From 4393c2ea02ce8d0ea89785187eda86d4dabb3a70 Mon Sep 17 00:00:00 2001 From: Ulrich Grave Date: Wed, 27 Jul 2022 09:02:54 +0200 Subject: [PATCH] Add hash-based Content-Security-Policy for SAML pages Closes gh-11631 --- .../filter/Saml2WebSsoAuthenticationRequestFilter.java | 2 ++ .../web/authentication/logout/Saml2LogoutRequestFilter.java | 2 ++ .../Saml2RelyingPartyInitiatedLogoutSuccessHandler.java | 2 ++ .../filter/Saml2WebSsoAuthenticationRequestFilterTests.java | 4 +++- .../authentication/logout/Saml2LogoutRequestFilterTests.java | 3 +++ .../Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests.java | 5 ++++- 6 files changed, 16 insertions(+), 2 deletions(-) diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java index b2764d8bba..8d649a445d 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java @@ -146,6 +146,8 @@ public class Saml2WebSsoAuthenticationRequestFilter extends OncePerRequestFilter StringBuilder html = new StringBuilder(); html.append("\n"); html.append("\n").append(" \n"); + html.append("