coalescing_panda 1.1.20 → 1.1.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62ef7c3a4a82f51ecf725ebd9f79df58c72602ad18d3b7ab26ab3bf05edc3590
-  data.tar.gz: 3ac60e603838204bd38208569b280c06c00165f49d70c59e944d5849835eee26
+  metadata.gz: 944d92a3431e6323e9ba3b51aa7def85416dd322fbd51c26c70a1f07f5eced1a
+  data.tar.gz: f58244ff27af50fef210b7a88b306adda5ab421e3abf72ef9adfad2fdd198ffa
 SHA512:
-  metadata.gz: 41a58d09537d538182234f1adff14c5c072b2039036990c2b4a132790976a1d011ff124afe212d97c525c53ba27cd13dab1efccdc3c9c583e6ddc6f4c94b6491
-  data.tar.gz: 5cd7905c28a7222bf455cd6a1cf8b6b0de2fbfc83984c641511f523aa9c321f01159e8e6d967f16505c84a4e71f1d4feb85f582f9cf8f817823be7026202652b
+  metadata.gz: f461fef8d038d1a6bb0c1bb6863231e556fe9bad0589d48b6e844dbc6e3f3eaf335f28706271a15eb54dfa5cb97c12cc34f044d243f594f82c64b4fe8244e723
+  data.tar.gz: 4962e1e2c3335c1e5986dca5ddd7132cb7b973156e76b34a738a6a9278f083106dd451165e7b88fde95d961a491301ba9bc98a61f0d3f226a4b41392c10120fb

data/lib/coalescing_panda/controller_helpers.rb

@@ -60,6 +60,7 @@ module CoalescingPanda
 
     def lti_authorize!(*roles)
       authorized = false
+      use_secure_headers_override(:safari_override) if browser.safari?
       if @lti_account = params['oauth_consumer_key'] && LtiAccount.find_by_key(params['oauth_consumer_key'])
         sanitized_params = sanitize_params
         authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.original_url, sanitized_params, @lti_account.secret)
@@ -158,6 +159,7 @@ module CoalescingPanda
         session[:safari_cookie_fixed] = true
         redirect_to params[:return_to]
       else
+        use_secure_headers_override(:safari_override)
         render 'coalescing_panda/lti/iframe_cookie_fix', layout: false
       end
     end

data/lib/coalescing_panda/engine.rb

@@ -1,3 +1,5 @@
+require 'secure_headers'
+
 module CoalescingPanda
   class Engine < ::Rails::Engine
     config.autoload_once_paths += Dir["#{config.root}/lib/**/"]
@@ -30,5 +32,51 @@ module CoalescingPanda
       end
     end
 
+    initializer :secure_headers do |app|
+      connect_src = %w('self')
+      script_src = %w('self')
+      if Rails.env.development?
+        # Allow webpack-dev-server to work
+        connect_src << "http://localhost:3035"
+        connect_src << "ws://localhost:3035"
+        # Allow stuff like rack-mini-profiler to work in development:
+        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
+        # DON'T ENABLE THIS FOR PRODUCTION!
+        script_src << "'unsafe-eval'"
+      end
+      SecureHeaders::Configuration.default do |config|
+        # The default cookie headers aren't compatable with PandaPal cookies currenntly
+        config.cookies = { samesite: { none: true } }
+        # Need to allow LTI iframes
+        config.x_frame_options = "ALLOWALL"
+        config.x_content_type_options = "nosniff"
+        config.x_xss_protection = "1; mode=block"
+        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+        config.csp = {
+          default_src: %w('self'),
+          script_src: script_src,
+          # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+          style_src: %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com),
+          font_src: %w('self' data: https://fonts.gstatic.com),
+          connect_src: connect_src,
+        }
+      end
+      SecureHeaders::Configuration.override(:safari_override) do |config|
+        config.cookies = SecureHeaders::OPT_OUT
+        # Need to allow LTI iframes
+        config.x_frame_options = "ALLOWALL"
+        config.x_content_type_options = "nosniff"
+        config.x_xss_protection = "1; mode=block"
+        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+        config.csp = {
+          default_src: %w('self'),
+          script_src: script_src,
+          # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+          style_src: %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com),
+          font_src: %w('self' data: https://fonts.gstatic.com),
+          connect_src: connect_src,
+        }
+      end
+    end
   end
 end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '1.1.20'
+  VERSION = '1.1.21'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 1.1.20
+  version: 1.1.21
 platform: ruby
 authors:
 - Nathan Mills
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-20 00:00:00.000000000 Z
+date: 2020-04-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -178,6 +178,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 2.0.0
+- !ruby/object:Gem::Dependency
+  name: secure_headers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement