Skip to content

Commit 7e48530

Browse files
blizzzblizzz
authored
Merge pull request #36750 from nextcloud/backport/36689/stable24
[stable24] Change X-Robots-Tag header from "none" to "noindex, nofollow"
2 parents a3a05f4 + 30c0937 commit 7e48530

File tree

12 files changed

+80
-37
lines changed

12 files changed

+80
-37
lines changed

‎.htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
Header always set X-Permitted-Cross-Domain-Policies "none"
3232

3333
Header onsuccess unset X-Robots-Tag
34-
Header always set X-Robots-Tag "none"
34+
Header always set X-Robots-Tag "noindex, nofollow"
3535

3636
Header onsuccess unset X-XSS-Protection
3737
Header always set X-XSS-Protection "1; mode=block"

‎build/integration/features/carddav.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Feature: carddav
4646
|X-Content-Type-Options |nosniff|
4747
|X-Frame-Options|SAMEORIGIN|
4848
|X-Permitted-Cross-Domain-Policies|none|
49-
|X-Robots-Tag|none|
49+
|X-Robots-Tag|noindex, nofollow|
5050
|X-XSS-Protection|1; mode=block|
5151

5252
Scenario: Exporting the picture of ones own contact
@@ -60,5 +60,5 @@ Feature: carddav
6060
|X-Content-Type-Options |nosniff|
6161
|X-Frame-Options|SAMEORIGIN|
6262
|X-Permitted-Cross-Domain-Policies|none|
63-
|X-Robots-Tag|none|
63+
|X-Robots-Tag|noindex, nofollow|
6464
|X-XSS-Protection|1; mode=block|

‎build/integration/features/dav-v2.feature‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Feature: dav-v2
2727
|X-Content-Type-Options |nosniff|
2828
|X-Frame-Options|SAMEORIGIN|
2929
|X-Permitted-Cross-Domain-Policies|none|
30-
|X-Robots-Tag|none|
30+
|X-Robots-Tag|noindex, nofollow|
3131
|X-XSS-Protection|1; mode=block|
3232
And Downloaded content should start with "Welcome to your Nextcloud account!"
3333

‎build/integration/features/webdav-related.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Feature: webdav-related
5353
And User "user0" moves file "/textfile0.txt" to "/testshare/textfile0.txt"
5454
And the HTTP status code should be "403"
5555
When Downloading file "/testshare/textfile0.txt"
56-
Then the HTTP status code should be "404"
56+
Then the HTTP status code should be "404"
5757

5858
Scenario: Moving a file to overwrite a file in a folder with no permissions
5959
Given using old dav path
@@ -251,7 +251,7 @@ Feature: webdav-related
251251
|X-Content-Type-Options |nosniff|
252252
|X-Frame-Options|SAMEORIGIN|
253253
|X-Permitted-Cross-Domain-Policies|none|
254-
|X-Robots-Tag|none|
254+
|X-Robots-Tag|noindex, nofollow|
255255
|X-XSS-Protection|1; mode=block|
256256
And Downloaded content should start with "Welcome to your Nextcloud account!"
257257

‎core/js/setupchecks.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -621,13 +621,13 @@
621621
if (xhr.status === 200) {
622622
var securityHeaders = {
623623
'X-Content-Type-Options': ['nosniff'],
624-
'X-Robots-Tag': ['none'],
624+
'X-Robots-Tag': ['noindex, nofollow'],
625625
'X-Frame-Options': ['SAMEORIGIN', 'DENY'],
626626
'X-Permitted-Cross-Domain-Policies': ['none'],
627627
};
628628
for (var header in securityHeaders) {
629629
var option = securityHeaders[header][0];
630-
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== option.toLowerCase()) {
630+
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).replace(/, /, ',').toLowerCase() !== option.replace(/, /, ',').toLowerCase()) {
631631
var msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});
632632
if(xhr.getResponseHeader(header) && securityHeaders[header].length > 1 && xhr.getResponseHeader(header).toLowerCase() === securityHeaders[header][1].toLowerCase()) {
633633
msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". Some features might not work correctly, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});

