public final class ContentSecurityPolicyFilter extends java.lang.Object implements Filter
Modifier and Type | Field and Description |
---|---|
private java.lang.String |
cspHeader |
private static java.util.regex.Pattern |
PATH_MATCH |
private java.lang.String |
policy |
private boolean |
reportOnly |
private static boolean |
UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED |
private static java.util.Set<java.lang.String> |
unsafeResources |
private java.lang.String |
unsafeResourcesPolicy |
Constructor and Description |
---|
ContentSecurityPolicyFilter() |
Modifier and Type | Method and Description |
---|---|
private java.lang.String |
addReportUriIfNeeded(java.lang.String policy,
FilterConfig config) |
void |
destroy() |
void |
doFilter(ServletRequest request,
ServletResponse response,
FilterChain chain) |
void |
init(FilterConfig config) |
static boolean |
isUnsafeInlineScriptsAllowed()
Checks if the current policy allows 'unsafe-inline' for the 'script-src'
attribute.
|
static void |
setSafeResources(java.lang.String jarName,
boolean safeResources)
Set a flag indicating if resources from the given extension JAR file are
should use the regular policy or the 'unsafe-resources' policy.
|
private static boolean UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED
private static final java.util.Set<java.lang.String> unsafeResources
private static final java.util.regex.Pattern PATH_MATCH
private java.lang.String policy
private java.lang.String unsafeResourcesPolicy
private boolean reportOnly
private java.lang.String cspHeader
public static boolean isUnsafeInlineScriptsAllowed()
public static void setSafeResources(java.lang.String jarName, boolean safeResources)
public void init(FilterConfig config)
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws java.io.IOException, ServletException
doFilter
in interface Filter
java.io.IOException
ServletException
private java.lang.String addReportUriIfNeeded(java.lang.String policy, FilterConfig config)