Skip to content

Commit ff38870

Browse files
labkey-adamlabkey-adam
committed
Eliminate X-Frame-Options setting
1 parent 814cdb0 commit ff38870

13 files changed

Lines changed: 0 additions & 97 deletions

File tree

‎api/src/org/labkey/api/security/AuthFilter.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ public class AuthFilter implements Filter
5555
private static final Object FIRST_REQUEST_LOCK = new Object();
5656

5757
public static final String STRICT_TRANSPORT_SECURITY_HEADER_NAME = "Strict-Transport-Security";
58-
public static final String X_FRAME_OPTIONS_HEADER_NAME = "X-Frame-Options";
5958
public static final String X_CONTENT_TYPE_OPTIONS_HEADER_NAME = "X-Content-Type-Options";
6059
public static final String REFERRER_POLICY_HEADER_NAME = "Referrer-Policy";
6160
public static final String SERVER_HEADER_NAME = "Server";
@@ -87,8 +86,6 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
8786

8887
if (ModuleLoader.getInstance().isStartupComplete())
8988
{
90-
if (!"ALLOW".equals(AppProps.getInstance().getXFrameOption()))
91-
resp.setHeader(X_FRAME_OPTIONS_HEADER_NAME, AppProps.getInstance().getXFrameOption());
9289
resp.setHeader(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, "nosniff");
9390
resp.setHeader(REFERRER_POLICY_HEADER_NAME, "origin-when-cross-origin" );
9491

‎api/src/org/labkey/api/settings/AppProps.java‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -211,11 +211,6 @@ static WriteableAppProps getWriteableInstance()
211211

212212
// configurable http security settings
213213

214-
/**
215-
* @return "SAMEORIGIN" or "DENY" or "ALLOW"
216-
*/
217-
String getXFrameOption();
218-
219214
String getStaticFilesPrefix();
220215

221216
boolean isWebfilesRootEnabled();

‎api/src/org/labkey/api/settings/AppPropsImpl.java‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -554,13 +554,6 @@ public boolean isAllowSessionKeys()
554554
return lookupBooleanValue(allowSessionKeys, false);
555555
}
556556

557-
@Override
558-
public String getXFrameOption()
559-
{
560-
return lookupStringValue(XFrameOption, "SAMEORIGIN");
561-
}
562-
563-
564557
private static final String not_init = "";
565558
private String staticFilesPrefix = not_init;
566559

‎api/src/org/labkey/api/settings/SiteSettingsProperties.java‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -178,14 +178,6 @@ public void setValue(WriteableAppProps writeable, String value)
178178
writeable.setAdminOnlyMessage(value);
179179
}
180180
},
181-
XFrameOption("Controls whether or not a browser may render a server page in a <frame> , <iframe> or <object>. Valid values: [SAMEORIGIN, ALLOW]")
182-
{
183-
@Override
184-
public void setValue(WriteableAppProps writeable, String value)
185-
{
186-
writeable.setXFrameOption(value);
187-
}
188-
},
189181
navAccessOpen("Always include inaccessible parent folders in project menu when child folder is accessible")
190182
{
191183
@Override

‎api/src/org/labkey/api/settings/WriteableAppProps.java‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -225,11 +225,6 @@ public void setAllowSessionKeys(boolean b)
225225
storeBooleanValue(allowSessionKeys, b);
226226
}
227227

228-
public void setXFrameOption(String option)
229-
{
230-
storeStringValue(XFrameOption, option);
231-
}
232-
233228
public void setExternalRedirectHosts(@NotNull Collection<String> externalRedirectHosts)
234229
{
235230
setAllowList(externalRedirectHostURLs, externalRedirectHosts);

‎api/src/org/labkey/api/util/ExceptionUtil.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -833,7 +833,6 @@ static ActionURL handleException(@NotNull HttpServletRequest request, @NotNull H
833833
ContentSecurityPolicyFilter.ContentSecurityPolicyType.Enforce.getHeaderName(),
834834
ContentSecurityPolicyFilter.ContentSecurityPolicyType.Report.getHeaderName(),
835835
AuthFilter.STRICT_TRANSPORT_SECURITY_HEADER_NAME,
836-
AuthFilter.X_FRAME_OPTIONS_HEADER_NAME,
837836
AuthFilter.X_CONTENT_TYPE_OPTIONS_HEADER_NAME,
838837
AuthFilter.REFERRER_POLICY_HEADER_NAME,
839838
AuthFilter.SERVER_HEADER_NAME))
@@ -1106,7 +1105,6 @@ private static void renderErrorPage(Throwable ex, int responseStatus, String mes
11061105
else
11071106
{
11081107
pageConfig.setTemplate(originalConfig.getTemplate());
1109-
pageConfig.setFrameOption(originalConfig.getFrameOption());
11101108
}
11111109

11121110
HttpView<?> errorView = null;

‎api/src/org/labkey/api/view/template/PageConfig.java‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,6 @@ public String getKey()
152152
private TrueFalse _showHeader = TrueFalse.Default;
153153
private List<NavTree> _navTrail;
154154
private AppBar _appBar;
155-
private FrameOption _frameOption = FrameOption.ALLOW;
156155
private boolean _trackingScript = true;
157156
private String _canonicalLink = null;
158157
private boolean _includePostParameters = false;
@@ -505,21 +504,6 @@ public HtmlString getMetaTags(URLHelper url)
505504
return sb.getHtmlString();
506505
}
507506

