Skip to content

Commit aeeb576

Browse files
arturdzmarturdzm
authored
Merge pull request #20260 from arturdzm/openapi-ui-sec-headers
Add security headers filter to OpenAPI UI
2 parents a922e0c + 6c3073c commit aeeb576

File tree

14 files changed

+283
-6
lines changed

14 files changed

+283
-6
lines changed

‎dev/com.ibm.ws.microprofile.openapi.ui/bnd.bnd‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ Web-ContextPath: /openapi/ui
99

1010
IBM-Authorization-Roles: com.ibm.ws.management
1111

12+
Import-Package: \
13+
com.ibm.ws.microprofile.openapi.servlet.filter
14+
1215
Include-Resource: \
1316
WEB-INF=resources/WEB-INF, \
1417
../com.ibm.ws.openapi.ui/swagger-ui/dist;filter:=!(*.html|*.map), \

‎dev/com.ibm.ws.microprofile.openapi.ui/resources/WEB-INF/web.xml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
Copyright (c) 2017 IBM Corporation and others.
3+
Copyright (c) 2017, 2022 IBM Corporation and others.
44
All rights reserved. This program and the accompanying materials
55
are made available under the terms of the Eclipse Public License v1.0
66
which accompanies this distribution, and is available at
@@ -18,5 +18,13 @@
1818
<welcome-file-list>
1919
<welcome-file>index.html</welcome-file>
2020
</welcome-file-list>
21+
<filter>
22+
<filter-name>headers-filter</filter-name>
23+
<filter-class>com.ibm.ws.microprofile.openapi.servlet.filter.OpenAPIUIFilter</filter-class>
24+
</filter>
25+
<filter-mapping>
26+
<filter-name>headers-filter</filter-name>
27+
<url-pattern>/*</url-pattern>
28+
</filter-mapping>
2129

2230
</web-app>

‎dev/com.ibm.ws.microprofile.openapi/bnd.bnd‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ Export-Package: \
3939
com.ibm.ws.microprofile.openapi.impl.core.*,\
4040
com.ibm.ws.microprofile.openapi.impl.jaxrs2.*,\
4141
com.ibm.ws.microprofile.openapi.impl.parser.*,\
42-
com.ibm.ws.microprofile.openapi.impl.validation
42+
com.ibm.ws.microprofile.openapi.impl.validation, \
43+
com.ibm.ws.microprofile.openapi.servlet.filter
4344

4445
Include-Resource: \
4546
WEB-INF=resources/WEB-INF, \

‎dev/com.ibm.ws.microprofile.openapi/src/com/ibm/ws/microprofile/openapi/servlet/filter/OpenAPIUIFilter.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*******************************************************************************
2+
* Copyright (c) 2022 IBM Corporation and others.
3+
* All rights reserved. This program and the accompanying materials
4+
* are made available under the terms of the Eclipse Public License v1.0
5+
* which accompanies this distribution, and is available at
6+
* http://www.eclipse.org/legal/epl-v10.html
7+
*
8+
* Contributors:
9+
* IBM Corporation - initial API and implementation
10+
*******************************************************************************/
11+
/**
12+
* @version 1.0
13+
*/
14+
package com.ibm.ws.microprofile.openapi.servlet.filter;
15+
16+
import javax.servlet.Filter;
17+
import javax.servlet.FilterConfig;
18+
import javax.servlet.FilterChain;
19+
import javax.servlet.ServletException;
20+
import javax.servlet.ServletRequest;
21+
import javax.servlet.ServletResponse;
22+
import javax.servlet.http.HttpServletRequest;
23+
import javax.servlet.http.HttpServletResponse;
24+
import java.io.IOException;
25+
26+
public class OpenAPIUIFilter implements Filter {
27+
/**
28+
* Filters out specific requests and takes the appropriate action for each
29+
*
30+
* @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
31+
*/
32+
@Override
33+
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
34+
35+
if (resp instanceof HttpServletResponse) {
36+
HttpServletResponse httpServletResp = (HttpServletResponse) resp;
37+
httpServletResp.setHeader("X-Frame-Options", "DENY");
38+
httpServletResp.setHeader("X-Content-Type-Options", "nosniff");
39+
chain.doFilter(req, resp);
40+
} else {
41+
chain.doFilter(req, resp);
42+
}
43+
}
44+
45+
@Override
46+
public void destroy() {}
47+
48+
@Override
49+
public void init(FilterConfig arg0) throws ServletException {}
50+
}

‎dev/com.ibm.ws.microprofile.openapi/src/com/ibm/ws/microprofile/openapi/servlet/filter/package-info.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/*******************************************************************************
2+
* Copyright (c) 2022 IBM Corporation and others.
3+
* All rights reserved. This program and the accompanying materials
4+
* are made available under the terms of the Eclipse Public License v1.0
5+
* which accompanies this distribution, and is available at
6+
* http://www.eclipse.org/legal/epl-v10.html
7+
*
8+
* Contributors:
9+
* IBM Corporation - initial API and implementation
10+
*******************************************************************************/
11+
/**
12+
* @version 1.0
13+
*/
14+
@org.osgi.annotation.versioning.Version("1.0")
15+
@TraceOptions(traceGroup = "MPOPENAPI", messageBundle = "io.openliberty.microprofile.openapi.internal.resources.OpenAPI")
16+
package com.ibm.ws.microprofile.openapi.servlet.filter;
17+
18+
import com.ibm.websphere.ras.annotation.TraceOptions;

