secure_headers 0.2.0 → 0.2.1

data/Guardfile

@@ -2,7 +2,7 @@ guard 'spork', :aggressive_kill => false do
   watch('spec/spec_helper.rb') { :rspec }
 end
 
-guard 'rspec', :cli => "--color --drb", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
+guard 'rspec', :cli => "--color --drb --debug", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
   watch(%r{^spec/.+_spec\.rb$})
   watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
   watch(%r{^app/controllers/(.+)\.rb$})     { |m| "spec/controllers/#{m[1]}_spec.rb" }

data/HISTORY.md

@@ -1,3 +1,8 @@
+0.2.1
+=======
+
+- Firefox headers will now stop overriding report_uri when only a path is supplied
+
 0.2.0
 =======
 

data/lib/secure_headers/headers/content_security_policy.rb

@@ -177,7 +177,9 @@ module SecureHeaders
     # we need to forward the request for Firefox.
     def normalize_reporting_endpoint
       return unless browser_strategy.normalize_reporting_endpoint?
-      return unless !same_origin? || URI.parse(report_uri).host.nil?
+      if same_origin? || report_uri.nil? || URI.parse(report_uri).host.nil?
+        return
+      end
 
       if forward_endpoint
         @report_uri = FF_CSP_ENDPOINT

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -165,9 +165,9 @@ module SecureHeaders
           csp.report_uri.should == FF_CSP_ENDPOINT
         end
 
-        it "doesn't set report-uri if no forward_endpoint is supplied" do
-          csp = ContentSecurityPolicy.new({:report_uri => "https://another.example.com"}, :request => request_for(FIREFOX, "https://anexample.com"))
-          csp.report_uri.should be_nil
+        it "doesn't change report-uri if a path supplied" do
+          csp = ContentSecurityPolicy.new({:report_uri => "/csp_reports"}, :request => request_for(FIREFOX, "https://anexample.com"))
+          csp.report_uri.should == "/csp_reports"
         end
 
         it "forwards if the request_uri is set to a non-matching value" do
@@ -224,7 +224,7 @@ module SecureHeaders
       context "X-Content-Security-Policy" do
         it "builds a csp header for firefox" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX))
-          csp.value.should == "allow https://*; options inline-script eval-script; img-src data:; script-src https://* data:; style-src https://* chrome-extension: about:;"
+          csp.value.should == "allow https://*; options inline-script eval-script; img-src data:; script-src https://* data:; style-src https://* chrome-extension: about:; report-uri /csp_report;"
         end
 
         it "copies connect-src values to xhr_src values" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-20 00:00:00.000000000 Z
+date: 2013-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: brwsr