RubyGems - secure_headers - Versions diffs - 0.1.1 → 0.2.0 - Mend

secure_headers 0.1.1 → 0.2.0

Potentially problematic release.

This version of secure_headers might be problematic. Click here for more details.

Files changed (104) hide show

data/fixtures/rails_3_2_12/Rakefile ADDED Viewed

@@ -0,0 +1,7 @@
+#!/usr/bin/env rake
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+require File.expand_path('../config/application', __FILE__)
+Rails3212::Application.load_tasks

data/fixtures/rails_3_2_12/app/controllers/application_controller.rb ADDED Viewed

@@ -0,0 +1,4 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+  ensure_security_headers
+end

data/fixtures/rails_3_2_12/app/controllers/other_things_controller.rb ADDED Viewed

@@ -0,0 +1,5 @@
+class OtherThingsController < ApplicationController
+  def index
+  end
+end

data/fixtures/rails_3_2_12/app/controllers/things_controller.rb ADDED Viewed

@@ -0,0 +1,6 @@
+class ThingsController < ApplicationController
+  ensure_security_headers :csp => false
+  def index
+    ######## : ) <- Marge Simpson?
+  end
+end

data/fixtures/rails_3_2_12/app/models/.gitkeep ADDED Viewed

File without changes

data/fixtures/rails_3_2_12/app/models/thing.rb ADDED Viewed

@@ -0,0 +1,3 @@
+class Thing < ActiveRecord::Base
+  # attr_accessible :title, :body
+end

data/fixtures/rails_3_2_12/app/views/layouts/application.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Rails3212</title>
+  <%= stylesheet_link_tag    "application", :media => "all" %>
+  <%= javascript_include_tag "application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+<%= yield %>
+</body>
+</html>

data/fixtures/rails_3_2_12/app/views/other_things/index.html.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ index

data/fixtures/rails_3_2_12/app/views/things/index.html.erb ADDED Viewed

@@ -0,0 +1,21 @@
+<h1>Listing things</h1>
+<table>
+  <tr>
+    <th></th>
+    <th></th>
+    <th></th>
+  </tr>
+<% @things.each do |thing| %>
+  <tr>
+    <td><%= link_to 'Show', thing %></td>
+    <td><%= link_to 'Edit', edit_thing_path(thing) %></td>
+    <td><%= link_to 'Destroy', thing, method: :delete, data: { confirm: 'Are you sure?' } %></td>
+  </tr>
+<% end %>
+</table>
+<br />
+<%= link_to 'New Thing', new_thing_path %>

data/fixtures/rails_3_2_12/config.ru ADDED Viewed

@@ -0,0 +1,4 @@
+# This file is used by Rack-based servers to start the application.
+require ::File.expand_path('../config/environment',  __FILE__)
+run Rails3212::Application

data/fixtures/rails_3_2_12/config/application.rb ADDED Viewed

@@ -0,0 +1,68 @@
+require File.expand_path('../boot', __FILE__)
+# Pick the frameworks you want:
+require "active_record/railtie"
+require "action_controller/railtie"
+require "action_mailer/railtie"
+require "active_resource/railtie"
+require "sprockets/railtie"
+# require "rails/test_unit/railtie"
+if defined?(Bundler)
+  # If you precompile assets before deploying to production, use this line
+  Bundler.require(*Rails.groups(:assets => %w(development test)))
+  # If you want your assets lazily compiled in production, use this line
+  # Bundler.require(:default, :assets, Rails.env)
+end
+module Rails3212
+  class Application < Rails::Application
+    # Settings in config/environments/* take precedence over those specified here.
+    # Application configuration should go into files in config/initializers
+    # -- all .rb files in that directory are automatically loaded.
+    # Custom directories with classes and modules you want to be autoloadable.
+    # config.autoload_paths += %W(#{config.root}/extras)
+    # Only load the plugins named here, in the order given (default is alphabetical).
+    # :all can be used as a placeholder for all plugins not explicitly named.
+    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
+    # Activate observers that should always be running.
+    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
+    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
+    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
+    # config.time_zone = 'Central Time (US & Canada)'
+    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
+    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
+    # config.i18n.default_locale = :de
+    # Configure the default encoding used in templates for Ruby 1.9.
+    config.encoding = "utf-8"
+    # Configure sensitive parameters which will be filtered from the log file.
+    config.filter_parameters += [:password]
+    # Enable escaping HTML in JSON.
+    config.active_support.escape_html_entities_in_json = true
+    # Use SQL instead of Active Record's schema dumper when creating the database.
+    # This is necessary if your schema can't be completely dumped by the schema dumper,
+    # like if you have constraints or database-specific column types
+    # config.active_record.schema_format = :sql
+    # Enforce whitelist mode for mass assignment.
+    # This will create an empty whitelist of attributes available for mass-assignment for all models
+    # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
+    # parameters by using an attr_accessible or attr_protected declaration.
+    config.active_record.whitelist_attributes = true
+    # Enable the asset pipeline
+    config.assets.enabled = true
+    # Version of your assets, change this if you want to expire all your assets
+    config.assets.version = '1.0'
+  end
+end

