Skip to content

Commit 892a804

Browse files
blizzzblizzz
authored
Merge pull request #36749 from nextcloud/backport/36689/stable25
[stable25] Change X-Robots-Tag header from "none" to "noindex, nofollow"
2 parents 5f2816a + b194d84 commit 892a804

12 files changed

Lines changed: 80 additions & 37 deletions

File tree

‎.htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
Header always set X-Permitted-Cross-Domain-Policies "none"
3232

3333
Header onsuccess unset X-Robots-Tag
34-
Header always set X-Robots-Tag "none"
34+
Header always set X-Robots-Tag "noindex, nofollow"
3535

3636
Header onsuccess unset X-XSS-Protection
3737
Header always set X-XSS-Protection "1; mode=block"

‎build/integration/features/carddav.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Feature: carddav
4646
|X-Content-Type-Options |nosniff|
4747
|X-Frame-Options|SAMEORIGIN|
4848
|X-Permitted-Cross-Domain-Policies|none|
49-
|X-Robots-Tag|none|
49+
|X-Robots-Tag|noindex, nofollow|
5050
|X-XSS-Protection|1; mode=block|
5151

5252
Scenario: Exporting the picture of ones own contact
@@ -60,5 +60,5 @@ Feature: carddav
6060
|X-Content-Type-Options |nosniff|
6161
|X-Frame-Options|SAMEORIGIN|
6262
|X-Permitted-Cross-Domain-Policies|none|
63-
|X-Robots-Tag|none|
63+
|X-Robots-Tag|noindex, nofollow|
6464
|X-XSS-Protection|1; mode=block|

‎build/integration/features/dav-v2.feature‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Feature: dav-v2
2727
|X-Content-Type-Options |nosniff|
2828
|X-Frame-Options|SAMEORIGIN|
2929
|X-Permitted-Cross-Domain-Policies|none|
30-
|X-Robots-Tag|none|
30+
|X-Robots-Tag|noindex, nofollow|
3131
|X-XSS-Protection|1; mode=block|
3232
And Downloaded content should start with "Welcome to your Nextcloud account!"
3333

‎build/integration/features/webdav-related.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Feature: webdav-related
5353
And User "user0" moves file "/textfile0.txt" to "/testshare/textfile0.txt"
5454
And the HTTP status code should be "403"
5555
When Downloading file "/testshare/textfile0.txt"
56-
Then the HTTP status code should be "404"
56+
Then the HTTP status code should be "404"
5757

5858
Scenario: Moving a file to overwrite a file in a folder with no permissions
5959
Given using old dav path
@@ -251,7 +251,7 @@ Feature: webdav-related
251251
|X-Content-Type-Options |nosniff|
252252
|X-Frame-Options|SAMEORIGIN|
253253
|X-Permitted-Cross-Domain-Policies|none|
254-
|X-Robots-Tag|none|
254+
|X-Robots-Tag|noindex, nofollow|
255255
|X-XSS-Protection|1; mode=block|
256256
And Downloaded content should start with "Welcome to your Nextcloud account!"
257257

‎core/js/setupchecks.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -628,13 +628,13 @@
628628
if (xhr.status === 200) {
629629
var securityHeaders = {
630630
'X-Content-Type-Options': ['nosniff'],
631-
'X-Robots-Tag': ['none'],
631+
'X-Robots-Tag': ['noindex, nofollow'],
632632
'X-Frame-Options': ['SAMEORIGIN', 'DENY'],
633633
'X-Permitted-Cross-Domain-Policies': ['none'],
634634
};
635635
for (var header in securityHeaders) {
636636
var option = securityHeaders[header][0];
637-
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== option.toLowerCase()) {
637+
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).replace(/, /, ',').toLowerCase() !== option.replace(/, /, ',').toLowerCase()) {
638638
var msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});
639639
if(xhr.getResponseHeader(header) && securityHeaders[header].length > 1 && xhr.getResponseHeader(header).toLowerCase() === securityHeaders[header][1].toLowerCase()) {
640640
msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". Some features might not work correctly, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});

