force to send x-* headers back to the client (browser)

Author: ton31337

nginx/modsecurity/ngx_http_modsecurity.c

@@ -70,6 +70,7 @@
 
 typedef struct {
     ngx_flag_t enable;
+    ngx_flag_t x_headers;
     directory_config *config;
 
     ngx_str_t *file;
@@ -158,6 +159,12 @@ static ngx_command_t ngx_http_modsecurity_commands[] =  {
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(ngx_http_modsecurity_loc_conf_t, enable),
     NULL },
+  { ngx_string("ModSecurityXHeaders"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_flag_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(ngx_http_modsecurity_loc_conf_t, x_headers),
+    NULL },
   ngx_null_command
 };
 
@@ -548,6 +555,10 @@ static int ngx_http_modsecurity_save_headers_in_visitor(void *data,
     }
 
     ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
+    h->lowcase_key[h->key.len] = '\0';
+
+    if(!ngx_strcmp(h->lowcase_key, "host"))
+      return 1;
 
     h->hash = ngx_hash_key(h->lowcase_key, h->key.len);
 
@@ -822,6 +833,7 @@ ngx_http_modsecurity_save_headers_out_visitor(void *data,
     ngx_http_upstream_main_conf_t  *umcf;
 
     umcf = ngx_http_get_module_main_conf(r, ngx_http_upstream_module);
+    ngx_http_modsecurity_loc_conf_t *conf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity);
 
     h = &he;
 
@@ -838,6 +850,20 @@ ngx_http_modsecurity_save_headers_out_visitor(void *data,
 
     ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
 
+    if(conf->x_headers) {
+      h->lowcase_key[h->key.len] = '\0';
+      if(h->lowcase_key[0] == 'x' &&
+          h->lowcase_key[1] == '-') {
+
+        new_h = ngx_list_push(&r->headers_out.headers);
+        new_h->key = h->key;
+        new_h->value = h->value;
+        new_h->hash = 1;
+        return 1;
+
+      }
+    }
+
     h->hash = ngx_hash_key(h->lowcase_key, h->key.len);
 
     hh = ngx_hash_find(&umcf->headers_in_hash, h->hash,
@@ -1017,6 +1043,7 @@ ngx_http_modsecurity_create_loc_conf(ngx_conf_t *cf)
 
     conf->config = NGX_CONF_UNSET_PTR;
     conf->enable = NGX_CONF_UNSET;
+    conf->x_headers = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -1030,6 +1057,7 @@ ngx_http_modsecurity_merge_loc_conf(ngx_conf_t *cf, void *parent,
     ngx_http_modsecurity_loc_conf_t  *conf = child;
 
     ngx_conf_merge_value(conf->enable, prev->enable, 0);
+    ngx_conf_merge_value(conf->x_headers, prev->x_headers, 0);
     ngx_conf_merge_ptr_value(conf->config, prev->config, NULL);
 
     if (conf->enable && conf->config == NULL) {