secure_headers 0.5.0 → 1.0.0

data/HISTORY.md

@@ -1,12 +1,24 @@
+1.0.0
+======
+
+Features:
+
+- Use non-prefixed header names for Firefox >= 23, Chrome >= 25
+- Use csp 1.0 compliant header for firefox >= 23
+
+Bug Fix:
+
+- Stop sending CSP on safari 5.1+
+
 0.5.0
 ======
 
-X-Content-Type-Options also applied to Chrome requests
+- X-Content-Type-Options also applied to Chrome requests
 
 0.4.3
 ======
 
-Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
+- Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
 
 0.4.2
 ======

data/lib/secure_headers.rb

@@ -59,6 +59,8 @@ module SecureHeaders
     # set_csp_header(+Hash+) - uses the request accessor and options from parameters
     # set_csp_header(+Rack::Request+, +Hash+)
     def set_csp_header(req = nil, options=nil)
+      return if broken_implementation?(brwsr)
+
       if req.is_a?(Hash)
         options = req
       elsif req
@@ -66,17 +68,15 @@ module SecureHeaders
       end
 
       options = self.class.secure_headers_options[:csp] if options.nil?
-
-      return if broken_implementation?(brwsr)
-
       options = self.class.options_for :csp, options
+
       return if options == false
 
-      header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
-      set_header(header.name, header.value)
+      csp_header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
+      set_header(csp_header)
       if options && options[:experimental] && options[:enforce]
-        header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
-        set_header(header.name, header.value)
+        experimental_header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
+        set_header(experimental_header)
       end
     end
 
@@ -105,26 +105,32 @@ module SecureHeaders
       return if options == false
 
       header = klass.new(options)
-      set_header(header.name, header.value)
+      set_header(header)
     end
 
-    def set_header(name, value)
-      response.headers[name] = value
+    def set_header(name_or_header, value=nil)
+      if name_or_header.is_a?(Header)
+        header = name_or_header
+        response.headers[header.name] = header.value
+      else
+        response.headers[name_or_header] = value
+      end
     end
 
     def broken_implementation?(browser)
-      return browser.ios5? || (browser.safari? && browser.version == 5)
+      return browser.ios5? || (browser.safari? && browser.version == '5')
     end
   end
 end
 
 
 require "secure_headers/version"
+require "secure_headers/header"
 require "secure_headers/headers/content_security_policy"
 require "secure_headers/headers/content_security_policy/browser_strategy"
 require "secure_headers/headers/content_security_policy/firefox_browser_strategy"
 require "secure_headers/headers/content_security_policy/ie_browser_strategy"
-require "secure_headers/headers/content_security_policy/webkit_browser_strategy"
+require "secure_headers/headers/content_security_policy/standard_browser_strategy"
 require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"

data/lib/secure_headers/header.rb

@@ -0,0 +1,5 @@
+module SecureHeaders
+  class Header
+
+  end
+end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -3,7 +3,7 @@ require 'brwsr'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
-  class ContentSecurityPolicy
+  class ContentSecurityPolicy < Header
     module Constants
       WEBKIT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https://* about: javascript:; img-src chrome-extension:"
       FIREFOX_CSP_HEADER = "options eval-script inline-script; allow https://* data:; frame-src https://* about: javascript:; img-src chrome-extension:"

data/lib/secure_headers/headers/content_security_policy/browser_strategy.rb

@@ -12,9 +12,13 @@ module SecureHeaders
         klass = if browser.ie?
           IeBrowserStrategy
         elsif browser.firefox?
-          FirefoxBrowserStrategy
+          if browser.version.to_i >= 23
+            StandardBrowserStrategy
+          else
+            FirefoxBrowserStrategy
+          end
         else
-          WebkitBrowserStrategy
+          StandardBrowserStrategy
         end
 
         klass.new content_security_policy

data/lib/secure_headers/headers/content_security_policy/{webkit_browser_strategy.rb → standard_browser_strategy.rb}

@@ -1,8 +1,12 @@
 module SecureHeaders
   class ContentSecurityPolicy
-    class WebkitBrowserStrategy < BrowserStrategy
+    class StandardBrowserStrategy < BrowserStrategy
       def base_name
-        SecureHeaders::ContentSecurityPolicy::WEBKIT_CSP_HEADER_NAME
+        if (browser.firefox? && browser.version.to_i >= 23) || (browser.chrome? && browser.version.to_i >= 25)
+          SecureHeaders::ContentSecurityPolicy::STANDARD_HEADER_NAME
+        else
+          SecureHeaders::ContentSecurityPolicy::WEBKIT_CSP_HEADER_NAME
+        end
       end
 
       def add_missing_extension_values

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class STSBuildError < StandardError; end
 
-  class StrictTransportSecurity
+  class StrictTransportSecurity < Header
     module Constants
       HSTS_HEADER_NAME = 'Strict-Transport-Security'
       HSTS_MAX_AGE = "631138519"

data/lib/secure_headers/headers/x_content_type_options.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class XContentTypeOptionsBuildError < StandardError; end
   # IE only
-  class XContentTypeOptions
+  class XContentTypeOptions < Header
     module Constants
       X_CONTENT_TYPE_OPTIONS_HEADER_NAME = "X-Content-Type-Options"
       DEFAULT_VALUE = "nosniff"

data/lib/secure_headers/headers/x_frame_options.rb

@@ -1,6 +1,6 @@
 module SecureHeaders
   class XFOBuildError < StandardError; end
-  class XFrameOptions
+  class XFrameOptions < Header
     module Constants
       XFO_HEADER_NAME = "X-Frame-Options"
       DEFAULT_VALUE = 'SAMEORIGIN'

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -1,6 +1,6 @@
 module SecureHeaders
   class XXssProtectionBuildError < StandardError; end
-  class XXssProtection
+  class XXssProtection < Header
     module Constants
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "0.5.0"
+  VERSION = "1.0.0"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -16,8 +16,10 @@ module SecureHeaders
 
     IE = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
     FIREFOX = "Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.2) Gecko/20121223 Ubuntu/9.25 (jaunty) Firefox/3.8"
-    FIREFOX_18 = "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:18.0) Gecko/18.0 Firefox/18.0"
+    FIREFOX_23 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0"
     CHROME = "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4"
+    CHROME_25 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
+
 
     def request_for user_agent, request_uri=nil, options={:ssl => false}
       double(:ssl? => options[:ssl], :env => {'HTTP_USER_AGENT' => user_agent}, :url => (request_uri || 'http://areallylongdomainexample.com') )
@@ -31,13 +33,17 @@ module SecureHeaders
       context "when supplying options to override request" do
         specify { ContentSecurityPolicy.new(default_opts, :ua => IE).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(default_opts, :ua => FIREFOX).name.should == FIREFOX_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(default_opts, :ua => FIREFOX_23).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(default_opts, :ua => CHROME).name.should == WEBKIT_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(default_opts, :ua => CHROME_25).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
       end
 
       context "when in report-only mode" do
         specify { ContentSecurityPolicy.new(default_opts, :request => request_for(IE)).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX)).name.should == FIREFOX_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX_23)).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME)).name.should == WEBKIT_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME_25)).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
       end
 
       context "when in enforce mode" do
@@ -45,14 +51,18 @@ module SecureHeaders
 
         specify { ContentSecurityPolicy.new(opts, :request => request_for(IE)).name.should == STANDARD_HEADER_NAME}
         specify { ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX)).name.should == FIREFOX_CSP_HEADER_NAME}
+        specify { ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX_23)).name.should == STANDARD_HEADER_NAME}
         specify { ContentSecurityPolicy.new(opts, :request => request_for(CHROME)).name.should == WEBKIT_CSP_HEADER_NAME}
+        specify { ContentSecurityPolicy.new(opts, :request => request_for(CHROME_25)).name.should == STANDARD_HEADER_NAME}
       end
 
       context "when in experimental mode" do
         let(:opts) { default_opts.merge(:enforce => true).merge(:experimental => {})}
         specify { ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(IE)}).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(FIREFOX)}).name.should == FIREFOX_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(FIREFOX_23)}).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
         specify { ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(CHROME)}).name.should == WEBKIT_CSP_HEADER_NAME + "-Report-Only"}
+        specify { ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(CHROME_25)}).name.should == STANDARD_HEADER_NAME + "-Report-Only"}
       end
     end
 