‎core/js/tests/specs/setupchecksSpec.js‎

Lines changed: 66 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1490,7 +1490,7 @@ describe('OC.SetupChecks tests', function() {
14901490
msg: 'The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14911491
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
14921492
}, {
1493-
msg: 'The "X-Robots-Tag" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1493+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14941494
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
14951495
}, {
14961496
msg: 'The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
@@ -1517,7 +1517,7 @@ describe('OC.SetupChecks tests', function() {
15171517
suite.server.requests[0].respond(
15181518
200,
15191519
{
1520-
'X-Robots-Tag': 'none',
1520+
'X-Robots-Tag': 'noindex, nofollow',
15211521
'X-Frame-Options': 'SAMEORIGIN',
15221522
'Strict-Transport-Security': 'max-age=15768000;preload',
15231523
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1548,7 +1548,7 @@ describe('OC.SetupChecks tests', function() {
15481548
{
15491549
'X-XSS-Protection': '1; mode=block',
15501550
'X-Content-Type-Options': 'nosniff',
1551-
'X-Robots-Tag': 'none',
1551+
'X-Robots-Tag': 'noindex, nofollow',
15521552
'X-Frame-Options': 'SAMEORIGIN',
15531553
'Strict-Transport-Security': 'max-age=15768000',
15541554
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1562,6 +1562,49 @@ describe('OC.SetupChecks tests', function() {
15621562
});
15631563
});
15641564

