panda_pal 3.2.3 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2de62b8e33689a9b977186c7886fa941a74e01e8
-  data.tar.gz: b40a4b7f488abbf8204b5024d033f3b7488ef811
+  metadata.gz: d06b29a94018b002f596dd6182ae6e99b2095d77
+  data.tar.gz: 333749f144fa69a081204fc36664f1250d2667b0
 SHA512:
-  metadata.gz: 356f9ab2fcce637dd21186a006a9ce83820a72df5e2c6e5e6376ba8959188ed445d1ad03e50eedfa1d9cc63d62d7411713759e26d4c4e0ba6cf2b0dbdb3df4e1
-  data.tar.gz: df4d02cc3ccfb78f6752fbc40b47a1bfbe9a5fbdb80d1882033e8997c66982984ebe79928f3227b099e9ddb4d11665e083e64cb88ebff4f7e680cb5eebb0281d
+  metadata.gz: 31d73e9e8d25d4d5ba6930e7582ddb83a41c43c7c088c2bd283cfa26e9f87ae03f426e940e2502b38ba11debc06c8e99715c4229b8fd3b11861e7f10d332cd3d
+  data.tar.gz: 5ffd1dcf5a23a191b3d3ad8acfaf38d0bfbad58ca172c610559f49b8281ec047381eea8500d237d34695b098c6b15261a078b990111581dcba6595dd8d4b2029

data/app/views/panda_pal/lti/iframe_cookie_fix.html.erb

@@ -1,4 +1,4 @@
-<script>
+<script nonce=<%= content_security_policy_script_nonce %>>
   var referrer = document.referrer;
   top.window.location='?safari_cookie_fix=true&return_to='.concat(encodeURI(referrer));
 </script>

data/lib/panda_pal/engine.rb

@@ -1,6 +1,7 @@
 require 'apartment'
 require 'ims/lti'
 require 'attr_encrypted'
+require 'secure_headers'
 
 module PandaPal
   class Engine < ::Rails::Engine
@@ -40,5 +41,42 @@ module PandaPal
         PandaPal::propagate_lti_navigation
       end
     end
+
+    initializer :secure_headers do |app|
+      connect_src = %w('self')
+      script_src = %w('self')
+
+      if Rails.env.development?
+        # Allow webpack-dev-server to work
+        connect_src << "http://localhost:3035"
+        connect_src << "ws://localhost:3035"
+
+        # Allow stuff like rack-mini-profiler to work in development:
+        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
+        # DON'T ENABLE THIS FOR PRODUCTION!
+        script_src << "'unsafe-eval'"
+      end
+
+      SecureHeaders::Configuration.default do |config|
+        # The default cookie headers aren't compatable with PandaPal cookies currenntly
+        config.cookies = SecureHeaders::OPT_OUT
+
+        # Need to allow LTI iframes
+        config.x_frame_options = "ALLOWALL"
+
+        config.x_content_type_options = "nosniff"
+        config.x_xss_protection = "1; mode=block"
+        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+
+        config.csp = {
+          default_src: %w('self'),
+          script_src: script_src,
+          # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+          style_src: %w('self' 'unsafe-inline' blob:),
+          font_src: %w('self' data:),
+          connect_src: connect_src,
+        }
+      end
+    end
   end
 end

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "3.2.3"
+  VERSION = "4.0.0"
 end

data/panda_pal.gemspec

@@ -21,6 +21,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'ims-lti', '~> 2.2.3'
   s.add_dependency 'browser', '2.5.0'
   s.add_dependency 'attr_encrypted', '~> 3.0.0'
+  s.add_dependency 'secure_headers', '~> 6.0.0'
   s.add_development_dependency 'rspec-rails'
   s.add_development_dependency 'factory_girl_rails'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 3.2.3
+  version: 4.0.0
 platform: ruby
 authors:
 - Instructure ProServe
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-17 00:00:00.000000000 Z
+date: 2018-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -100,6 +100,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 3.0.0
+- !ruby/object:Gem::Dependency
+  name: secure_headers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 6.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 6.0.0
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement