From 409998a3fe0e93e41cb6f712a38c8fb979c7f098 Mon Sep 17 00:00:00 2001 From: Ulrich Grave Date: Wed, 27 Jul 2022 09:02:54 +0200 Subject: [PATCH] Add hash-based Content-Security-Policy for SAML pages Closes gh-11631 --- .../filter/Saml2WebSsoAuthenticationRequestFilter.java | 2 ++ .../web/authentication/logout/Saml2LogoutRequestFilter.java | 2 ++ .../Saml2RelyingPartyInitiatedLogoutSuccessHandler.java | 2 ++ .../filter/Saml2WebSsoAuthenticationRequestFilterTests.java | 4 +++- .../authentication/logout/Saml2LogoutRequestFilterTests.java | 3 +++ .../Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests.java | 5 ++++- 6 files changed, 16 insertions(+), 2 deletions(-) diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java index e6ee29a71b..044f8b7033 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java @@ -236,6 +236,8 @@ public class Saml2WebSsoAuthenticationRequestFilter extends OncePerRequestFilter StringBuilder html = new StringBuilder(); html.append("\n"); html.append("\n").append(" \n"); + html.append("