{"id":119,"date":"2010-11-02T00:16:36","date_gmt":"2010-11-02T08:16:36","guid":{"rendered":"http:\/\/www.mantisbt.org\/blog\/?p=119"},"modified":"2015-01-16T09:49:11","modified_gmt":"2015-01-16T14:49:11","slug":"progress-towards-fully-implementing-x-content-security-policy","status":"publish","type":"post","link":"https:\/\/mantisbt.org\/blog\/archives\/mantisbt\/119","title":{"rendered":"Progress towards fully implementing X-Content-Security-Policy"},"content":{"rendered":"

MantisBT 1.2.1 introduced anti-clickjacking<\/a> features in the form of both X-Content-Security Policy<\/a> and X-Frame-Options<\/a> HTTP headers. SHODAN<\/a> is a search engine that allows the searching of HTTP server fingerprints obtained from internet facing hosts. If we search for X-Frame-Options<\/a> in SHODAN’s database, just over 7000 results are returned. Performing the same check for the X-Content-Security-Policy<\/a> header returns just over 90 results. Interestingly, the great majority of search results for X-Content-Security-Policy are MantisBT installations. It therefore appears that other web applications (and websites) have yet to implement X-Content-Security-Policy in readiness for the stable release of Firefox 4.<\/p>\n

As Firefox 4 has been pushed back to early 2011 we have more time to finish off the implementation of X-Content-Security-Policy within MantisBT. A fair amount of progress has already been achieved towards removing inline JavaScript<\/a> from within MantisBT pages. Once this process is complete we can switch on CSP’s ability to block inline JavaScript from being executed. This will severely limit the impact of XSS vulnerabilities on MantisBT. At the same time there is also a push towards reimplementing the output handling of MantisBT to use a templating system that automatically escapes user supplied data before printing it into HTML output. This approach would help prevent mistakes from occurring, especially with respect to third party plugins that may not undergo as much scrutiny as the MantisBT core.<\/p>\n","protected":false},"excerpt":{"rendered":"

MantisBT 1.2.1 introduced anti-clickjacking features in the form of both X-Content-Security Policy and X-Frame-Options HTTP headers. SHODAN is a search engine that allows the searching of HTTP server fingerprints obtained from internet facing hosts. If we search for X-Frame-Options in SHODAN’s database, just over 7000 results are returned. Performing the same check for the X-Content-Security-Policy … Continue reading “Progress towards fully implementing X-Content-Security-Policy”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-119","post","type-post","status-publish","format-standard","hentry","category-mantisbt"],"_links":{"self":[{"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/posts\/119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/comments?post=119"}],"version-history":[{"count":1,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/posts\/119\/revisions"}],"predecessor-version":[{"id":363,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/posts\/119\/revisions\/363"}],"wp:attachment":[{"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/media?parent=119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/categories?post=119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mantisbt.org\/blog\/wp-json\/wp\/v2\/tags?post=119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}