secure_headers 1.1.1 → 1.3.4

data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb

@@ -1,53 +1,54 @@
 module SecureHeaders
   describe XXssProtection do
-    specify { XXssProtection.new.name.should == X_XSS_PROTECTION_HEADER_NAME}
-    specify { XXssProtection.new.value.should == "1"}
-    specify { XXssProtection.new("0").value.should == "0"}
-    specify { XXssProtection.new(:value => 1, :mode => 'block').value.should == '1; mode=block' }
+    specify { expect(XXssProtection.new.name).to eq(X_XSS_PROTECTION_HEADER_NAME)}
+    specify { expect(XXssProtection.new.value).to eq("1")}
+    specify { expect(XXssProtection.new("0").value).to eq("0")}
+    specify { expect(XXssProtection.new(:value => 1, :mode => 'block').value).to eq('1; mode=block') }
+    specify { expect(XXssProtection.new(:value => 1, :mode => 'block', :report_uri => 'https://www.secure.com/reports').value).to eq('1; mode=block; report=https://www.secure.com/reports') }
 
     context "with invalid configuration" do
       it "should raise an error when providing a string that is not valid" do
-        lambda {
+        expect {
           XXssProtection.new("asdf")
-        }.should raise_error(XXssProtectionBuildError)
+        }.to raise_error(XXssProtectionBuildError)
 
-        lambda {
+        expect {
           XXssProtection.new("asdf; mode=donkey")
-        }.should raise_error(XXssProtectionBuildError)
+        }.to raise_error(XXssProtectionBuildError)
       end
 
       context "when using a hash value" do
         it "should allow string values ('1' or '0' are the only valid strings)" do
-          lambda {
+          expect {
             XXssProtection.new(:value => '1')
-          }.should_not raise_error
+          }.not_to raise_error
         end
 
         it "should allow integer values (1 or 0 are the only valid integers)" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 1)
-          }.should_not raise_error
+          }.not_to raise_error
         end
 
         it "should raise an error if no value key is supplied" do
-          lambda {
+          expect {
             XXssProtection.new(:mode => 'block')
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
 
         it "should raise an error if an invalid key is supplied" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 123)
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
 
         it "should raise an error if mode != block" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 1, :mode => "donkey")
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
       end
 
     end
   end
-end
+end

data/spec/lib/secure_headers_spec.rb

@@ -13,9 +13,9 @@ describe SecureHeaders do
 
   before(:each) do
     stub_user_agent(nil)
-    headers.stub(:[])
-    subject.stub(:response).and_return(response)
-    subject.stub(:request).and_return(request)
+    allow(headers).to receive(:[])
+    allow(subject).to receive(:response).and_return(response)
+    allow(subject).to receive(:request).and_return(request)
   end
 
   ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
@@ -32,15 +32,15 @@ describe SecureHeaders do
   }
 
   def should_assign_header name, value
-    response.headers.should_receive(:[]=).with(name, value)
+    expect(response.headers).to receive(:[]=).with(name, value)
   end
 
   def should_not_assign_header name
-    response.headers.should_not_receive(:[]=).with(name, anything)
+    expect(response.headers).not_to receive(:[]=).with(name, anything)
   end
 
   def stub_user_agent val
-    request.stub_chain(:env, :[]).and_return(val)
+    allow(request).to receive_message_chain(:env, :[]).and_return(val)
   end
 
   def options_for header
@@ -54,6 +54,7 @@ describe SecureHeaders do
       config.x_content_type_options = nil
       config.x_xss_protection = nil
       config.csp = nil
+      config.x_download_options = nil
     end
   end
 
@@ -63,12 +64,13 @@ describe SecureHeaders do
     subject.set_x_frame_options_header
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
+    subject.set_x_download_options_header
   end
 
   describe "#ensure_security_headers" do
     it "sets a before filter" do
       options = {}
-      DummyClass.should_receive(:before_filter).exactly(5).times
+      expect(DummyClass).to receive(:before_filter).exactly(6).times
       DummyClass.ensure_security_headers(options)
     end
   end
@@ -87,18 +89,19 @@ describe SecureHeaders do
 
   describe "#set_security_headers" do
     before(:each) do
-      SecureHeaders::ContentSecurityPolicy.stub(:new).and_return(double.as_null_object)
+      allow(SecureHeaders::ContentSecurityPolicy).to receive(:new).and_return(double.as_null_object)
     end
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 5
-        subject.should_receive(:set_header).exactly(number_of_headers).times # a request for a given header
+        number_of_headers = 6
+        expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
         subject.set_hsts_header
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
+        subject.set_x_download_options_header
       end
     end
 
