secure_headers 1.1.1 → 2.0.2

data/spec/lib/secure_headers/headers/x_frame_options_spec.rb

@@ -2,34 +2,34 @@ require 'spec_helper'
 
 module SecureHeaders
   describe XFrameOptions do
-    specify{ XFrameOptions.new.name.should == "X-Frame-Options" }
+    specify{ expect(XFrameOptions.new.name).to eq("X-Frame-Options") }
 
     describe "#value" do
-      specify { XFrameOptions.new.value.should == XFrameOptions::Constants::DEFAULT_VALUE}
-      specify { XFrameOptions.new("SAMEORIGIN").value.should == "SAMEORIGIN"}
-      specify { XFrameOptions.new(:value => 'DENY').value.should == "DENY"}
+      specify { expect(XFrameOptions.new.value).to eq(XFrameOptions::Constants::DEFAULT_VALUE)}
+      specify { expect(XFrameOptions.new("SAMEORIGIN").value).to eq("SAMEORIGIN")}
+      specify { expect(XFrameOptions.new(:value => 'DENY').value).to eq("DENY")}
 
       context "with invalid configuration" do
         it "allows SAMEORIGIN" do
-          lambda {
+          expect {
             XFrameOptions.new("SAMEORIGIN").value
-          }.should_not raise_error
+          }.not_to raise_error
         end
 
         it "allows DENY" do
-          lambda {
+          expect {
             XFrameOptions.new("DENY").value
-          }.should_not raise_error        end
+          }.not_to raise_error        end
 
         it "allows ALLOW-FROM*" do
-          lambda {
+          expect {
             XFrameOptions.new("ALLOW-FROM: example.com").value
-          }.should_not raise_error
+          }.not_to raise_error
         end
         it "does not allow garbage" do
-          lambda {
+          expect {
             XFrameOptions.new("I like turtles").value
-          }.should raise_error(XFOBuildError)
+          }.to raise_error(XFOBuildError)
         end
       end
     end

data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb

@@ -0,0 +1,64 @@
+module SecureHeaders
+  describe XPermittedCrossDomainPolicies do
+    specify { expect(XPermittedCrossDomainPolicies.new.name).to eq(XPermittedCrossDomainPolicies::Constants::XPCDP_HEADER_NAME)}
+    specify { expect(XPermittedCrossDomainPolicies.new.value).to eq("none")}
+    specify { expect(XPermittedCrossDomainPolicies.new('master-only').value).to eq('master-only')}
+    specify { expect(XPermittedCrossDomainPolicies.new(:value => 'master-only').value).to eq('master-only') }
+
+    context "valid configuration values" do
+      it "accepts 'all'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("all")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "all")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-ftp-filename'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-ftp-filename")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-ftp-filename")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-content-type'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-content-type")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-content-type")
+        }.not_to raise_error
+      end
+      it "accepts 'master-only'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("master-only")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "master-only")
+        }.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect {
+          XPermittedCrossDomainPolicies.new
+        }.not_to raise_error
+      end
+    end
+
+    context 'invlaid configuration values' do
+
+      it "doesn't accept invalid values" do
+        expect {
+          XPermittedCrossDomainPolicies.new("open")
+        }.to raise_error
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb

@@ -1,53 +1,54 @@
 module SecureHeaders
   describe XXssProtection do
-    specify { XXssProtection.new.name.should == X_XSS_PROTECTION_HEADER_NAME}
-    specify { XXssProtection.new.value.should == "1"}
-    specify { XXssProtection.new("0").value.should == "0"}
-    specify { XXssProtection.new(:value => 1, :mode => 'block').value.should == '1; mode=block' }
+    specify { expect(XXssProtection.new.name).to eq(X_XSS_PROTECTION_HEADER_NAME)}
+    specify { expect(XXssProtection.new.value).to eq("1")}
+    specify { expect(XXssProtection.new("0").value).to eq("0")}
+    specify { expect(XXssProtection.new(:value => 1, :mode => 'block').value).to eq('1; mode=block') }
+    specify { expect(XXssProtection.new(:value => 1, :mode => 'block', :report_uri => 'https://www.secure.com/reports').value).to eq('1; mode=block; report=https://www.secure.com/reports') }
 
     context "with invalid configuration" do
       it "should raise an error when providing a string that is not valid" do
-        lambda {
+        expect {
           XXssProtection.new("asdf")
-        }.should raise_error(XXssProtectionBuildError)
+        }.to raise_error(XXssProtectionBuildError)
 
