From e7fa1e7e44f63a8c9477ec5ed6be22bf24faf256 Mon Sep 17 00:00:00 2001 From: Logan Hanks Date: Thu, 1 Nov 2018 14:46:05 -0700 Subject: [PATCH] Set "never" referrer policy Linkification and plugins can cause requests originating from PolyGerrit to third-party sites. Without this policy, such requests would include a "Referer" header that potentially reveals sensitive information in hostnames, project names, and filenames. Unfortunately, different browsers implement different versions of the standard. We want to use the legacy policy name "never" so browsers that only implement the legacy standard will comply. We use a meta tag instead of an HTTP response header because Chrome doesn't respect legacy policies specified outside of meta tags. Change-Id: Ibb601742121c6d0c9122e34dda2d447a068c0913 (cherry picked from commit dbde9244fefcbbdc948902eb57d9276804333f64) --- resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy | 1 + 1 file changed, 1 insertion(+) diff --git a/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy b/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy index 816dd23988..78c868432e 100644 --- a/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy +++ b/resources/com/google/gerrit/httpd/raw/PolyGerritIndexHtml.soy @@ -30,6 +30,7 @@ {\n} {\n} {\n} + {\n} {\n}