org.ballerinalang.net.http.HttpConstants.PACKAGE;
import static org.ballerinalang.net.http.HttpConstants.PASSWORD;
import static org.ballerinalang.net.http.HttpConstants.PKCS_STORE_TYPE;
Expand All @@ -177,6 +178,7 @@
import static org.ballerinalang.net.http.HttpConstants.SSL_CONFIG_SSL_VERIFY_CLIENT;
import static org.ballerinalang.net.http.HttpConstants.SSL_PROTOCOL_VERSION;
import static org.ballerinalang.net.http.HttpConstants.TRANSPORT_MESSAGE;
import static org.ballerinalang.net.http.HttpConstants.X_CONTENT_TYPE_OPTIONS;
import static org.ballerinalang.net.http.nativeimpl.pipelining.PipeliningHandler.sendPipelinedResponse;
import static org.ballerinalang.stdlib.io.utils.IOConstants.DETAIL_RECORD_TYPE_NAME;
import static org.ballerinalang.stdlib.io.utils.IOConstants.IO_PACKAGE_ID;
Expand Down Expand Up @@ -441,6 +443,10 @@ public static HttpCarbonMessage createErrorMessage(String payload, int statusCod
if (payload != null) {
payload = lowerCaseTheFirstLetter(payload);
response.addHttpContent(new DefaultLastHttpContent(Unpooled.wrappedBuffer(payload.getBytes())));
// This header is added to block content sniffing in the old browsers where
// the response payload may contain executable scripts
// Related issue: ballerina-platform/ballerina-standard-library/issues/5088
response.setHeader(X_CONTENT_TYPE_OPTIONS, NO_SNIFF);
TharmiganK marked this conversation as resolved.
Show resolved Hide resolved
TharmiganK marked this conversation as resolved.
Show resolved Hide resolved
} else {
response.addHttpContent(new DefaultLastHttpContent());
}
Expand Down
8 changes: 8 additions & 0 deletions stdlib/http/src/test/java/org/ballerinalang/stdlib/services/basics/ServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@
import static org.ballerinalang.mime.util.MimeConstants.APPLICATION_FORM;
import static org.ballerinalang.mime.util.MimeConstants.APPLICATION_JSON;
import static org.ballerinalang.mime.util.MimeConstants.TEXT_PLAIN;
import static org.ballerinalang.net.http.HttpConstants.NO_SNIFF;
import static org.ballerinalang.net.http.HttpConstants.X_CONTENT_TYPE_OPTIONS;

/**
* Service/Resource dispatchers test class.
Expand Down Expand Up @@ -104,18 +106,24 @@ public void testServiceDispatchingWithWorker() {
public void testServiceAvailabilityCheck() {
HTTPTestRequest requestMsg = MessageUtils.generateHTTPMessage("/foo/message", "GET");
HttpCarbonMessage responseMsg = Services.invoke(TEST_ENDPOINT_1_PORT, requestMsg);
Assert.assertNotNull(responseMsg);
String responseMsgPayload = StringUtils
.getStringFromInputStream(new HttpMessageDataStreamer(responseMsg).getInputStream());
Assert.assertEquals(responseMsgPayload, "no matching service found for path : /foo/message");
String contentTypeOptions = responseMsg.getHeader(X_CONTENT_TYPE_OPTIONS);
Assert.assertEquals(contentTypeOptions, NO_SNIFF);
}

@Test(description = "Test for resource availability check")
public void testResourceAvailabilityCheck() {
HTTPTestRequest requestMsg = MessageUtils.generateHTTPMessage("/echo/bar", "GET");
HttpCarbonMessage responseMsg = Services.invoke(TEST_ENDPOINT_1_PORT, requestMsg);
Assert.assertNotNull(responseMsg);
String responseMsgPayload = StringUtils
.getStringFromInputStream(new HttpMessageDataStreamer(responseMsg).getInputStream());
Assert.assertEquals(responseMsgPayload, "no matching resource found for path : /echo/bar , method : GET");
String contentTypeOptions = responseMsg.getHeader(X_CONTENT_TYPE_OPTIONS);
Assert.assertEquals(contentTypeOptions, NO_SNIFF);
}

@Test
Expand Down
Loading