secure_headers 1.1.1 → 2.1.0

data/lib/secure_headers/railtie.rb

@@ -3,7 +3,24 @@ if defined?(Rails::Railtie)
   module SecureHeaders
     class Railtie < Rails::Engine
       isolate_namespace ::SecureHeaders if defined? isolate_namespace # rails 3.0
-      ActionController::Base.send :include, ::SecureHeaders
+      conflicting_headers = ['X-Frame-Options', 'X-XSS-Protection', 'X-Content-Type-Options',
+                             'X-Permitted-Cross-Domain-Policies', 'X-Download-Options',
+                             'X-Content-Type-Options', 'Strict-Transport-Security',
+                             'Content-Security-Policy', 'Content-Security-Policy-Report-Only',
+                             'X-Permitted-Cross-Domain-Policies','Public-Key-Pins','Public-Key-Pins-Report-Only']
+
+      initializer "secure_headers.action_controller" do
+        ActiveSupport.on_load(:action_controller) do
+          include ::SecureHeaders
+
+          unless Rails.application.config.action_dispatch.default_headers.nil?
+            conflicting_headers.each do |header|
+              Rails.application.config.action_dispatch.default_headers.delete(header)
+            end
+          end
+
+        end
+      end
     end
   end
 else
@@ -12,26 +29,4 @@ else
       include ::SecureHeaders
     end
   end
-
-  module SecureHeaders
-    module Routing
-      module MapperExtensions
-        def csp_endpoint
-          @set.add_route(ContentSecurityPolicy::FF_CSP_ENDPOINT, {:controller => "content_security_policy", :action => "scribe"})
-        end
-      end
-    end
-  end
-
-  if defined?(ActiveSupport::Dependencies)
-    if ActiveSupport::Dependencies.autoload_paths
-      ActiveSupport::Dependencies.autoload_paths << File.expand_path(File.join("..", "..", "..", "app", "controllers"), __FILE__)
-    else
-      ActiveSupport::Dependencies.autoload_paths = [File.expand_path(File.join("..", "..", "..", "app", "controllers"), __FILE__)]
-    end
-  end
-
-  if defined? ActionController::Routing
-    ActionController::Routing::RouteSet::Mapper.send :include, ::SecureHeaders::Routing::MapperExtensions
-  end
-end
+end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "1.1.1"
+  VERSION = "2.1.0"
 end

data/lib/secure_headers/view_helper.rb

@@ -0,0 +1,68 @@
+module SecureHeaders
+  class UnexpectedHashedScriptException < StandardError
+
+  end
+
+  module ViewHelpers
+    include SecureHeaders::HashHelper
+    SECURE_HEADERS_RAKE_TASK = "rake secure_headers:generate_hashes"
+
+    def nonced_style_tag(content = nil, &block)
+      nonced_tag(content, :style, block)
+    end
+
+    def nonced_javascript_tag(content = nil, &block)
+      nonced_tag(content, :script, block)
+    end
+
+    def hashed_javascript_tag(raise_error_on_unrecognized_hash = false, &block)
+      content = capture(&block)
+
+      if ['development', 'test'].include?(ENV["RAILS_ENV"])
+        hash_value = hash_source(content)
+        file_path = File.join('app', 'views', self.instance_variable_get(:@virtual_path) + '.html.erb')
+        script_hashes = controller.instance_variable_get(:@script_hashes)[file_path]
+        unless script_hashes && script_hashes.include?(hash_value)
+          message = unexpected_hash_error_message(file_path, hash_value, content)
+          if raise_error_on_unrecognized_hash
+            raise UnexpectedHashedScriptException.new(message)
+          else
+            puts message
+            request.env[HASHES_ENV_KEY] = (request.env[HASHES_ENV_KEY] || []) << hash_value
+          end
+        end
+      end
+
+      content_tag :script, content
+    end
+
+    private
+
+    def nonced_tag(content, type, block)
+      content = if block
+        capture(&block)
+      else
+        content.html_safe # :'(
+      end
+
+      content_tag type, content, :nonce => @content_security_policy_nonce
+    end
+
+    def unexpected_hash_error_message(file_path, hash_value, content)
+      <<-EOF
+\n\n*** WARNING: Unrecognized hash in #{file_path}!!! Value: #{hash_value} ***
+<script>#{content}</script>
+*** This is fine in dev/test, but will raise exceptions in production. ***
+*** Run #{SECURE_HEADERS_RAKE_TASK} or add the following to config/script_hashes.yml:***
+#{file_path}:
+- #{hash_value}\n\n
+      EOF
+    end
+  end
+end
+
+module ActionView #:nodoc:
+  class Base #:nodoc:
+    include SecureHeaders::ViewHelpers
+  end
+end

data/lib/secure_headers.rb

@@ -1,11 +1,18 @@
 module SecureHeaders
+  SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
+  HASHES_ENV_KEY = 'secure_headers.script_hashes'
+
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-        :x_xss_protection, :csp
+        :x_xss_protection, :csp, :x_download_options, :script_hashes,
+        :x_permitted_cross_domain_policies, :hpkp
 
       def configure &block
         instance_eval &block
+        if File.exists?(SCRIPT_HASH_CONFIG_FILE)
+          ::SecureHeaders::Configuration.script_hashes = YAML.load(File.open(SCRIPT_HASH_CONFIG_FILE))
+        end
       end
     end
   end
@@ -33,11 +40,15 @@ module SecureHeaders
 
     def ensure_security_headers options = {}
       self.secure_headers_options = options
+      before_filter :prep_script_hash
       before_filter :set_hsts_header
+      before_filter :set_hpkp_header
       before_filter :set_x_frame_options_header
       before_filter :set_csp_header
       before_filter :set_x_xss_protection_header
       before_filter :set_x_content_type_options_header
+      before_filter :set_x_download_options_header
+      before_filter :set_x_permitted_cross_domain_policies_header
     end
 
