forked from I2P_Developers/i2p.i2p
zzz
58578d9020
XSSFilter patch from str4d: XSSFilter and XSSRequestWrapper were from http://ricardozuasti.com/2012/stronger-anti-cross-site-scripting-xss-filter-for-java-web-apps/ No provided license, but it is clearly intended for public consumption. But most of it is boilerplate provided by the Servlet Filter system. In fact, now that I have stripped out his JS-specific patterns and replaced it with the whitelist, it is effectively identical to what I would have written from scratch.
52 lines
1.5 KiB
XML
52 lines
1.5 KiB
XML
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
<!DOCTYPE web-app
|
|
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
|
|
"http://java.sun.com/j2ee/dtds/web-app_2.2.dtd">
|
|
|
|
<web-app>
|
|
<filter>
|
|
<filter-name>XSSFilter</filter-name>
|
|
<filter-class>net.i2p.servlet.filters.XSSFilter</filter-class>
|
|
</filter>
|
|
<filter-mapping>
|
|
<filter-name>XSSFilter</filter-name>
|
|
<url-pattern>/*</url-pattern>
|
|
</filter-mapping>
|
|
|
|
<!-- precompiled servlets -->
|
|
|
|
<!-- yeah, i'm lazy, using a jsp instead of a servlet.. -->
|
|
<servlet-mapping>
|
|
<servlet-name>net.i2p.router.web.jsp.viewtheme_jsp</servlet-name>
|
|
<url-pattern>/themes/*</url-pattern>
|
|
</servlet-mapping>
|
|
|
|
<servlet-mapping>
|
|
<servlet-name>net.i2p.router.web.jsp.viewtheme_jsp</servlet-name>
|
|
<url-pattern>/javadoc/*</url-pattern>
|
|
</servlet-mapping>
|
|
|
|
<servlet-mapping>
|
|
<servlet-name>net.i2p.router.web.jsp.viewhistory_jsp</servlet-name>
|
|
<url-pattern>/history.txt</url-pattern>
|
|
</servlet-mapping>
|
|
|
|
<session-config>
|
|
<session-timeout>
|
|
30
|
|
</session-timeout>
|
|
</session-config>
|
|
<welcome-file-list>
|
|
<welcome-file>index.html</welcome-file>
|
|
<welcome-file>index.jsp</welcome-file>
|
|
</welcome-file-list>
|
|
<error-page>
|
|
<error-code>404</error-code>
|
|
<location>/error.jsp</location>
|
|
</error-page>
|
|
<error-page>
|
|
<error-code>500</error-code>
|
|
<location>/error500.jsp</location>
|
|
</error-page>
|
|
</web-app>
|