This is an automated email from the ASF dual-hosted git repository. alexoree pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit d16b446c3b2ed692f9aaca91c08c065a70ec8bed Merge: 28595bf1f 4db0b125d Author: spyhunter99 <[email protected]> AuthorDate: Thu Nov 13 13:20:06 2025 -0500 Merge pull request #428 from spyhunter99/feature/securityImprovements JSPWIKI-1230 Preconfigured tomcat configurations should disable aut… Dockerfile | 3 + .../conf => docker-files}/catalina.properties | 419 +- .../tomcat/conf => docker-files}/server.xml | 18 +- .../overlay/tomcat/conf => docker-files}/web.xml | 9474 ++++++++++---------- .../src/main/resources/META-INF/jspwiki.tld | 4 +- .../src/main/resources/ini/jspwiki.properties | 3 +- .../src/overlay/tomcat/conf/catalina.properties | 5 + .../src/overlay/tomcat/conf/server.xml | 17 +- jspwiki-portable/src/overlay/tomcat/conf/web.xml | 2 +- jspwiki-war/src/main/webapp/WEB-INF/web.xml | 5 + 10 files changed, 4995 insertions(+), 4955 deletions(-) diff --cc jspwiki-war/src/main/webapp/WEB-INF/web.xml index e7a9266e9,de3aa36bb..2d881e612 --- a/jspwiki-war/src/main/webapp/WEB-INF/web.xml +++ b/jspwiki-war/src/main/webapp/WEB-INF/web.xml @@@ -86,67 -86,10 +86,70 @@@ <url-pattern>/wiki/*</url-pattern> <url-pattern>*.jsp</url-pattern> </filter-mapping> + <!-- optional set of servlet filters which inject OWASP recommended + http response headers into all outbound responses. + most have optional init parameters that can be used to customize the output + --> + <filter> + <filter-name>COEPFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.COEPFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>COEPFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>CORPFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.CORPFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>CORPFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>ClearSiteDataFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.ClearSiteDataFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>ClearSiteDataFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>ContentTypeOptionsFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.ContentTypeOptionsFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>ContentTypeOptionsFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>CrossDomainFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.CrossDomainFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>CrossDomainFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>ReferrerPolicyFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.ReferrerPolicyFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>ReferrerPolicyFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <filter> + <filter-name>STSFilter</filter-name> + <filter-class>org.apache.wiki.http.filter.STSFilter</filter-class> + </filter> + <filter-mapping> + <filter-name>STSFilter</filter-name> + <url-pattern>/*</url-pattern> + </filter-mapping> + <session-config> + <session-timeout>10</session-timeout> + </session-config> <!-- HttpSessionListener used for managing WikiSession's. -->