data/fixtures/rails_3_2_12/config/boot.rb ADDED Viewed

@@ -0,0 +1,6 @@
+require 'rubygems'
+# Set up gems listed in the Gemfile.
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+require 'bundler/setup' if File.exists?(ENV['BUNDLE_GEMFILE'])

data/fixtures/rails_3_2_12/config/database.yml ADDED Viewed

@@ -0,0 +1,25 @@
+# SQLite version 3.x
+#   gem install sqlite3
+#
+#   Ensure the SQLite 3 gem is defined in your Gemfile
+#   gem 'sqlite3'
+development:
+  adapter: sqlite3
+  database: db/development.sqlite3
+  pool: 5
+  timeout: 5000
+# Warning: The database defined as "test" will be erased and
+# re-generated from your development database when you run "rake".
+# Do not set this db to the same as development or production.
+test:
+  adapter: sqlite3
+  database: db/test.sqlite3
+  pool: 5
+  timeout: 5000
+production:
+  adapter: sqlite3
+  database: db/production.sqlite3
+  pool: 5
+  timeout: 5000

data/fixtures/rails_3_2_12/config/environment.rb ADDED Viewed

@@ -0,0 +1,5 @@
+# Load the rails application
+require File.expand_path('../application', __FILE__)
+# Initialize the rails application
+Rails3212::Application.initialize!

data/fixtures/rails_3_2_12/config/environments/development.rb ADDED Viewed

@@ -0,0 +1,37 @@
+Rails3212::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+  # In the development environment your application's code is reloaded on
+  # every request. This slows down response time but is perfect for development
+  # since you don't have to restart the web server when you make code changes.
+  config.cache_classes = false
+  # Log error messages when you accidentally call methods on nil.
+  config.whiny_nils = true
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+  # Don't care if the mailer can't send
+  config.action_mailer.raise_delivery_errors = false
+  # Print deprecation notices to the Rails logger
+  config.active_support.deprecation = :log
+  # Only use best-standards-support built into browsers
+  config.action_dispatch.best_standards_support = :builtin
+  # Raise exception on mass assignment protection for Active Record models
+  config.active_record.mass_assignment_sanitizer = :strict
+  # Log the query plan for queries taking more than this (works
+  # with SQLite, MySQL, and PostgreSQL)
+  config.active_record.auto_explain_threshold_in_seconds = 0.5
+  # Do not compress assets
+  config.assets.compress = false
+  # Expands the lines which load the assets
+  config.assets.debug = true
+end

