com.atlassian.jira.web.filters.steps.security.csp

Class DynamicContentSecurityPolicyResponseWrapper

java.lang.Object

javax.servlet.ServletResponseWrapper

javax.servlet.http.HttpServletResponseWrapper

com.atlassian.jira.web.filters.steps.security.csp.DynamicContentSecurityPolicyResponseWrapper

All Implemented Interfaces:

javax.servlet.http.HttpServletResponse, javax.servlet.ServletResponse

public class DynamicContentSecurityPolicyResponseWrapper
extends javax.servlet.http.HttpServletResponseWrapper

This functionality is contained in new ResponseWrapper because it is not possible to achieve such behaviour in JiraFilters themselves. It cannot be placed in "downward" filters path, because Content-Type and Content-Disposition headers are not set yet. It is also not possible on "upward" path of filters the response is already being sent and headers cannot be modified anymore. Thus this wrapper reacts right at the moment of setting the headers instead, before they are flushed. By default 'Content-Security-Policy: sandbox' is applied to all responses which are not html, js with one exception - if html or js files are served with 'Content-Disposition: attachment' they are also sandboxed. To fix issues with audio/video attachments playback CSP header value varies depending on User-Agent and request's servlet path. On Chrome and Safari when /secure/attachment or /secure/temporaryattachment is requested sandbox clause is modified, so that files play without issues - https://jira.atlassian.com/browse/JRASERVER-72275.

Field Summary

Fields inherited from interface javax.servlet.http.HttpServletResponse

SC_ACCEPTED, SC_BAD_GATEWAY, SC_BAD_REQUEST, SC_CONFLICT, SC_CONTINUE, SC_CREATED, SC_EXPECTATION_FAILED, SC_FORBIDDEN, SC_FOUND, SC_GATEWAY_TIMEOUT, SC_GONE, SC_HTTP_VERSION_NOT_SUPPORTED, SC_INTERNAL_SERVER_ERROR, SC_LENGTH_REQUIRED, SC_METHOD_NOT_ALLOWED, SC_MOVED_PERMANENTLY, SC_MOVED_TEMPORARILY, SC_MULTIPLE_CHOICES, SC_NO_CONTENT, SC_NON_AUTHORITATIVE_INFORMATION, SC_NOT_ACCEPTABLE, SC_NOT_FOUND, SC_NOT_IMPLEMENTED, SC_NOT_MODIFIED, SC_OK, SC_PARTIAL_CONTENT, SC_PAYMENT_REQUIRED, SC_PRECONDITION_FAILED, SC_PROXY_AUTHENTICATION_REQUIRED, SC_REQUEST_ENTITY_TOO_LARGE, SC_REQUEST_TIMEOUT, SC_REQUEST_URI_TOO_LONG, SC_REQUESTED_RANGE_NOT_SATISFIABLE, SC_RESET_CONTENT, SC_SEE_OTHER, SC_SERVICE_UNAVAILABLE, SC_SWITCHING_PROTOCOLS, SC_TEMPORARY_REDIRECT, SC_UNAUTHORIZED, SC_UNSUPPORTED_MEDIA_TYPE, SC_USE_PROXY

Method Summary

Modifier and Type	Method and Description
void	addHeader(String name, String value)
void	setContentType(String type)
void	setHeader(String name, String value)

Methods inherited from class javax.servlet.http.HttpServletResponseWrapper

addCookie, addDateHeader, addIntHeader, containsHeader, encodeRedirectUrl, encodeRedirectURL, encodeUrl, encodeURL, getHeader, getHeaderNames, getHeaders, getStatus, getTrailerFields, sendError, sendError, sendRedirect, setDateHeader, setIntHeader, setStatus, setStatus, setTrailerFields

Methods inherited from class javax.servlet.ServletResponseWrapper

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getResponse, getWriter, isCommitted, isWrapperFor, isWrapperFor, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentLengthLong, setLocale, setResponse

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface javax.servlet.ServletResponse

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getWriter, isCommitted, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentLengthLong, setLocale

Method Detail

setContentType

public void setContentType(String type)

Specified by:

setContentType in interface javax.servlet.ServletResponse

Overrides:

setContentType in class javax.servlet.ServletResponseWrapper

setHeader

public void setHeader(String name,
                      String value)

Specified by:

setHeader in interface javax.servlet.http.HttpServletResponse

Overrides:

setHeader in class javax.servlet.http.HttpServletResponseWrapper

addHeader

public void addHeader(String name,
                      String value)

Specified by:

addHeader in interface javax.servlet.http.HttpServletResponse

Overrides:

addHeader in class javax.servlet.http.HttpServletResponseWrapper