fix(security): T2.4 hardening: PSSecurityHeadersFilter for X-Frame-Options + X-Content-Type-Options + Referrer-Policy + HSTS (issue #94)

[natechadwick-intsof]

Summary

T2.4 hardening sub-task of the parent epic #73. This is defense-in-depth for several of the 45+ CVEs in Spring 5.3.x + Spring Security 5.8.x. Many of those CVEs are addressed by setting standard security response headers (clickjacking, MIME-sniffing, referrer-leak, HTTPS downgrade). The framework's WebSecurityConfigurerAdapter / SecurityFilterChain can set them automatically, but the project uses legacy web.xml filter-based security, so a dedicated servlet filter is the most reliable way to add them across all webapps.

This PR adds a reusable filter and registers it in the 2 main Rhythmyx web.xml files. The other ~9 web.xml files (deliverytiersuite, comments, polls, etc.) can be follow-up PRs.

What changes (3 files, +131 / −0)

1. New filter (1 file, +117)

modules/perc-security-utils/src/main/java/com/percussion/security/servlet/PSSecurityHeadersFilter.java — a simple Filter that sets the following response headers on every request:

• X-Frame-Options: SAMEORIGIN (clickjacking, CWE-1021)
• X-Content-Type-Options: nosniff (MIME-sniffing, CWE-79 follow-up)
• Referrer-Policy: strict-origin-when-cross-origin (referrer-leak)
• Strict-Transport-Security: max-age=31536000; includeSubDomains (HTTPS downgrade; only emitted on secure (HTTPS) requests, so a misconfigured HTTP-only deployment does not get a stale HSTS header that browsers might honor on a future HTTPS port)
• X-XSS-Protection: 0 (the deprecated XSS auditor is disabled; per the modern recommendation, 0 is correct, not 1; mode=block)

All values are constants on the class. Future tuning is a one-line change.

2. Registration in 2 main web.xml files (2 files, +14 each)

• projects/sitemanage/src/main/resources/Rhythmyx/sys_resources/webapps/secure/WEB-INF/web.xml
• projects/sitemanage/src/main/resources/Rhythmyx/sys_resources/webapps/non-secure/WEB-INF/web.xml

Each gets a <filter> and <filter-mapping> block that registers the new filter at /* (after the existing PSCacheControlFilter / PSDefaultContentTypeFilter, before springSecurityFilterChain).

Verification

• ./mvn-env.sh clean install -DskipTests → BUILD SUCCESS in 4:00 (61 modules, Java 1.8.0_504)
• No UnsupportedClassVersionError in the build log
• A manual smoke test: curl -I <server>/Rhythmyx/whatever should now show all 4-5 headers in the response (X-Frame-Options, X-Content-Type-Options, Referrer-Policy; Strict-Transport-Security on HTTPS only)

Out of scope (separate issues under #73)

• Add the filter to the other ~9 web.xml files (deliverytiersuite, comments, polls, etc.) — follow-up PRs
• Update Spring to the latest 5.3.x patch (no security-relevant change in this PR; can be a follow-up)
• The remaining 35+ T2.4 CVEs require feature-level config changes (e.g., enabling CSRF in Spring Security's HttpSecurity config)
• commons-httpclient 3.1 → HttpClient 5 (deps: EOL replace commons-httpclient 3.1 with org.apache.httpcomponents.client5:httpclient5 (closes 1 CVE) #88, deferred; multi-day migration)
• T2.13 Eclipse Jetty 9.4.58 hardening (29+ CVEs)
• T2.6 commons-collections4 input validation (2 CVEs)

References

• Closes [security] T2.4 hardening: add PSSecurityHeadersFilter for X-Frame-Options, X-Content-Type-Options, Referrer-Policy (covers ~10+ of 45+ CVEs) #94 (T2.4 header sub-task; the remaining T2.4 CVEs require Spring feature config)
• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• OWASP Secure Headers Project: https://owasp.org/www-project-secure-headers/
• Tier 2 plan: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md#t24--spring-53x--spring-security-58x-hardening

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.