‎dev/com.ibm.ws.openapi.ui.private/bnd.bnd‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ Web-ContextPath: @privateOpenAPIExplorerURL
1919

2020
IBM-Authorization-Roles: com.ibm.ws.management
2121

22+
Private-Package: \
23+
com.ibm.ws.openapi.filter.*
24+
2225
Include-Resource: \
2326
WEB-INF=../com.ibm.ws.openapi.ui/resources/WEB-INF, \
2427
WEB-INF=resources/WEB-INF, \
@@ -27,4 +30,5 @@ Include-Resource: \
2730
index.html=../com.ibm.ws.openapi.ui/swagger-ui/dist/openapi.html
2831

2932
-buildpath: \
30-
com.ibm.ws.openapi.ui
33+
com.ibm.ws.openapi.ui, \
34+
com.ibm.websphere.javaee.servlet.3.1;version=latest

‎dev/com.ibm.ws.openapi.ui.private/resources/WEB-INF/web.xml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
Copyright (c) 2017 IBM Corporation and others.
3+
Copyright (c) 2017, 2022 IBM Corporation and others.
44
All rights reserved. This program and the accompanying materials
55
are made available under the terms of the Eclipse Public License v1.0
66
which accompanies this distribution, and is available at
@@ -19,6 +19,16 @@
1919
<welcome-file>index.html</welcome-file>
2020
</welcome-file-list>
2121

22+
23+
<filter>
24+
<filter-name>headers-filter</filter-name>
25+
<filter-class>com.ibm.ws.openapi.filter.OpenAPIFilter</filter-class>
26+
</filter>
27+
<filter-mapping>
28+
<filter-name>headers-filter</filter-name>
29+
<url-pattern>/*</url-pattern>
30+
</filter-mapping>
31+
2232
<!-- SERVLET SECURITY CONFIGURATION -->
2333
<!-- Everything in the PrivateOpenAPIUI should be protected. -->
2434
<security-constraint id="SecurityConstraints_PrivateOpenAPIUI">

‎dev/com.ibm.ws.openapi.ui.private/src/com/ibm/ws/openapi/filter/OpenAPIFilter.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/*******************************************************************************
2+
* Copyright (c) 2022 IBM Corporation and others.
3+
* All rights reserved. This program and the accompanying materials
4+
* are made available under the terms of the Eclipse Public License v1.0
5+
* which accompanies this distribution, and is available at
6+
* http://www.eclipse.org/legal/epl-v10.html
7+
*
8+
* Contributors:
9+
* IBM Corporation - initial API and implementation
10+
*******************************************************************************/
11+
/**
12+
* @version 1.0
13+
*/
14+
package com.ibm.ws.openapi.filter;
15+
16+
import javax.servlet.Filter;
17+
import javax.servlet.FilterConfig;
18+
import javax.servlet.FilterChain;
19+
import javax.servlet.ServletException;
20+
import javax.servlet.ServletRequest;
21+
import javax.servlet.ServletResponse;
22+
import javax.servlet.http.HttpServletRequest;
23+
import javax.servlet.http.HttpServletResponse;
24+
import java.io.IOException;
25+
26+
public class OpenAPIFilter implements Filter {
27+
/**
28+
* Filters out specific requests and takes the appropriate action for each
29+
*
30+
* @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
31+
*/
32+
@Override
33+
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
34+
if (resp instanceof HttpServletResponse) {
35+
HttpServletResponse httpServletResp = (HttpServletResponse) resp;
36+
httpServletResp.setHeader("X-Frame-Options", "DENY");
37+
httpServletResp.setHeader("X-Content-Type-Options", "nosniff");
38+
chain.doFilter(req, resp);
39+
} else {
40+
chain.doFilter(req, resp);
41+
}
42+
}
43+
44+
@Override
45+
public void destroy() {}
46+
47+
@Override
48+
public void init(FilterConfig arg0) throws ServletException {}
49+
}

‎dev/com.ibm.ws.openapi.ui/bnd.bnd‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,14 @@ Web-ContextPath: @publicOpenAPIExplorerURL
1919

2020
IBM-Authorization-Roles: com.ibm.ws.management
2121

22+
Private-Package: \
23+
com.ibm.ws.openapi.filter.*
24+
2225
Include-Resource: \
2326
WEB-INF=resources/WEB-INF, \
2427
swagger-ui/dist;filter:=!(*.html|*.map), \
2528
swagger-ui/dist/oauth2-redirect.html, \
2629
index.html=swagger-ui/dist/openapi.html
30+
31+
-buildpath: \
32+
com.ibm.websphere.javaee.servlet.3.1;version=latest

‎dev/com.ibm.ws.openapi.ui/resources/WEB-INF/web.xml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
Copyright (c) 2017 IBM Corporation and others.
3+
Copyright (c) 2017, 2022 IBM Corporation and others.
44
All rights reserved. This program and the accompanying materials
55
are made available under the terms of the Eclipse Public License v1.0
66
which accompanies this distribution, and is available at
@@ -18,5 +18,12 @@
1818
<welcome-file-list>
1919
<welcome-file>index.html</welcome-file>
2020
</welcome-file-list>
21-
21+
<filter>
22+
<filter-name>headers-filter</filter-name>
23+
<filter-class>com.ibm.ws.openapi.filter.OpenAPIFilter</filter-class>
24+
</filter>
25+
<filter-mapping>
26+
<filter-name>headers-filter</filter-name>
27+
<url-pattern>/*</url-pattern>
28+
</filter-mapping>
2229
</web-app>

0 commit comments

Comments
 (0)