首页 发现 帮助
注册 登录
github
/
spring-security
镜像自地址 https://github.com/spring-projects/spring-security
2
0
派生 0
文件 工单管理 0 Wiki
浏览代码

Add hash-based Content-Security-Policy for SAML pages

Closes gh-11631
Ulrich Grave 3 年之前
父节点
f86d30f4a1
当前提交
4393c2ea02
共有 6 个文件被更改，包括 16 次插入 和 2 次删除
分列视图 显示文件统计
  1. 2 0
      saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java
  2. 2 0
      saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java
  3. 2 0
      saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandler.java
  4. 3 1
      saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilterTests.java
  5. 3 0
      saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilterTests.java
  6. 4 1
      saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests.java

+ 2 - 0
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java
查看文件 

@@ -146,6 +146,8 @@ public class Saml2WebSsoAuthenticationRequestFilter extends OncePerRequestFilter
 
 		StringBuilder html = new StringBuilder();
 
 		html.append("<!DOCTYPE html>\n");
 
 		html.append("<html>\n").append("    <head>\n");
 
+		html.append("        <meta http-equiv=\"Content-Security-Policy\" ")
 
+				.append("content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">\n");
 
 		html.append("        <meta charset=\"utf-8\" />\n");
 
 		html.append("    </head>\n");
 
 		html.append("    <body onload=\"document.forms[0].submit()\">\n");

+ 2 - 0
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java
查看文件 

@@ -199,6 +199,8 @@ public final class Saml2LogoutRequestFilter extends OncePerRequestFilter {
 
 		StringBuilder html = new StringBuilder();
 
 		html.append("<!DOCTYPE html>\n");
 
 		html.append("<html>\n").append("    <head>\n");
 
+		html.append("        <meta http-equiv=\"Content-Security-Policy\" ")
 
+				.append("content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">\n");
 
 		html.append("        <meta charset=\"utf-8\" />\n");
 
 		html.append("    </head>\n");
 
 		html.append("    <body onload=\"document.forms[0].submit()\">\n");

+ 2 - 0
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandler.java
查看文件 

@@ -118,6 +118,8 @@ public final class Saml2RelyingPartyInitiatedLogoutSuccessHandler implements Log
 
 		StringBuilder html = new StringBuilder();
 
 		html.append("<!DOCTYPE html>\n");
 
 		html.append("<html>\n").append("    <head>\n");
 
+		html.append("        <meta http-equiv=\"Content-Security-Policy\" ")
 
+				.append("content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">\n");
 
 		html.append("        <meta charset=\"utf-8\" />\n");
 
 		html.append("    </head>\n");
 
 		html.append("    <body onload=\"document.forms[0].submit()\">\n");

+ 3 - 1
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilterTests.java
查看文件 

@@ -170,7 +170,9 @@ public class Saml2WebSsoAuthenticationRequestFilterTests {
 
 		given(this.authenticationRequestResolver.resolve(any())).willReturn(request);
 
 		this.filter.doFilterInternal(this.request, this.response, this.filterChain);
 
 		assertThat(this.response.getHeader("Location")).isNull();
 
-		assertThat(this.response.getContentAsString())
 
+		assertThat(this.response.getContentAsString()).contains(
 
+				"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">")
 
+				.contains("<body onload=\"document.forms[0].submit()\">")
 
 				.contains("<form action=\"https://sso-url.example.com/IDP/SSO\" method=\"post\">")
 
 				.contains("<input type=\"hidden\" name=\"SAMLRequest\"")
 
 				.contains("value=\"" + relayStateEncoded + "\"");

+ 3 - 0
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilterTests.java
查看文件 

@@ -111,6 +111,9 @@ public class Saml2LogoutRequestFilterTests {
 
 		String content = response.getContentAsString();
 
 		assertThat(content).contains(Saml2ParameterNames.SAML_RESPONSE);
 
 		assertThat(content).contains(registration.getAssertingPartyDetails().getSingleLogoutServiceResponseLocation());
 
+		assertThat(content).contains(
 
+				"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">");
 
+		assertThat(content).contains("<body onload=\"document.forms[0].submit()\">");
 
 	}
 
 
 	@Test

+ 4 - 1
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests.java
查看文件 

@@ -1,5 +1,5 @@
 
 /*
 
- * Copyright 2002-2021 the original author or authors.
 
+ * Copyright 2002-2022 the original author or authors.
 
  *
 
  * Licensed under the Apache License, Version 2.0 (the "License");
 
  * you may not use this file except in compliance with the License.
 
@@ -97,6 +97,9 @@ public class Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests {
 
 		String content = response.getContentAsString();
 
 		assertThat(content).contains(Saml2ParameterNames.SAML_REQUEST);
 
 		assertThat(content).contains(registration.getAssertingPartyDetails().getSingleLogoutServiceLocation());
 
+		assertThat(content).contains(
 
+				"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE='\">");
 
+		assertThat(content).contains("<body onload=\"document.forms[0].submit()\">");
 
 	}
 
 
 	private Saml2Authentication authentication(RelyingPartyRegistration registration) {