-        lambda {
+        expect {
           XXssProtection.new("asdf; mode=donkey")
-        }.should raise_error(XXssProtectionBuildError)
+        }.to raise_error(XXssProtectionBuildError)
       end
 
       context "when using a hash value" do
         it "should allow string values ('1' or '0' are the only valid strings)" do
-          lambda {
+          expect {
             XXssProtection.new(:value => '1')
-          }.should_not raise_error
+          }.not_to raise_error
         end
 
         it "should allow integer values (1 or 0 are the only valid integers)" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 1)
-          }.should_not raise_error
+          }.not_to raise_error
         end
 
         it "should raise an error if no value key is supplied" do
-          lambda {
+          expect {
             XXssProtection.new(:mode => 'block')
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
 
         it "should raise an error if an invalid key is supplied" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 123)
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
 
         it "should raise an error if mode != block" do
-          lambda {
+          expect {
             XXssProtection.new(:value => 1, :mode => "donkey")
-          }.should raise_error(XXssProtectionBuildError)
+          }.to raise_error(XXssProtectionBuildError)
         end
       end
 
     end
   end
-end
+end

data/spec/lib/secure_headers_spec.rb

@@ -13,38 +13,13 @@ describe SecureHeaders do
 
   before(:each) do
     stub_user_agent(nil)
-    headers.stub(:[])
-    subject.stub(:response).and_return(response)
-    subject.stub(:request).and_return(request)
-  end
-
-  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
-  USER_AGENTS = {
-    :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
-    :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
-    :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
-    :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
-    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
-    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
-    :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
-  }
-
-  def should_assign_header name, value
-    response.headers.should_receive(:[]=).with(name, value)
-  end
-
-  def should_not_assign_header name
-    response.headers.should_not_receive(:[]=).with(name, anything)
+    allow(headers).to receive(:[])
+    allow(subject).to receive(:response).and_return(response)
+    allow(subject).to receive(:request).and_return(request)
   end
 
   def stub_user_agent val
-    request.stub_chain(:env, :[]).and_return(val)
-  end
-
-  def options_for header
-    ALL_HEADERS.reject{|k,v| k == header}
+    allow(request).to receive_message_chain(:env, :[]).and_return(val)
   end
 
   def reset_config
@@ -54,6 +29,8 @@ describe SecureHeaders do
       config.x_content_type_options = nil
       config.x_xss_protection = nil
       config.csp = nil
+      config.x_download_options = nil
+      config.x_permitted_cross_domain_policies = nil
     end
   end
 
@@ -63,14 +40,8 @@ describe SecureHeaders do
     subject.set_x_frame_options_header
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
-  end
-
-  describe "#ensure_security_headers" do
-    it "sets a before filter" do
-      options = {}
-      DummyClass.should_receive(:before_filter).exactly(5).times
-      DummyClass.ensure_security_headers(options)
-    end
+    subject.set_x_download_options_header
+    subject.set_x_permitted_cross_domain_policies_header
   end
 
   describe "#set_header" do
@@ -86,19 +57,18 @@ describe SecureHeaders do
   end
 
   describe "#set_security_headers" do
-    before(:each) do
-      SecureHeaders::ContentSecurityPolicy.stub(:new).and_return(double.as_null_object)
-    end
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 5
-        subject.should_receive(:set_header).exactly(number_of_headers).times # a request for a given header
+        number_of_headers = 7
+        expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
         subject.set_hsts_header
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
+        subject.set_x_download_options_header
+        subject.set_x_permitted_cross_domain_policies_header
       end
     end
 
@@ -113,26 +83,47 @@ describe SecureHeaders do
       subject.set_x_xss_protection_header(false)
     end
 
+    it "does not set the X-Download-Options header if disabled" do
+      should_not_assign_header(XDO_HEADER_NAME)
+      subject.set_x_download_options_header(false)
+    end
+
     it "does not set the X-Frame-Options header if disabled" do
       should_not_assign_header(XFO_HEADER_NAME)
       subject.set_x_frame_options_header(false)
     end
 
+    it "does not set the X-Permitted-Cross-Domain-Policies header if disabled" do
+      should_not_assign_header(XPCDP_HEADER_NAME)
+      subject.set_x_permitted_cross_domain_policies_header(false)
+    end
+
     it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
     end
 
     it "does not set the HSTS header if request is over HTTP" do
-      subject.stub_chain(:request, :ssl?).and_return(false)
+      allow(subject).to receive_message_chain(:request, :ssl?).and_return(false)
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header({:include_subdomains => true})
     end
 
     it "does not set the CSP header if disabled" do
       stub_user_agent(USER_AGENTS[:chrome])
-      should_not_assign_header(STANDARD_HEADER_NAME)
-      subject.set_csp_header(options_for(:csp).merge(:csp => false))
+      should_not_assign_header(HEADER_NAME)
+      subject.set_csp_header(false)
+    end
+
+    it "saves the options to the env when using script hashes" do
+      opts = {
+        :default_src => 'self',
+        :script_hash_middleware => true
+      }
+      stub_user_agent(USER_AGENTS[:chrome])
+
+      expect(SecureHeaders::ContentSecurityPolicy).to receive(:add_to_env)
+      subject.set_csp_header(opts)
     end
 
     context "when disabled by configuration settings" do
@@ -143,8 +134,10 @@ describe SecureHeaders do
           config.x_content_type_options = false
           config.x_xss_protection = false
           config.csp = false
+          config.x_download_options = false
+          config.x_permitted_cross_domain_policies = false
         end
-        subject.should_not_receive(:set_header)
+        expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
         reset_config
       end
@@ -163,6 +156,18 @@ describe SecureHeaders do
     end
   end
 
+  describe "#set_x_download_options_header" do
+    it "sets the X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+      subject.set_x_download_options_header
+    end
+
+    it "allows a custom X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, "noopen")
+      subject.set_x_download_options_header(:value => 'noopen')
+    end
+  end
+
   describe "#set_strict_transport_security" do
     it "sets the Strict-Transport-Security header" do
       should_assign_header(HSTS_HEADER_NAME, SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
@@ -178,6 +183,11 @@ describe SecureHeaders do
       should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains")
       subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true)
     end
+
+    it "allows you to specify preload" do
+      should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains; preload")
+      subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true, :preload => true)
+    end
   end
 
   describe "#set_x_xss_protection" do
@@ -221,7 +231,7 @@ describe SecureHeaders do
     context "when using Firefox" do
       it "sets CSP headers" do
         stub_user_agent(USER_AGENTS[:firefox])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -229,7 +239,7 @@ describe SecureHeaders do
     context "when using Chrome" do
       it "sets default CSP header" do
         stub_user_agent(USER_AGENTS[:chrome])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -237,36 +247,21 @@ describe SecureHeaders do
     context "when using a browser besides chrome/firefox" do
       it "sets the CSP header" do
         stub_user_agent(USER_AGENTS[:opera])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
+  end
 
-    context "when using the experimental key" do
-      before(:each) do
-        stub_user_agent(USER_AGENTS[:chrome])
-        @opts = {
-          :enforce => true,
-          :default_src => 'self',
-          :script_src => 'https://mycdn.example.com',
-          :experimental => {
-            :script_src => 'self',
-          }
-        }
-      end
-
-      it "does not set the header in enforce mode if experimental is supplied, but enforce is disabled" do
-        opts = @opts.merge(:enforce => false)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        should_not_assign_header(STANDARD_HEADER_NAME)
-        subject.set_csp_header(opts)
-      end
+  describe "#set_x_permitted_cross_domain_policies_header" do
+    it "sets the X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+      subject.set_x_permitted_cross_domain_policies_header
+    end
 
-      it "sets a header in enforce mode as well as report-only mode" do
-        should_assign_header(STANDARD_HEADER_NAME, anything)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        subject.set_csp_header(@opts)
-      end
+    it "allows a custom X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, "master-only")
+      subject.set_x_permitted_cross_domain_policies_header(:value => 'master-only')
     end
   end
 end

data/spec/spec_helper.rb

@@ -1,25 +1,36 @@
 require 'rubygems'
-require 'spork'
+require 'rspec'
 
-unless Spork.using_spork?
-  require 'simplecov'
-  SimpleCov.start do
-    add_filter "spec"
-  end
-end
+require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-Spork.prefork do
-  require 'pry'
-  require 'rspec'
+if defined?(Coveralls)
+  Coveralls.wear!
 end
 
-Spork.each_run do
-  require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
-  require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
-  include ::SecureHeaders::StrictTransportSecurity::Constants
-  include ::SecureHeaders::ContentSecurityPolicy::Constants
-  include ::SecureHeaders::XFrameOptions::Constants
-  include ::SecureHeaders::XXssProtection::Constants
-  include ::SecureHeaders::XContentTypeOptions::Constants
+include ::SecureHeaders::StrictTransportSecurity::Constants
+include ::SecureHeaders::ContentSecurityPolicy::Constants
+include ::SecureHeaders::XFrameOptions::Constants
+include ::SecureHeaders::XXssProtection::Constants
+include ::SecureHeaders::XContentTypeOptions::Constants
+include ::SecureHeaders::XDownloadOptions::Constants
+include ::SecureHeaders::XPermittedCrossDomainPolicies::Constants
+
+USER_AGENTS = {
+  :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
+  :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
+  :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
+  :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
+  :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+  :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+  :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+  :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
+  :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+}
+
+def should_assign_header name, value
+  expect(response.headers).to receive(:[]=).with(name, value)
 end
 
+def should_not_assign_header name
+  expect(response.headers).not_to receive(:[]=).with(name, anything)
+end