secure_headers 1.1.1 → 2.1.0

data/lib/secure_headers/hash_helper.rb

@@ -0,0 +1,7 @@
+module SecureHeaders
+  module HashHelper
+    def hash_source(inline_script, digest = :SHA256)
+      [digest.to_s.downcase, "-", [[Digest.const_get(digest).hexdigest(inline_script)].pack("H*")].pack("m").chomp].join
+    end
+  end
+end

data/lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb

@@ -0,0 +1,22 @@
+module SecureHeaders
+  class ContentSecurityPolicy
+    class ScriptHashMiddleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, response = @app.call(env)
+        metadata = env[ContentSecurityPolicy::ENV_KEY]
+        if !metadata.nil?
+          config, options = metadata.values_at(:config, :options)
+          config.merge!(:script_hashes => env[HASHES_ENV_KEY])
+          csp_header = ContentSecurityPolicy.new(config, options)
+          headers[csp_header.name] = csp_header.value
+        end
+
+        [status, headers, response]
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,79 +1,160 @@
 require 'uri'
+require 'base64'
+require 'securerandom'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
   class ContentSecurityPolicy < Header
     module Constants
-      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https://* about: javascript:; img-src data:"
-      STANDARD_HEADER_NAME = "Content-Security-Policy"
-      FF_CSP_ENDPOINT = "/content_security_policy/forward_report"
-      DIRECTIVES = [:default_src, :script_src, :frame_src, :style_src, :img_src, :media_src, :font_src, :object_src, :connect_src]
-      META = [:enforce, :http_additions, :disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
+      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: about: javascript:; img-src data:"
+      HEADER_NAME = "Content-Security-Policy"
+      ENV_KEY = 'secure_headers.content_security_policy'
+      DIRECTIVES = [
+        :default_src,
+        :connect_src,
+        :font_src,
+        :frame_src,
+        :img_src,
+        :media_src,
+        :object_src,
+        :script_src,
+        :style_src
+      ]
+
+      NON_DEFAULT_SOURCES = [
+        :base_uri,
+        :child_src,
+        :form_action,
+        :frame_ancestors,
+        :plugin_types,
+        :referrer,
+        :reflected_xss
+      ]
+
+      OTHER = [
+        :report_uri
+      ]
+
+      SOURCE_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
+
+      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES + OTHER
     end
     include Constants
 
-    attr_accessor *META
-    attr_reader :browser, :ssl_request, :report_uri, :request_uri, :experimental
-
-    alias :disable_chrome_extension? :disable_chrome_extension
+    attr_reader :disable_fill_missing, :ssl_request
     alias :disable_fill_missing? :disable_fill_missing
     alias :ssl_request? :ssl_request
 
+    class << self
+      def generate_nonce
+        SecureRandom.base64(32).chomp
+      end
+
+      def set_nonce(controller, nonce = generate_nonce)
+        controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+      end
+
+      def add_to_env(request, controller, config)
+        set_nonce(controller)
+        options = options_from_request(request).merge(:controller => controller)
+        request.env[Constants::ENV_KEY] = {
+          :config => config,
+          :options => options,
+        }
+      end
+
+      def options_from_request(request)
+        {
+          :ssl => request.ssl?,
+          :ua => request.env['HTTP_USER_AGENT'],
+          :request_uri => request_uri_from_request(request),
+        }
+      end
+
+      def request_uri_from_request(request)
+        if request.respond_to?(:original_url)
+          # rails 3.1+
+          request.original_url
+        else
+          # rails 2/3.0
+          request.url
+        end
+      end
+
+      def symbol_to_hyphen_case sym
+        sym.to_s.gsub('_', '-')
+      end
+    end
+
     # +options+ param contains
-    # :experimental use experimental block for config
+    # :controller used for setting instance variables for nonces/hashes
     # :ssl_request used to determine if http_additions should be used
-    # :request_uri used to determine if firefox should send the report directly
-    # or use the forwarding endpoint
     # :ua the user agent (or just use Firefox/Chrome/MSIE/etc)
     #
     # :report used to determine what :ssl_request, :ua, and :request_uri are set to
     def initialize(config=nil, options={})
-      @experimental = !!options.delete(:experimental)
-      @controller = options.delete(:controller)
+      return unless config
+
       if options[:request]
-        parse_request(options[:request])
-      else
-        @ua = options[:ua]
-        # fails open, assumes http. Bad idea? Will always include http additions.
-        # could also fail if not supplied.
-        @ssl_request = !!options.delete(:ssl)
-        # a nil value here means we always assume we are not on the same host,
-        # which causes all FF csp reports to go through the forwarder
-        @request_uri = options.delete(:request_uri)
+        options = options.merge(self.class.options_from_request(options[:request]))
       end
 
-      configure(config) if config
-    end
-
-    def configure(config)
-      @config = config.dup
-
-      experimental_config = @config.delete(:experimental)
-      if @experimental && experimental_config
-        @config[:http_additions] = experimental_config[:http_additions]
-        @config.merge!(experimental_config)
-      end
+      @controller = options[:controller]
+      @ua = options[:ua]
+      @ssl_request = !!options.delete(:ssl)
+      @request_uri = options.delete(:request_uri)
+
+      # Config values can be string, array, or lamdba values
+      @config = config.inject({}) do |hash, (key, value)|
+        config_val = value.respond_to?(:call) ? value.call : value
+
+        if SOURCE_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
+          config_val = config_val.split if config_val.is_a? String
+          if config_val.is_a?(Array)
+            config_val = config_val.map do |val|
+              translate_dir_value(val)
+            end.flatten.uniq
+          end
+        end
 
-      META.each do |meta|
-        self.send("#{meta}=", @config.delete(meta))
+        hash[key] = config_val
+        hash
       end
 
+      @http_additions = @config.delete(:http_additions)
+      @app_name = @config.delete(:app_name)
       @report_uri = @config.delete(:report_uri)
-      @script_nonce = @config.delete(:script_nonce)
 
-      normalize_csp_options
-      normalize_reporting_endpoint
+      @disable_fill_missing = !!@config.delete(:disable_fill_missing)
+      @enforce = !!@config.delete(:enforce)
+      @tag_report_uri = !!@config.delete(:tag_report_uri)
+      @script_hashes = @config.delete(:script_hashes) || []
+
+      add_script_hashes if @script_hashes.any?
       fill_directives unless disable_fill_missing?
     end
 
+    ##
+    # Return or initialize the nonce value used for this header.
+    # If a reference to a controller is passed in the config, this method
+    # will check if a nonce has already been set and use it.
+    def nonce
+      @nonce ||= @controller.instance_variable_get(:@content_security_policy_nonce) || self.class.generate_nonce
+    end
+
+    ##
+    # Returns the name to use for the header. Either "Content-Security-Policy" or
+    # "Content-Security-Policy-Report-Only"
     def name
-      base = STANDARD_HEADER_NAME
-      if !enforce || experimental
+      base = HEADER_NAME
+      if !@enforce
         base += "-Report-Only"
       end
       base
     end
 
+    ##
+    # Return the value of the CSP header
     def value
       return @config if @config.is_a?(String)
       if @config
@@ -85,87 +166,52 @@ module SecureHeaders
 
     private
 
+    def add_script_hashes
+      @config[:script_src] << @script_hashes.map {|hash| "'#{hash}'"} << ["'unsafe-inline'"]
+    end
+
     def build_value
       raise "Expected to find default_src directive value" unless @config[:default_src]
       append_http_additions unless ssl_request?
       header_value = [
-        # ensure default-src is first
-        build_directive(:default_src),
-        generic_directives(@config),
-        report_uri_directive,
-        script_nonce_directive,
-      ].join
-
-      #store the value for next time
-      @config = header_value
-      header_value.strip
-    rescue StandardError => e
-      raise ContentSecurityPolicyBuildError.new("Couldn't build CSP header :( #{e}")
+        generic_directives,
+        non_default_directives,
+        report_uri_directive
+      ].join.strip
     end
 
     def fill_directives
-      return unless @config[:default_src]
-      default = @config[:default_src]
-      DIRECTIVES.each do |directive|
-        unless @config[directive]
-          @config[directive] = default
+      if default = @config[:default_src]
+        DIRECTIVES.each do |directive|
+          unless @config[directive]
+            @config[directive] = default
+          end
         end
       end
-      @config
     end
 
     def append_http_additions
-      return unless http_additions
-      http_additions.each do |k, v|
+      return unless @http_additions
+      @http_additions.each do |k, v|
         @config[k] ||= []
         @config[k] << v
       end
     end
 
-    def normalize_csp_options
-      @config.each do |k,v|
-        @config[k] = v.split if v.is_a? String
-        @config[k] = @config[k].map do |val|
-          translate_dir_value(val)
-        end
-      end
-    end
-
-    # translates 'inline','self', 'none' and 'eval' to their respective impl-specific values.
     def translate_dir_value val
       if %w{inline eval}.include?(val)
         val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
-        # self/none are special sources/src-dir-values and need to be quoted in chrome
+        # self/none are special sources/src-dir-values and need to be quoted
       elsif %{self none}.include?(val)
         "'#{val}'"
+      elsif val == 'nonce'
+        self.class.set_nonce(@controller, nonce)
+        ["'nonce-#{nonce}'", "'unsafe-inline'"]
       else
         val
       end
     end
 
-    # if we have a forwarding endpoint setup and we are not on the same origin as our report_uri
-    # or only a path was supplied (in which case we assume cross-host)
-    # we need to forward the request for Firefox.
-    def normalize_reporting_endpoint
-      if @ua && @ua =~ /Firefox/
-        if same_origin? || report_uri.nil? || URI.parse(report_uri).host.nil?
-          return
-        end
-
-        if forward_endpoint
-          @report_uri = FF_CSP_ENDPOINT
-        end
-      end
-    end
-
-    def same_origin?
-      return unless report_uri && request_uri
-
-      origin = URI.parse(request_uri)
-      uri = URI.parse(report_uri)
-      uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
-    end
-
     def report_uri_directive
       return '' if @report_uri.nil?
 
@@ -177,55 +223,40 @@ module SecureHeaders
                       end
       end
 
-      "report-uri #{@report_uri};"
-    end
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
 
-    def script_nonce_directive
-      return '' if @script_nonce.nil?
-      nonce_value = if @script_nonce.is_a?(String)
-                      @script_nonce
-                    elsif @controller
-                      @controller.instance_exec(&@script_nonce)
-                    else
-                      @script_nonce.call
-                    end
-      "script-nonce #{nonce_value};"
+      "report-uri #{@report_uri};"
     end
 
-    def generic_directives(config)
+    def generic_directives
       header_value = ''
-      if config[:img_src]
-        config[:img_src] = config[:img_src] + ['data:'] unless config[:img_src].include?('data:')
+      if @config[:img_src]
+        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
       else
-        config[:img_src] = ['data:']
+        @config[:img_src] = @config[:default_src] + ['data:']
       end
 
-      config.keys.sort_by{|k| k.to_s}.each do |k| # ensure consistent ordering
-        header_value += build_directive(k)
+      DIRECTIVES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
       end
 
       header_value
     end
 
-    # build and deletes the directive
-    def build_directive(key)
-      "#{symbol_to_hyphen_case(key)} #{@config.delete(key).join(" ")}; "
-    end
+    def non_default_directives
+      header_value = ''
+      NON_DEFAULT_SOURCES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
+      end
 
-    def symbol_to_hyphen_case sym
-      sym.to_s.gsub('_', '-')
+      header_value
     end
 
-    def parse_request request
-      @ssl_request = request.ssl?
-      @ua = request.env['HTTP_USER_AGENT']
-      @request_uri = if request.respond_to?(:original_url)
-        # rails 3.1+
-        request.original_url
-      else
-        # rails 2/3.0
-        request.url
-      end
+    def build_directive(key)
+      "#{self.class.symbol_to_hyphen_case(key)} #{@config[key].join(" ")}; "
     end
   end
 end

data/lib/secure_headers/headers/public_key_pins.rb

@@ -0,0 +1,95 @@
+module SecureHeaders
+  class PublicKeyPinsBuildError < StandardError; end
+  class PublicKeyPins < Header
+    module Constants
+      HPKP_HEADER_NAME = "Public-Key-Pins"
+      ENV_KEY = 'secure_headers.public_key_pins'
+      HASH_ALGORITHMS = [:sha256]
+      DIRECTIVES = [:max_age]
+    end
+    class << self
+      def symbol_to_hyphen_case sym
+        sym.to_s.gsub('_', '-')
+      end
+    end
+    include Constants
+
+    def initialize(config=nil)
+      @config = validate_config(config)
+
+      @pins = @config.fetch(:pins, nil)
+      @report_uri = @config.fetch(:report_uri, nil)
+      @app_name = @config.fetch(:app_name, nil)
+      @enforce = !!@config.fetch(:enforce, nil)
+      @include_subdomains = !!@config.fetch(:include_subdomains, nil)
+      @tag_report_uri = !!@config.fetch(:tag_report_uri, nil)
+    end
+
+    def name
+      base = HPKP_HEADER_NAME
+      if !@enforce
+        base += "-Report-Only"
+      end
+      base
+    end
+
+    def value
+      header_value = [
+        generic_directives,
+        pin_directives,
+        report_uri_directive,
+        subdomain_directive
+      ].compact.join('; ').strip
+    end
+
+    def validate_config(config)
+      raise PublicKeyPinsBuildError.new("config must be a hash.") unless config.is_a? Hash
+
+      if !config[:max_age]
+        raise PublicKeyPinsBuildError.new("max-age is a required directive.")
+      elsif config[:max_age].to_s !~ /\A\d+\z/
+        raise PublicKeyPinsBuildError.new("max-age must be a number.
+                                          #{config[:max_age]} was supplied.")
+      elsif config[:pins] && config[:pins].length < 2
+        raise PublicKeyPinsBuildError.new("A minimum of 2 pins are required.")
+      end
+
+      config
+    end
+
+    def pin_directives
+      return nil if @pins.nil?
+      @pins.collect do |pin|
+        pin.map do |token, hash|
+          "pin-#{token}=\"#{hash}\"" if HASH_ALGORITHMS.include?(token)
+        end
+      end.join('; ')
+    end
+
+    def generic_directives
+      DIRECTIVES.collect do |directive_name|
+        build_directive(directive_name) if @config[directive_name]
+      end.join('; ')
+    end
+
+    def build_directive(key)
+      "#{self.class.symbol_to_hyphen_case(key)}=#{@config[key]}"
+    end
+
+    def report_uri_directive
+      return nil if @report_uri.nil?
+
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
+
+      "report-uri=\"#{@report_uri}\""
+    end
+
+
+    def subdomain_directive
+      @include_subdomains ? 'includeSubDomains' : nil
+    end
+  end
+end

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -6,7 +6,7 @@ module SecureHeaders
       HSTS_HEADER_NAME = 'Strict-Transport-Security'
       HSTS_MAX_AGE = "631138519"
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
-      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?\z/i
+      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
     end
     include Constants
@@ -31,6 +31,7 @@ module SecureHeaders
       max_age = @config.fetch(:max_age, HSTS_MAX_AGE)
       value = "max-age=" + max_age.to_s
       value += "; includeSubdomains" if @config[:include_subdomains]
+      value += "; preload" if @config[:preload]
 
       value
     end

data/lib/secure_headers/headers/x_download_options.rb

@@ -0,0 +1,39 @@
+module SecureHeaders
+  class XDOBuildError < StandardError; end
+  class XDownloadOptions < Header
+    module Constants
+      XDO_HEADER_NAME = "X-Download-Options"
+      DEFAULT_VALUE = 'noopen'
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XDO_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless value.casecmp(DEFAULT_VALUE) == 0
+        raise XDOBuildError.new("Value can only be nil or 'noopen'")
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -0,0 +1,40 @@
+module SecureHeaders
+  class XPCDPBuildError < StandardError; end
+  class XPermittedCrossDomainPolicies < Header
+    module Constants
+      XPCDP_HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
+      DEFAULT_VALUE = 'none'
+      VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XPCDP_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless VALID_POLICIES.include?(value.downcase)
+        raise XPCDPBuildError.new("Value can only be one of #{VALID_POLICIES.join(', ')}")
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -4,7 +4,7 @@ module SecureHeaders
     module Constants
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"
-      VALID_X_XSS_HEADER = /\A[01](; mode=block)?\z/i
+      VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
     end
     include Constants
 
@@ -26,6 +26,7 @@ module SecureHeaders
       else
         value = @config[:value].to_s
         value += "; mode=#{@config[:mode]}" if @config[:mode]
+        value += "; report=#{@config[:report_uri]}" if @config[:report_uri]
         value
       end
     end

data/lib/secure_headers/padrino.rb

@@ -0,0 +1,14 @@
+module SecureHeaders
+  module Padrino
+    class << self
+      ##
+      # Main class that register this extension.
+      #
+      def registered(app)
+        app.extend SecureHeaders::ClassMethods
+        app.helpers SecureHeaders::InstanceMethods
+      end
+      alias :included :registered
+    end
+  end
+end