content-security-policy 0.1.2 → 0.1.3

data/README.md

@@ -59,7 +59,7 @@ run MyApplication
 
 ## Status
 
-Content Security Policy is now implemented with `X-Content-Security-Policy` and `X-WebKit-CSP` headers.
+Content Security Policy is now implemented with `Content-Security-Policy` (official name), `X-Content-Security-Policy` (Firefox and IE) and `X-WebKit-CSP` (Chrome and Safari) headers.
 
 ## Copyright
 

data/lib/content-security-policy/middleware.rb

@@ -20,16 +20,13 @@ class ContentSecurityPolicy
   def initialize(app, options = {})
     @app = app
     @report_only = options[:report_only] || ContentSecurityPolicy.report_only
-    @directives = options[:directives] || ContentSecurityPolicy.directives
+    @directives  = options[:directives]  || ContentSecurityPolicy.directives
 
     @directives or raise NoDirectivesError, 'No directives were passed.'
 
     # make sure directives with policy-uri don't contain any other directives
     if @directives['policy-uri'] && @directives.keys.length > 1
       raise IncorrectDirectivesError, 'You passed both policy-uri and other directives.'
-    # make sure default-src is present
-    elsif !@directives['policy-uri'] && !@directives['default-src']
-      raise IncorrectDirectivesError, 'You have to set default-src directive.'
     end
   end
 
@@ -51,9 +48,17 @@ class ContentSecurityPolicy
 
     # prepare response headers names
     if @report_only
-      resp_headers = %w(X-Content-Security-Policy-Report-Only X-WebKit-CSP-Report-Only)
+      resp_headers = %w(
+        Content-Security-Policy-Report-Only
+        X-Content-Security-Policy-Report-Only
+        X-WebKit-CSP-Report-Only
+      )
     else
-      resp_headers = %w(X-Content-Security-Policy X-WebKit-CSP)
+      resp_headers = %w(
+        Content-Security-Policy
+        X-Content-Security-Policy
+        X-WebKit-CSP
+      )
     end
 
     # append response header

data/lib/content-security-policy/version.rb

@@ -1,5 +1,5 @@
 class ContentSecurityPolicy
 
-  VERSION = '0.1.2'
+  VERSION = '0.1.3'
 
 end # ContentSecurityPolicy

data/spec/content-security-policy_spec.rb

@@ -1,7 +1,6 @@
 require 'spec_helper'
 
 describe ContentSecurityPolicy do
-
   context 'configuration' do
     let(:app) do
       [200, { 'Content-Type' => 'text/plain' }, %w(ok)]
@@ -9,46 +8,39 @@ describe ContentSecurityPolicy do
 
     describe '#initialize' do
       it 'should raise error if directives hash is not present' do
-        lambda do
+        lambda {
           ContentSecurityPolicy.new(app)
-        end.should raise_error(ContentSecurityPolicy::NoDirectivesError, 'No directives were passed.')
-      end
-
-      it 'should raise error if default-src was not set' do
-        lambda do
-          options = { :directives => { 'script-src' => "'self'" }}
-          ContentSecurityPolicy.new(app, options)
-        end.should raise_error(ContentSecurityPolicy::IncorrectDirectivesError, 'You have to set default-src directive.')
+        }.should raise_error(ContentSecurityPolicy::NoDirectivesError, 'No directives were passed.')
       end
 
       it 'should raise error if both policy-uri and other directive was set' do
-        lambda do
+        lambda {
           options = { :directives => { 'policy-uri' => 'policy.xml', 'script-src' => "'self'" }}
           ContentSecurityPolicy.new(app, options)
-        end.should raise_error(ContentSecurityPolicy::IncorrectDirectivesError, "You passed both policy-uri and other directives.")
+        }.should raise_error(ContentSecurityPolicy::IncorrectDirectivesError, "You passed both policy-uri and other directives.")
       end
 
       it 'should allow setting directives with ContentSecurityPolicy.configure' do
         ContentSecurityPolicy.configure { |csp| csp['default-src'] = "'self'" }
         ContentSecurityPolicy.should_receive(:directives).and_return('default-src' => '*')
 
-        lambda do
+        lambda {
           ContentSecurityPolicy.new(app)
-        end.should_not raise_error(ContentSecurityPolicy::NoDirectivesError, 'No directives were passed.')
+        }.should_not raise_error(ContentSecurityPolicy::NoDirectivesError, 'No directives were passed.')
       end
 
       it 'should allow passing hash of directives' do
-        lambda do
+        lambda {
           options = { :directives => { 'default-src' => "'self'" }}
           ContentSecurityPolicy.new(app, options)
-        end.should_not raise_error
+        }.should_not raise_error
       end
 
       it 'should allow passing report_only attribute' do
-        lambda do
+        lambda {
           options = { :directives => { 'default-src' => "'self'" }, :report_only => true }
           ContentSecurityPolicy.new(app, options)
-        end.should_not raise_error
+        }.should_not raise_error
       end
     end
 
