package io.hawt.web.filters;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
 */
public class ContentSecurityPolicyFilter extends HttpHeaderFilter {

    private static final String POLICY =
        "default-src 'self'; " +
        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
        "style-src 'self' 'unsafe-inline'; " +
        "font-src 'self' data:";

    @Override
    protected void addHeaders(HttpServletRequest request, HttpServletResponse response) {
        response.addHeader("Content-Security-Policy", POLICY);
    }
}

@@ -38,274 +38,783 @@
 java
-x.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse;%0A%0A/**%0A * https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP%0A */%0Apublic class ContentSecurityPolicyFilter extends HttpHeaderFilter %7B%0A%0A    private static final String POLICY =%0A   
+.io.BufferedReader;%0Aimport java.io.FileReader;%0Aimport java.io.IOException;%0Aimport java.net.URI;%0Aimport javax.servlet.FilterConfig;%0Aimport javax.servlet.ServletException;%0Aimport javax.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse;%0A%0Aimport io.hawt.web.ServletHelpers;%0Aimport io.hawt.web.auth.keycloak.KeycloakServlet;%0Aimport org.json.JSONObject;%0Aimport org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory;%0A%0A/**%0A * https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP%0A */%0Apublic class ContentSecurityPolicyFilter extends HttpHeaderFilter %7B%0A%0A    private static final transient Logger LOG = LoggerFactory.getLogger(ContentSecurityPolicyFilter.class);%0A%0A    private static String POLICY = %22%22;%0A    private static final String POLICY_TEMPLATE =%0A
      
+   
 %22def
@@ -852,32 +852,34 @@
 cript-src 'self'
+%25s
  'unsafe-inline'
@@ -975,18 +975,1528 @@
 f' data:
-%22
 ;
+ %22 +%0A        %22connect-src 'self'%25s%22;%0A%0A    @Override%0A    public void init(FilterConfig filterConfig) throws ServletException %7B%0A        super.init(filterConfig);%0A%0A        String keycloakConfigFile = getConfigParameter(KeycloakServlet.KEYCLOAK_CLIENT_CONFIG);%0A        if (keycloakConfigFile == null && System.getProperty(KeycloakServlet.HAWTIO_KEYCLOAK_CLIENT_CONFIG) != null) %7B%0A            keycloakConfigFile = System.getProperty(KeycloakServlet.HAWTIO_KEYCLOAK_CLIENT_CONFIG);%0A        %7D%0A%0A        boolean addedKeycloakUrl = false;%0A        if (keycloakConfigFile != null) %7B%0A            try (FileReader reader = new FileReader(keycloakConfigFile)) %7B%0A                JSONObject json = ServletHelpers.readObject(new BufferedReader(reader));%0A                String url = (String) json.get(%22url%22);%0A                URI uri = URI.create(url);%0A                LOG.info(%22Found Keycloak URL: %7B%7D%22, uri);%0A                // mind the initial whitespace%0A                String hostPort = String.format(%22 %25s:%25d%22, uri.getHost(), uri.getPort() %3E 0 ? uri.getPort()%0A                        : %22https%22.equals(uri.getScheme()) ? 443 : 80);%0A                POLICY = String.format(POLICY_TEMPLATE, hostPort, hostPort);%0A                addedKeycloakUrl = true;%0A            %7D catch (IOException e) %7B%0A                LOG.error(%22Can't read keycloak configuration file%22, e);%0A            %7D%0A        %7D%0A        if (!addedKeycloakUrl) %7B%0A            POLICY = String.format(POLICY_TEMPLATE, %22%22, %22%22);%0A        %7D%0A%0A        super.init(filterConfig);%0A    %7D
 %0A%0A    @O

Add discovered Keycloak host:port to CSP header