Return-Path: X-Original-To: apmail-hadoop-common-commits-archive@www.apache.org Delivered-To: apmail-hadoop-common-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id E75F6191BB for ; Tue, 12 Apr 2016 21:41:05 +0000 (UTC) Received: (qmail 22404 invoked by uid 500); 12 Apr 2016 21:41:05 -0000 Delivered-To: apmail-hadoop-common-commits-archive@hadoop.apache.org Received: (qmail 22329 invoked by uid 500); 12 Apr 2016 21:41:05 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-dev@hadoop.apache.org Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 22320 invoked by uid 99); 12 Apr 2016 21:41:05 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 12 Apr 2016 21:41:05 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 85CD6DFB95; Tue, 12 Apr 2016 21:41:05 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: rkanter@apache.org To: common-commits@hadoop.apache.org Message-Id: X-Mailer: ASF-Git Admin Mailer Subject: hadoop git commit: HADOOP-12964. Http server vulnerable to clickjacking (haibochen via rkanter) Date: Tue, 12 Apr 2016 21:41:05 +0000 (UTC) Repository: hadoop Updated Branches: refs/heads/trunk 6ef42873a -> 042a3ae96 HADOOP-12964. Http server vulnerable to clickjacking (haibochen via rkanter) Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/042a3ae9 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/042a3ae9 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/042a3ae9 Branch: refs/heads/trunk Commit: 042a3ae960883c263adc76f16d0ea3438d8b12be Parents: 6ef4287 Author: Robert Kanter Authored: Tue Apr 12 14:40:43 2016 -0700 Committer: Robert Kanter Committed: Tue Apr 12 14:40:43 2016 -0700 ---------------------------------------------------------------------- .../org/apache/hadoop/http/HttpServer2.java | 29 ++++++++++++++++---- .../org/apache/hadoop/http/TestHttpServer.java | 10 +++++++ 2 files changed, 33 insertions(+), 6 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/042a3ae9/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java index 45417f6..8ba67dd 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java @@ -55,10 +55,7 @@ import org.apache.hadoop.conf.ConfServlet; import org.apache.hadoop.conf.Configuration; import org.apache.hadoop.fs.CommonConfigurationKeys; import org.apache.hadoop.security.AuthenticationFilterInitializer; -import org.apache.hadoop.security.authentication.util.FileSignerSecretProvider; -import org.apache.hadoop.security.authentication.util.RandomSignerSecretProvider; import org.apache.hadoop.security.authentication.util.SignerSecretProvider; -import org.apache.hadoop.security.authentication.util.ZKSignerSecretProvider; import org.apache.hadoop.security.ssl.SslSocketConnectorSecure; import org.apache.hadoop.jmx.JMXJsonServlet; import org.apache.hadoop.log.LogLevel; @@ -98,8 +95,6 @@ import com.google.common.base.Preconditions; import com.google.common.collect.Lists; import com.sun.jersey.spi.container.servlet.ServletContainer; -import static org.apache.hadoop.security.authentication.server - .AuthenticationFilter.*; /** * Create a Jetty embedded server to answer http requests. The primary goal is * to serve up status information for the server. There are three contexts: @@ -1124,9 +1119,11 @@ public final class HttpServer2 implements FilterContainer { /** * A Servlet input filter that quotes all HTML active characters in the * parameter names and values. The goal is to quote the characters to make - * all of the servlets resistant to cross-site scripting attacks. + * all of the servlets resistant to cross-site scripting attacks. It also + * sets X-FRAME-OPTIONS in the header to mitigate clickjacking attacks. */ public static class QuotingInputFilter implements Filter { + private static final XFrameOption X_FRAME_OPTION = XFrameOption.SAMEORIGIN; private FilterConfig config; public static class RequestQuoter extends HttpServletRequestWrapper { @@ -1246,6 +1243,7 @@ public final class HttpServer2 implements FilterContainer { } else if (mime.startsWith("application/xml")) { httpResponse.setContentType("text/xml; charset=utf-8"); } + httpResponse.addHeader("X-FRAME-OPTIONS", X_FRAME_OPTION.toString()); chain.doFilter(quoted, httpResponse); } @@ -1262,4 +1260,23 @@ public final class HttpServer2 implements FilterContainer { } } + + /** + * The X-FRAME-OPTIONS header in HTTP response to mitigate clickjacking + * attack. + */ + public enum XFrameOption { + DENY("DENY") , SAMEORIGIN ("SAMEORIGIN"), ALLOWFROM ("ALLOW-FROM"); + + XFrameOption(String name) { + this.name = name; + } + + private final String name; + + @Override + public String toString() { + return this.name; + } + } } http://git-wip-us.apache.org/repos/asf/hadoop/blob/042a3ae9/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java index 4d2e1bf..3ed89a8 100644 --- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java +++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServer.java @@ -235,6 +235,16 @@ public class TestHttpServer extends HttpServerFunctionalTest { assertEquals("text/html; charset=utf-8", conn.getContentType()); } + @Test + public void testHttpResonseContainsXFrameOptions() throws IOException { + URL url = new URL(baseUrl, ""); + HttpURLConnection conn = (HttpURLConnection) url.openConnection(); + conn.connect(); + + String xfoHeader = conn.getHeaderField("X-FRAME-OPTIONS"); + assertTrue("X-FRAME-OPTIONS is absent in the header", xfoHeader != null); + } + /** * Dummy filter that mimics as an authentication filter. Obtains user identity * from the request parameter user.name. Wraps around the request so that