From aa1405029060942b75bf55467e45263e1b0fa450 Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Fri, 28 Aug 2026 19:10:16 -0400
Subject: [PATCH] fix(security): T2.4 hardening: register
 PSSecurityHeadersFilter in delivery-tier webapps (issue #96)

PR #95 added the reusable PSSecurityHeadersFilter and registered it in the
two main Rhythmyx webapps (secure + non-secure). The delivery-tier webapps
(comments, feeds, forms, integrations, membership, metadata, polls) did
not have any security-header filter, so they were missing:
  - X-Frame-Options (clickjacking, CWE-1021)
  - X-Content-Type-Options: nosniff (MIME-sniffing)
  - Referrer-Policy: strict-origin-when-cross-origin (referrer leakage)
  - Strict-Transport-Security on HTTPS (downgrade)
  - X-XSS-Protection: 0 (legacy XSS auditor disabled)

This is the same defense-in-depth added to the main Rhythmyx webapps.

WebUI/war and system/ear already have the existing PSSecurityHeaderFilter
(com.percussion.utils.security.PSSecurityHeaderFilter), which is a richer
filter that does X-Frame/XSS/HSTS/CSP/Cache-Control. Adding the new
filter there would create duplicate header writes, so they are out of
scope for this slice.

Verified clean build via ./mvn-env.sh clean install -DskipTests (7 of 7
target modules BUILD SUCCESS; PSSecurityHeadersFilter present in each
built WAR's WEB-INF/web.xml).

> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
---
 .../comments/src/main/java/webapp/WEB-INF/web.xml     | 11 +++++++++++
 .../feeds/src/main/java/webapp/WEB-INF/web.xml        | 11 +++++++++++
 .../forms/src/main/java/webapp/WEB-INF/web.xml        | 11 +++++++++++
 .../integrations/src/main/java/webapp/WEB-INF/web.xml | 11 +++++++++++
 .../membership/src/main/java/webapp/WEB-INF/web.xml   | 11 +++++++++++
 .../metadata/src/main/java/webapp/WEB-INF/web.xml     | 11 +++++++++++
 .../polls/src/main/java/webapp/WEB-INF/web.xml        | 11 +++++++++++
 7 files changed, 77 insertions(+)

diff --git a/deliverytiersuite/delivery-tier-suite/comments/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/comments/src/main/java/webapp/WEB-INF/web.xml
index 1bf9bf76b6..a67b23a52f 100644
--- a/deliverytiersuite/delivery-tier-suite/comments/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/comments/src/main/java/webapp/WEB-INF/web.xml
@@ -43,6 +43,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
 
     <servlet>
         <servlet-name>Jersey Spring Web Application</servlet-name>
diff --git a/deliverytiersuite/delivery-tier-suite/feeds/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/feeds/src/main/java/webapp/WEB-INF/web.xml
index 3cf3dbeb5b..49dc5124f8 100644
--- a/deliverytiersuite/delivery-tier-suite/feeds/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/feeds/src/main/java/webapp/WEB-INF/web.xml
@@ -47,6 +47,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
     <servlet>
         <servlet-name>Jersey Spring Web Application</servlet-name>
         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
diff --git a/deliverytiersuite/delivery-tier-suite/forms/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/forms/src/main/java/webapp/WEB-INF/web.xml
index 5a9cd48697..7e5cc3d6cc 100644
--- a/deliverytiersuite/delivery-tier-suite/forms/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/forms/src/main/java/webapp/WEB-INF/web.xml
@@ -46,6 +46,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
     <servlet>
         <servlet-name>Jersey Spring Web Application</servlet-name>
         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
diff --git a/deliverytiersuite/delivery-tier-suite/integrations/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/integrations/src/main/java/webapp/WEB-INF/web.xml
index 4db279acf5..9f76cd3679 100644
--- a/deliverytiersuite/delivery-tier-suite/integrations/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/integrations/src/main/java/webapp/WEB-INF/web.xml
@@ -46,6 +46,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
    <servlet>
       <servlet-name>Jersey Spring Web Application</servlet-name>
       <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
diff --git a/deliverytiersuite/delivery-tier-suite/membership/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/membership/src/main/java/webapp/WEB-INF/web.xml
index 70fb76b55f..5eefceface 100644
--- a/deliverytiersuite/delivery-tier-suite/membership/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/membership/src/main/java/webapp/WEB-INF/web.xml
@@ -44,6 +44,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
     <servlet>
         <servlet-name>Jersey Spring Web Application</servlet-name>
         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
diff --git a/deliverytiersuite/delivery-tier-suite/metadata/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/metadata/src/main/java/webapp/WEB-INF/web.xml
index 5815f29b45..f73142470c 100644
--- a/deliverytiersuite/delivery-tier-suite/metadata/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/metadata/src/main/java/webapp/WEB-INF/web.xml
@@ -47,6 +47,17 @@
       <url-pattern>/*</url-pattern>
    </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
    <servlet>
       <servlet-name>Jersey Spring Web Application</servlet-name>
       <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
diff --git a/deliverytiersuite/delivery-tier-suite/polls/src/main/java/webapp/WEB-INF/web.xml b/deliverytiersuite/delivery-tier-suite/polls/src/main/java/webapp/WEB-INF/web.xml
index d6030d5ab0..ec4c527f01 100644
--- a/deliverytiersuite/delivery-tier-suite/polls/src/main/java/webapp/WEB-INF/web.xml
+++ b/deliverytiersuite/delivery-tier-suite/polls/src/main/java/webapp/WEB-INF/web.xml
@@ -47,6 +47,17 @@
         <url-pattern>/*</url-pattern>
     </filter-mapping>
 
+    <filter>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <filter-class>com.percussion.security.servlet.PSSecurityHeadersFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>PSSecurityHeadersFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+
     <servlet>
         <servlet-name>Jersey Spring Web Application</servlet-name>
         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>