apache /
kudu /
43ee785b2d793fe9abaae91ad152c50813e9aa59 [www] Add CSP header to web UI
CSP (Content Security Policy) headers provide a way to tell the browser
where assets can be loaded from to prevent XSS attacks. Kudu's web UI is
read-only, at least for now, so it's not susceptible for XSS attacks,
but some security scanners still flag it as vulnerable due to not having
this header.
This patch adds a CSP header that allows loading assets on the same
host, and some inline styles and images in jQuery. It also removes all
inline style definitions from first-party files and moves them to
kudu.css.
There's no good way to write a unit test for this, as it requires a
GUI browser (curl doesn't load external resources and doesn't use
JavaScript), but I tested it manually both through HTTP and HTTPS and
confirmed there are no related errors in the JS console.
Change-Id: I411d8f4ca079bfd5584f563aeeaa867833eb1106
Reviewed-on: http://gerrit.cloudera.org:8080/18285
Tested-by: Kudu Jenkins
Reviewed-by: Alexey Serbin <alexey@apache.org>
4 files changed