data/fixtures/rails_3_2_12/config/environments/production.rb ADDED Viewed

@@ -0,0 +1,67 @@
+Rails3212::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+  # Code is not reloaded between requests
+  config.cache_classes = true
+  # Full error reports are disabled and caching is turned on
+  config.consider_all_requests_local       = false
+  config.action_controller.perform_caching = true
+  # Disable Rails's static asset server (Apache or nginx will already do this)
+  config.serve_static_assets = false
+  # Compress JavaScripts and CSS
+  config.assets.compress = true
+  # Don't fallback to assets pipeline if a precompiled asset is missed
+  config.assets.compile = false
+  # Generate digests for assets URLs
+  config.assets.digest = true
+  # Defaults to nil and saved in location specified by config.assets.prefix
+  # config.assets.manifest = YOUR_PATH
+  # Specifies the header that your server uses for sending files
+  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache
+  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx
+  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
+  # config.force_ssl = true
+  # See everything in the log (default is :info)
+  # config.log_level = :debug
+  # Prepend all log lines with the following tags
+  # config.log_tags = [ :subdomain, :uuid ]
+  # Use a different logger for distributed setups
+  # config.logger = ActiveSupport::TaggedLogging.new(SyslogLogger.new)
+  # Use a different cache store in production
+  # config.cache_store = :mem_cache_store
+  # Enable serving of images, stylesheets, and JavaScripts from an asset server
+  # config.action_controller.asset_host = "http://assets.example.com"
+  # Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
+  # config.assets.precompile += %w( search.js )
+  # Disable delivery errors, bad email addresses will be ignored
+  # config.action_mailer.raise_delivery_errors = false
+  # Enable threaded mode
+  # config.threadsafe!
+  # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
+  # the I18n.default_locale when a translation can not be found)
+  config.i18n.fallbacks = true
+  # Send deprecation notices to registered listeners
+  config.active_support.deprecation = :notify
+  # Log the query plan for queries taking more than this (works
+  # with SQLite, MySQL, and PostgreSQL)
+  # config.active_record.auto_explain_threshold_in_seconds = 0.5
+end

data/fixtures/rails_3_2_12/config/environments/test.rb ADDED Viewed

@@ -0,0 +1,37 @@
+Rails3212::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+  # The test environment is used exclusively to run your application's
+  # test suite. You never need to work with it otherwise. Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs. Don't rely on the data there!
+  config.cache_classes = true
+  # Configure static asset server for tests with Cache-Control for performance
+  config.serve_static_assets = true
+  config.static_cache_control = "public, max-age=3600"
+  # Log error messages when you accidentally call methods on nil
+  config.whiny_nils = true
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+  # Raise exceptions instead of rendering exception templates
+  config.action_dispatch.show_exceptions = false
+  # Disable request forgery protection in test environment
+  config.action_controller.allow_forgery_protection    = false
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  config.action_mailer.delivery_method = :test
+  # Raise exception on mass assignment protection for Active Record models
+  config.active_record.mass_assignment_sanitizer = :strict
+  # Print deprecation notices to the stderr
+  config.active_support.deprecation = :stderr
+end

data/fixtures/rails_3_2_12/config/initializers/backtrace_silencers.rb ADDED Viewed

@@ -0,0 +1,7 @@
+# Be sure to restart your server when you modify this file.
+# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
+# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
+# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code.
+# Rails.backtrace_cleaner.remove_silencers!

data/fixtures/rails_3_2_12/config/initializers/inflections.rb ADDED Viewed

@@ -0,0 +1,15 @@
+# Be sure to restart your server when you modify this file.
+# Add new inflection rules using the following format
+# (all these examples are active by default):
+# ActiveSupport::Inflector.inflections do |inflect|
+#   inflect.plural /^(ox)$/i, '\1en'
+#   inflect.singular /^(ox)en/i, '\1'
+#   inflect.irregular 'person', 'people'
+#   inflect.uncountable %w( fish sheep )
+# end
+#
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections do |inflect|
+#   inflect.acronym 'RESTful'
+# end

data/fixtures/rails_3_2_12/config/initializers/mime_types.rb ADDED Viewed

@@ -0,0 +1,5 @@
+# Be sure to restart your server when you modify this file.
+# Add new mime types for use in respond_to blocks:
+# Mime::Type.register "text/richtext", :rtf
+# Mime::Type.register_alias "text/html", :iphone

data/fixtures/rails_3_2_12/config/initializers/secret_token.rb ADDED Viewed

@@ -0,0 +1,7 @@
+# Be sure to restart your server when you modify this file.
+# Your secret key for verifying the integrity of signed cookies.
+# If you change this key, all old signed cookies will become invalid!
+# Make sure the secret is at least 30 characters and all random,
+# no regular words or you'll be exposed to dictionary attacks.
+Rails3212::Application.config.secret_token = '8dd5aabfbd49f9bce1c5b7dee79d7349cb869f54984ead01f7a272e6f75a58413f621733855906dc9cc249b9486d95583519096d92e77b910f82ba4a90326db7'