‎core/js/tests/specs/setupchecksSpec.js‎

Lines changed: 66 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1569,7 +1569,7 @@ describe('OC.SetupChecks tests', function() {
15691569
msg: 'The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
15701570
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
15711571
}, {
1572-
msg: 'The "X-Robots-Tag" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1572+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
15731573
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
15741574
}, {
15751575
msg: 'The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
@@ -1596,7 +1596,7 @@ describe('OC.SetupChecks tests', function() {
15961596
suite.server.requests[0].respond(
15971597
200,
15981598
{
1599-
'X-Robots-Tag': 'none',
1599+
'X-Robots-Tag': 'noindex, nofollow',
16001600
'X-Frame-Options': 'SAMEORIGIN',
16011601
'Strict-Transport-Security': 'max-age=15768000;preload',
16021602
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1627,7 +1627,7 @@ describe('OC.SetupChecks tests', function() {
16271627
{
16281628
'X-XSS-Protection': '1; mode=block',
16291629
'X-Content-Type-Options': 'nosniff',
1630-
'X-Robots-Tag': 'none',
1630+
'X-Robots-Tag': 'noindex, nofollow',
16311631
'X-Frame-Options': 'SAMEORIGIN',
16321632
'Strict-Transport-Security': 'max-age=15768000',
16331633
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1641,6 +1641,49 @@ describe('OC.SetupChecks tests', function() {
16411641
});
16421642
});
16431643

1644+
describe('check X-Robots-Tag header', function() {
1645+
it('should return no message if X-Robots-Tag is set to noindex,nofollow without space', function(done) {
1646+
protocolStub.returns('https');
1647+
var result = OC.SetupChecks.checkGeneric();
1648+
suite.server.requests[0].respond(200, {
1649+
'Strict-Transport-Security': 'max-age=15768000',
1650+
'X-XSS-Protection': '1; mode=block',
1651+
'X-Content-Type-Options': 'nosniff',
1652+
'X-Robots-Tag': 'noindex,nofollow',
1653+
'X-Frame-Options': 'SAMEORIGIN',
1654+
'X-Permitted-Cross-Domain-Policies': 'none',
1655+
'Referrer-Policy': 'no-referrer',
1656+
});
1657+
result.done(function( data, s, x ){
1658+
expect(data).toEqual([]);
1659+
done();
1660+
});
1661+
});
1662+
1663+
it('should return a message if X-Robots-Tag is set to none', function(done) {
1664+
protocolStub.returns('https');
1665+
var result = OC.SetupChecks.checkGeneric();
1666+
suite.server.requests[0].respond(200, {
1667+
'Strict-Transport-Security': 'max-age=15768000',
1668+
'X-XSS-Protection': '1; mode=block',
1669+
'X-Content-Type-Options': 'nosniff',
1670+
'X-Robots-Tag': 'none',
1671+
'X-Frame-Options': 'SAMEORIGIN',
1672+
'X-Permitted-Cross-Domain-Policies': 'none',
1673+
'Referrer-Policy': 'no-referrer',
1674+
});
1675+
result.done(function( data, s, x ){
1676+
expect(data).toEqual([
1677+
{
1678+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1679+
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
1680+
}
1681+
]);
1682+
done();
1683+
});
1684+
});
1685+
});
1686+
16441687
describe('check X-XSS-Protection header', function() {
16451688
it('should return no message if X-XSS-Protection is set to 1; mode=block; report=https://example.com', function(done) {
16461689
protocolStub.returns('https');
@@ -1650,7 +1693,7 @@ describe('OC.SetupChecks tests', function() {
16501693
'Strict-Transport-Security': 'max-age=15768000',
16511694
'X-XSS-Protection': '1; mode=block; report=https://example.com',
16521695
'X-Content-Type-Options': 'nosniff',
1653-
'X-Robots-Tag': 'none',
1696+
'X-Robots-Tag': 'noindex, nofollow',
16541697
'X-Frame-Options': 'SAMEORIGIN',
16551698
'X-Permitted-Cross-Domain-Policies': 'none',
16561699
'Referrer-Policy': 'no-referrer',
@@ -1670,7 +1713,7 @@ describe('OC.SetupChecks tests', function() {
16701713
'Strict-Transport-Security': 'max-age=15768000',
16711714
'X-XSS-Protection': '1; mode=block',
16721715
'X-Content-Type-Options': 'nosniff',
1673-
'X-Robots-Tag': 'none',
1716+
'X-Robots-Tag': 'noindex, nofollow',
16741717
'X-Frame-Options': 'SAMEORIGIN',
16751718
'X-Permitted-Cross-Domain-Policies': 'none',
16761719
'Referrer-Policy': 'no-referrer',
@@ -1690,7 +1733,7 @@ describe('OC.SetupChecks tests', function() {
16901733
'Strict-Transport-Security': 'max-age=15768000',
16911734
'X-XSS-Protection': '1',
16921735
'X-Content-Type-Options': 'nosniff',
1693-
'X-Robots-Tag': 'none',
1736+
'X-Robots-Tag': 'noindex, nofollow',
16941737
'X-Frame-Options': 'SAMEORIGIN',
16951738
'X-Permitted-Cross-Domain-Policies': 'none',
16961739
'Referrer-Policy': 'no-referrer',
@@ -1715,7 +1758,7 @@ describe('OC.SetupChecks tests', function() {
17151758
'Strict-Transport-Security': 'max-age=15768000',
17161759
'X-XSS-Protection': '0',
17171760
'X-Content-Type-Options': 'nosniff',
1718-
'X-Robots-Tag': 'none',
1761+
'X-Robots-Tag': 'noindex, nofollow',
17191762
'X-Frame-Options': 'SAMEORIGIN',
17201763
'X-Permitted-Cross-Domain-Policies': 'none',
17211764
'Referrer-Policy': 'no-referrer',
@@ -1742,7 +1785,7 @@ describe('OC.SetupChecks tests', function() {
17421785
'Strict-Transport-Security': 'max-age=15768000',
17431786
'X-XSS-Protection': '1; mode=block',
17441787
'X-Content-Type-Options': 'nosniff',
1745-
'X-Robots-Tag': 'none',
1788+
'X-Robots-Tag': 'noindex, nofollow',
17461789
'X-Frame-Options': 'SAMEORIGIN',
17471790
'X-Permitted-Cross-Domain-Policies': 'none',
17481791
'Referrer-Policy': 'no-referrer',
@@ -1762,7 +1805,7 @@ describe('OC.SetupChecks tests', function() {
17621805
'Strict-Transport-Security': 'max-age=15768000',
17631806
'X-XSS-Protection': '1; mode=block',
17641807
'X-Content-Type-Options': 'nosniff',
1765-
'X-Robots-Tag': 'none',
1808+
'X-Robots-Tag': 'noindex, nofollow',
17661809
'X-Frame-Options': 'SAMEORIGIN',
17671810
'X-Permitted-Cross-Domain-Policies': 'none',
17681811
'Referrer-Policy': 'no-referrer-when-downgrade',
@@ -1782,7 +1825,7 @@ describe('OC.SetupChecks tests', function() {
17821825
'Strict-Transport-Security': 'max-age=15768000',
17831826
'X-XSS-Protection': '1; mode=block',
17841827
'X-Content-Type-Options': 'nosniff',
1785-
'X-Robots-Tag': 'none',
1828+
'X-Robots-Tag': 'noindex, nofollow',
17861829
'X-Frame-Options': 'SAMEORIGIN',
17871830
'X-Permitted-Cross-Domain-Policies': 'none',
17881831
'Referrer-Policy': 'strict-origin',
@@ -1802,7 +1845,7 @@ describe('OC.SetupChecks tests', function() {
18021845
'Strict-Transport-Security': 'max-age=15768000',
18031846
'X-XSS-Protection': '1; mode=block',
18041847
'X-Content-Type-Options': 'nosniff',
1805-
'X-Robots-Tag': 'none',
1848+
'X-Robots-Tag': 'noindex, nofollow',
18061849
'X-Frame-Options': 'SAMEORIGIN',
18071850
'X-Permitted-Cross-Domain-Policies': 'none',
