secure_headers 1.1.1 → 2.0.0

data/lib/secure_headers.rb

@@ -1,11 +1,18 @@
 module SecureHeaders
+  SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
+  HASHES_ENV_KEY = 'secure_headers.script_hashes'
+
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-        :x_xss_protection, :csp
+        :x_xss_protection, :csp, :x_download_options, :script_hashes,
+        :x_permitted_cross_domain_policies
 
       def configure &block
         instance_eval &block
+        if File.exists?(SCRIPT_HASH_CONFIG_FILE)
+          ::SecureHeaders::Configuration.script_hashes = YAML.load(File.open(SCRIPT_HASH_CONFIG_FILE))
+        end
       end
     end
   end
@@ -33,11 +40,14 @@ module SecureHeaders
 
     def ensure_security_headers options = {}
       self.secure_headers_options = options
+      before_filter :prep_script_hash
       before_filter :set_hsts_header
       before_filter :set_x_frame_options_header
       before_filter :set_csp_header
       before_filter :set_x_xss_protection_header
       before_filter :set_x_content_type_options_header
+      before_filter :set_x_download_options_header
+      before_filter :set_x_permitted_cross_domain_policies_header
     end
 
     # we can't use ||= because I'm overloading false => disable, nil => default
@@ -48,37 +58,64 @@ module SecureHeaders
   end
 
   module InstanceMethods
-    # Re-added for backwards compat.
     def set_security_headers(options = self.class.secure_headers_options)
       set_csp_header(request, options[:csp])
       set_hsts_header(options[:hsts])
       set_x_frame_options_header(options[:x_frame_options])
       set_x_xss_protection_header(options[:x_xss_protection])
       set_x_content_type_options_header(options[:x_content_type_options])
+      set_x_download_options_header(options[:x_download_options])
+      set_x_permitted_cross_domain_policies_header(options[:x_permitted_cross_domain_policies])
     end
 
-    # backwards compatibility jank, to be removed in 1.0. Old API required a request
-    # object when it didn't really need to.
     # set_csp_header - uses the request accessor and SecureHeader::Configuration settings
     # set_csp_header(+Rack::Request+) - uses the parameter and and SecureHeader::Configuration settings
     # set_csp_header(+Hash+) - uses the request accessor and options from parameters
     # set_csp_header(+Rack::Request+, +Hash+)
-    def set_csp_header(req = nil, options=nil)
-      # hack to help generating headers statically
-      if req.is_a?(Hash)
-        options = req
+    def set_csp_header(req = nil, config=nil)
+      if req.is_a?(Hash) || req.is_a?(FalseClass)
+        config = req
       end
 
-      options = self.class.secure_headers_options[:csp] if options.nil?
-      options = self.class.options_for :csp, options
+      config = self.class.secure_headers_options[:csp] if config.nil?
+      config = self.class.options_for :csp, config
 
-      return if options == false
+      return if config == false
+
+      if config && config[:script_hash_middleware]
+        ContentSecurityPolicy.add_to_env(request, self, config)
+      else
+        csp_header = ContentSecurityPolicy.new(config, :request => request, :controller => self)
+        set_header(csp_header)
+      end
+    end
+
+
+    def prep_script_hash
+      if ::SecureHeaders::Configuration.script_hashes
+        @script_hashes = ::SecureHeaders::Configuration.script_hashes.dup
+        ActiveSupport::Notifications.subscribe("render_partial.action_view") do |event_name, start_at, end_at, id, payload|
+          save_hash_for_later payload
+        end
 
-      csp_header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
-      set_header(csp_header)
-      if options && options[:experimental] && options[:enforce]
-        experimental_header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
-        set_header(experimental_header)
+        ActiveSupport::Notifications.subscribe("render_template.action_view") do |event_name, start_at, end_at, id, payload|
+          save_hash_for_later payload
+        end
+      end
+    end
+
+    def save_hash_for_later payload
+      matching_hashes = @script_hashes[payload[:identifier].gsub(Rails.root.to_s + "/", "")] || []
+
+      if payload[:layout]
+        # We're assuming an html.erb layout for now. Will need to handle mustache too, just not sure of the best way to do this
+        layout_hashes = @script_hashes[File.join("app", "views", payload[:layout]) + '.html.erb']
+
+        matching_hashes << layout_hashes if layout_hashes
+      end
+
+      if matching_hashes.any?
+        request.env[HASHES_ENV_KEY] = ((request.env[HASHES_ENV_KEY] || []) << matching_hashes).flatten
       end
     end
 
@@ -99,6 +136,14 @@ module SecureHeaders
       set_a_header(:hsts, StrictTransportSecurity, options)
     end
 
