http-security 0.1.0

data/spec/headers/x_content_type_options_spec.rb

@@ -0,0 +1,26 @@
+require 'spec_helper'
+require 'http/security/headers/x_content_type_options'
+
+describe HTTP::Security::Headers::XContentTypeOptions do
+  subject { described_class.new(nosniff: true) }
+
+  describe "no_sniff?" do
+    context "when nosniff: was true" do
+      subject { described_class.new(nosniff: true) }
+
+      it { expect(subject.no_sniff?).to be true }
+    end
+
+    context "when nosniff: was false" do
+      subject { described_class.new(nosniff: false) }
+
+      it { expect(subject.no_sniff?).to be false }
+    end
+  end
+
+  describe "#to_s" do
+    it "should return a string" do
+      expect(subject.to_s).to be == "nosniff"
+    end
+  end
+end

data/spec/headers/x_frame_options_spec.rb

@@ -0,0 +1,86 @@
+require 'spec_helper'
+require 'http/security/headers/x_frame_options'
+
+require 'uri'
+
+describe HTTP::Security::Headers::XFrameOptions do
+  let(:allow_from) { URI('http://example.com/') }
+
+  subject { described_class.new(allow_from: allow_from) }
+
+  describe "#initialize" do
+    context "when allow_from: is passed" do
+      it "should set allow_from" do
+        expect(subject.allow_from).to be allow_from
+      end
+    end
+  end
+
+  describe "deny?" do
+    context "when deny: was true" do
+      subject { described_class.new(deny: true) }
+
+      it { expect(subject.deny?).to be true }
+    end
+
+    context "when deny: was false" do
+      subject { described_class.new(deny: false) }
+
+      it { expect(subject.deny?).to be false }
+    end
+  end
+
+  describe "same_origin?" do
+    context "when sameorigin: was true" do
+      subject { described_class.new(sameorigin: true) }
+
+      it { expect(subject.same_origin?).to be true }
+    end
+
+    context "when sameorigin: was false" do
+      subject { described_class.new(sameorigin: false) }
+
+      it { expect(subject.same_origin?).to be false }
+    end
+  end
+
+  describe "allow_all?" do
+    context "when allowall: was true" do
+      subject { described_class.new(allowall: true) }
+
+      it { expect(subject.allow_all?).to be true }
+    end
+
+    context "when sameorigin: was false" do
+      subject { described_class.new(allowall: false) }
+
+      it { expect(subject.allow_all?).to be false }
+    end
+  end
+
+  describe "#to_s" do
+    context "when deny: was true" do
+      subject { described_class.new(deny: true) }
+
+      it { expect(subject.to_s).to be == 'DENY' }
+    end
+
+    context "when same_origin: was true" do
+      subject { described_class.new(sameorigin: true) }
+
+      it { expect(subject.to_s).to be == 'SAMEORIGIN' }
+    end
+
+    context "when allow_from: was specified" do
+      subject { described_class.new(allow_from: allow_from) }
+
+      it { expect(subject.to_s).to be == "ALLOW-FROM #{allow_from}" }
+    end
+
+    context "when allowall: was specified" do
+      subject { described_class.new(allowall: allow_from) }
+
+      it { expect(subject.to_s).to be == 'ALLOWALL' }
+    end
+  end
+end