data/fixtures/rails_3_2_12/config/initializers/secure_headers.rb ADDED Viewed

@@ -0,0 +1,15 @@
+::SecureHeaders::Configuration.configure do |config|
+  config.hsts = { :max_age => 10.years.to_i.to_s, :include_subdomains => false }
+  config.x_frame_options = 'SAMEORIGIN'
+  config.x_content_type_options = "nosniff"
+  config.x_xss_protection = {:value => 1, :mode => 'BLOCK'}
+  csp = {
+    :default_src => "self",
+    :disable_chrome_extension => true,
+    :disable_fill_missing => true,
+    :report_uri => 'somewhere',
+    :enforce => false # false means warnings only
+  }
+  config.csp = csp
+end

data/fixtures/rails_3_2_12/config/initializers/session_store.rb ADDED Viewed

@@ -0,0 +1,8 @@
+# Be sure to restart your server when you modify this file.
+Rails3212::Application.config.session_store :cookie_store, :key => '_rails_3_2_12_session'
+# Use the database for sessions instead of the cookie-based default,
+# which shouldn't be used to store highly confidential information
+# (create the session table with "rails generate session_migration")
+# Rails3212::Application.config.session_store :active_record_store

data/fixtures/rails_3_2_12/config/initializers/wrap_parameters.rb ADDED Viewed

@@ -0,0 +1,14 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file contains settings for ActionController::ParamsWrapper which
+# is enabled by default.
+# Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array.
+ActiveSupport.on_load(:action_controller) do
+  wrap_parameters :format => [:json]
+end
+# Disable root element in JSON by default.
+ActiveSupport.on_load(:active_record) do
+  self.include_root_in_json = false
+end

data/fixtures/rails_3_2_12/config/locales/en.yml ADDED Viewed

@@ -0,0 +1,5 @@
+# Sample localization file for English. Add more files in this directory for other locales.
+# See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points.
+en:
+  hello: "Hello world"

data/fixtures/rails_3_2_12/config/routes.rb ADDED Viewed

@@ -0,0 +1,61 @@
+Rails3212::Application.routes.draw do
+  resources :things
+  # The priority is based upon order of creation:
+  # first created -> highest priority.
+  # Sample of regular route:
+  #   match 'products/:id' => 'catalog#view'
+  # Keep in mind you can assign values other than :controller and :action
+  # Sample of named route:
+  #   match 'products/:id/purchase' => 'catalog#purchase', :as => :purchase
+  # This route can be invoked with purchase_url(:id => product.id)
+  # Sample resource route (maps HTTP verbs to controller actions automatically):
+  #   resources :products
+  # Sample resource route with options:
+  #   resources :products do
+  #     member do
+  #       get 'short'
+  #       post 'toggle'
+  #     end
+  #
+  #     collection do
+  #       get 'sold'
+  #     end
+  #   end
+  # Sample resource route with sub-resources:
+  #   resources :products do
+  #     resources :comments, :sales
+  #     resource :seller
+  #   end
+  # Sample resource route with more complex sub-resources
+  #   resources :products do
+  #     resources :comments
+  #     resources :sales do
+  #       get 'recent', :on => :collection
+  #     end
+  #   end
+  # Sample resource route within a namespace:
+  #   namespace :admin do
+  #     # Directs /admin/products/* to Admin::ProductsController
+  #     # (app/controllers/admin/products_controller.rb)
+  #     resources :products
+  #   end
+  # You can have the root of your site routed with "root"
+  # just remember to delete public/index.html.
+  # root :to => 'welcome#index'
+  # See how all your routes lay out with "rake routes"
+  # This is a legacy wild controller route that's not recommended for RESTful applications.
+  # Note: This route will make all actions in every controller accessible via GET requests.
+  match ':controller(/:action(/:id))(.:format)'
+end