rack-content_security_policy 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1c74e025fe99f4261fae5e2e702595beb9b583e6
-  data.tar.gz: 3a7a571e64ff5f6c9c6544cbdafec917a3486534
+  metadata.gz: 9b9e9aca094f17fb9f1e827681438079c7367455
+  data.tar.gz: 56f4b069b5f8200fb013185ceeca0edd2f948a53
 SHA512:
-  metadata.gz: b7f8a959b4aff650ec3ee02dbe8b58721d3c769b1c41486568a6c92439ead14673d37cede35bc51ee951c444af36e431cd3d029620dc86aabdd6be2e0ae494bd
-  data.tar.gz: 98b3604f10022434f6209398afb7bb99839573ddc8d09ac8ff30bd97639b5af1a32fea78c4eaaf61c9563ebdeb6d9db8c014bb540915d7c4576d95561ce0a68d
+  metadata.gz: 9f1b007aa13990118fbfde2c03e6754b21129ff88aec595db998b529429679cce29145dafa968db45a15e69cadb0de2525a44b94264cd329452dcc1dd395d7c4
+  data.tar.gz: 69c52990e9ba6e5ae7776382e17e5f671b6815971a91171270109c26503c996bf8039e139c45a35d0146bb5e5d2559ac0acdc93c04c233be2513961e1ed31438

data/README.md

@@ -50,6 +50,9 @@ accepts two primary configuration options:
 * `report_only` : boolean `true` or `false`. Returns a `Content-Security-Policy-Report-Only` header instead of `Content-Security-Policy` when `true`. Defaults to true.
 * `directives` : A collection of valid CSP directives provided as key/value pairs. The key must be a lowercase String and must be comprised of the characters [a-z] and the `-`. The value must also be a String but is not limited to remain flexible as the CSP standards evolve. You can use conditional statements within the configuration block to set values dynamically at startup time. Defaults to an empty config that you must configure. An empty config will raise an exception.
 
+Note that certain CSP directives, such as `upgrade-insecure-requests`, do not
+take any arguments. For those, just set the value to `true`.
+
 Learn more about the Content Security Policy at the following sites:
 
 * W3C CSP Level 1 (deprecated) : [https://www.w3.org/TR/CSP1/](https://www.w3.org/TR/CSP1/)
@@ -72,6 +75,7 @@ Rack::ContentSecurityPolicy.configure do |d|
   d.report_only = ENV.fetch('RACK_ENV') != 'production'
   d['default-src'] = "'none'"
   d['script-src']  = "'self'"
+  d['upgrade-insecure-requests'] = true
 end
 
 use Rack::ContentSecurityPolicy

data/lib/rack/content_security_policy/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class ContentSecurityPolicy
-    VERSION = '0.1.0'.freeze
+    VERSION = '0.1.1'.freeze
   end
 end

data/lib/rack/content_security_policy.rb

@@ -45,7 +45,7 @@ module Rack
     def _call(env)
       status, headers, response = @app.call(env)
 
-      if headers['Content-Type'].include?('text/html')
+      if headers.is_a?(Hash) && headers['Content-Type'] && headers['Content-Type'].include?('text/html')
         directives = @directives.sort.map do |d|
           if NO_ARG_DIRECTIVES.include?(d[0])
             d[0]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-content_security_policy
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Glenn Rempe
@@ -30,7 +30,7 @@ cert_chain:
   vprF5QiDz8HshVP9DjJT2I1wyGyvxEdU3cTRo0upMP/VZLcgyBVFy90N2XYWWk2D
   GIxGSw==
   -----END CERTIFICATE-----
-date: 2016-11-10 00:00:00.000000000 Z
+date: 2016-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack