From 4d0f20d9620d2b8c01930beb600f4cab08ae9daa Mon Sep 17 00:00:00 2001 From: Yize Li Date: Fri, 11 Sep 2020 15:41:34 +0800 Subject: [PATCH] add http security headers --- .../client/HttpSecurityHeadersConstants.java | 82 +++++++++++++++++++ .../prestosql/client/StatementClientV1.java | 19 +++++ .../io/prestosql/client/util/HttpUtil.java | 19 +++++ .../security/HttpSecurityHeaderFilter.java | 66 +++++++++++++++ .../server/security/ServerSecurityModule.java | 3 + 5 files changed, 189 insertions(+) create mode 100644 presto-client/src/main/java/io/prestosql/client/HttpSecurityHeadersConstants.java create mode 100644 presto-main/src/main/java/io/prestosql/server/security/HttpSecurityHeaderFilter.java diff --git a/presto-client/src/main/java/io/prestosql/client/HttpSecurityHeadersConstants.java b/presto-client/src/main/java/io/prestosql/client/HttpSecurityHeadersConstants.java new file mode 100644 index 000000000..3084d1254 --- /dev/null +++ b/presto-client/src/main/java/io/prestosql/client/HttpSecurityHeadersConstants.java @@ -0,0 +1,82 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.client; + +public class HttpSecurityHeadersConstants +{ + /** + * Http security header: Content-Security-Policy + */ + public static final String HTTP_SECURITY_CSP = "Content-Security-Policy"; + + /** + * Http security header: Content-Security-Policy + */ + public static final String HTTP_SECURITY_CSP_VALUE = "default-src 'self'"; + + /** + * Http security header: Referrer-Policy + */ + public static final String HTTP_SECURITY_RP = "Referrer-Policy"; + + /** + * Http security header: Referrer-Policy + */ + public static final String HTTP_SECURITY_RP_VALUE = "strict-origin-when-cross-origin"; + + /** + * Http security header: X-Content-Type-Options + */ + public static final String HTTP_SECURITY_XCTO = "X-Content-Type-Options"; + + /** + * Http security header: X-Content-Type-Options + */ + public static final String HTTP_SECURITY_XCTO_VALUE = "nosniff"; + + /** + * Http security header: X-Frame-Options + */ + public static final String HTTP_SECURITY_XFO = "X-Frame-Options"; + + /** + * Http security header: X-Frame-Options + */ + public static final String HTTP_SECURITY_XFO_VALUE = "deny"; + + /** + * Http security header: X-Permitted-Cross-Domain-Policies + */ + public static final String HTTP_SECURITY_XPCDP = "X-Permitted-Cross-Domain-Policies"; + + /** + * Http security header: X-Permitted-Cross-Domain-Policies + */ + public static final String HTTP_SECURITY_XPCDP_VALUE = "master-only"; + + /** + * Http security header: X-XSS-Protection + */ + public static final String HTTP_SECURITY_XXP = "X-XSS-Protection"; + + /** + * Http security header: X-XSS-Protection + */ + public static final String HTTP_SECURITY_XXP_VALUE = "1; mode=block"; + + private HttpSecurityHeadersConstants() + { + } +} diff --git a/presto-client/src/main/java/io/prestosql/client/StatementClientV1.java b/presto-client/src/main/java/io/prestosql/client/StatementClientV1.java index c42c1cda7..dd24a5745 100644 --- a/presto-client/src/main/java/io/prestosql/client/StatementClientV1.java +++ b/presto-client/src/main/java/io/prestosql/client/StatementClientV1.java @@ -49,6 +49,18 @@ import static com.google.common.base.MoreObjects.firstNonNull; import static com.google.common.base.Preconditions.checkState; import static com.google.common.net.HttpHeaders.USER_AGENT; import static io.airlift.json.JsonCodec.jsonCodec; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE; import static java.lang.String.format; import static java.net.HttpURLConnection.HTTP_OK; import static java.net.HttpURLConnection.HTTP_UNAVAILABLE; @@ -177,6 +189,13 @@ class StatementClientV1 builder.addHeader(PrestoHeaders.PRESTO_CLIENT_CAPABILITIES, clientCapabilities); + // add security header + builder.addHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE); + builder.addHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE); + builder.addHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE); + builder.addHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE); + builder.addHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE); + builder.addHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE); return builder.build(); } diff --git a/presto-client/src/main/java/io/prestosql/client/util/HttpUtil.java b/presto-client/src/main/java/io/prestosql/client/util/HttpUtil.java index 9b24e9c0a..662b696b9 100644 --- a/presto-client/src/main/java/io/prestosql/client/util/HttpUtil.java +++ b/presto-client/src/main/java/io/prestosql/client/util/HttpUtil.java @@ -36,6 +36,18 @@ import java.util.Map; import static com.google.common.base.MoreObjects.firstNonNull; import static com.google.common.net.HttpHeaders.USER_AGENT; import static io.airlift.json.JsonCodec.jsonCodec; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE; import static io.prestosql.client.PrestoHeaders.PRESTO_CATALOG; import static io.prestosql.client.PrestoHeaders.PRESTO_CLIENT_CAPABILITIES; import static io.prestosql.client.PrestoHeaders.PRESTO_CLIENT_INFO; @@ -165,6 +177,13 @@ public class HttpUtil builder.addHeader(PRESTO_USER, session.getUser()) .addHeader(USER_AGENT, USER_AGENT_VALUE); builder.addHeader(ACCEPT_ENCODING_HEADER, ""); + // add security header + builder.addHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE); + builder.addHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE); + builder.addHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE); + builder.addHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE); + builder.addHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE); + builder.addHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE); return builder.url(url); } diff --git a/presto-main/src/main/java/io/prestosql/server/security/HttpSecurityHeaderFilter.java b/presto-main/src/main/java/io/prestosql/server/security/HttpSecurityHeaderFilter.java new file mode 100644 index 000000000..deaacab07 --- /dev/null +++ b/presto-main/src/main/java/io/prestosql/server/security/HttpSecurityHeaderFilter.java @@ -0,0 +1,66 @@ +/* + * Copyright (C) 2018-2020. Huawei Technologies Co., Ltd. All rights reserved. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package io.prestosql.server.security; + +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpFilter; +import javax.servlet.http.HttpServletResponse; + +import java.io.IOException; + +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_CSP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_RP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XCTO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XFO_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XPCDP_VALUE; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP; +import static io.prestosql.client.HttpSecurityHeadersConstants.HTTP_SECURITY_XXP_VALUE; + +public class HttpSecurityHeaderFilter + extends HttpFilter +{ + public HttpSecurityHeaderFilter() + { + } + + @Override + public void init(FilterConfig filterConfig) {} + + @Override + public void destroy() {} + + @Override + public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) + throws IOException, ServletException + { + HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; + httpServletResponse.setHeader(HTTP_SECURITY_CSP, HTTP_SECURITY_CSP_VALUE); + httpServletResponse.setHeader(HTTP_SECURITY_RP, HTTP_SECURITY_RP_VALUE); + httpServletResponse.setHeader(HTTP_SECURITY_XCTO, HTTP_SECURITY_XCTO_VALUE); + httpServletResponse.setHeader(HTTP_SECURITY_XFO, HTTP_SECURITY_XFO_VALUE); + httpServletResponse.setHeader(HTTP_SECURITY_XPCDP, HTTP_SECURITY_XPCDP_VALUE); + httpServletResponse.setHeader(HTTP_SECURITY_XXP, HTTP_SECURITY_XXP_VALUE); + filterChain.doFilter(servletRequest, servletResponse); + } +} diff --git a/presto-main/src/main/java/io/prestosql/server/security/ServerSecurityModule.java b/presto-main/src/main/java/io/prestosql/server/security/ServerSecurityModule.java index 27943ce46..580031539 100644 --- a/presto-main/src/main/java/io/prestosql/server/security/ServerSecurityModule.java +++ b/presto-main/src/main/java/io/prestosql/server/security/ServerSecurityModule.java @@ -45,6 +45,9 @@ public class ServerSecurityModule binder.bind(PasswordAuthenticatorManager.class).in(Scopes.SINGLETON); + newSetBinder(binder, Filter.class, TheServlet.class).addBinding() + .to(HttpSecurityHeaderFilter.class).in(Scopes.SINGLETON); + List authTypes = buildConfigObject(SecurityConfig.class).getAuthenticationTypes(); Multibinder authBinder = newSetBinder(binder, Authenticator.class);