1565+
describe('check X-Robots-Tag header', function() {
1566+
it('should return no message if X-Robots-Tag is set to noindex,nofollow without space', function(done) {
1567+
protocolStub.returns('https');
1568+
var result = OC.SetupChecks.checkGeneric();
1569+
suite.server.requests[0].respond(200, {
1570+
'Strict-Transport-Security': 'max-age=15768000',
1571+
'X-XSS-Protection': '1; mode=block',
1572+
'X-Content-Type-Options': 'nosniff',
1573+
'X-Robots-Tag': 'noindex,nofollow',
1574+
'X-Frame-Options': 'SAMEORIGIN',
1575+
'X-Permitted-Cross-Domain-Policies': 'none',
1576+
'Referrer-Policy': 'no-referrer',
1577+
});
1578+
result.done(function( data, s, x ){
1579+
expect(data).toEqual([]);
1580+
done();
1581+
});
1582+
});
1583+
1584+
it('should return a message if X-Robots-Tag is set to none', function(done) {
1585+
protocolStub.returns('https');
1586+
var result = OC.SetupChecks.checkGeneric();
1587+
suite.server.requests[0].respond(200, {
1588+
'Strict-Transport-Security': 'max-age=15768000',
1589+
'X-XSS-Protection': '1; mode=block',
1590+
'X-Content-Type-Options': 'nosniff',
1591+
'X-Robots-Tag': 'none',
1592+
'X-Frame-Options': 'SAMEORIGIN',
1593+
'X-Permitted-Cross-Domain-Policies': 'none',
1594+
'Referrer-Policy': 'no-referrer',
1595+
});
1596+
result.done(function( data, s, x ){
1597+
expect(data).toEqual([
1598+
{
1599+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1600+
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
1601+
}
1602+
]);
1603+
done();
1604+
});
1605+
});
1606+
});
1607+
15651608
describe('check X-XSS-Protection header', function() {
15661609
it('should return no message if X-XSS-Protection is set to 1; mode=block; report=https://example.com', function(done) {
15671610
protocolStub.returns('https');
@@ -1571,7 +1614,7 @@ describe('OC.SetupChecks tests', function() {
15711614
'Strict-Transport-Security': 'max-age=15768000',
15721615
'X-XSS-Protection': '1; mode=block; report=https://example.com',
15731616
'X-Content-Type-Options': 'nosniff',
1574-
'X-Robots-Tag': 'none',
1617+
'X-Robots-Tag': 'noindex, nofollow',
15751618
'X-Frame-Options': 'SAMEORIGIN',
15761619
'X-Permitted-Cross-Domain-Policies': 'none',
15771620
'Referrer-Policy': 'no-referrer',
@@ -1591,7 +1634,7 @@ describe('OC.SetupChecks tests', function() {
15911634
'Strict-Transport-Security': 'max-age=15768000',
15921635
'X-XSS-Protection': '1; mode=block',
15931636
'X-Content-Type-Options': 'nosniff',
1594-
'X-Robots-Tag': 'none',
1637+
'X-Robots-Tag': 'noindex, nofollow',
15951638
'X-Frame-Options': 'SAMEORIGIN',
15961639
'X-Permitted-Cross-Domain-Policies': 'none',
15971640
'Referrer-Policy': 'no-referrer',
@@ -1611,7 +1654,7 @@ describe('OC.SetupChecks tests', function() {
16111654
'Strict-Transport-Security': 'max-age=15768000',
16121655
'X-XSS-Protection': '1',
16131656
'X-Content-Type-Options': 'nosniff',
1614-
'X-Robots-Tag': 'none',
1657+
'X-Robots-Tag': 'noindex, nofollow',
16151658
'X-Frame-Options': 'SAMEORIGIN',
16161659
'X-Permitted-Cross-Domain-Policies': 'none',
16171660
'Referrer-Policy': 'no-referrer',
@@ -1636,7 +1679,7 @@ describe('OC.SetupChecks tests', function() {
16361679
'Strict-Transport-Security': 'max-age=15768000',
16371680
'X-XSS-Protection': '0',
16381681
'X-Content-Type-Options': 'nosniff',
1639-
'X-Robots-Tag': 'none',
1682+
'X-Robots-Tag': 'noindex, nofollow',
16401683
'X-Frame-Options': 'SAMEORIGIN',
16411684
'X-Permitted-Cross-Domain-Policies': 'none',
16421685
'Referrer-Policy': 'no-referrer',
@@ -1663,7 +1706,7 @@ describe('OC.SetupChecks tests', function() {
16631706
'Strict-Transport-Security': 'max-age=15768000',
16641707
'X-XSS-Protection': '1; mode=block',
16651708
'X-Content-Type-Options': 'nosniff',
1666-
'X-Robots-Tag': 'none',
1709+
'X-Robots-Tag': 'noindex, nofollow',
16671710
'X-Frame-Options': 'SAMEORIGIN',
16681711
'X-Permitted-Cross-Domain-Policies': 'none',
16691712
'Referrer-Policy': 'no-referrer',
@@ -1683,7 +1726,7 @@ describe('OC.SetupChecks tests', function() {
16831726
'Strict-Transport-Security': 'max-age=15768000',
16841727
'X-XSS-Protection': '1; mode=block',
16851728
'X-Content-Type-Options': 'nosniff',
1686-
'X-Robots-Tag': 'none',
1729+
'X-Robots-Tag': 'noindex, nofollow',
16871730
'X-Frame-Options': 'SAMEORIGIN',
16881731
'X-Permitted-Cross-Domain-Policies': 'none',
16891732
'Referrer-Policy': 'no-referrer-when-downgrade',
@@ -1703,7 +1746,7 @@ describe('OC.SetupChecks tests', function() {
17031746
'Strict-Transport-Security': 'max-age=15768000',
17041747
'X-XSS-Protection': '1; mode=block',
17051748
'X-Content-Type-Options': 'nosniff',
1706-
'X-Robots-Tag': 'none',
1749+
'X-Robots-Tag': 'noindex, nofollow',
17071750
'X-Frame-Options': 'SAMEORIGIN',
17081751
'X-Permitted-Cross-Domain-Policies': 'none',
17091752
'Referrer-Policy': 'strict-origin',
@@ -1723,7 +1766,7 @@ describe('OC.SetupChecks tests', function() {
17231766
'Strict-Transport-Security': 'max-age=15768000',
17241767
'X-XSS-Protection': '1; mode=block',
17251768
'X-Content-Type-Options': 'nosniff',
1726-
'X-Robots-Tag': 'none',
1769+
'X-Robots-Tag': 'noindex, nofollow',
17271770
'X-Frame-Options': 'SAMEORIGIN',
17281771
'X-Permitted-Cross-Domain-Policies': 'none',
