Adding Content-Security-Policy support to HttpHeaderSecurityFilter

2020-03-24 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, While replying to James's recent message about this filter's anti click-jacking features[1], I was surprised to see that this filter does not have any support for the Content-Security-Policy header. Adding such support would be fairly simple:

[Bug 64255] tomcat-embed:chunked responses with header 'connetion:close' are damaged

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64255 taojiaen changed: What|Removed |Added Resolution|INVALID |INFORMATIONPROVIDED --- Comment #3 from

[Bug 64255] tomcat-embed:chunked responses with header 'connetion:close' are damaged

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64255 --- Comment #2 from taojiaen --- (In reply to Mark Thomas from comment #1) > If the application takes responsibility for setting the chunked encoding > header it also has to take responsibility sending for a correctly encoded > body. > >

[tomcat] branch 8.5.x updated: Process HTTP/0.9 requests with extra request line data as HTTP/1.1

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/8.5.x by this push: new 50aff94 Process HTTP/0.9 requests with extra

[Bug 64255] tomcat-embed:chunked responses with header 'connetion:close' are damaged

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64255 Mark Thomas changed: What|Removed |Added Resolution|INFORMATIONPROVIDED |INVALID --- Comment #4 from Mark Thomas

[tomcat] branch master updated: Remove left-over debug code

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/master by this push: new bf42f57 Remove left-over debug code bf42f57 is

[tomcat] branch 9.0.x updated: Process HTTP/0.9 requests with extra request line data as HTTP/1.1

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new ec3edf7 Process HTTP/0.9 requests with extra

[tomcat] branch master updated: Process HTTP/0.9 requests with extra request line data as HTTP/1.1

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/master by this push: new f4c3950 Process HTTP/0.9 requests with extra

[tomcat] branch 7.0.x updated: Process HTTP/0.9 requests with extra request line data as HTTP/1.1

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 7.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/7.0.x by this push: new f15c077 Process HTTP/0.9 requests with extra

[Bug 64149] NullPointerException in AbstractAccessLogValve

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64149 --- Comment #4 from Roland Wachinger --- Created attachment 37118 --> https://bz.apache.org/bugzilla/attachment.cgi?id=37118=edit our server.xml I attached the server.xml. I think the problem here is one of the valves in the end. This used

[Bug 64260] New: Clean install target

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64260 Bug ID: 64260 Summary: Clean install target Product: Tomcat Native Version: 1.2.23 Hardware: All OS: All Status: NEW Severity: enhancement

[Bug 64149] NullPointerException in AbstractAccessLogValve

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64149 Remy Maucherat changed: What|Removed |Added Status|NEEDINFO|NEW --- Comment #5 from Remy

[tomcat] branch master updated: 64149: Avoid NPE when using the access log valve without a pattern

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/master by this push: new 60a7af2 64149: Avoid NPE when using the access

[tomcat] branch 9.0.x updated: Ordering

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new d35c65b Ordering d35c65b is described below

[tomcat] branch 8.5.x updated: 64149: Avoid NPE when using the access log valve without a pattern

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/8.5.x by this push: new d49329c 64149: Avoid NPE when using the access log

[Bug 64149] NullPointerException in AbstractAccessLogValve

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64149 Remy Maucherat changed: What|Removed |Added Resolution|--- |FIXED Status|NEW

[tomcat] branch 9.0.x updated: 64149: Avoid NPE when using the access log valve without a pattern

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new 0c1f669 64149: Avoid NPE when using the access log

[tomcat] branch 8.5.x updated: Ordering

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/8.5.x by this push: new 5a7e1b3 Ordering 5a7e1b3 is described below

[tomcat] branch master updated: Ordering

2020-03-24 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/master by this push: new 7600f50 Ordering 7600f50 is described below

[tomcat] branch master updated: Increase coverage of Range header tests

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/master by this push: new 3116926 Increase coverage of Range header tests

[tomcat] branch 8.5.x updated: Increase coverage of Range header tests

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 8.5.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/8.5.x by this push: new b88aa88 Increase coverage of Range header tests

[tomcat] branch 9.0.x updated: Increase coverage of Range header tests

2020-03-24 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new 9431eec Increase coverage of Range header tests

[Bug 64240] http 0.9 request return nothing

2020-03-24 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=64240 Mark Thomas changed: What|Removed |Added Resolution|--- |FIXED Status|NEW

Re: Adding Content-Security-Policy support to HttpHeaderSecurityFilter

2020-03-24 Thread Mark Thomas
On 24/03/2020 21:28, Christopher Schultz wrote: > All, > > While replying to James's recent message about this filter's anti > click-jacking features[1], I was surprised to see that this filter > does not have any support for the Content-Security-Policy header. > > Adding such support would be