replace if by switch & check for uncorrect enum

Author: novashdima

src/ngx_http_security_headers_module.c

@@ -272,15 +272,26 @@ ngx_http_security_headers_filter(ngx_http_request_t *r)
         && NGX_HTTP_SECURITY_HEADER_OMIT != slcf->xss
         && ngx_http_test_content_type(r, &slcf->text_types) != NULL)
     {
-        ngx_str_set(&key, "X-XSS-Protection");
-        if (NGX_HTTP_XSS_HEADER_ON == slcf->xss) {
-            ngx_str_set(&val, "1");
-        } else if (NGX_HTTP_XSS_HEADER_BLOCK == slcf->xss) {
-            ngx_str_set(&val, "1; mode=block");
-        } else if (NGX_HTTP_XSS_HEADER_OFF == slcf->xss) {
-            ngx_str_set(&val, "0");
+
+        switch (slcf->xss) {
+            case NGX_HTTP_XSS_HEADER_ON:
+                ngx_str_set(&val, "1");
+                break;
+            case NGX_HTTP_XSS_HEADER_BLOCK:
+                ngx_str_set(&val, "1; mode=block");
+                break;
+            case NGX_HTTP_XSS_HEADER_OFF:
+                ngx_str_set(&val, "0");
+                break;
+            default:
+                val.len = 0;
+                val.data = NULL;
+        }
+
+        if (val.data) {
+            ngx_str_set(&key, "X-XSS-Protection");
+            ngx_set_headers_out_by_search(r, &key, &val);
         }
-        ngx_set_headers_out_by_search(r, &key, &val);
     }
 
     scheme_value = ngx_http_get_variable(r, &scheme, scheme_hash_key);
@@ -300,38 +311,62 @@ ngx_http_security_headers_filter(ngx_http_request_t *r)
         && NGX_HTTP_SECURITY_HEADER_OMIT != slcf->fo
         && ngx_http_test_content_type(r, &slcf->text_types) != NULL)
     {
-        ngx_str_set(&key, "X-Frame-Options");
-        if (NGX_HTTP_FO_HEADER_SAME == slcf->fo) {
-            ngx_str_set(&val, "SAMEORIGIN");
-        } else if (NGX_HTTP_FO_HEADER_DENY == slcf->fo) {
-            ngx_str_set(&val, "DENY");
+
+        switch (slcf->fo) {
+            case NGX_HTTP_FO_HEADER_SAME:
+                ngx_str_set(&val, "SAMEORIGIN");
+                break;
+            case NGX_HTTP_FO_HEADER_DENY:
+                ngx_str_set(&val, "DENY");
+                break;
+            default:
+                val.len = 0;
+                val.data = NULL;
+        }
+
+        if (val.data) {
+            ngx_str_set(&key, "X-Frame-Options");
+            ngx_set_headers_out_by_search(r, &key, &val);
         }
-        ngx_set_headers_out_by_search(r, &key, &val);
     }
 
     /* Referrer-Policy: no-referrer-when-downgrade */
     if (r->headers_out.status != NGX_HTTP_NOT_MODIFIED
         && NGX_HTTP_SECURITY_HEADER_OMIT != slcf->rp) {
-            ngx_str_set(&key, "Referrer-Policy");
 
-            if (NGX_HTTP_RP_HEADER_NO == slcf->rp) {
-                ngx_str_set(&val, "no-referrer");
-            } else if (NGX_HTTP_RP_HEADER_DOWNGRADE == slcf->rp) {
-                ngx_str_set(&val, "no-referrer-when-downgrade");
-            } else if (NGX_HTTP_RP_HEADER_SAME_ORIGIN == slcf->rp) {
-                ngx_str_set(&val, "same-origin");
-            } else if (NGX_HTTP_RP_HEADER_ORIGIN == slcf->rp) {
-                ngx_str_set(&val, "origin");
-            } else if (NGX_HTTP_RP_HEADER_STRICT_ORIGIN == slcf->rp) {
-                ngx_str_set(&val, "strict-origin");
-            } else if (NGX_HTTP_RP_HEADER_ORIGIN_WHEN_CROSS == slcf->rp) {
-                ngx_str_set(&val, "origin-when-cross-origin");
-            } else if (NGX_HTTP_RP_HEADER_STRICT_ORIG_WHEN_CROSS == slcf->rp) {
-                ngx_str_set(&val, "strict-origin-when-cross-origin");
-            } else if (NGX_HTTP_RP_HEADER_UNSAFE_URL == slcf->rp) {
-                ngx_str_set(&val, "unsafe-url");
+            switch (slcf->rp) {
+                case NGX_HTTP_RP_HEADER_NO:
+                    ngx_str_set(&val, "no-referrer");
+                    break;
+                case NGX_HTTP_RP_HEADER_DOWNGRADE:
+                    ngx_str_set(&val, "no-referrer-when-downgrade");
+                    break;
+                case NGX_HTTP_RP_HEADER_SAME_ORIGIN:
+                    ngx_str_set(&val, "same-origin");
+                    break;
+                case NGX_HTTP_RP_HEADER_ORIGIN:
+                    ngx_str_set(&val, "origin");
+                    break;
+                case NGX_HTTP_RP_HEADER_STRICT_ORIGIN:
+                    ngx_str_set(&val, "strict-origin");
+                    break;
+                case NGX_HTTP_RP_HEADER_ORIGIN_WHEN_CROSS:
+                    ngx_str_set(&val, "origin-when-cross-origin");
+                    break;
+                case NGX_HTTP_RP_HEADER_STRICT_ORIG_WHEN_CROSS:
+                    ngx_str_set(&val, "strict-origin-when-cross-origin");
+                    break;
+                case NGX_HTTP_RP_HEADER_UNSAFE_URL:
+                    ngx_str_set(&val, "unsafe-url");
+                    break;
+                default:
+                    val.len = 0;
+                    val.data = NULL;
             }
-        ngx_set_headers_out_by_search(r, &key, &val);
+        if (val.data) {
+            ngx_str_set(&key, "Referrer-Policy");
+            ngx_set_headers_out_by_search(r, &key, &val);
+        }
     }