secure_headers 1.0.0 → 2.0.0

data/lib/secure_headers/headers/content_security_policy/firefox_browser_strategy.rb

@@ -1,72 +0,0 @@
-module SecureHeaders
-  class ContentSecurityPolicy
-    class FirefoxBrowserStrategy < BrowserStrategy
-      def base_name
-        SecureHeaders::ContentSecurityPolicy::FIREFOX_CSP_HEADER_NAME
-      end
-
-      def csp_header
-        SecureHeaders::ContentSecurityPolicy::FIREFOX_CSP_HEADER
-      end
-
-      def directives
-        SecureHeaders::ContentSecurityPolicy::FIREFOX_DIRECTIVES
-      end
-
-      def filter_unsupported_directives(config)
-        config = config.dup
-        config[:xhr_src] = config.delete(:connect_src) if config[:connect_src]
-        config
-      end
-
-      def translate_inline_or_eval val
-        val == 'inline' ? 'inline-script' : 'eval-script'
-      end
-
-      def build_impl_specific_directives(default)
-        build_firefox_specific_preamble(default) || ''
-      end
-
-      def build_firefox_specific_preamble(default_src_value)
-        header_value = ''
-        header_value += "allow #{default_src_value.join(" ")}; " if default_src_value.any?
-
-        options_directive = build_options_directive
-        header_value += "options #{options_directive.join(" ")}; " if options_directive.any?
-        header_value
-      end
-
-      # moves inline/eval values from script-src to options
-      # discards those values in the style-src directive
-      def build_options_directive
-        options_directive = []
-        config.each do |directive, val|
-          next if val.is_a?(String)
-          new_val = []
-          val.each do |token|
-            if ['inline-script', 'eval-script'].include?(token)
-              # Firefox does not support blocking inline styles ATM
-              # https://bugzilla.mozilla.org/show_bug.cgi?id=763879
-              unless directive?(directive, "style_src") || options_directive.include?(token)
-                options_directive << token
-              end
-            else
-              new_val << token
-            end
-          end
-          config[directive] = new_val
-        end
-
-        options_directive
-      end
-
-      def directive? val, name
-        val.to_s.casecmp(name) == 0
-      end
-
-      def normalize_reporting_endpoint?
-        true
-      end
-    end
-  end
-end

data/lib/secure_headers/headers/content_security_policy/ie_browser_strategy.rb

@@ -1,6 +0,0 @@
-module SecureHeaders
-  class ContentSecurityPolicy
-    class IeBrowserStrategy < BrowserStrategy
-    end
-  end
-end

data/lib/secure_headers/headers/content_security_policy/standard_browser_strategy.rb

@@ -1,22 +0,0 @@
-module SecureHeaders
-  class ContentSecurityPolicy
-    class StandardBrowserStrategy < BrowserStrategy
-      def base_name
-        if (browser.firefox? && browser.version.to_i >= 23) || (browser.chrome? && browser.version.to_i >= 25)
-          SecureHeaders::ContentSecurityPolicy::STANDARD_HEADER_NAME
-        else
-          SecureHeaders::ContentSecurityPolicy::WEBKIT_CSP_HEADER_NAME
-        end
-      end
-
-      def add_missing_extension_values
-        directives.each do |directive|
-          next unless config[directive]
-          if !config[directive].include?('chrome-extension:')
-            config[directive] << 'chrome-extension:'
-          end
-        end
-      end
-    end
-  end
-end

data/spec/controllers/content_security_policy_controller_spec.rb

@@ -1,74 +0,0 @@
-require 'spec_helper'
-
-describe ContentSecurityPolicyController do
-  let(:params) {
-    {
-      "csp-report" => {
-        "document-uri" => "http://localhost:3001/csp","violated-directive" => "script-src 'none'",
-        "original-policy" => "default-src https://* 'unsafe-eval'; frame-src 'self'; img-src chrome-extension: https://*; report-uri http://localhost:3001/scribes/csp_report; script-src 'none'; style-src 'unsafe-inline' 'self';",
-        "blocked-uri" => "http://localhost:3001/stuff.js"
-      }
-    }
-  }
-
-  describe "#csp" do
-    let(:request) { double().as_null_object }
-    let(:endpoint) { "https://example.com" }
-    let(:secondary_endpoint) { "https://internal.example.com" }
-
-    before(:each) do
-      SecureHeaders::Configuration.stub(:csp).and_return({:report_uri => endpoint, :forward_endpoint => secondary_endpoint})
-      subject.should_receive :head
-      subject.stub(:params).and_return(params)
-      Net::HTTP.any_instance.stub(:request)
-    end
-
-    context "delivery endpoint" do
-      it "posts over ssl" do
-        subject.should_receive(:use_ssl)
-        subject.scribe
-      end
-
-      it "posts over plain http" do
-        SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => 'http://example.com')
-        subject.should_not_receive(:use_ssl)
-        subject.scribe
-      end
-    end
-
-    it "makes a POST request" do
-      Net::HTTP.stub(:new).and_return(request)
-      request.should_receive(:request).with(instance_of(::Net::HTTP::Post))
-      params.stub(:to_json)
-      subject.scribe
-    end
-
-    it "POSTs to the configured forward_endpoint" do
-      Net::HTTP::Post.should_receive(:new).with(secondary_endpoint).and_return(request)
-      subject.scribe
-    end
-
-    it "does not POST if there is no forwarder configured" do
-      SecureHeaders::Configuration.stub(:csp).and_return({})
-      Net::HTTP::Post.should_not_receive(:new)
-      subject.scribe
-    end
-
-    it "eliminates known phony CSP reports" do
-      SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => nil)
-      Net::HTTP::Post.should_not_receive :new
-      subject.scribe
-    end
-
-    it "logs errors when it cannot forward the CSP report" do
-      class Rails; def logger; end; end
-      logger = double(:repond_to? => true)
-      Rails.stub(:logger).and_return(logger)
-
-      SecureHeaders::Configuration.stub(:csp).and_raise(StandardError)
-
-      logger.should_receive(:warn)
-      subject.scribe
-    end
-  end
-end