+    def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
+      set_a_header(:x_download_options, XDownloadOptions, options)
+    end
+
+    def set_x_permitted_cross_domain_policies_header(options=self.class.secure_headers_options[:x_permitted_cross_domain_policies])
+      set_a_header(:x_permitted_cross_domain_policies, XPermittedCrossDomainPolicies, options)
+    end
+
     private
 
     def set_a_header(name, klass, options=nil)
@@ -128,4 +173,8 @@ require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"
 require "secure_headers/headers/x_content_type_options"
+require "secure_headers/headers/x_download_options"
+require "secure_headers/headers/x_permitted_cross_domain_policies"
 require "secure_headers/railtie"
+require "secure_headers/hash_helper"
+require "secure_headers/view_helper"

data/lib/tasks/tasks.rake

@@ -0,0 +1,48 @@
+INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx
+INLINE_HASH_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
+
+namespace :secure_headers do
+  include SecureHeaders::HashHelper
+
+  def is_erb?(filename)
+    filename =~ /\.erb\Z/
+  end
+
+  def generate_inline_script_hashes(filename)
+    file = File.read(filename)
+    hashes = []
+
+    [INLINE_SCRIPT_REGEX, INLINE_HASH_HELPER_REGEX].each do |regex|
+      file.gsub(regex) do # TODO don't use gsub
+        inline_script = Regexp.last_match.captures.last
+        if (filename =~ /\.mustache\Z/ && inline_script =~ /\{\{.*\}\}/) || (is_erb?(filename) && inline_script =~ /<%.*%>/)
+          puts "Looks like there's some dynamic content inside of a script tag :-/"
+          puts "That pretty much means the hash value will never match."
+          puts "Code: " + inline_script
+          puts "=" * 20
+        end
+
+        hashes << hash_source(inline_script)
+      end
+    end
+
+    hashes
+  end
+
+  task :generate_hashes do |t, args|
+    script_hashes = {}
+    Dir.glob("app/{views,templates}/**/*.{erb,mustache}") do |filename|
+      hashes = generate_inline_script_hashes(filename)
+      if hashes.any?
+        script_hashes[filename] = hashes
+      end
+    end
+
+    File.open(SCRIPT_HASH_CONFIG_FILE, 'w') do |file|
+      file.write(script_hashes.to_yaml)
+    end
+
+    puts "Script hashes from " + script_hashes.keys.size.to_s + " files added to #{SCRIPT_HASH_CONFIG_FILE}"
+  end
+end

data/secure_headers.gemspec

@@ -8,10 +8,10 @@ Gem::Specification.new do |gem|
   gem.version       = SecureHeaders::VERSION
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
-  gem.description   = %q{Add easily configured browser headers to responses.}
-  gem.summary       = %q{Add easily configured browser headers to responses
-    including content security policy, x-frame-options,
-    strict-transport-security and more.}
+  gem.description   = %q{Security related headers all in one gem.}
+  gem.summary       = %q{Add easily configured security headers to responses
+    including content-security-policy, x-frame-options,
+    strict-transport-security, etc.}
   gem.homepage      = "https://github.com/twitter/secureheaders"
   gem.license       = "Apache Public License 2.0"
   gem.files         = `git ls-files`.split($/)

data/spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+require 'secure_headers/headers/content_security_policy/script_hash_middleware'
+
+module SecureHeaders
+  describe ContentSecurityPolicy::ScriptHashMiddleware do
+
+    let(:app) { double(:call => [200, headers, '']) }
+    let(:env) { double }
+    let(:headers) { double }
+
+    let(:default_config) do
+      {
+        :disable_fill_missing => true,
+        :default_src => 'https://*',
+        :report_uri => '/csp_report',
+        :script_src => 'inline eval https://* data:',
+        :style_src => "inline https://* about:"
+      }
+    end
+
+    def should_assign_header name, value
+      expect(headers).to receive(:[]=).with(name, value)
+    end
+
+    def call_middleware(hashes = [])
+      options = {
+        :ua => USER_AGENTS[:chrome]
+      }
+      expect(env).to receive(:[]).with(HASHES_ENV_KEY).and_return(hashes)
+      expect(env).to receive(:[]).with(ENV_KEY).and_return(
+        :config => default_config,
+        :options => options
+      )
+      ContentSecurityPolicy::ScriptHashMiddleware.new(app).call(env)
+    end
+
+    it "adds hashes stored in env to the header" do
+      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*'sha256-/)
+      call_middleware(['sha256-abc123'])
+    end
+
+    it "leaves things alone when no hashes are saved to env" do
+      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*(?!'sha256-)/)
+      call_middleware()
+    end
+  end
+end