Added a filter for framable resources. - #12779
Conversation
offtherailz
left a comment
offtherailz
left a comment
There was a problem hiding this comment.
Apply the same suggested in the main web.xml to the template one of course.
|
|
||
| <filter> | ||
| <filter-name>viewFramingFilter</filter-name> | ||
| <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> |
There was a problem hiding this comment.
This is a tomcat only filter. "org.apache.catalina.filters."
Not sure it should be used ... We are using only tomcat right now. So not sure if we can skip, maybe is not blocking
| </filter-mapping> | ||
| <filter-mapping> | ||
| <filter-name>viewFramingFilter</filter-name> | ||
| <url-pattern>/configs/*</url-pattern> |
There was a problem hiding this comment.
What does this really covers? JSON are not "embeddable". I think it will never be applied so it doesn't protect from any issues. I think this was a false interception of something, by AI
| <filter-name>viewFramingFilter</filter-name> | ||
| <!-- FORWARD is required: / is resolved to index.html through an internal forward --> | ||
| <url-pattern>/</url-pattern> | ||
| <dispatcher>REQUEST</dispatcher> | ||
| <dispatcher>FORWARD</dispatcher> | ||
| </filter-mapping> |
There was a problem hiding this comment.
This mapping never matches: the filter is applied to / by the /index.html mapping below, not by this one, and the FORWARD dispatcher is not involved either.
3 participants
Description
Not all the resources exposed from MapStore should be framable, so this filter limits framing to same-origin requests where appropriate.
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (check one with "x", remove the others)
Issue
What is the current behavior?
#
What is the new behavior?
Breaking change
Does this PR introduce a breaking change? (check one with "x", remove the other)
Other useful information