@@ -66,8 +58,7 @@ describe ContentSecurityPolicy do
       it 'should append directives' do
         ContentSecurityPolicy.configure { |csp| csp['default-src'] = '*' }
         ContentSecurityPolicy.configure { |csp| csp['script-src']  = '*' }
-        ContentSecurityPolicy.directives.should == { 'default-src' => '*',
-                                                     'script-src'  => '*' }
+        ContentSecurityPolicy.directives.should == { 'default-src' => '*', 'script-src'  => '*' }
       end
 
       it 'should save report_only attribute' do
@@ -95,42 +86,17 @@ describe ContentSecurityPolicy do
     end
 
     describe '#call' do
-      it 'should respond with X-Content-Security-Policy HTTP response header' do
-        directives = "default-src *; img-src *.google.com; script-src 'self'"
-
-        header = get('/').headers['X-Content-Security-Policy']
-        header.should_not be_nil
-        header.should_not be_empty
-        header.should == directives
-      end
-
-      it 'should respond with X-WebKit-CSP HTTP response header' do
-        directives = "default-src *; img-src *.google.com; script-src 'self'"
-
-        header = get('/').headers['X-WebKit-CSP']
-        header.should_not be_nil
-        header.should_not be_empty
-        header.should == directives
+      %w(Content-Security-Policy X-Content-Security-Policy X-WebKit-CSP).each do |header|
+        it "should respond with #{header} HTTP response header" do
+          get('/').headers[header].should == "default-src *; img-src *.google.com; script-src 'self'"
+        end
       end
 
-      it 'should respond with X-Content-Security-Policy-Report-Only HTTP response header' do
-        ContentSecurityPolicy.configure { |csp| csp.report_only = true }
-        directives = "default-src *; img-src *.google.com; script-src 'self'"
-
-        header = get('/').headers['X-Content-Security-Policy-Report-Only']
-        header.should_not be_nil
-        header.should_not be_empty
-        header.should == directives
-      end
-
-      it 'should respond with X-WebKit-CSP HTTP response header' do
-        ContentSecurityPolicy.configure { |csp| csp.report_only = true }
-        directives = "default-src *; img-src *.google.com; script-src 'self'"
-
-        header = get('/').headers['X-WebKit-CSP-Report-Only']
-        header.should_not be_nil
-        header.should_not be_empty
-        header.should == directives
+      %w(Content-Security-Policy-Report-Only X-Content-Security-Policy-Report-Only X-WebKit-CSP-Report-Only).each do |header|
+        it "should respond with #{header}  HTTP response header" do
+          ContentSecurityPolicy.report_only = true
+          get('/').headers[header].should == "default-src *; img-src *.google.com; script-src 'self'"
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: content-security-policy
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-02-22 00:00:00.000000000Z
+date: 2012-09-13 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &16425620 !ruby/object:Gem::Requirement
+  requirement: &15825420 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: '1.4'
   type: :runtime
   prerelease: false
-  version_requirements: *16425620
+  version_requirements: *15825420
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &16425120 !ruby/object:Gem::Requirement
+  requirement: &15856880 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: '0.6'
   type: :development
   prerelease: false
-  version_requirements: *16425120
+  version_requirements: *15856880
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &16424660 !ruby/object:Gem::Requirement
+  requirement: &16810180 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: '2.8'
   type: :development
   prerelease: false
-  version_requirements: *16424660
+  version_requirements: *16810180
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &16424200 !ruby/object:Gem::Requirement
+  requirement: &17568560 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -54,7 +54,7 @@ dependencies:
         version: '0.9'
   type: :development
   prerelease: false
-  version_requirements: *16424200
+  version_requirements: *17568560
 description: Full-featured Content Security Policy as Rack middleware
 email: p0deje@gmail.com
 executables: []
@@ -85,12 +85,18 @@ required_ruby_version: !ruby/object:Gem::Requirement
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -3566934327810610234
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -3566934327810610234
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.16
@@ -100,4 +106,3 @@ summary: Full-featured Content Security Policy as Rack middleware
 test_files:
 - spec/content-security-policy_spec.rb
 - spec/spec_helper.rb
-has_rdoc: