From f5026c058f0ba8113b8a6e9d702bb0c9305d2e9e Mon Sep 17 00:00:00 2001
From: Dennis Thompson <djthomps@informatica.com>
Date: Wed, 15 Aug 2018 08:41:59 -0700
Subject: [PATCH 1/2] Adding CSP header

---
 conf/zeppelin-site.xml.template               |  8 +++++++
 docs/setup/security/http_security_headers.md  | 24 ++++++++++++++++++-
 .../zeppelin/conf/ZeppelinConfiguration.java  |  5 ++++
 .../apache/zeppelin/server/CorsFilter.java    |  2 ++
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/conf/zeppelin-site.xml.template b/conf/zeppelin-site.xml.template
index 31f8f739696..3f7b87ce3ae 100755
--- a/conf/zeppelin-site.xml.template
+++ b/conf/zeppelin-site.xml.template
@@ -492,6 +492,14 @@
 </property>
 -->
 
+<!--
+<property>
+  <name>zeppelin.server.csp.frame</name>
+  <value>frame-ancestors 'none'</value>
+  <description>The Content-Security-Policy HTTP response header can be used to mitigate the risk of content-injection attacks and can be used in conjunction with X-Frame-Options to provide better security for browsers that don't support ALLOWED-FROM.</description>
+</property>
+-->
+
 <!--
 <property>
   <name>zeppelin.server.strict.transport</name>
diff --git a/docs/setup/security/http_security_headers.md b/docs/setup/security/http_security_headers.md
index ad4aeef2336..2a19305543a 100644
--- a/docs/setup/security/http_security_headers.md
+++ b/docs/setup/security/http_security_headers.md
@@ -87,12 +87,34 @@ The following property needs to be updated in the zeppelin-site.xml in order to
 ```
 
 
-You can choose appropriate value from below.
+You can choose from an appropriate value from below.
 
 * `DENY`
 * `SAMEORIGIN`
 * `ALLOW-FROM uri`
 
+## Setting up Content-Security-Policy Header
+
+The Content-Security-Policy HTTP response header can indicate browser to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites in a `<frame>`,`<iframe>` or `<object>`.
+
+The following property needs to be updated in the zeppelin-site.xml in order to set Content-Security-Policy header.
+
+```xml
+<property>
+  <name>zeppelin.server.csp.frame</name>
+  <value>frame-ancestors 'none'</value>
+  <description>The Content-Security-Policy HTTP response header can be used to mitigate the risk of content-injection attacks and can be used in conjunction with X-Frame-Options to provide better security for browsers that don't support ALLOWED-FROM.</description>
+</property>
+```
+
+You can choose from an appropriate value below:
+
+* `frame-ancestors 'none'`
+* `frame-ancestors 'self'`
+* `frame-ancestors 'https://example.com:8443' 'http://example.com'`
+
+Additional documentation can be found on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors).
+
 ## Setting up Server Header
 
 Security conscious organisations does not want to reveal the Application Server name and version to prevent finding this information easily by Attacker while fingerprinting the Application. The exact version number can tell an Attacker if the current Application Server is patched for or vulnerable to certain publicly known CVE associated to it.
diff --git a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
index 6392a2968b4..7a1f48045d6 100644
--- a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
+++ b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
@@ -574,6 +574,10 @@ public String getXFrameOptions() {
     return getString(ConfVars.ZEPPELIN_SERVER_XFRAME_OPTIONS);
   }
 
+  public String getCSPFrame() {
+    return getString(ConfVars.ZEPPELIN_SERVER_CSP_FRAME);
+  }
+
   public String getXxssProtection() {
     return getString(ConfVars.ZEPPELIN_SERVER_X_XSS_PROTECTION);
   }
@@ -763,6 +767,7 @@ public enum ConfVars {
     ZEPPELIN_WEBSOCKET_MAX_TEXT_MESSAGE_SIZE("zeppelin.websocket.max.text.message.size", "1024000"),
     ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED("zeppelin.server.default.dir.allowed", false),
     ZEPPELIN_SERVER_XFRAME_OPTIONS("zeppelin.server.xframe.options", "SAMEORIGIN"),
+    ZEPPELIN_SERVER_CSP_FRAME("zeppelin.server.csp.frame", "frame-ancestors 'none'"),
     ZEPPELIN_SERVER_JETTY_NAME("zeppelin.server.jetty.name", null),
     ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE("zeppelin.server.jetty.request.header.size", 8192),
     ZEPPELIN_SERVER_STRICT_TRANSPORT("zeppelin.server.strict.transport", "max-age=631138519"),
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/server/CorsFilter.java b/zeppelin-server/src/main/java/org/apache/zeppelin/server/CorsFilter.java
index efbd8c5fdf9..ea28057cc08 100644
--- a/zeppelin-server/src/main/java/org/apache/zeppelin/server/CorsFilter.java
+++ b/zeppelin-server/src/main/java/org/apache/zeppelin/server/CorsFilter.java
@@ -75,6 +75,8 @@ private void addCorsHeaders(HttpServletResponse response, String origin) {
 
     ZeppelinConfiguration zeppelinConfiguration = ZeppelinConfiguration.create();
     response.setHeader("X-FRAME-OPTIONS", zeppelinConfiguration.getXFrameOptions());
+    response.setHeader("Content-Security-Policy", zeppelinConfiguration.getCSPFrame());
+
     if (zeppelinConfiguration.useSsl()) {
       response.setHeader("Strict-Transport-Security", zeppelinConfiguration.getStrictTransport());
     }

From ebf248db94d01781998e98b00cb7897be5297ca9 Mon Sep 17 00:00:00 2001
From: Dennis Thompson <djthomps@informatica.com>
Date: Wed, 15 Aug 2018 09:45:10 -0700
Subject: [PATCH 2/2] Updating docs to use proper syntax

---
 docs/setup/security/http_security_headers.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/setup/security/http_security_headers.md b/docs/setup/security/http_security_headers.md
index 2a19305543a..a56c6805d7b 100644
--- a/docs/setup/security/http_security_headers.md
+++ b/docs/setup/security/http_security_headers.md
@@ -111,7 +111,7 @@ You can choose from an appropriate value below:
 
 * `frame-ancestors 'none'`
 * `frame-ancestors 'self'`
-* `frame-ancestors 'https://example.com:8443' 'http://example.com'`
+* `frame-ancestors https://example.com:8443 http://example.com`
 
 Additional documentation can be found on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors).