opendev
/
gerrit
Code Issues Proposed changes

Set "never" referrer policy 

Linkification and plugins can cause requests originating from PolyGerrit
to third-party sites. Without this policy, such requests would include a
"Referer" header that potentially reveals sensitive information in
hostnames, project names, and filenames.

Unfortunately, different browsers implement different versions of the
standard. We want to use the legacy policy name "never" so browsers that
only implement the legacy standard will comply. We use a meta tag
instead of an HTTP response header because Chrome doesn't respect legacy
policies specified outside of meta tags.

Change-Id: Ibb601742121c6d0c9122e34dda2d447a068c0913
(cherry picked from commit dbde9244fe)
This commit is contained in:
Logan Hanks 2018-11-01 14:46:05 -07:00 committed by David Pursehouse
parent 537b7336fe
commit e7fa1e7e44
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy
View File

@ -30,6 +30,7 @@
<html lang="en">{\n}
<meta charset="utf-8">{\n}
<meta name="description" content="Gerrit Code Review">{\n}
<meta name="referrer" content="never">{\n}
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0">{\n}
<script>