@@ -113,6 +116,11 @@ describe SecureHeaders do
       subject.set_x_xss_protection_header(false)
     end
 
+    it "does not set the X-Download-Options header if disabled" do
+      should_not_assign_header(XDO_HEADER_NAME)
+      subject.set_x_download_options_header(false)
+    end
+
     it "does not set the X-Frame-Options header if disabled" do
       should_not_assign_header(XFO_HEADER_NAME)
       subject.set_x_frame_options_header(false)
@@ -124,7 +132,7 @@ describe SecureHeaders do
     end
 
     it "does not set the HSTS header if request is over HTTP" do
-      subject.stub_chain(:request, :ssl?).and_return(false)
+      allow(subject).to receive_message_chain(:request, :ssl?).and_return(false)
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header({:include_subdomains => true})
     end
@@ -143,8 +151,9 @@ describe SecureHeaders do
           config.x_content_type_options = false
           config.x_xss_protection = false
           config.csp = false
+          config.x_download_options = false
         end
-        subject.should_not_receive(:set_header)
+        expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
         reset_config
       end
@@ -163,6 +172,18 @@ describe SecureHeaders do
     end
   end
 
+  describe "#set_x_download_options_header" do
+    it "sets the X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+      subject.set_x_download_options_header
+    end
+
+    it "allows a custom X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, "noopen")
+      subject.set_x_download_options_header(:value => 'noopen')
+    end
+  end
+
   describe "#set_strict_transport_security" do
     it "sets the Strict-Transport-Security header" do
       should_assign_header(HSTS_HEADER_NAME, SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
@@ -178,6 +199,11 @@ describe SecureHeaders do
       should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains")
       subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true)
     end
+
+    it "allows you to specify preload" do
+      should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains; preload")
+      subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true, :preload => true)
+    end
   end
 
   describe "#set_x_xss_protection" do

data/spec/spec_helper.rb

@@ -1,25 +1,11 @@
 require 'rubygems'
-require 'spork'
-
-unless Spork.using_spork?
-  require 'simplecov'
-  SimpleCov.start do
-    add_filter "spec"
-  end
-end
-
-Spork.prefork do
-  require 'pry'
-  require 'rspec'
-end
-
-Spork.each_run do
-  require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
-  require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
-  include ::SecureHeaders::StrictTransportSecurity::Constants
-  include ::SecureHeaders::ContentSecurityPolicy::Constants
-  include ::SecureHeaders::XFrameOptions::Constants
-  include ::SecureHeaders::XXssProtection::Constants
-  include ::SecureHeaders::XContentTypeOptions::Constants
-end
-
+require 'rspec'
+
+require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
+require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
+include ::SecureHeaders::StrictTransportSecurity::Constants
+include ::SecureHeaders::ContentSecurityPolicy::Constants
+include ::SecureHeaders::XFrameOptions::Constants
+include ::SecureHeaders::XXssProtection::Constants
+include ::SecureHeaders::XContentTypeOptions::Constants
+include ::SecureHeaders::XDownloadOptions::Constants

