Cross Frame Scripting #796
Description
Originally reported on Google Code with ID 500
Description:
XRF Vulnerability in GitBlit. Adding the Request header X-Frame-Options = SAMEORIGIN
will fix this for most modern browsers. However, for protection in legacy browsers
a javascript fix is needed. The headers are easy enough to add if one is using Apache
httpd as a proxy. The javascript fix is the only extra thing needed.
Expected Output:
An implementation of Javascript frame-breaker as described at the following link:
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#Best-for-now_Legacy_Browser_Frame_Breaking_Script
Environment:
Gitblit Version 1.6.0 running on rhel 6 / tomcat 7 / apache httpd 2.2 with proxy ajp
Reported by 1988porsche944 on 2014-09-05 13:48:25