bridgetown-content-security-policy 0.1.1 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 292cea094aafa8dee2b33e25a254763b873bbbc0dea3071b3efa9708cb326e88
-  data.tar.gz: 344305e3fea005fc0534d83587d307de52f59b924a0e95e5688880e02eecf0a4
+  metadata.gz: c3e351af829a35641581be3e470fa4f78a5ebb041c8c8474376e73cc409fa595
+  data.tar.gz: b0e54b5d25568a18cf5ddd85e1958c94f4c9bcbb9f65de1df6bd21900a4ec27f
 SHA512:
-  metadata.gz: feb6637a476c50ee50ac2c9ed8068bfd83afbd4ac30754284b5a80ac5e76b2b9349ef3138ab1b5b708af50460324815bda080f90f69c85f5295ab6ba19646532
-  data.tar.gz: 897c577c9924d0bf602c1b1acfd8d6caecfaeb981458e517e538a2d2bad17f19fae2dfb03288fc5885b0a8b281a70d7c16426d620ef912c41f4ace318ca86f50
+  metadata.gz: 4aa5d832289b2bb28a918969afc7d5af0595241aaecfa145092b521180700f84309bb66b0e0466722c6d370992bd89d8c46aee30f22df843411df8a09d8c0414
+  data.tar.gz: e45993e4d39e9645a444240eef1175a153037dc524755b002d46223449a94fade0da020742084e2deea0331967df98ba8dc4df3b9a2442bf2479a17008b4deb6

data/.gitignore

@@ -36,3 +36,6 @@ test/dest
 .bridgetown-metadata
 .bridgetown-cache
 .bridgetown-webpack
+
+# macOS
+.DS_Store

data/README.md

@@ -16,12 +16,20 @@ The plugin allows you to define one or more Content Security Policies using a co
 
 The installation should create a `content_security_policy.config.rb` file in your project root. More info about the DSL is contained in the file.
 
-Add `{% content_security_policy %}` in the `head` tag of *your layout file* to include the CSP on all your pages.
-
-You can also define a specific CSP for pages by setting `content_security_policy:` in your frontmatter; and then defining the relevent CSP in `content_security_policy.config.rb`.
+You can define a specific CSP for pages by setting `content_security_policy:` in your frontmatter; and then defining the relevent CSP in `content_security_policy.config.rb`.
 
 All page specific CSPs will inherit from the `default` CSP.
 
+### Including the CSP on your web pages
+
+You'll need to add a `content_security_policy` tag to your **layout file(s)** to include the CSP meta tag in all your pages. This plugin supports *Liquid*, *ERB* and other Tilt based templating languages like *HAML* or *Slim*.
+
+- **Liquid templates**: `{% content_security_policy %}`
+- **ERB**: `<%= content_security_policy %>`
+
+Add the appropriate CSP tag in the `head` tag of **_your layout file_** to include the CSP on all your pages.
+
+
 ## Testing
 
 * Run `bundle exec rake test` to run the test suite

data/bridgetown.automation.rb

@@ -4,18 +4,21 @@ add_bridgetown_plugin "bridgetown-content-security-policy"
 
 create_file "content_security_policy.config.rb" do
   <<~RUBY
-  # The recommended default Content Security Policy 
+  # The recommended default Content Security Policy
 
   BridgetownContentSecurityPolicy.configure :default do |policy|
       policy.default_src :self
       policy.img_src     :self, :data
       policy.object_src  :none
+
+      # Allow BrowserSync in development
+      policy.script_src  :self, :unsafe_inline if Bridgetown.environment.development?
   end
 
   # All other policies with inherit from :default
   # To allow inline styles on certain pages, we can define the following
   # policy which inherits all the values from :default and defines a style_src
-  # 
+  #
   # BridgetownContentSecurityPolicy.configure :allow_inline_styles do |policy|
   #     policy.style_src   :self, :unsafe_inline
   # end

data/lib/bridgetown-content-security-policy/builder.rb

@@ -18,15 +18,25 @@ module BridgetownContentSecurityPolicy
         # rubocop:enable Layout/LineLength
       end
 
-      liquid_tag "content_security_policy", :render
+      liquid_tag "content_security_policy" do |_attributes, tag|
+        render tag.context["page"]["content_security_policy"]
+      end
+
+      helper "_csp" do |policy_name|
+        render policy_name
+      end
+
+      helper "content_security_policy", helpers_scope: true do
+        _csp view.page.data.content_security_policy
+      end
     end
 
     private
 
-    def render(_attributes, tag)
+    def render(policy_name = nil)
       return "" unless default_policy
 
-      page_specific_policy_name = tag.context["page"]["content_security_policy"]&.to_sym
+      page_specific_policy_name = policy_name&.to_sym
       page_specific_policy = BridgetownContentSecurityPolicy.policies[page_specific_policy_name]
 
       if page_specific_policy_name && page_specific_policy.nil?
@@ -35,10 +45,10 @@ module BridgetownContentSecurityPolicy
 
       policy = default_policy.merge(page_specific_policy)
 
-      render_policy policy
+      markup_for_policy policy
     end
 
-    def render_policy(policy)
+    def markup_for_policy(policy)
       "<meta http-equiv=\"Content-Security-Policy\" content=\"#{policy.build}\">"
     end
 

data/lib/bridgetown-content-security-policy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BridgetownContentSecurityPolicy
-  VERSION = "0.1.1"
+  VERSION = "1.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bridgetown-content-security-policy
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 1.0.0
 platform: ruby
 authors:
 - Ayush Newatia
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-12 00:00:00.000000000 Z
+date: 2021-01-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bridgetown
@@ -92,7 +92,6 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".DS_Store"
 - ".gitignore"
 - ".rubocop.yml"
 - CHANGELOG.md