17291772
'Referrer-Policy': 'strict-origin-when-cross-origin',
@@ -1743,7 +1786,7 @@ describe('OC.SetupChecks tests', function() {
17431786
'Strict-Transport-Security': 'max-age=15768000',
17441787
'X-XSS-Protection': '1; mode=block',
17451788
'X-Content-Type-Options': 'nosniff',
1746-
'X-Robots-Tag': 'none',
1789+
'X-Robots-Tag': 'noindex, nofollow',
17471790
'X-Frame-Options': 'SAMEORIGIN',
17481791
'X-Permitted-Cross-Domain-Policies': 'none',
17491792
'Referrer-Policy': 'same-origin',
@@ -1763,7 +1806,7 @@ describe('OC.SetupChecks tests', function() {
17631806
'Strict-Transport-Security': 'max-age=15768000',
17641807
'X-XSS-Protection': '1; mode=block',
17651808
'X-Content-Type-Options': 'nosniff',
1766-
'X-Robots-Tag': 'none',
1809+
'X-Robots-Tag': 'noindex, nofollow',
17671810
'X-Frame-Options': 'SAMEORIGIN',
17681811
'X-Permitted-Cross-Domain-Policies': 'none',
17691812
'Referrer-Policy': 'origin',
@@ -1788,7 +1831,7 @@ describe('OC.SetupChecks tests', function() {
17881831
'Strict-Transport-Security': 'max-age=15768000',
17891832
'X-XSS-Protection': '1; mode=block',
17901833
'X-Content-Type-Options': 'nosniff',
1791-
'X-Robots-Tag': 'none',
1834+
'X-Robots-Tag': 'noindex, nofollow',
17921835
'X-Frame-Options': 'SAMEORIGIN',
17931836
'X-Permitted-Cross-Domain-Policies': 'none',
17941837
'Referrer-Policy': 'origin-when-cross-origin',
@@ -1813,7 +1856,7 @@ describe('OC.SetupChecks tests', function() {
18131856
'Strict-Transport-Security': 'max-age=15768000',
18141857
'X-XSS-Protection': '1; mode=block',
18151858
'X-Content-Type-Options': 'nosniff',
1816-
'X-Robots-Tag': 'none',
1859+
'X-Robots-Tag': 'noindex, nofollow',
18171860
'X-Frame-Options': 'SAMEORIGIN',
18181861
'X-Permitted-Cross-Domain-Policies': 'none',
18191862
'Referrer-Policy': 'unsafe-url',
@@ -1840,7 +1883,7 @@ describe('OC.SetupChecks tests', function() {
18401883
{
18411884
'X-XSS-Protection': '1; mode=block',
18421885
'X-Content-Type-Options': 'nosniff',
1843-
'X-Robots-Tag': 'none',
1886+
'X-Robots-Tag': 'noindex, nofollow',
18441887
'X-Frame-Options': 'SAMEORIGIN',
18451888
'X-Permitted-Cross-Domain-Policies': 'none',
18461889
'Referrer-Policy': 'no-referrer',
@@ -1886,7 +1929,7 @@ describe('OC.SetupChecks tests', function() {
18861929
{
18871930
'X-XSS-Protection': '1; mode=block',
18881931
'X-Content-Type-Options': 'nosniff',
1889-
'X-Robots-Tag': 'none',
1932+
'X-Robots-Tag': 'noindex, nofollow',
18901933
'X-Frame-Options': 'SAMEORIGIN',
18911934
'X-Permitted-Cross-Domain-Policies': 'none',
18921935
'Referrer-Policy': 'no-referrer',
@@ -1911,7 +1954,7 @@ describe('OC.SetupChecks tests', function() {
19111954
'Strict-Transport-Security': 'max-age=15551999',
19121955
'X-XSS-Protection': '1; mode=block',
19131956
'X-Content-Type-Options': 'nosniff',
1914-
'X-Robots-Tag': 'none',
1957+
'X-Robots-Tag': 'noindex, nofollow',
19151958
'X-Frame-Options': 'SAMEORIGIN',
19161959
'X-Permitted-Cross-Domain-Policies': 'none',
19171960
'Referrer-Policy': 'no-referrer',
@@ -1936,7 +1979,7 @@ describe('OC.SetupChecks tests', function() {
19361979
'Strict-Transport-Security': 'iAmABogusHeader342',
19371980
'X-XSS-Protection': '1; mode=block',
19381981
'X-Content-Type-Options': 'nosniff',
1939-
'X-Robots-Tag': 'none',
1982+
'X-Robots-Tag': 'noindex, nofollow',
19401983
'X-Frame-Options': 'SAMEORIGIN',
19411984
'X-Permitted-Cross-Domain-Policies': 'none',
19421985
'Referrer-Policy': 'no-referrer',
@@ -1960,7 +2003,7 @@ describe('OC.SetupChecks tests', function() {
19602003
'Strict-Transport-Security': 'max-age=15768000',
19612004
'X-XSS-Protection': '1; mode=block',
19622005
'X-Content-Type-Options': 'nosniff',
1963-
'X-Robots-Tag': 'none',
2006+
'X-Robots-Tag': 'noindex, nofollow',
19642007
'X-Frame-Options': 'SAMEORIGIN',
19652008
'X-Permitted-Cross-Domain-Policies': 'none',
19662009
'Referrer-Policy': 'no-referrer',
@@ -1980,7 +2023,7 @@ describe('OC.SetupChecks tests', function() {
19802023
'Strict-Transport-Security': 'max-age=99999999',
19812024
'X-XSS-Protection': '1; mode=block',
19822025
'X-Content-Type-Options': 'nosniff',
1983-
'X-Robots-Tag': 'none',
2026+
'X-Robots-Tag': 'noindex, nofollow',
19842027
'X-Frame-Options': 'SAMEORIGIN',
19852028
'X-Permitted-Cross-Domain-Policies': 'none',
19862029
'Referrer-Policy': 'no-referrer',
@@ -2000,7 +2043,7 @@ describe('OC.SetupChecks tests', function() {
20002043
'Strict-Transport-Security': 'max-age=99999999; includeSubDomains',
20012044
'X-XSS-Protection': '1; mode=block',
20022045
'X-Content-Type-Options': 'nosniff',
2003-
'X-Robots-Tag': 'none',
2046+
'X-Robots-Tag': 'noindex, nofollow',
20042047
'X-Frame-Options': 'SAMEORIGIN',
20052048
'X-Permitted-Cross-Domain-Policies': 'none',
20062049
'Referrer-Policy': 'no-referrer',
@@ -2020,7 +2063,7 @@ describe('OC.SetupChecks tests', function() {
20202063
'Strict-Transport-Security': 'max-age=99999999; preload; includeSubDomains',
20212064
'X-XSS-Protection': '1; mode=block',
20222065
'X-Content-Type-Options': 'nosniff',
2023-
'X-Robots-Tag': 'none',
2066+
'X-Robots-Tag': 'noindex, nofollow',
20242067
'X-Frame-Options': 'SAMEORIGIN',
20252068
'X-Permitted-Cross-Domain-Policies': 'none',
20262069
'Referrer-Policy': 'no-referrer',

