Release 2023-10-26

buildpack/core/nginx.py

@@ -22,6 +22,7 @@
     "Strict-Transport-Security": r"(?i)(^max-age=[0-9]*$|^max-age=[0-9]*; includeSubDomains$|^max-age=[0-9]*; preload$)",  # noqa: line-too-long
     "X-Permitted-Cross-Domain-Policies": r"(?i)(^all$|^none$|^master-only$|^by-content-type$|^by-ftp-filename$)",  # noqa: line-too-long
     "X-XSS-Protection": r"(?i)(^0$|^1$|^1; mode=block$|^1; report=https?://([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*(:\d+)?$)",  # noqa: line-too-long
+    "Origin-Trial": r"[a-zA-Z0-9:;/''\"\*_\- \.\n?=%&+]+",
 }
 
 CONFIG_FILE = "nginx/conf/nginx.conf"

tests/unit/test_custom_headers.py

@@ -170,3 +170,25 @@ def test_invalid_header_json(self):
         os.environ["HTTP_RESPONSE_HEADERS"] = "invalid"
         with self.assertRaises(ValueError):
             nginx._get_http_headers()
+
+    def test_valid_header_originTrial(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Origin-Trial": "ArmVE2nkyn2sDf+DNN9MJVBYCagx:+NCFIc7=="
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertIn(
+            ("Origin-Trial", 
+             "ArmVE2nkyn2sDf+DNN9MJVBYCagx:+NCFIc7==",
+            ),
+            header_config,
+        )
+    def test_inValid_header_originTrial(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Origin-Trial": "#####"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertEqual([], header_config)