MiringValidator Changelog

All notable changes to the Miring Validator are documented here.

v1.3.0 2026-06-24

Security Hardening (DAST Scan Remediation)

Added Strict-Transport-Security (HSTS) header - enforces HTTPS for 1 year
Added Permissions-Policy header - disables unused browser APIs (camera, microphone, geolocation, payment)
Expanded Content-Security-Policy - added frame-ancestors, form-action, base-uri directives
Added X-Frame-Options: DENY on all responses including Jersey endpoints
Suppressed Server and X-Powered-By response headers to reduce information leakage
Added Cache-Control: no-store on validator API responses
Session cookie hardening: HttpOnly, Secure flags, COOKIE-only tracking mode
Removed Access-Control-Allow-Credentials: true from CORS (unsafe with wildcard origin)
Removed dead PHP block from index.html (information leakage)
Added Subresource Integrity (SRI) attributes to CDN-loaded scripts
Fixed JavaScript global variable leaks (memory leak findings)
Fixed unclosed iframe document.write in rule table rendering

CI/CD Improvements

Enabled pipeline execution and dev1 deployment for all branch types (feature/, debug/, breakfix/, security/, etc.)
Added Maven auto-versioning - patch increment on feature branches, minor increment on release

Security

XML External Entity (XXE) protection - disabled external entity processing in all XML parsers
Updated org.json from 20140107 to 20231013 (CVE-2022-45688, CVE-2023-5072)
Path traversal protection in test utilities
Added JAXB dependencies for Java 11+ compatibility

Features

Initial Release