secure_headers 1.1.1 → 1.3.1

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,4 +1,5 @@
 require 'uri'
+require 'base64'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
@@ -8,7 +9,7 @@ module SecureHeaders
       STANDARD_HEADER_NAME = "Content-Security-Policy"
       FF_CSP_ENDPOINT = "/content_security_policy/forward_report"
       DIRECTIVES = [:default_src, :script_src, :frame_src, :style_src, :img_src, :media_src, :font_src, :object_src, :connect_src]
-      META = [:enforce, :http_additions, :disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
+      META = [:disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
     end
     include Constants
 
@@ -30,6 +31,7 @@ module SecureHeaders
     def initialize(config=nil, options={})
       @experimental = !!options.delete(:experimental)
       @controller = options.delete(:controller)
+
       if options[:request]
         parse_request(options[:request])
       else
@@ -45,6 +47,10 @@ module SecureHeaders
       configure(config) if config
     end
 
+    def nonce
+      @nonce ||= SecureRandom.base64(32).chomp
+    end
+
     def configure(config)
       @config = config.dup
 
@@ -54,21 +60,24 @@ module SecureHeaders
         @config.merge!(experimental_config)
       end
 
+      # http_additions will be the only field that still doesn't support
+      # lambdas because it's an ugly api that's showing it's age.
+      @http_additions = @config.delete(:http_additions)
+
+      normalize_csp_options
+
       META.each do |meta|
         self.send("#{meta}=", @config.delete(meta))
       end
 
-      @report_uri = @config.delete(:report_uri)
-      @script_nonce = @config.delete(:script_nonce)
-
-      normalize_csp_options
+      @enforce = @config.delete(:enforce)
       normalize_reporting_endpoint
       fill_directives unless disable_fill_missing?
     end
 
     def name
       base = STANDARD_HEADER_NAME
-      if !enforce || experimental
+      if !@enforce || experimental
         base += "-Report-Only"
       end
       base
@@ -89,16 +98,9 @@ module SecureHeaders
       raise "Expected to find default_src directive value" unless @config[:default_src]
       append_http_additions unless ssl_request?
       header_value = [
-        # ensure default-src is first
-        build_directive(:default_src),
         generic_directives(@config),
-        report_uri_directive,
-        script_nonce_directive,
-      ].join
-
-      #store the value for next time
-      @config = header_value
-      header_value.strip
+        report_uri_directive
+      ].join.strip
     rescue StandardError => e
       raise ContentSecurityPolicyBuildError.new("Couldn't build CSP header :( #{e}")
     end
@@ -115,20 +117,31 @@ module SecureHeaders
     end
 
     def append_http_additions
-      return unless http_additions
-      http_additions.each do |k, v|
+      return unless @http_additions
+      @http_additions.each do |k, v|
         @config[k] ||= []
         @config[k] << v
       end
     end
 
     def normalize_csp_options
-      @config.each do |k,v|
-        @config[k] = v.split if v.is_a? String
-        @config[k] = @config[k].map do |val|
-          translate_dir_value(val)
+      @config = @config.inject({}) do |hash, (key, value)|
+        # lambdas
+        config_val = value.respond_to?(:call) ? value.call : value
+        # space-delimeted strings
+        config_val = config_val.split if config_val.is_a? String
+        # array of strings
+        if config_val.respond_to?(:map) #skip booleans
+          config_val = config_val.map do |val|
+            translate_dir_value(val)
+          end.flatten.uniq
         end
+
+        hash[key] = config_val
+        hash
       end
+
+      @report_uri = @config.delete(:report_uri).join(" ") if @config[:report_uri]
     end
 
     # translates 'inline','self', 'none' and 'eval' to their respective impl-specific values.
@@ -138,6 +151,9 @@ module SecureHeaders
         # self/none are special sources/src-dir-values and need to be quoted in chrome
       elsif %{self none}.include?(val)
         "'#{val}'"
+      elsif val == 'nonce'
+        @controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+        ["'nonce-#{nonce}'", "'unsafe-inline'"]
       else
         val
       end
@@ -161,8 +177,13 @@ module SecureHeaders
     def same_origin?
       return unless report_uri && request_uri
 
-      origin = URI.parse(request_uri)
-      uri = URI.parse(report_uri)
+      begin
+        origin = URI.parse(request_uri)
+        uri = URI.parse(report_uri)
+      rescue URI::InvalidURIError
+        return false
+      end
+
       uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
     end
 
