rack-padlock 0.0.2 → 0.0.3

data/README.md

@@ -1,10 +1,10 @@
 # rack-padlock
 
-A toolkit for rack applications that ensures _ALL_ content on a page is secure.  The browser padlock is pretty important for commercial web applications. Modern sites rely on so many third party services: analytics, video players, social media widgets.  With all these moving parts it's easy to end up with a broken padlock. Rack-Padlock will increase the visibility of padlock problems to your development team, and it's dead easy to use.
+A toolkit for rack applications that ensures _ALL_ content on a page adheres to your [Content Security Policy][W3C CSP spec].  The browser padlock is pretty important for commercial web applications. Modern sites rely on so many third party services: analytics, video players, social media widgets.  With all these moving parts it's easy to end up with a broken padlock. Rack-Padlock will increase the visibility of padlock problems to your development team, and it's dead easy to use.
 
 ## Prerequisites
 
-All you need to have a rack based application! (Rails, Sinatra, Camping, etc...)
+All you need to have is a rack based application! (Rails, Sinatra, Camping, etc...)
 
 ## Setup
 
@@ -46,7 +46,7 @@ Once you've set things up simply run
 rake padlock
 ```
 
-This will run the padlock tests.  If any of your integration tests mix secure and insecure content, the padlock test will fail.
+This will run the padlock tests.  If any of your integration tests mix secure and insecure content, the padlock test will fail. ![alt text](http://dl.dropbox.com/u/80061077/Screenshots/c.png "Example of failing tests")
 
 ## Example rack application
 
@@ -56,6 +56,8 @@ Have a look at a simple sinatra application that demonstrates rack-padlock at ht
 
 Rack-Padlock starts your Rack app up with an SSL enabled webrick server.  It puts a custom middleware in front of your application that implements a CSP policy.  That policy requires the browser to notify us of any non SSL activity.  The custom middleware intercepts these notifications and logs them.  At the end of the run the rack-padlock test will either succeed or fail based on the presence of any policy violations.
 
-## References
+## Not perfect
 
-1. http://www.w3.org/TR/CSP/
+I have noticed that CSP doesn't check resources requested by Flash.  But google chrome will break the padlock when flash requests non-secure resources.
+
+[W3C CSP spec]: http://www.w3.org/TR/CSP/

data/lib/rack/padlock/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Padlock
-    VERSION = "0.0.2"
+    VERSION = "0.0.3"
   end
 end

data/lib/rack/padlock.rb

@@ -75,7 +75,7 @@ module Rack
       report_uri = "#{host}/padlock_middleware/report"
       csp_header_names = %w(Content-Security-Policy-Report-Only X-Content-Security-Policy-Report-Only X-WebKit-CSP-Report-Only)
       csp_headers = {}
-      csp_header_names.each{|name| csp_headers[name] = "default-src https: 'unsafe-inline' 'unsafe-eval'; report-uri https://#{report_uri}"}
+      csp_header_names.each{|name| csp_headers[name] = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; object-src 'none'; report-uri https://#{report_uri}"}
       csp_headers
     end
     

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-padlock
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-10 00:00:00.000000000 Z
+date: 2013-02-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &70095896651180 !ruby/object:Gem::Requirement
+  requirement: &70233880620940 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70095896651180
+  version_requirements: *70233880620940
 - !ruby/object:Gem::Dependency
   name: rainbow
-  requirement: &70095900907220 !ruby/object:Gem::Requirement
+  requirement: &70233876684360 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70095900907220
+  version_requirements: *70233876684360
 - !ruby/object:Gem::Dependency
   name: selenium-webdriver
-  requirement: &70095900905920 !ruby/object:Gem::Requirement
+  requirement: &70233876683060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70095900905920
+  version_requirements: *70233876683060
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70095900904820 !ruby/object:Gem::Requirement
+  requirement: &70233876682060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70095900904820
+  version_requirements: *70233876682060
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70095900903940 !ruby/object:Gem::Requirement
+  requirement: &70233876681100 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70095900903940
+  version_requirements: *70233876681100
 - !ruby/object:Gem::Dependency
   name: minitest
-  requirement: &70095900903060 !ruby/object:Gem::Requirement
+  requirement: &70233876680220 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,10 +76,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70095900903060
+  version_requirements: *70233876680220
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &70095900902260 !ruby/object:Gem::Requirement
+  requirement: &70233876679420 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,7 +87,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70095900902260
+  version_requirements: *70233876679420
 description: A Gem for testing web applications don't generate mixed secure/insecure
   traffic. Keep that browser padlock locked!
 email: joshuacronemeyer@gmail.com