Skip to content

Fix X-Robots-Tag header valid values check #40715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phil-davis merged 9 commits into from
Apr 26, 2023
Merged

Fix X-Robots-Tag header valid values check #40715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
09fd4f6
Handle X-Robots-Tag header valid values other than none
rizlas Mar 30, 2023
c3d4ce3
Add changelog. Precise messages in setupchecks securityHeaders
rizlas Mar 30, 2023
77d2911
Changelog
rizlas Mar 31, 2023
e10d927
Fix messages consistency with checkGeneric tests
rizlas Mar 31, 2023
7c42f05
Fix check header x-robots-tag exists
rizlas Mar 31, 2023
df37920
Update changelog/unreleased/40715
rizlas Apr 2, 2023
54ec1ca
Update changelog/unreleased/40715
phil-davis Apr 2, 2023
a5173c9
if statement styling. Increase browser compatibility. Increase securi…
rizlas Apr 15, 2023
bed1a09
fix line indentation
rizlas Apr 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions changelog/unreleased/40715
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
Enhancement: Improve X-Robots-Tag header values check

Setup checks now allows other values other than "none" for X-Robots-Tag header.
If "none" or "noindex" and "nofollow" are missing, a security warning is raised.
Previously a header value with "noindex" and "nofollow" wasn't allowed even though it was valid.

https://github.com/owncloud/core/pull/40715
25 changes: 21 additions & 4 deletions core/js/setupchecks.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,17 +238,34 @@
var securityHeaders = {
'X-XSS-Protection': '0',
'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none',
'X-Robots-Tag': ['none', 'noindex', 'nofollow'],
'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
};

for (var header in securityHeaders) {
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== securityHeaders[header].toLowerCase()) {
if (header === 'X-Robots-Tag') {
xRobotsTagValues = [];
if (xhr.getResponseHeader(header)) {
xRobotsTagValues = xhr.getResponseHeader(header).split(',').map(function(item) {
return item.trim();
});
}

var hasNoneDirective = xRobotsTagValues.indexOf('none') !== -1;
var hasNoIndexAndNoFollowDirectives = xRobotsTagValues.indexOf('noindex') !== -1 && xRobotsTagValues.indexOf('nofollow') !== -1;

if (!hasNoneDirective && !hasNoIndexAndNoFollowDirectives) {
messages.push({
msg: t('core', 'The "{header}" HTTP header is misconfigured. Expected values are "none" or "noindex, nofollow". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header}),
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
});
}
} else if (!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== securityHeaders[header].toLowerCase()) {
messages.push({
msg: t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header, expected: securityHeaders[header]}),
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
msg: t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header, expected: securityHeaders[header]}),
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
});
}
}
Expand Down
3 changes: 1 addition & 2 deletions core/js/tests/specs/setupchecksSpec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,9 +422,8 @@ describe('OC.SetupChecks tests', function() {
msg: 'The "X-Content-Type-Options" HTTP header is not configured to equal to "nosniff". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
}, {
msg: 'The "X-Robots-Tag" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and we recommend adjusting this setting.',
msg: 'The "X-Robots-Tag" HTTP header is misconfigured. Expected values are "none" or "noindex, nofollow". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING

}, {
msg: 'The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
Expand Down