x_frame_options check: Check if header not empty, not just exist

Arachni · Dec 18, 2021 · 7544bba · 7544bba
1 parent bafc02c
commit 7544bba
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/components/checks/passive/grep/x_frame_options.rb b/components/checks/passive/grep/x_frame_options.rb
@@ -12,7 +12,8 @@ class Arachni::Checks::XFrameOptions < Arachni::Check::Base
     def run
         return if audited?( page.parsed_url.host ) ||
             page.response.headers.empty? ||
-            page.response.headers['X-Frame-Options'] || page.code != 200
+            !page.response.headers['X-Frame-Options'].to_s.empty? || page.code != 200
+
         audited( page.parsed_url.host )
 
         log(