secure_headers 1.1.1 → 1.3.4

data/fixtures/rails_3_2_12_no_init/spec/controllers/things_controller_spec.rb

@@ -4,45 +4,45 @@ require 'spec_helper'
 # all values are defaulted because no initializer is configured, and the values in app controller
 # only provide csp => false
 
-describe ThingsController do
+describe ThingsController, :type => :controller do
   describe "headers" do
-    before(:each) do
-        # Chrome
-        request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
-    end
-
     it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE
+      expect(response.headers['X-XSS-Protection']).to eq(SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-Frame-Options'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
+      expect(response.headers['X-Frame-Options']).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-WebKit-CSP header" do
       get :index
-      response.headers['Content-Security-Policy-Report-Only'].should == nil
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq(nil)
     end
 
     #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
-      response.headers['Strict-Transport-Security'].should == SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE
+      expect(response.headers['Strict-Transport-Security']).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+    end
+
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-Content-Type-Options header" do
       get :index
-      response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+      expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
     end
 
     context "using IE" do
       it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+        expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
       end
     end
   end

data/fixtures/rails_3_2_12_no_init/spec/spec_helper.rb

@@ -1,20 +1,5 @@
 require 'rubygems'
-require 'spork'
-#uncomment the following line to use spork with the debugger
-#require 'spork/ext/ruby-debug'
 
-Spork.prefork do
-  # Loading more in this block will cause your tests to run faster. However,
-  # if you change any configuration or code from libraries loaded here, you'll
-  # need to restart spork for it take effect.
-# This file is copied to spec/ when you run 'rails generate rspec:install'
-  ENV["RAILS_ENV"] ||= 'test'
-  require File.expand_path("../../config/environment", __FILE__)
-  require 'rspec/rails'
-  require 'rspec/autorun'
-  # require 'ruby-debug'
-end
-
-Spork.each_run do
-
-end
+ENV["RAILS_ENV"] ||= 'test'
+require File.expand_path("../../config/environment", __FILE__)
+require 'rspec/rails'

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,4 +1,5 @@
 require 'uri'
+require 'base64'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
@@ -8,7 +9,7 @@ module SecureHeaders
       STANDARD_HEADER_NAME = "Content-Security-Policy"
       FF_CSP_ENDPOINT = "/content_security_policy/forward_report"
       DIRECTIVES = [:default_src, :script_src, :frame_src, :style_src, :img_src, :media_src, :font_src, :object_src, :connect_src]
-      META = [:enforce, :http_additions, :disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
+      META = [:disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
     end
     include Constants
 
@@ -30,6 +31,7 @@ module SecureHeaders
     def initialize(config=nil, options={})
       @experimental = !!options.delete(:experimental)
       @controller = options.delete(:controller)
+
       if options[:request]
         parse_request(options[:request])
       else
@@ -45,6 +47,10 @@ module SecureHeaders
       configure(config) if config
     end
 
+    def nonce
+      @nonce ||= SecureRandom.base64(32).chomp
+    end
+
     def configure(config)
       @config = config.dup
 
@@ -54,21 +60,26 @@ module SecureHeaders
         @config.merge!(experimental_config)
       end
 
+      # these values don't support lambdas because this needs to be rewritten
+      @http_additions = @config.delete(:http_additions)
+      @app_name = @config.delete(:app_name)
+
+      normalize_csp_options
+
       META.each do |meta|
         self.send("#{meta}=", @config.delete(meta))
       end
 
-      @report_uri = @config.delete(:report_uri)
-      @script_nonce = @config.delete(:script_nonce)
+      @enforce = !!@config.delete(:enforce)
+      @tag_report_uri = @config.delete(:tag_report_uri)
 
-      normalize_csp_options
       normalize_reporting_endpoint
       fill_directives unless disable_fill_missing?
     end
 
     def name
       base = STANDARD_HEADER_NAME
-      if !enforce || experimental
+      if !@enforce || experimental
         base += "-Report-Only"
       end
       base
@@ -89,16 +100,9 @@ module SecureHeaders
       raise "Expected to find default_src directive value" unless @config[:default_src]
       append_http_additions unless ssl_request?
       header_value = [
-        # ensure default-src is first
-        build_directive(:default_src),
         generic_directives(@config),
-        report_uri_directive,
-        script_nonce_directive,
-      ].join
-
-      #store the value for next time
-      @config = header_value
-      header_value.strip
+        report_uri_directive
+      ].join.strip
     rescue StandardError => e
       raise ContentSecurityPolicyBuildError.new("Couldn't build CSP header :( #{e}")
     end
@@ -115,20 +119,31 @@ module SecureHeaders
     end
 
     def append_http_additions
-      return unless http_additions
-      http_additions.each do |k, v|
+      return unless @http_additions
+      @http_additions.each do |k, v|
         @config[k] ||= []
         @config[k] << v
       end
     end
 
     def normalize_csp_options
-      @config.each do |k,v|
-        @config[k] = v.split if v.is_a? String
-        @config[k] = @config[k].map do |val|
-          translate_dir_value(val)
+      @config = @config.inject({}) do |hash, (key, value)|
+        # lambdas
+        config_val = value.respond_to?(:call) ? value.call : value
+        # space-delimeted strings
+        config_val = config_val.split if config_val.is_a? String
+        # array of strings
+        if config_val.respond_to?(:map) #skip booleans
+          config_val = config_val.map do |val|
+            translate_dir_value(val)
+          end.flatten.uniq
         end
+
+        hash[key] = config_val
+        hash
       end
+
+      @report_uri = @config.delete(:report_uri).join(" ") if @config[:report_uri]
     end
 