508-
public enum FrameOption
509-
{
510-
ALLOW, SAMEORIGIN, DENY
511-
}
512-
513-
public void setFrameOption(FrameOption option)
514-
{
515-
_frameOption = option;
516-
}
517-
518-
public FrameOption getFrameOption()
519-
{
520-
return null==_frameOption?FrameOption.ALLOW:_frameOption;
521-
}
522-
523507
public void setAllowTrackingScript(TrueFalse opt)
524508
{
525509
_trackingScript = opt != TrueFalse.False;

‎core/src/org/labkey/core/CoreModule.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -542,8 +542,6 @@ public QuerySchema createSchema(DefaultSchema schema, Module module)
542542
"search to find the other select values.", false, true);
543543
OptionalFeatureService.get().addFeatureFlag(new OptionalFeatureFlag(SQLFragment.FEATUREFLAG_DISABLE_STRICT_CHECKS, "Disable SQLFragment strict checks",
544544
"Disables strict SQL generation safeguards in SQLFragment.appendIdentifier and QueryPivot value emission", false, true, FeatureType.Deprecated));
545-
OptionalFeatureService.get().addExperimentalFeatureFlag(LoginController.FEATUREFLAG_DISABLE_LOGIN_XFRAME, "Disable Login X-FRAME-OPTIONS=DENY",
546-
"By default LabKey disables all framing of login related actions. Disabling this feature will revert to using the standard site settings.", false, true);
547545
OptionalFeatureService.get().addExperimentalFeatureFlag(PageTemplate.EXPERIMENTAL_SHORT_CIRCUIT_ROBOTS,
548546
"Short-circuit robots",
549547
"Save resources by not rendering pages marked as 'noindex' for robots. This is experimental as not all robots are search engines.",

‎core/src/org/labkey/core/admin/AdminController.java‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1471,13 +1471,6 @@ public boolean handlePost(SiteSettingsForm form, BindException errors) throws Ex
14711471
}
14721472
}
14731473

1474-
String frameOption = StringUtils.trimToEmpty(form.getXFrameOption());
1475-
if (!frameOption.equals("DENY") && !frameOption.equals("SAMEORIGIN") && !frameOption.equals("ALLOW"))
1476-
{
1477-
errors.reject(ERROR_MSG, "XFrameOption must equal DENY, or SAMEORIGIN, or ALLOW");
1478-
return false;
1479-
}
1480-
props.setXFrameOption(frameOption);
14811474
props.setIncludeServerHttpHeader(form.isIncludeServerHttpHeader());
14821475

14831476
props.setTermsOfUseFrequencySeconds(form.getTermsOfUseFrequencySeconds());
@@ -2402,7 +2395,6 @@ public static class SiteSettingsForm
24022395
private boolean _allowSessionKeys;
24032396
private boolean _navAccessOpen;
24042397

2405-
private String _XFrameOption;
24062398
private boolean _includeServerHttpHeader;
24072399
private int _termsOfUseFrequencySeconds;
24082400

@@ -2616,16 +2608,6 @@ public void setAllowSessionKeys(boolean allowSessionKeys)
26162608
_allowSessionKeys = allowSessionKeys;
26172609
}
26182610

2619-
public String getXFrameOption()
2620-
{
2621-
return _XFrameOption;
2622-
}
2623-
2624-
public void setXFrameOption(String XFrameOption)
2625-
{
2626-
_XFrameOption = XFrameOption;
2627-
}
2628-
26292611
public boolean isIncludeServerHttpHeader()
26302612
{
26312613
return _includeServerHttpHeader;

‎core/src/org/labkey/core/admin/customizeSite.jsp‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -463,15 +463,6 @@ Click the Save button at any time to accept the current settings and continue.</
463463
<td colspan=2>HTTP security settings (<%=bean.getSiteSettingsHelpLink("http")%>)</td>
464464
</tr>
465465
<tr><td colspan=3 class=labkey-title-area-line></td></tr>
466-
<tr>
467-
<td class="labkey-form-label"><label for="<%=XFrameOption%>">X-Frame-Options</label></td>
468-
<td><select name="<%=XFrameOption%>" id="<%=XFrameOption%>">
469-
<% String option = appProps.getXFrameOption(); %>
470-
<%-- BREAKS GWT <option value="DENY" <%=selectedEq("DENY",option)%>>DENY</option> --%>
471-
<option value="SAMEORIGIN" <%=selectedEq("SAMEORIGIN",option)%>>SAMEORIGIN</option>
472-
<option value="ALLOW" <%=selectedEq("ALLOW",option)%>>Allow</option></select></td>
473-
</tr>
474-
<tr><td colspan=3 class=labkey-title-area-line></td></tr>
475466
<tr>
476467
<td class="labkey-form-label"><label for="<%=includeServerHttpHeader%>">Include a <code>Server</code> HTTP header in responses</label></td>
477468
<td><labkey:checkbox id="<%=includeServerHttpHeader.name()%>" name="<%=includeServerHttpHeader.name()%>" checked="<%=AppProps.getInstance().isIncludeServerHttpHeader()%>" value="true"/></td>

0 commit comments

Comments
 (0)