Class ContentSecurityPolicyFilter

  • All Implemented Interfaces:
    Filter

    public final class ContentSecurityPolicyFilter
    extends Object
    implements Filter
    This is a filter that sets the "Content-Security-Policy" header in the http response. See http://base.thep.lu.se/ticket/1712 for more information.
    Since:
    3.3
    Author:
    Nicklas
    Last modified
    $Date$
    • Field Detail

      • UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED

        private static boolean UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED
      • unsafeResources

        private static final Set<String> unsafeResources
      • PATH_MATCH

        private static final Pattern PATH_MATCH
      • policy

        private String policy
      • unsafeResourcesPolicy

        private String unsafeResourcesPolicy
      • reportOnly

        private boolean reportOnly
      • cspHeader

        private String cspHeader
    • Constructor Detail

      • ContentSecurityPolicyFilter

        public ContentSecurityPolicyFilter()
    • Method Detail

      • isUnsafeInlineScriptsAllowed

        public static boolean isUnsafeInlineScriptsAllowed()
        Checks if the current policy allows 'unsafe-inline' for the 'script-src' attribute. If not we need to check extensions and display a warning to the admin that the extension may not work.
      • setSafeResources

        public static void setSafeResources​(String jarName,
                                            boolean safeResources)
        Set a flag indicating if resources from the given extension JAR file are should use the regular policy or the 'unsafe-resources' policy.
      • destroy

        public void destroy()
        Specified by:
        destroy in interface Filter