@@ -180,26 +201,15 @@ module SecureHeaders
       "report-uri #{@report_uri};"
     end
 
-    def script_nonce_directive
-      return '' if @script_nonce.nil?
-      nonce_value = if @script_nonce.is_a?(String)
-                      @script_nonce
-                    elsif @controller
-                      @controller.instance_exec(&@script_nonce)
-                    else
-                      @script_nonce.call
-                    end
-      "script-nonce #{nonce_value};"
-    end
-
     def generic_directives(config)
       header_value = ''
       if config[:img_src]
         config[:img_src] = config[:img_src] + ['data:'] unless config[:img_src].include?('data:')
       else
-        config[:img_src] = ['data:']
+        config[:img_src] = config[:default_src] + ['data:']
       end
 
+      header_value = build_directive(:default_src)
       config.keys.sort_by{|k| k.to_s}.each do |k| # ensure consistent ordering
         header_value += build_directive(k)
       end

data/lib/secure_headers/padrino.rb

@@ -0,0 +1,14 @@
+module SecureHeaders
+  module Padrino
+    class << self
+      ##
+      # Main class that register this extension.
+      #
+      def registered(app)
+        app.extend SecureHeaders::ClassMethods
+        app.helpers SecureHeaders::InstanceMethods
+      end
+      alias :included :registered
+    end
+  end
+end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "1.1.1"
+  VERSION = "1.3.1"
 end

data/spec/controllers/content_security_policy_controller_spec.rb

@@ -32,58 +32,58 @@ describe ContentSecurityPolicyController do
     let(:secondary_endpoint) { "https://internal.example.com" }
 
     before(:each) do
-      SecureHeaders::Configuration.stub(:csp).and_return({:report_uri => endpoint, :forward_endpoint => secondary_endpoint})
-      subject.should_receive :head
-      subject.stub(:params).and_return(params)
-      subject.stub(:request).and_return(FakeRequest.new)
-      Net::HTTP.any_instance.stub(:request)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return({:report_uri => endpoint, :forward_endpoint => secondary_endpoint})
+      expect(subject).to receive :head
+      allow(subject).to receive(:params).and_return(params)
+      allow(subject).to receive(:request).and_return(FakeRequest.new)
+      allow_any_instance_of(Net::HTTP).to receive(:request)
     end
 
     context "delivery endpoint" do
       it "posts over ssl" do
-        subject.should_receive(:use_ssl)
+        expect(subject).to receive(:use_ssl)
         subject.scribe
       end
 
       it "posts over plain http" do
-        SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => 'http://example.com')
-        subject.should_not_receive(:use_ssl)
+        allow(SecureHeaders::Configuration).to receive(:csp).and_return(:report_uri => 'http://example.com')
+        expect(subject).not_to receive(:use_ssl)
         subject.scribe
       end
     end
 
     it "makes a POST request" do
-      Net::HTTP.stub(:new).and_return(request)
-      request.should_receive(:request).with(instance_of(::Net::HTTP::Post))
-      params.stub(:to_json)
+      allow(Net::HTTP).to receive(:new).and_return(request)
+      expect(request).to receive(:request).with(instance_of(::Net::HTTP::Post))
+      allow(params).to receive(:to_json)
       subject.scribe
     end
 
     it "POSTs to the configured forward_endpoint" do
-      Net::HTTP::Post.should_receive(:new).with(secondary_endpoint).and_return(request)
+      expect(Net::HTTP::Post).to receive(:new).with(secondary_endpoint).and_return(request)
       subject.scribe
     end
 
     it "does not POST if there is no forwarder configured" do
-      SecureHeaders::Configuration.stub(:csp).and_return({})
-      Net::HTTP::Post.should_not_receive(:new)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return({})
+      expect(Net::HTTP::Post).not_to receive(:new)
       subject.scribe
     end
 
     it "eliminates known phony CSP reports" do
-      SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => nil)
-      Net::HTTP::Post.should_not_receive :new
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return(:report_uri => nil)
+      expect(Net::HTTP::Post).not_to receive :new
       subject.scribe
     end
 
     it "logs errors when it cannot forward the CSP report" do
       class Rails; def logger; end; end
       logger = double(:repond_to? => true)
-      Rails.stub(:logger).and_return(logger)
+      allow(Rails).to receive(:logger).and_return(logger)
 
-      SecureHeaders::Configuration.stub(:csp).and_raise(StandardError)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_raise(StandardError)
 
-      logger.should_receive(:warn)
+      expect(logger).to receive(:warn)
       subject.scribe
     end
   end