From 436efca340c0eeb1c6a1feadf63e09707f6acb58 Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" Date: Mon, 21 Nov 2011 22:31:20 +0000 Subject: [PATCH] Bug 680771 - Send X-XSS-Protection header for XSS prevention/blocking [r=mkanat a=LpSolit] git-svn-id: svn://10.0.0.236/trunk@263093 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/.bzrrev | 2 +- mozilla/webtools/bugzilla/Bugzilla/CGI.pm | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev index 0659a4cb18f..23278b8408b 100644 --- a/mozilla/webtools/bugzilla/.bzrrev +++ b/mozilla/webtools/bugzilla/.bzrrev @@ -1 +1 @@ -8009 \ No newline at end of file +8010 \ No newline at end of file diff --git a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm index e0e1c40ba33..9d8a1c48ffc 100644 --- a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm +++ b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm @@ -306,6 +306,10 @@ sub header { unshift(@_, '-x_frame_options' => 'SAMEORIGIN'); } + # Add X-XSS-Protection header to prevent simple XSS attacks + # and enforce the blocking (rather than the rewriting) mode. + unshift(@_, '-x_xss_protection' => '1; mode=block'); + return $self->SUPER::header(@_) || ""; }