Skip to content
Permalink
Browse files
Merge pull request #1391 from daniel-beck/JENKINS-21881
[FIXED JENKINS-21881] System property for disabling X-Frame-Options
  • Loading branch information
daniel-beck committed Sep 13, 2014
2 parents 598aea4 + 3b5564a commit 852ba85c961499be716012e76ecbb1104a64091a
@@ -0,0 +1,17 @@
package jenkins.security;

import hudson.Extension;
import hudson.model.PageDecorator;
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.NoExternalUse;

/**
* Adds the 'X-Frame-Options' header to all web pages.
*
* @since TODO
*/
@Extension(ordinal = 1000)
public class FrameOptionsPageDecorator extends PageDecorator {
@Restricted(NoExternalUse.class)
public static boolean enabled = Boolean.valueOf(System.getProperty(FrameOptionsPageDecorator.class.getName() + ".enabled", "true"));
}
@@ -0,0 +1,6 @@
<?jelly escape-by-default='true'?>
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler">
<j:if test="${it.enabled}">
<st:header name="X-Frame-Options" value="sameorigin"/>
</j:if>
</j:jelly>
@@ -56,7 +56,6 @@ THE SOFTWARE.
<st:setHeader name="Expires" value="0" />
<st:setHeader name="Cache-Control" value="no-cache,no-store,must-revalidate" />
<st:setHeader name="X-Hudson-Theme" value="default" />
<st:setHeader name="X-Frame-Options" value="sameorigin" />
<st:contentType value="text/html;charset=UTF-8" />

<j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
@@ -0,0 +1,41 @@
package jenkins.security;

import com.gargoylesoftware.htmlunit.WebResponse;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import org.apache.commons.httpclient.NameValuePair;
import org.junit.Assert;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.JenkinsRule;
import org.xml.sax.SAXException;

import java.io.IOException;

public class FrameOptionsPageDecoratorTest {
@Rule
public JenkinsRule j = new JenkinsRule();

@Test
public void defaultHeaderPresent() throws IOException, SAXException {
JenkinsRule.WebClient wc = j.createWebClient();
HtmlPage page = wc.goTo("");
Assert.assertEquals("Expected different X-Frame-Options value", getFrameOptionsFromResponse(page.getWebResponse()), "sameorigin");
}

@Test
public void testDisabledFrameOptions() throws IOException, SAXException {
FrameOptionsPageDecorator.enabled = false;
JenkinsRule.WebClient wc = j.createWebClient();
HtmlPage page = wc.goTo("");
Assert.assertNull("Expected X-Frame-Options unset", getFrameOptionsFromResponse(page.getWebResponse()));
}

private static String getFrameOptionsFromResponse(WebResponse response) {
for (NameValuePair pair : response.getResponseHeaders()) {
if (pair.getName().equals("X-Frame-Options")) {
return pair.getValue();
}
}
return null;
}
}

0 comments on commit 852ba85

Please sign in to comment.