From 51041e37b72abcd2e0a4b1643346fd3787084e37 Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Sun, 9 Aug 2026 16:19:17 -0700
Subject: [PATCH] Fix clickjacking level 1 framing protection

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../clickjacking/ClickjackingVulnerability.java     |  6 +++++-
 .../clickjacking/ClickjackingVulnerabilityTest.java | 13 +++++--------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
index 984500b1d..2923e36c7 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
@@ -62,7 +62,11 @@ public class ClickjackingVulnerability {
             value = LevelConstants.LEVEL_1,
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> noFramingProtection() {
-        return ResponseEntity.ok(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        HttpHeaders headers = new HttpHeaders();
+        headers.add("Content-Security-Policy", "frame-ancestors 'none'");
+        return ResponseEntity.ok()
+                .headers(headers)
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
     }
 
     /**
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
index d0832dda3..3f3b92132 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
@@ -25,14 +25,15 @@ void setUp() {
     }
 
     @Test
-    @DisplayName("Level 1 - No X-Frame-Options header present, page fully vulnerable")
-    void test_Level1_NoFramingProtection_HeaderAbsent() {
+    @DisplayName("Level 1 - CSP frame-ancestors none prevents framing")
+    void test_Level1_CSP_FrameAncestors_None() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.noFramingProtection();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
         assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).isNull();
-        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
+        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
     }
 
     @Test
@@ -98,10 +99,8 @@ void test_Level7_OverlayAttack_SameOrigin() {
     }
 
     @Test
-    @DisplayName("Vulnerable levels (1, 2, 3, 6, 7) do not set DENY or frame-ancestors none")
+    @DisplayName("Vulnerable levels (2, 3, 6, 7) do not set DENY or frame-ancestors none")
     void test_VulnerableLevels_DoNotHaveSecureHeaders() {
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> level1 =
-                clickjackingVulnerability.noFramingProtection();
         ResponseEntity<GenericVulnerabilityResponseBean<String>> level2 =
                 clickjackingVulnerability.xFrameOptionsAllowAll();
         ResponseEntity<GenericVulnerabilityResponseBean<String>> level3 =
@@ -111,13 +110,11 @@ void test_VulnerableLevels_DoNotHaveSecureHeaders() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> level7 =
                 clickjackingVulnerability.overlayAttackSameOrigin();
 
-        assertThat(level1.getHeaders().get(X_FRAME_OPTIONS)).isNull();
         assertThat(level2.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
         assertThat(level3.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
         assertThat(level6.getHeaders().get(X_FRAME_OPTIONS)).isNull();
         assertThat(level7.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
 
-        assertThat(level1.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
         assertThat(level2.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
         assertThat(level3.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
         assertThat(level6.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();