Add Referrer-Policy header check and update description

[balaakasam]

Description

Adds a missing Referrer-Policy header check to the existing Multiple Security Header Check script and updates the metadata description to include it in the list of checked headers.

Changes

• Added Referrer-Policy to the metadata description list
• Added check for missing Referrer-Policy header with appropriate alert name, description, and solution

Why

The Referrer-Policy header is a modern security header recommended by OWASP and included in the OWASP Secure Headers Project. It was missing from this script while all other major security headers were already covered.

References

• https://owasp.org/www-project-secure-headers/
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

[psiinon]

Checkmarx One – Scan Summary & Details – b426d58a-8a55-4a52-b96a-79581eb4e313

---

New Issues (2 out of 2)

Checkmarx found the following issues in this Pull Request

Severity: 2 High

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-68494	Maven-com.fasterxml.jackson.core:jackson-core-2.17.0	details Recommended version: 2.18.8 Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2026-89407	Maven-com.fasterxml.jackson.core:jackson-core-2.17.0	details Description: NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity: 1 High

Severity	Issue	Source File / Package
	Cx2c9af752-2171	Maven-com.fasterxml.jackson.core:jackson-core-2.17.0

---

Use @Checkmarx to take action directly from this PR:

• Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR

[kingthorin]

Needs a spotlessApply.
Also the new addition may as well follow the array mechanism the original code already established for alert details.

[balaakasam]

Thank you for the feedback @kingthorin. I've refactored the Referrer-Policy check to use the existing array mechanism consistent with the rest of the script. Please let me know if any further changes are needed, I can do so accordingly.

[balaakasam]

@kingthorin ,wondering if this need PR any more changes from me? or is it ready to be published?

[kingthorin]

@ balaakasam the PR needs the spotlessApply task run. Are you able to do that?

[kingthorin]

The CHANCELOG should also be updated.