     # translates 'inline','self', 'none' and 'eval' to their respective impl-specific values.
@@ -138,6 +153,9 @@ module SecureHeaders
         # self/none are special sources/src-dir-values and need to be quoted in chrome
       elsif %{self none}.include?(val)
         "'#{val}'"
+      elsif val == 'nonce'
+        @controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+        ["'nonce-#{nonce}'", "'unsafe-inline'"]
       else
         val
       end
@@ -156,13 +174,23 @@ module SecureHeaders
           @report_uri = FF_CSP_ENDPOINT
         end
       end
+
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
     end
 
     def same_origin?
       return unless report_uri && request_uri
 
-      origin = URI.parse(request_uri)
-      uri = URI.parse(report_uri)
+      begin
+        origin = URI.parse(request_uri)
+        uri = URI.parse(report_uri)
+      rescue URI::InvalidURIError
+        return false
+      end
+
       uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
     end
 
@@ -180,26 +208,15 @@ module SecureHeaders
       "report-uri #{@report_uri};"
     end
 
-    def script_nonce_directive
-      return '' if @script_nonce.nil?
-      nonce_value = if @script_nonce.is_a?(String)
-                      @script_nonce
-                    elsif @controller
-                      @controller.instance_exec(&@script_nonce)
-                    else
-                      @script_nonce.call
-                    end
-      "script-nonce #{nonce_value};"
-    end
-
     def generic_directives(config)
       header_value = ''
       if config[:img_src]
         config[:img_src] = config[:img_src] + ['data:'] unless config[:img_src].include?('data:')
       else
-        config[:img_src] = ['data:']
+        config[:img_src] = config[:default_src] + ['data:']
       end
 
+      header_value = build_directive(:default_src)
       config.keys.sort_by{|k| k.to_s}.each do |k| # ensure consistent ordering
         header_value += build_directive(k)
       end

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -6,7 +6,7 @@ module SecureHeaders
       HSTS_HEADER_NAME = 'Strict-Transport-Security'
       HSTS_MAX_AGE = "631138519"
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
-      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?\z/i
+      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
     end
     include Constants
@@ -31,6 +31,7 @@ module SecureHeaders
       max_age = @config.fetch(:max_age, HSTS_MAX_AGE)
       value = "max-age=" + max_age.to_s
       value += "; includeSubdomains" if @config[:include_subdomains]
+      value += "; preload" if @config[:preload]
 
       value
     end

data/lib/secure_headers/headers/x_download_options.rb

@@ -0,0 +1,39 @@
+module SecureHeaders
+  class XDOBuildError < StandardError; end
+  class XDownloadOptions < Header
+    module Constants
+      XDO_HEADER_NAME = "X-Download-Options"
+      DEFAULT_VALUE = 'noopen'
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XDO_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless value.casecmp(DEFAULT_VALUE) == 0
+        raise XDOBuildError.new("Value can only be nil or 'noopen'")
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -4,7 +4,7 @@ module SecureHeaders
     module Constants
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"
-      VALID_X_XSS_HEADER = /\A[01](; mode=block)?\z/i
+      VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
     end
     include Constants
 
@@ -26,6 +26,7 @@ module SecureHeaders
       else
         value = @config[:value].to_s
         value += "; mode=#{@config[:mode]}" if @config[:mode]
+        value += "; report=#{@config[:report_uri]}" if @config[:report_uri]
         value
       end
     end

data/lib/secure_headers/padrino.rb

@@ -0,0 +1,14 @@
+module SecureHeaders
+  module Padrino
+    class << self
+      ##
+      # Main class that register this extension.
+      #
+      def registered(app)
+        app.extend SecureHeaders::ClassMethods
+        app.helpers SecureHeaders::InstanceMethods
+      end
+      alias :included :registered
+    end
+  end
+end

data/lib/secure_headers/railtie.rb

@@ -3,7 +3,11 @@ if defined?(Rails::Railtie)
   module SecureHeaders
     class Railtie < Rails::Engine
       isolate_namespace ::SecureHeaders if defined? isolate_namespace # rails 3.0
-      ActionController::Base.send :include, ::SecureHeaders
+      initializer "secure_headers.action_controller" do
+        ActiveSupport.on_load(:action_controller) do
+          include ::SecureHeaders
+        end
+      end
     end
   end
 else
@@ -34,4 +38,4 @@ else
   if defined? ActionController::Routing
     ActionController::Routing::RouteSet::Mapper.send :include, ::SecureHeaders::Routing::MapperExtensions
   end
-end
+end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "1.1.1"
+  VERSION = "1.3.4"
 end

data/lib/secure_headers.rb

@@ -2,7 +2,7 @@ module SecureHeaders
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-        :x_xss_protection, :csp
+        :x_xss_protection, :csp, :x_download_options
 
       def configure &block
         instance_eval &block
@@ -38,6 +38,7 @@ module SecureHeaders
       before_filter :set_csp_header
       before_filter :set_x_xss_protection_header
       before_filter :set_x_content_type_options_header
+      before_filter :set_x_download_options_header
     end
 
