make all OpenGrok cookies use the SameSite attribute (#3238)

fixes #3164

Author: Vladimir Kotal

opengrok-web/src/main/java/org/opengrok/web/CookieFilter.java

@@ -0,0 +1,91 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * See LICENSE.txt included in this distribution for the specific
+ * language governing permissions and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at LICENSE.txt.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ */
+package org.opengrok.web;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.core.HttpHeaders;
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Enumeration;
+
+/**
+ * Makes sure that all cookies originating from the web application have the Same-site attribute set.
+ */
+public class CookieFilter implements Filter {
+    private FilterConfig fc;
+
+    @Override
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
+            throws IOException, ServletException {
+
+        HttpServletResponse response = (HttpServletResponse) res;
+
+        chain.doFilter(req, response);
+
+        // Change the existing cookies to use the attributes and values from the configuration.
+        Collection<String> headers = response.getHeaders(HttpHeaders.SET_COOKIE);
+        boolean firstHeader = true;
+        for (String header : headers) { // there can be multiple Set-Cookie attributes
+            if (firstHeader) {
+                response.setHeader(HttpHeaders.SET_COOKIE, String.format("%s; %s", header, getSuffix()));
+                firstHeader = false;
+                continue;
+            }
+            response.addHeader(HttpHeaders.SET_COOKIE, String.format("%s; %s", header, getSuffix()));
+        }
+    }
+
+    private String getSuffix() {
+        StringBuilder sb = new StringBuilder();
+
+        for (Enumeration<String> e = fc.getInitParameterNames(); e.hasMoreElements();) {
+            String attributeName = e.nextElement();
+            if (sb.length() > 0) {
+                sb.append("; ");
+            }
+            sb.append(attributeName);
+            String attributeValue = fc.getInitParameter(attributeName);
+            if (!attributeValue.isEmpty()) {
+                sb.append("=");
+                sb.append(attributeValue);
+            }
+        }
+        return sb.toString();
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) {
+        this.fc = filterConfig;
+    }
+
+    @Override
+    public void destroy() {
+        // pass
+    }
+}

opengrok-web/src/main/webapp/WEB-INF/web.xml

@@ -64,6 +64,23 @@
         <url-pattern>/eforbidden</url-pattern>
         <dispatcher>REQUEST</dispatcher>
     </filter-mapping>
+    <filter>
+        <filter-name>CookieFilter</filter-name>
+        <filter-class>org.opengrok.web.CookieFilter</filter-class>
+        <init-param>
+            <param-name>SameSite</param-name>
+            <param-value>Strict</param-value>
+        </init-param>
+        <init-param>
+            <param-name>Secure</param-name>
+            <param-value></param-value>
+        </init-param>
+    </filter>
+    <filter-mapping>
+        <filter-name>CookieFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+        <dispatcher>REQUEST</dispatcher>
+    </filter-mapping>
     <servlet>
         <display-name>Source Finder</display-name>
         <servlet-name>search</servlet-name>