From 8840bc073fae22b892693d2236e70b60f819aaef Mon Sep 17 00:00:00 2001
From: Dominik Langenegger <dominik.langenegger@abacus.ch>
Date: Mon, 10 Apr 2017 11:20:07 +0200
Subject: [PATCH] KEYCLOAK-4736 Extend security defenses with additional option
 to set the X-XSS-Protection header, block by default

---
 .../org/keycloak/migration/migrators/MigrateTo3_1_0.java   | 1 +
 .../java/org/keycloak/models/BrowserSecurityHeaders.java   | 2 ++
 .../theme/base/admin/messages/admin-messages_en.properties | 2 ++
 .../base/admin/resources/partials/defense-headers.html     | 7 +++++++
 4 files changed, 12 insertions(+)

diff --git a/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo3_1_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo3_1_0.java
index 22da4f8e06..b405d42f65 100644
--- a/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo3_1_0.java
+++ b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo3_1_0.java
@@ -40,6 +40,7 @@ public class MigrateTo3_1_0 implements Migration {
 
                 Map<String, String> browserSecurityHeaders = new HashMap<>(realm.getBrowserSecurityHeaders());
                 browserSecurityHeaders.put("xRobotsTag", "none");
+                browserSecurityHeaders.put("xXSSProtection", "1; mode=block");
 
                 realm.setBrowserSecurityHeaders(Collections.unmodifiableMap(browserSecurityHeaders));
             }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java b/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
index f384f7b885..40274fe681 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
@@ -35,12 +35,14 @@ public class BrowserSecurityHeaders {
         headerMap.put("contentSecurityPolicy", "Content-Security-Policy");
         headerMap.put("xContentTypeOptions", "X-Content-Type-Options");
         headerMap.put("xRobotsTag", "X-Robots-Tag");
+        headerMap.put("xXSSProtection", "X-XSS-Protection");
 
         Map<String, String> dh = new HashMap<>();
         dh.put("xFrameOptions", "SAMEORIGIN");
         dh.put("contentSecurityPolicy", "frame-src 'self'");
         dh.put("xContentTypeOptions", "nosniff");
         dh.put("xRobotsTag", "none");
+        dh.put("xXSSProtection", "1; mode=block");
 
         defaultHeaders = Collections.unmodifiableMap(dh);
         headerAttributeMap = Collections.unmodifiableMap(headerMap);
diff --git a/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties b/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
index 14708d82c3..fff8bf2536 100644
--- a/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
+++ b/themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
@@ -124,6 +124,8 @@ content-type-options=X-Content-Type-Options
 content-type-options-tooltip=Default value prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type (click label for more information)
 robots-tag=X-Robots-Tag
 robots-tag-tooltip=Prevent pages from appearing in search engines (click label for more information)
+x-xss-protection=X-XSS-Protection
+x-xss-protection-tooltip=This header configures the Cross-site scripting (XSS) filter in your browser. Using the default behavior, the browser will prevent rendering of the page when a XSS attack is detected (click label for more information)
 max-login-failures=Max Login Failures
 max-login-failures.tooltip=How many failures before wait is triggered.
 wait-increment=Wait Increment
diff --git a/themes/src/main/resources/theme/base/admin/resources/partials/defense-headers.html b/themes/src/main/resources/theme/base/admin/resources/partials/defense-headers.html
index 75e5ba01bb..f2787cda74 100755
--- a/themes/src/main/resources/theme/base/admin/resources/partials/defense-headers.html
+++ b/themes/src/main/resources/theme/base/admin/resources/partials/defense-headers.html
@@ -36,6 +36,13 @@
                 </div>
                 <kc-tooltip>{{:: 'robots-tag-tooltip' | translate}}</kc-tooltip>
             </div>
+            <div class="form-group">
+                <label class="col-md-2 control-label" for="xXSSProtection"><a href="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#xxxsp" target="_blank">{{:: 'x-xss-protection' | translate}}</a></label>
+                <div class="col-sm-6">
+                    <input class="form-control" id="xXSSProtection" type="text" ng-model="realm.browserSecurityHeaders.xXSSProtection">
+                </div>
+                <kc-tooltip>{{:: 'x-xss-protection-tooltip' | translate}}</kc-tooltip>
+            </div>
         </fieldset>
         <div class="form-group" data-ng-show="access.manageRealm">
             <div class="col-md-10 col-md-offset-2">