     # we can't use ||= because I'm overloading false => disable, nil => default
@@ -55,6 +56,7 @@ module SecureHeaders
       set_x_frame_options_header(options[:x_frame_options])
       set_x_xss_protection_header(options[:x_xss_protection])
       set_x_content_type_options_header(options[:x_content_type_options])
+      set_x_download_options_header(options[:x_download_options])
     end
 
     # backwards compatibility jank, to be removed in 1.0. Old API required a request
@@ -99,6 +101,10 @@ module SecureHeaders
       set_a_header(:hsts, StrictTransportSecurity, options)
     end
 
+    def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
+      set_a_header(:x_download_options, XDownloadOptions, options)
+    end
+
     private
 
     def set_a_header(name, klass, options=nil)
@@ -128,4 +134,5 @@ require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"
 require "secure_headers/headers/x_content_type_options"
+require "secure_headers/headers/x_download_options"
 require "secure_headers/railtie"

data/spec/controllers/content_security_policy_controller_spec.rb

@@ -32,58 +32,58 @@ describe ContentSecurityPolicyController do
     let(:secondary_endpoint) { "https://internal.example.com" }
 
     before(:each) do
-      SecureHeaders::Configuration.stub(:csp).and_return({:report_uri => endpoint, :forward_endpoint => secondary_endpoint})
-      subject.should_receive :head
-      subject.stub(:params).and_return(params)
-      subject.stub(:request).and_return(FakeRequest.new)
-      Net::HTTP.any_instance.stub(:request)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return({:report_uri => endpoint, :forward_endpoint => secondary_endpoint})
+      expect(subject).to receive :head
+      allow(subject).to receive(:params).and_return(params)
+      allow(subject).to receive(:request).and_return(FakeRequest.new)
+      allow_any_instance_of(Net::HTTP).to receive(:request)
     end
 
     context "delivery endpoint" do
       it "posts over ssl" do
-        subject.should_receive(:use_ssl)
+        expect(subject).to receive(:use_ssl)
         subject.scribe
       end
 
       it "posts over plain http" do
-        SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => 'http://example.com')
-        subject.should_not_receive(:use_ssl)
+        allow(SecureHeaders::Configuration).to receive(:csp).and_return(:report_uri => 'http://example.com')
+        expect(subject).not_to receive(:use_ssl)
         subject.scribe
       end
     end
 
     it "makes a POST request" do
-      Net::HTTP.stub(:new).and_return(request)
-      request.should_receive(:request).with(instance_of(::Net::HTTP::Post))
-      params.stub(:to_json)
+      allow(Net::HTTP).to receive(:new).and_return(request)
+      expect(request).to receive(:request).with(instance_of(::Net::HTTP::Post))
+      allow(params).to receive(:to_json)
       subject.scribe
     end
 
     it "POSTs to the configured forward_endpoint" do
-      Net::HTTP::Post.should_receive(:new).with(secondary_endpoint).and_return(request)
+      expect(Net::HTTP::Post).to receive(:new).with(secondary_endpoint).and_return(request)
       subject.scribe
     end
 
     it "does not POST if there is no forwarder configured" do
-      SecureHeaders::Configuration.stub(:csp).and_return({})
-      Net::HTTP::Post.should_not_receive(:new)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return({})
+      expect(Net::HTTP::Post).not_to receive(:new)
       subject.scribe
     end
 
     it "eliminates known phony CSP reports" do
-      SecureHeaders::Configuration.stub(:csp).and_return(:report_uri => nil)
-      Net::HTTP::Post.should_not_receive :new
+      allow(SecureHeaders::Configuration).to receive(:csp).and_return(:report_uri => nil)
+      expect(Net::HTTP::Post).not_to receive :new
       subject.scribe
     end
 
     it "logs errors when it cannot forward the CSP report" do
       class Rails; def logger; end; end
       logger = double(:repond_to? => true)
-      Rails.stub(:logger).and_return(logger)
+      allow(Rails).to receive(:logger).and_return(logger)
 
-      SecureHeaders::Configuration.stub(:csp).and_raise(StandardError)
+      allow(SecureHeaders::Configuration).to receive(:csp).and_raise(StandardError)
 
-      logger.should_receive(:warn)
+      expect(logger).to receive(:warn)
       subject.scribe
     end
   end