public final class ContentSecurityPolicyFilter extends Object implements Filter
Modifier and Type | Field and Description |
---|---|
private String |
cspHeader |
private static Pattern |
PATH_MATCH |
private String |
policy |
private boolean |
reportOnly |
private static boolean |
UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED |
private static Set<String> |
unsafeResources |
private String |
unsafeResourcesPolicy |
Constructor and Description |
---|
ContentSecurityPolicyFilter() |
Modifier and Type | Method and Description |
---|---|
private String |
addReportUriIfNeeded(String policy,
FilterConfig config) |
void |
destroy() |
void |
doFilter(ServletRequest request,
ServletResponse response,
FilterChain chain) |
void |
init(FilterConfig config) |
static boolean |
isUnsafeInlineScriptsAllowed()
Checks if the current policy allows 'unsafe-inline' for the 'script-src'
attribute.
|
static void |
setSafeResources(String jarName,
boolean safeResources)
Set a flag indicating if resources from the given extension JAR file are
should use the regular policy or the 'unsafe-resources' policy.
|
private static boolean UNSAFE_INLINE_SCRIPTS_ARE_ALLOWED
private static final Pattern PATH_MATCH
private String policy
private String unsafeResourcesPolicy
private boolean reportOnly
private String cspHeader
public static boolean isUnsafeInlineScriptsAllowed()
public static void setSafeResources(String jarName, boolean safeResources)
public void init(FilterConfig config)
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
doFilter
in interface Filter
IOException
ServletException
private String addReportUriIfNeeded(String policy, FilterConfig config)