18081851
'Referrer-Policy': 'strict-origin-when-cross-origin',
@@ -1822,7 +1865,7 @@ describe('OC.SetupChecks tests', function() {
18221865
'Strict-Transport-Security': 'max-age=15768000',
18231866
'X-XSS-Protection': '1; mode=block',
18241867
'X-Content-Type-Options': 'nosniff',
1825-
'X-Robots-Tag': 'none',
1868+
'X-Robots-Tag': 'noindex, nofollow',
18261869
'X-Frame-Options': 'SAMEORIGIN',
18271870
'X-Permitted-Cross-Domain-Policies': 'none',
18281871
'Referrer-Policy': 'same-origin',
@@ -1842,7 +1885,7 @@ describe('OC.SetupChecks tests', function() {
18421885
'Strict-Transport-Security': 'max-age=15768000',
18431886
'X-XSS-Protection': '1; mode=block',
18441887
'X-Content-Type-Options': 'nosniff',
1845-
'X-Robots-Tag': 'none',
1888+
'X-Robots-Tag': 'noindex, nofollow',
18461889
'X-Frame-Options': 'SAMEORIGIN',
18471890
'X-Permitted-Cross-Domain-Policies': 'none',
18481891
'Referrer-Policy': 'origin',
@@ -1867,7 +1910,7 @@ describe('OC.SetupChecks tests', function() {
18671910
'Strict-Transport-Security': 'max-age=15768000',
18681911
'X-XSS-Protection': '1; mode=block',
18691912
'X-Content-Type-Options': 'nosniff',
1870-
'X-Robots-Tag': 'none',
1913+
'X-Robots-Tag': 'noindex, nofollow',
18711914
'X-Frame-Options': 'SAMEORIGIN',
18721915
'X-Permitted-Cross-Domain-Policies': 'none',
18731916
'Referrer-Policy': 'origin-when-cross-origin',
@@ -1892,7 +1935,7 @@ describe('OC.SetupChecks tests', function() {
18921935
'Strict-Transport-Security': 'max-age=15768000',
18931936
'X-XSS-Protection': '1; mode=block',
18941937
'X-Content-Type-Options': 'nosniff',
1895-
'X-Robots-Tag': 'none',
1938+
'X-Robots-Tag': 'noindex, nofollow',
18961939
'X-Frame-Options': 'SAMEORIGIN',
18971940
'X-Permitted-Cross-Domain-Policies': 'none',
18981941
'Referrer-Policy': 'unsafe-url',
@@ -1919,7 +1962,7 @@ describe('OC.SetupChecks tests', function() {
19191962
{
19201963
'X-XSS-Protection': '1; mode=block',
19211964
'X-Content-Type-Options': 'nosniff',
1922-
'X-Robots-Tag': 'none',
1965+
'X-Robots-Tag': 'noindex, nofollow',
19231966
'X-Frame-Options': 'SAMEORIGIN',
19241967
'X-Permitted-Cross-Domain-Policies': 'none',
19251968
'Referrer-Policy': 'no-referrer',
@@ -1965,7 +2008,7 @@ describe('OC.SetupChecks tests', function() {
19652008
{
19662009
'X-XSS-Protection': '1; mode=block',
19672010
'X-Content-Type-Options': 'nosniff',
1968-
'X-Robots-Tag': 'none',
2011+
'X-Robots-Tag': 'noindex, nofollow',
19692012
'X-Frame-Options': 'SAMEORIGIN',
19702013
'X-Permitted-Cross-Domain-Policies': 'none',
19712014
'Referrer-Policy': 'no-referrer',
@@ -1990,7 +2033,7 @@ describe('OC.SetupChecks tests', function() {
19902033
'Strict-Transport-Security': 'max-age=15551999',
19912034
'X-XSS-Protection': '1; mode=block',
19922035
'X-Content-Type-Options': 'nosniff',
1993-
'X-Robots-Tag': 'none',
2036+
'X-Robots-Tag': 'noindex, nofollow',
19942037
'X-Frame-Options': 'SAMEORIGIN',
19952038
'X-Permitted-Cross-Domain-Policies': 'none',
19962039
'Referrer-Policy': 'no-referrer',
@@ -2015,7 +2058,7 @@ describe('OC.SetupChecks tests', function() {
20152058
'Strict-Transport-Security': 'iAmABogusHeader342',
20162059
'X-XSS-Protection': '1; mode=block',
20172060
'X-Content-Type-Options': 'nosniff',
2018-
'X-Robots-Tag': 'none',
2061+
'X-Robots-Tag': 'noindex, nofollow',
20192062
'X-Frame-Options': 'SAMEORIGIN',
20202063
'X-Permitted-Cross-Domain-Policies': 'none',
20212064
'Referrer-Policy': 'no-referrer',
@@ -2039,7 +2082,7 @@ describe('OC.SetupChecks tests', function() {
20392082
'Strict-Transport-Security': 'max-age=15768000',
20402083
'X-XSS-Protection': '1; mode=block',
20412084
'X-Content-Type-Options': 'nosniff',
2042-
'X-Robots-Tag': 'none',
2085+
'X-Robots-Tag': 'noindex, nofollow',
20432086
'X-Frame-Options': 'SAMEORIGIN',
20442087
'X-Permitted-Cross-Domain-Policies': 'none',
20452088
'Referrer-Policy': 'no-referrer',
@@ -2059,7 +2102,7 @@ describe('OC.SetupChecks tests', function() {
20592102
'Strict-Transport-Security': 'max-age=99999999',
20602103
'X-XSS-Protection': '1; mode=block',
20612104
'X-Content-Type-Options': 'nosniff',
2062-
'X-Robots-Tag': 'none',
2105+
'X-Robots-Tag': 'noindex, nofollow',
20632106
'X-Frame-Options': 'SAMEORIGIN',
20642107
'X-Permitted-Cross-Domain-Policies': 'none',
20652108
'Referrer-Policy': 'no-referrer',
@@ -2079,7 +2122,7 @@ describe('OC.SetupChecks tests', function() {
20792122
'Strict-Transport-Security': 'max-age=99999999; includeSubDomains',
20802123
'X-XSS-Protection': '1; mode=block',
20812124
'X-Content-Type-Options': 'nosniff',
2082-
'X-Robots-Tag': 'none',
2125+
'X-Robots-Tag': 'noindex, nofollow',
20832126
'X-Frame-Options': 'SAMEORIGIN',
20842127
'X-Permitted-Cross-Domain-Policies': 'none',
20852128
'Referrer-Policy': 'no-referrer',
@@ -2099,7 +2142,7 @@ describe('OC.SetupChecks tests', function() {
20992142
'Strict-Transport-Security': 'max-age=99999999; preload; includeSubDomains',
21002143
'X-XSS-Protection': '1; mode=block',
21012144
'X-Content-Type-Options': 'nosniff',
2102-
'X-Robots-Tag': 'none',
2145+
'X-Robots-Tag': 'noindex, nofollow',
21032146
'X-Frame-Options': 'SAMEORIGIN',
21042147
'X-Permitted-Cross-Domain-Policies': 'none',
21052148
'Referrer-Policy': 'no-referrer',