data/spec/headers/x_permitted_cross_domain_policies_spec.rb

@@ -0,0 +1,108 @@
+require 'spec_helper'
+require 'http/security/headers/x_permitted_cross_domain_policies'
+
+require 'uri'
+
+describe HTTP::Security::Headers::XPermittedCrossDomainPolicies do
+  describe "#none?" do
+    context "when none: was true" do
+      subject { described_class.new(none: true) }
+
+      it { expect(subject.none?).to be true }
+    end
+
+    context "when none: was false" do
+      subject { described_class.new(none: false) }
+
+      it { expect(subject.none?).to be false }
+    end
+  end
+
+  describe "#master_only?" do
+    context "when master_only: was true" do
+      subject { described_class.new(master_only: true) }
+
+      it { expect(subject.master_only?).to be true }
+    end
+
+    context "when master_only: was false" do
+      subject { described_class.new(master_only: false) }
+
+      it { expect(subject.master_only?).to be false }
+    end
+  end
+
+  describe "#by_content_type?" do
+    context "when by_content_type: was true" do
+      subject { described_class.new(by_content_type: true) }
+
+      it { expect(subject.by_content_type?).to be true }
+    end
+
+    context "when by_content_type: was false" do
+      subject { described_class.new(by_content_type: false) }
+
+      it { expect(subject.by_content_type?).to be false }
+    end
+  end
+
+  describe "#by_ftp_filename?" do
+    context "when by_ftp_filename: was true" do
+      subject { described_class.new(by_ftp_filename: true) }
+
+      it { expect(subject.by_ftp_filename?).to be true }
+    end
+
+    context "when by_ftp_filename: was false" do
+      subject { described_class.new(by_ftp_filename: false) }
+
+      it { expect(subject.by_ftp_filename?).to be false }
+    end
+  end
+
+  describe "#all?" do
+    context "when all: was true" do
+      subject { described_class.new(all: true) }
+
+      it { expect(subject.all?).to be true }
+    end
+
+    context "when all: was false" do
+      subject { described_class.new(all: false) }
+
+      it { expect(subject.all?).to be false }
+    end
+  end
+
+  describe "#to_s" do
+    context "when none: was true" do
+      subject { described_class.new(none: true) }
+
+      it { expect(subject.to_s).to be == 'none' }
+    end
+
+    context "when master_only: was true" do
+      subject { described_class.new(master_only: true) }
+
+      it { expect(subject.to_s).to be == 'master-only' }
+    end
+
+    context "when by_content_type: was true" do
+      subject { described_class.new(by_content_type: true) }
+
+      it { expect(subject.to_s).to be == 'by-content-type' }
+    end
+
+    context "when by_ftp_filename: was true" do
+      subject { described_class.new(by_ftp_filename: true) }
+
+      it { expect(subject.to_s).to be == 'by-ftp-filename' }
+    end
+
+    context "when all: was true" do
+      subject { described_class.new(all: true) }
+
+      it { expect(subject.to_s).to be == 'all' }
+    end
+  end
+end

data/spec/headers/x_xss_protection_spec.rb

@@ -0,0 +1,59 @@
+require 'spec_helper'
+require 'http/security/headers/x_xss_protection'
+
+describe HTTP::Security::Headers::XXSSProtection do
+  let(:mode) { 'block' }
+  let(:report_uri) do
+    "/xss-report/25b8988e-64ff-45a8-b0c6-2700fc1e9abd?source%5Baction%5D=index&source%5Bcontroller%5D=shop&source%5Bsection%5D=storefront"
+  end
+
+  subject do
+    described_class.new(
+      enabled: true,
+      mode:    mode,
+      report:  report_uri
+    )
+  end
+
+  describe "#initialize" do
+    it "should set mode" do
+      expect(subject.mode).to be mode
+    end
+
+    it "should set report" do
+      expect(subject.report).to be report_uri
+    end
+  end
+
+  describe "#enabled?" do
+    context "when enabled: was true" do
+      subject { described_class.new(enabled: true) }
+
+      it { expect(subject.enabled?).to be true }
+    end
+
+    context "when enabled: was false" do
+      subject { described_class.new(enabled: false) }
+
+      it { expect(subject.enabled?).to be false }
+    end
+  end
+
+  describe "#to_s" do
+    it "should return a string" do
+      expect(subject.to_s).to be == "1; mode=#{mode}; report=#{report_uri}"
+    end
+
+    context "when enabled: was true" do
+      subject { described_class.new(enabled: true) }
+
+      it { expect(subject.to_s).to be == '1' }
+    end
+
+    context "when enabled: was false" do
+      subject { described_class.new(enabled: false) }
+
+      it { expect(subject.to_s).to be == '0' }
+    end
+  end
+end

data/spec/parsers/cache_control_spec.rb

@@ -0,0 +1,26 @@
+require "spec_helper"
+require "http/security/parsers/cache_control"
+
+describe Parsers::CacheControl do
+  it "accepts private" do
+    header = 'private'
+
+    expect(subject.parse(header)).to be == {private: true}
+  end
+
+  it "accepts public, max-age=1" do
+    header = "public, max-age=1"
+
+    expect(subject.parse(header)).to be == {public: true, max_age: 1}
+  end
+
+  it "accepts all recommended value: private, max-age=0, no-cache" do
+    header = "private, max-age=0, no-cache"
+
+    expect(subject.parse(header)).to be == {
+      private: true,
+      max_age: 0,
+      no_cache: true
+    }
+  end
+end

