@@ -0,0 +1,1432 @@
+package jenkins.security;%0A%0Aimport com.gargoylesoftware.htmlunit.WebResponse;%0Aimport com.gargoylesoftware.htmlunit.html.HtmlPage;%0Aimport org.apache.commons.httpclient.NameValuePair;%0Aimport org.junit.Assert;%0Aimport org.junit.Rule;%0Aimport org.junit.Test;%0Aimport org.jvnet.hudson.test.JenkinsRule;%0Aimport org.xml.sax.SAXException;%0A%0Aimport java.io.IOException;%0A%0Apublic class FrameOptionsPageDecoratorTest %7B%0A    @Rule%0A    public JenkinsRule j = new JenkinsRule();%0A%0A    @Test%0A    public void defaultHeaderPresent() throws IOException, SAXException %7B%0A        JenkinsRule.WebClient wc = j.createWebClient();%0A        HtmlPage page = wc.goTo(%22%22);%0A        Assert.assertEquals(%22Expected different X-Frame-Options value%22, getFrameOptionsFromResponse(page.getWebResponse()), %22sameorigin%22);%0A    %7D%0A%0A    @Test%0A    public void testDisabledFrameOptions() throws IOException, SAXException %7B%0A        FrameOptionsPageDecorator.enabled = false;%0A        JenkinsRule.WebClient wc = j.createWebClient();%0A        HtmlPage page = wc.goTo(%22%22);%0A        Assert.assertNull(%22Expected X-Frame-Options unset%22, getFrameOptionsFromResponse(page.getWebResponse()));%0A    %7D%0A%0A    private static String getFrameOptionsFromResponse(WebResponse response) %7B%0A        for (NameValuePair pair : response.getResponseHeaders()) %7B%0A            if (pair.getName().equals(%22X-Frame-Options%22)) %7B%0A                return pair.getValue();%0A            %7D%0A        %7D%0A        return null;%0A    %7D%0A%7D%0A

Add test