@@ -224,7 +234,6 @@ module SecureHeaders
       end
 
       context "auto-whitelists data: uris for img-src" do
-
         it "sets the value if no img-src specified" do
           csp = ContentSecurityPolicy.new({:default_src => 'self', :disable_fill_missing => true, :disable_chrome_extension => true}, :request => request_for(CHROME))
           csp.value.should == "default-src 'self'; img-src data:;"
@@ -248,7 +257,7 @@ module SecureHeaders
         csp.value.should match "default-src"
       end
 
-      context "X-Content-Security-Policy" do
+      context "Firefox" do
         it "builds a csp header for firefox" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX))
           csp.value.should == "allow https://*; options inline-script eval-script; img-src data:; script-src https://* data:; style-src https://* about:; report-uri /csp_report;"
@@ -270,19 +279,15 @@ module SecureHeaders
           csp.value.should =~ /xhr-src 'self' http:/
         end
 
-        it "copies connect-src values to xhr_src values for FF 18" do
-          opts = {
-            :default_src => 'http://twitter.com',
-            :connect_src => 'self http://*.localhost.com:*',
-            :disable_chrome_extension => true,
-            :disable_fill_missing => true
-          }
-          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX_18))
-          csp.value.should =~ /xhr-src 'self' http:\/\/\*\.localhost\.com:\*/
+        context "Firefox >= 23" do
+          it "builds a csp header for firefox" do
+            csp = ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX_23))
+            csp.value.should == "default-src https://*; img-src data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"
+          end
         end
       end
 
-      context "X-Webkit-CSP" do
+      context "Chrome" do
         it "builds a csp header for chrome" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME))
           csp.value.should == "default-src https://*; img-src data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"

data/spec/lib/secure_headers_spec.rb

@@ -27,15 +27,16 @@ describe SecureHeaders do
     :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
     :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
     :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+    :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
     :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
   }
 
   def should_assign_header name, value
-    subject.should_receive(:set_header).with(name, value)
+    response.headers.should_receive(:[]=).with(name, value)
   end
 
   def should_not_assign_header name
-    subject.should_not_receive(:set_header).with(name, anything)
+    response.headers.should_not_receive(:[]=).with(name, anything)
   end
 
   def stub_user_agent val
@@ -72,6 +73,18 @@ describe SecureHeaders do
     end
   end
 
+  describe "#set_header" do
+    it "accepts name/value pairs" do
+      should_assign_header("X-Hipster-Ipsum", "kombucha")
+      subject.send(:set_header, "X-Hipster-Ipsum", "kombucha")
+    end
+
+    it "accepts header objects" do
+      should_assign_header("Strict-Transport-Security", SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+      subject.send(:set_header, SecureHeaders::StrictTransportSecurity.new)
+    end
+  end
+
   describe "#set_security_headers" do
     before(:each) do
       SecureHeaders::ContentSecurityPolicy.stub(:new).and_return(double.as_null_object)
@@ -82,7 +95,7 @@ describe SecureHeaders do
         number_of_headers = case name
         when :ie, :chrome
           5
-        when :ios5, :safari5
+        when :ios5, :safari5, :safari5_1
           3 # csp breaks these browsers
         else
           4
@@ -262,13 +275,13 @@ describe SecureHeaders do
         opts = @opts.merge(:enforce => false)
         should_assign_header(WEBKIT_CSP_HEADER_NAME + "-Report-Only", anything)
         should_not_assign_header(WEBKIT_CSP_HEADER_NAME)
-        subject.set_csp_header opts
+        subject.set_csp_header(opts)
       end
 
       it "sets a header in enforce mode as well as report-only mode" do
         should_assign_header(WEBKIT_CSP_HEADER_NAME, anything)
         should_assign_header(WEBKIT_CSP_HEADER_NAME + "-Report-Only", anything)
-        subject.set_csp_header @opts
+        subject.set_csp_header(@opts)
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 1.0.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-05-21 00:00:00.000000000 Z
+date: 2013-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: brwsr
@@ -148,11 +148,12 @@ files:
 - fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
 - lib/secure_headers.rb
+- lib/secure_headers/header.rb
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/content_security_policy/browser_strategy.rb
 - lib/secure_headers/headers/content_security_policy/firefox_browser_strategy.rb
 - lib/secure_headers/headers/content_security_policy/ie_browser_strategy.rb
-- lib/secure_headers/headers/content_security_policy/webkit_browser_strategy.rb
+- lib/secure_headers/headers/content_security_policy/standard_browser_strategy.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
 - lib/secure_headers/headers/x_frame_options.rb