metadata

@@ -1,20 +1,18 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.1.1
-  prerelease: 
+  version: 1.3.4
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-19 00:00:00.000000000 Z
+date: 2014-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -22,7 +20,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -35,7 +32,8 @@ extensions: []
 extra_rdoc_files: []
 files:
 - .gitignore
-- .rvmrc
+- .ruby-gemset
+- .ruby-version
 - .travis.yml
 - Gemfile
 - Guardfile
@@ -48,21 +46,18 @@ files:
 - config/routes.rb
 - fixtures/rails_3_2_12/.rspec
 - fixtures/rails_3_2_12/Gemfile
-- fixtures/rails_3_2_12/Guardfile
 - fixtures/rails_3_2_12/README.rdoc
 - fixtures/rails_3_2_12/Rakefile
 - fixtures/rails_3_2_12/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12/app/models/.gitkeep
-- fixtures/rails_3_2_12/app/models/thing.rb
 - fixtures/rails_3_2_12/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12/app/views/other_things/index.html.erb
 - fixtures/rails_3_2_12/app/views/things/index.html.erb
 - fixtures/rails_3_2_12/config.ru
 - fixtures/rails_3_2_12/config/application.rb
 - fixtures/rails_3_2_12/config/boot.rb
-- fixtures/rails_3_2_12/config/database.yml
 - fixtures/rails_3_2_12/config/environment.rb
 - fixtures/rails_3_2_12/config/environments/development.rb
 - fixtures/rails_3_2_12/config/environments/production.rb
@@ -76,8 +71,6 @@ files:
 - fixtures/rails_3_2_12/config/initializers/wrap_parameters.rb
 - fixtures/rails_3_2_12/config/locales/en.yml
 - fixtures/rails_3_2_12/config/routes.rb
-- fixtures/rails_3_2_12/db/schema.rb
-- fixtures/rails_3_2_12/db/seeds.rb
 - fixtures/rails_3_2_12/lib/assets/.gitkeep
 - fixtures/rails_3_2_12/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12/log/.gitkeep
@@ -89,14 +82,12 @@ files:
 - fixtures/rails_3_2_12/vendor/plugins/.gitkeep
 - fixtures/rails_3_2_12_no_init/.rspec
 - fixtures/rails_3_2_12_no_init/Gemfile
-- fixtures/rails_3_2_12_no_init/Guardfile
 - fixtures/rails_3_2_12_no_init/README.rdoc
 - fixtures/rails_3_2_12_no_init/Rakefile
 - fixtures/rails_3_2_12_no_init/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/models/.gitkeep
-- fixtures/rails_3_2_12_no_init/app/models/thing.rb
 - fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/other_things/index.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/things/_form.html.erb
@@ -107,7 +98,6 @@ files:
 - fixtures/rails_3_2_12_no_init/config.ru
 - fixtures/rails_3_2_12_no_init/config/application.rb
 - fixtures/rails_3_2_12_no_init/config/boot.rb
-- fixtures/rails_3_2_12_no_init/config/database.yml
 - fixtures/rails_3_2_12_no_init/config/environment.rb
 - fixtures/rails_3_2_12_no_init/config/environments/development.rb
 - fixtures/rails_3_2_12_no_init/config/environments/production.rb
@@ -120,8 +110,6 @@ files:
 - fixtures/rails_3_2_12_no_init/config/initializers/wrap_parameters.rb
 - fixtures/rails_3_2_12_no_init/config/locales/en.yml
 - fixtures/rails_3_2_12_no_init/config/routes.rb
-- fixtures/rails_3_2_12_no_init/db/schema.rb
-- fixtures/rails_3_2_12_no_init/db/seeds.rb
 - fixtures/rails_3_2_12_no_init/lib/assets/.gitkeep
 - fixtures/rails_3_2_12_no_init/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12_no_init/log/.gitkeep
@@ -136,8 +124,10 @@ files:
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
+- lib/secure_headers/headers/x_download_options.rb
 - lib/secure_headers/headers/x_frame_options.rb
 - lib/secure_headers/headers/x_xss_protection.rb
+- lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
 - lib/secure_headers/version.rb
 - secure_headers.gemspec
@@ -145,6 +135,7 @@ files:
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
@@ -153,27 +144,26 @@ files:
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 2.1.1
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Add easily configured browser headers to responses including content security
   policy, x-frame-options, strict-transport-security and more.
 test_files:
@@ -181,6 +171,7 @@ test_files:
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb

data/.rvmrc

@@ -1 +0,0 @@
-rvm use 1.9.3@secureheaders --create

data/fixtures/rails_3_2_12/Guardfile

@@ -1,14 +0,0 @@
-guard 'spork', :rspec_port => 1234, :aggressive_kill => false do
-  watch('spec/spec_helper.rb') { :rspec }
-end
-
-guard 'rspec', :cli => "--color --drb --drb-port 1234", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
-  watch(%r{^spec/.+_spec\.rb$})
-  watch('../../../lib')
-  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
-  watch('spec/spec_helper.rb')  { "spec" }
-  watch(%r{^app/controllers/(.+)_(controller)\.rb$})  { |m| ["spec/routing/#{m[1]}_routing_spec.rb", "spec/#{m[2]}s/#{m[1]}_#{m[2]}_spec.rb", "spec/acceptance/#{m[1]}_spec.rb"] }
-  watch(%r{^spec/support/(.+)\.rb$})                  { "spec" }
-  watch('app/controllers/application_controller.rb')  { "spec/controllers" }
-end
-

data/fixtures/rails_3_2_12/app/models/thing.rb

@@ -1,3 +0,0 @@
-class Thing < ActiveRecord::Base
-  # attr_accessible :title, :body
-end

