jffwang
/
hetu-core
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add http security headers

This commit is contained in:
Yize Li 2020-09-11 15:41:34 +08:00
parent 411496c301
commit 4d0f20d962
5 changed files with 189 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
presto-client/src/main/java/io/prestosql/client/HttpSecurityHeadersConstants.java Normal file
View File

@ -0,0 +1,82 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.client;
public class HttpSecurityHeadersConstants
{
/**
* Http security header: Content-Security-Policy
*/
public static final String HTTP_SECURITY_CSP = "Content-Security-Policy";
/**
* Http security header: Content-Security-Policy
*/
public static final String HTTP_SECURITY_CSP_VALUE = "default-src 'self'";
/**
* Http security header: Referrer-Policy
*/
public static final String HTTP_SECURITY_RP = "Referrer-Policy";
/**
* Http security header: Referrer-Policy
*/
public static final String HTTP_SECURITY_RP_VALUE = "strict-origin-when-cross-origin";
/**
* Http security header: X-Content-Type-Options
*/
public static final String HTTP_SECURITY_XCTO = "X-Content-Type-Options";
/**
* Http security header: X-Content-Type-Options
*/
public static final String HTTP_SECURITY_XCTO_VALUE = "nosniff";
/**
* Http security header: X-Frame-Options
*/
public static final String HTTP_SECURITY_XFO = "X-Frame-Options";
/**
* Http security header: X-Frame-Options
*/
public static final String HTTP_SECURITY_XFO_VALUE = "deny";
/**
* Http security header: X-Permitted-Cross-Domain-Policies
*/
public static final String HTTP_SECURITY_XPCDP = "X-Permitted-Cross-Domain-Policies";
/**
* Http security header: X-Permitted-Cross-Domain-Policies
*/
public static final String HTTP_SECURITY_XPCDP_VALUE = "master-only";
/**
* Http security header: X-XSS-Protection
*/
public static final String HTTP_SECURITY_XXP = "X-XSS-Protection";
/**
* Http security header: X-XSS-Protection
*/
public static final String HTTP_SECURITY_XXP_VALUE = "1; mode=block";
private HttpSecurityHeadersConstants()
{
}
}

19
presto-client/src/main/java/io/prestosql/client/StatementClientV1.java
View File

@ -49,6 +49,18 @@ import static com.google.common.base.MoreObjects.firstNonNull;
import static com.google.common.base.Preconditions.checkState;
import static com.google.common.net.HttpHeaders.USER_AGENT;
import static io.airlift.json.JsonCodec.jsonCodec;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE;
import static java.lang.String.format;
import static java.net.HttpURLConnection.HTTP_OK;
import static java.net.HttpURLConnection.HTTP_UNAVAILABLE;
@ -177,6 +189,13 @@ class StatementClientV1
builder.addHeader(PrestoHeaders.PRESTO_CLIENT_CAPABILITIES, clientCapabilities);
// add security header
builder.addHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE);
builder.addHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE);
builder.addHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE);
builder.addHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE);
builder.addHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE);
builder.addHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE);
return builder.build();
}

19
presto-client/src/main/java/io/prestosql/client/util/HttpUtil.java
View File

@ -36,6 +36,18 @@ import java.util.Map;
import static com.google.common.base.MoreObjects.firstNonNull;
import static com.google.common.net.HttpHeaders.USER_AGENT;
import static io.airlift.json.JsonCodec.jsonCodec;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE;
import static io.prestosql.client.PrestoHeaders.PRESTO_CATALOG;
import static io.prestosql.client.PrestoHeaders.PRESTO_CLIENT_CAPABILITIES;
import static io.prestosql.client.PrestoHeaders.PRESTO_CLIENT_INFO;
@ -165,6 +177,13 @@ public class HttpUtil
builder.addHeader(PRESTO_USER, session.getUser())
.addHeader(USER_AGENT, USER_AGENT_VALUE);
builder.addHeader(ACCEPT_ENCODING_HEADER, "");
// add security header
builder.addHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE);
builder.addHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE);
builder.addHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE);
builder.addHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE);
builder.addHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE);
builder.addHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE);
return builder.url(url);
}

66
presto-main/src/main/java/io/prestosql/server/security/HttpSecurityHeaderFilter.java Normal file
View File

@ -0,0 +1,66 @@
/*
* Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.prestosql.server.security;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpFilter;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP;
import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE;
public class HttpSecurityHeaderFilter
extends HttpFilter
{
public HttpSecurityHeaderFilter()
{
}
@Override
public void init(FilterConfig filterConfig) {}
@Override
public void destroy() {}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
throws IOException, ServletException
{
HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
httpServletResponse.setHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE);
httpServletResponse.setHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE);
httpServletResponse.setHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE);
httpServletResponse.setHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE);
httpServletResponse.setHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE);
httpServletResponse.setHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE);
filterChain.doFilter(servletRequest, servletResponse);
}
}

3
presto-main/src/main/java/io/prestosql/server/security/ServerSecurityModule.java
View File

@ -45,6 +45,9 @@ public class ServerSecurityModule
binder.bind(PasswordAuthenticatorManager.class).in(Scopes.SINGLETON);
newSetBinder(binder, Filter.class, TheServlet.class).addBinding()
.to(HttpSecurityHeaderFilter.class).in(Scopes.SINGLETON);
List<AuthenticationType> authTypes = buildConfigObject(SecurityConfig.class).getAuthenticationTypes();
Multibinder<Authenticator> authBinder = newSetBinder(binder, Authenticator.class);