‎lib/private/legacy/OC_Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public static function addSecurityHeaders() {
9999
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
100100
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
101101
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
102-
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
102+
header('X-Robots-Tag: noindex, nofollow'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
103103
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
104104
}
105105
}

‎lib/public/AppFramework/Http/Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ public function getHeaders() {
256256

257257
$this->headers['Content-Security-Policy'] = $this->getContentSecurityPolicy()->buildPolicy();
258258
$this->headers['Feature-Policy'] = $this->getFeaturePolicy()->buildPolicy();
259-
$this->headers['X-Robots-Tag'] = 'none';
259+
$this->headers['X-Robots-Tag'] = 'noindex, nofollow';
260260

261261
if ($this->ETag) {
262262
$mergeWith['ETag'] = '"' . $this->ETag . '"';

‎tests/data/setUploadLimit/htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
# Add security and privacy related headers
1212
Header set X-Content-Type-Options "nosniff"
1313
Header set X-XSS-Protection "1; mode=block"
14-
Header set X-Robots-Tag "none"
14+
Header set X-Robots-Tag "noindex, nofollow"
1515
Header set X-Frame-Options "SAMEORIGIN"
1616
SetEnv modHeadersAvailable true
1717
</IfModule>

‎tests/lib/AppFramework/Controller/ControllerTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ public function testFormatDataResponseJSON() {
117117
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'",
118118
'Feature-Policy' => "autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'",
119119
'X-Request-Id' => $this->request->getId(),
120-
'X-Robots-Tag' => 'none',
120+
'X-Robots-Tag' => 'noindex, nofollow',
121121
];
122122

123123
$response = $this->controller->customDataResponse(['hi']);

0 commit comments

Comments
 (0)