data/spec/parsers/content_security_policy_report_only_spec.rb

@@ -0,0 +1,48 @@
+require "spec_helper"
+require "http/security/parsers/content_security_policy_report_only"
+
+describe Parsers::ContentSecurityPolicyReportOnly do
+  it "accepts default-src 'self'" do
+    header = "default-src 'self';"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'"
+    }
+  end
+
+  it "accepts default-src 'self'; script-src 'self';" do
+    header = "default-src 'self'; script-src 'self';"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      script_src: "'self'"
+    }
+  end
+
+  it "accepts a domain" do
+    header = "default-src 'self' trustedscripts.foo.com"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self' trustedscripts.foo.com"
+    }
+  end
+
+  it "accepts img-src and media-src" do
+    header = "default-src 'self'; img-src 'self' data:; media-src mediastream:"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      img_src: "'self' data:",
+      media_src: "mediastream:"
+    }
+  end
+
+  it "accepts report URLs" do
+    header = "default-src 'self'; report-uri http://www.example1.com http://www.example2.com"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      report_uri: [ URI("http://www.example1.com"), URI("http://www.example2.com") ]
+    }
+  end
+end

data/spec/parsers/content_security_policy_spec.rb

@@ -0,0 +1,74 @@
+require "spec_helper"
+require "http/security/parsers/content_security_policy"
+
+describe Parsers::ContentSecurityPolicy do
+  it "accepts default-src 'self'" do
+    header = "default-src 'self';"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'"
+    }
+  end
+
+  it "accepts default-src 'self'; script-src 'self';" do
+    header = "default-src 'self'; script-src 'self';"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      script_src: "'self'"
+    }
+  end
+
+  it "accepts a domain" do
+    header = "default-src 'self' trustedscripts.foo.com"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self' trustedscripts.foo.com"
+    }
+  end
+
+  it "accepts img-src and media-src" do
+    header = "default-src 'self'; img-src 'self' data:; media-src mediastream:"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      img_src: "'self' data:",
+      media_src: "mediastream:"
+    }
+  end
+
+ it "accepts wildcard domains" do
+  header = "default-src 'self'; img-src *; object-src media1.example.com media2.example.com *.cdn.example.com; script-src trustedscripts.example.com"
+
+    expect(subject.parse(header)).to be == {
+      default_src: "'self'",
+      img_src: "*",
+      object_src: "media1.example.com media2.example.com *.cdn.example.com",
+      script_src: "trustedscripts.example.com"
+    }
+ end
+
+ it "parses unsafe-inline and unsafe-eval" do
+  header = "default-src https: 'unsafe-inline' 'unsafe-eval'"
+  response = subject.parse(header)
+
+    expect(subject.parse(header)).to be == {
+      default_src: "https: 'unsafe-inline' 'unsafe-eval'"
+    }
+ end
+
+ it "parses sandbox" do
+  header = "sandbox token1 token2 token3"
+  response = subject.parse(header)
+
+    expect(subject.parse(header)).to be == {
+      sandbox: "token1 token2 token3"
+    }
+ end
+
+ describe "specific URI paths" do
+  header = "default-src default-src 'self'; script-src https://example.com/js/"
+    it "is not inlcuded in CSP 1.0. Enable ext_host_source to parse specific paths."
+ end
+
+end

data/spec/parsers/expires_spec.rb

@@ -0,0 +1,71 @@
+require "spec_helper"
+require "http/security/parsers/expires"
+
+describe Parsers::Expires do
+  it "parses negative integers" do
+    header = "-1"
+
+    expect(subject.parse(header)).to eq(-1)
+  end
+
+  it "parses 0" do
+    header = "0"
+
+    expect(subject.parse(header)).to eq(0)
+  end
+
+  it "parses positive integers" do
+    header = "100"
+
+    expect(subject.parse(header)).to eq(100)
+  end
+
+  it "parses rfc1123-date" do
+    header = "Thu, 04 Dec 2015 16:00:00 GMT"
+    date = Date.parse(header)
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses rfc850-date" do
+    header = "Thursday, 04-Dec-15 16:00:00 GMT"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses asctime-date format #1" do
+    header = "Thu Dec 04 16:00:00 2015"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses asctime-date format #2" do
+    header = "Thu Dec  4 16:00:00 2015"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses rfc1123-date" do
+    header = "Thu, 04 Dec 2015 16:00:00 GMT"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses rfc850-date" do
+    header = "Thursday, 04-Dec-15 16:00:00 GMT"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses asctime-date format #1" do
+    header = "Thu Dec 04 16:00:00 2015"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+
+  it "parses asctime-date format #2" do
+    header = "Thu Dec  4 16:00:00 2015"
+
+    expect(subject.parse(header)).to be == Date.parse(header)
+  end
+end