‎lib/private/legacy/OC_Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public static function addSecurityHeaders() {
9999
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
100100
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
101101
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
102-
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
102+
header('X-Robots-Tag: noindex, nofollow'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
103103
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
104104
}
105105
}

‎lib/public/AppFramework/Http/Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ public function getHeaders() {
258258

259259
$this->headers['Content-Security-Policy'] = $this->getContentSecurityPolicy()->buildPolicy();
260260
$this->headers['Feature-Policy'] = $this->getFeaturePolicy()->buildPolicy();
261-
$this->headers['X-Robots-Tag'] = 'none';
261+
$this->headers['X-Robots-Tag'] = 'noindex, nofollow';
262262

263263
if ($this->ETag) {
264264
$mergeWith['ETag'] = '"' . $this->ETag . '"';

‎tests/data/setUploadLimit/htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
# Add security and privacy related headers
1212
Header set X-Content-Type-Options "nosniff"
1313
Header set X-XSS-Protection "1; mode=block"
14-
Header set X-Robots-Tag "none"
14+
Header set X-Robots-Tag "noindex, nofollow"
1515
Header set X-Frame-Options "SAMEORIGIN"
1616
SetEnv modHeadersAvailable true
1717
</IfModule>

‎tests/lib/AppFramework/Controller/ControllerTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ public function testFormatDataResponseJSON() {
117117
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'",
118118
'Feature-Policy' => "autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'",
119119
'X-Request-Id' => $this->request->getId(),
120-
'X-Robots-Tag' => 'none',
120+
'X-Robots-Tag' => 'noindex, nofollow',
121121
];
122122

123123
$response = $this->controller->customDataResponse(['hi']);

0 commit comments

Comments
 (0)