data/fixtures/rails_3_2_12/config/database.yml

@@ -1,25 +0,0 @@
-# SQLite version 3.x
-#   gem install sqlite3
-#
-#   Ensure the SQLite 3 gem is defined in your Gemfile
-#   gem 'sqlite3'
-development:
-  adapter: sqlite3
-  database: db/development.sqlite3
-  pool: 5
-  timeout: 5000
-
-# Warning: The database defined as "test" will be erased and
-# re-generated from your development database when you run "rake".
-# Do not set this db to the same as development or production.
-test:
-  adapter: sqlite3
-  database: db/test.sqlite3
-  pool: 5
-  timeout: 5000
-
-production:
-  adapter: sqlite3
-  database: db/production.sqlite3
-  pool: 5
-  timeout: 5000

data/fixtures/rails_3_2_12/db/schema.rb

@@ -1,16 +0,0 @@
-# encoding: UTF-8
-# This file is auto-generated from the current state of the database. Instead
-# of editing this file, please use the migrations feature of Active Record to
-# incrementally modify your database, and then regenerate this schema definition.
-#
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
-#
-# It's strongly recommended to check this file into your version control system.
-
-ActiveRecord::Schema.define(:version => 0) do
-
-end

data/fixtures/rails_3_2_12/db/seeds.rb

@@ -1,7 +0,0 @@
-# This file should contain all the record creation needed to seed the database with its default values.
-# The data can then be loaded with the rake db:seed (or created alongside the db with db:setup).
-#
-# Examples:
-#
-#   cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }])
-#   Mayor.create(name: 'Emanuel', city: cities.first)

data/fixtures/rails_3_2_12_no_init/Guardfile

@@ -1,14 +0,0 @@
-guard 'spork', :rspec_port => 1235, :aggressive_kill => false do
-  watch('spec/spec_helper.rb') { :rspec }
-end
-
-guard 'rspec', :cli => "--color --drb --drb-port 1235", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
-  watch(%r{^spec/.+_spec\.rb$})
-  watch('../../../lib')
-  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
-  watch('spec/spec_helper.rb')  { "spec" }
-  watch(%r{^app/controllers/(.+)_(controller)\.rb$})  { |m| ["spec/routing/#{m[1]}_routing_spec.rb", "spec/#{m[2]}s/#{m[1]}_#{m[2]}_spec.rb", "spec/acceptance/#{m[1]}_spec.rb"] }
-  watch(%r{^spec/support/(.+)\.rb$})                  { "spec" }
-  watch('app/controllers/application_controller.rb')  { "spec/controllers" }
-end
-

data/fixtures/rails_3_2_12_no_init/app/models/thing.rb

@@ -1,3 +0,0 @@
-class Thing < ActiveRecord::Base
-  # attr_accessible :title, :body
-end

data/fixtures/rails_3_2_12_no_init/config/database.yml

@@ -1,25 +0,0 @@
-# SQLite version 3.x
-#   gem install sqlite3
-#
-#   Ensure the SQLite 3 gem is defined in your Gemfile
-#   gem 'sqlite3'
-development:
-  adapter: sqlite3
-  database: db/development.sqlite3
-  pool: 5
-  timeout: 5000
-
-# Warning: The database defined as "test" will be erased and
-# re-generated from your development database when you run "rake".
-# Do not set this db to the same as development or production.
-test:
-  adapter: sqlite3
-  database: db/test.sqlite3
-  pool: 5
-  timeout: 5000
-
-production:
-  adapter: sqlite3
-  database: db/production.sqlite3
-  pool: 5
-  timeout: 5000

data/fixtures/rails_3_2_12_no_init/db/schema.rb

@@ -1,16 +0,0 @@
-# encoding: UTF-8
-# This file is auto-generated from the current state of the database. Instead
-# of editing this file, please use the migrations feature of Active Record to
-# incrementally modify your database, and then regenerate this schema definition.
-#
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
-#
-# It's strongly recommended to check this file into your version control system.
-
-ActiveRecord::Schema.define(:version => 0) do
-
-end

data/fixtures/rails_3_2_12_no_init/db/seeds.rb

@@ -1,7 +0,0 @@
-# This file should contain all the record creation needed to seed the database with its default values.
-# The data can then be loaded with the rake db:seed (or created alongside the db with db:setup).
-#
-# Examples:
-#
-#   cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }])
-#   Mayor.create(name: 'Emanuel', city: cities.first)