     # we can't use ||= because I'm overloading false => disable, nil => default
@@ -48,37 +59,65 @@ module SecureHeaders
   end
 
   module InstanceMethods
-    # Re-added for backwards compat.
     def set_security_headers(options = self.class.secure_headers_options)
       set_csp_header(request, options[:csp])
       set_hsts_header(options[:hsts])
+      set_hpkp_header(options[:hpkp])
       set_x_frame_options_header(options[:x_frame_options])
       set_x_xss_protection_header(options[:x_xss_protection])
       set_x_content_type_options_header(options[:x_content_type_options])
+      set_x_download_options_header(options[:x_download_options])
+      set_x_permitted_cross_domain_policies_header(options[:x_permitted_cross_domain_policies])
     end
 
-    # backwards compatibility jank, to be removed in 1.0. Old API required a request
-    # object when it didn't really need to.
     # set_csp_header - uses the request accessor and SecureHeader::Configuration settings
     # set_csp_header(+Rack::Request+) - uses the parameter and and SecureHeader::Configuration settings
     # set_csp_header(+Hash+) - uses the request accessor and options from parameters
     # set_csp_header(+Rack::Request+, +Hash+)
-    def set_csp_header(req = nil, options=nil)
-      # hack to help generating headers statically
-      if req.is_a?(Hash)
-        options = req
+    def set_csp_header(req = nil, config=nil)
+      if req.is_a?(Hash) || req.is_a?(FalseClass)
+        config = req
       end
 
-      options = self.class.secure_headers_options[:csp] if options.nil?
-      options = self.class.options_for :csp, options
+      config = self.class.secure_headers_options[:csp] if config.nil?
+      config = self.class.options_for :csp, config
 
-      return if options == false
+      return if config == false
+
+      if config && config[:script_hash_middleware]
+        ContentSecurityPolicy.add_to_env(request, self, config)
+      else
+        csp_header = ContentSecurityPolicy.new(config, :request => request, :controller => self)
+        set_header(csp_header)
+      end
+    end
+
+
+    def prep_script_hash
+      if ::SecureHeaders::Configuration.script_hashes
+        @script_hashes = ::SecureHeaders::Configuration.script_hashes.dup
+        ActiveSupport::Notifications.subscribe("render_partial.action_view") do |event_name, start_at, end_at, id, payload|
+          save_hash_for_later payload
+        end
+
+        ActiveSupport::Notifications.subscribe("render_template.action_view") do |event_name, start_at, end_at, id, payload|
+          save_hash_for_later payload
+        end
+      end
+    end
+
+    def save_hash_for_later payload
+      matching_hashes = @script_hashes[payload[:identifier].gsub(Rails.root.to_s + "/", "")] || []
 
-      csp_header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
-      set_header(csp_header)
-      if options && options[:experimental] && options[:enforce]
-        experimental_header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
-        set_header(experimental_header)
+      if payload[:layout]
+        # We're assuming an html.erb layout for now. Will need to handle mustache too, just not sure of the best way to do this
+        layout_hashes = @script_hashes[File.join("app", "views", payload[:layout]) + '.html.erb']
+
+        matching_hashes << layout_hashes if layout_hashes
+      end
+
+      if matching_hashes.any?
+        request.env[HASHES_ENV_KEY] = ((request.env[HASHES_ENV_KEY] || []) << matching_hashes).flatten
       end
     end
 
@@ -99,6 +138,24 @@ module SecureHeaders
       set_a_header(:hsts, StrictTransportSecurity, options)
     end
 
+    def set_hpkp_header(options=self.class.secure_headers_options[:hpkp])
+      return unless request.ssl?
+      config = self.class.options_for :hpkp, options
+
+      return if config == false || config.nil?
+
+      hpkp_header = PublicKeyPins.new(config)
+      set_header(hpkp_header)
+    end
+
+    def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
+      set_a_header(:x_download_options, XDownloadOptions, options)
+    end
+
+    def set_x_permitted_cross_domain_policies_header(options=self.class.secure_headers_options[:x_permitted_cross_domain_policies])
+      set_a_header(:x_permitted_cross_domain_policies, XPermittedCrossDomainPolicies, options)
+    end
+
     private
 
     def set_a_header(name, klass, options=nil)
@@ -123,9 +180,14 @@ end
 
 require "secure_headers/version"
 require "secure_headers/header"
+require "secure_headers/headers/public_key_pins"
 require "secure_headers/headers/content_security_policy"
 require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"
 require "secure_headers/headers/x_content_type_options"
+require "secure_headers/headers/x_download_options"
+require "secure_headers/headers/x_permitted_cross_domain_policies"
 require "secure_headers/railtie"
+require "secure_headers/hash_helper"
+require "secure_headers/view_helper"

data/lib/tasks/tasks.rake

@@ -0,0 +1,48 @@
+INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx
+INLINE_HASH_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
+
+namespace :secure_headers do
+  include SecureHeaders::HashHelper
+
+  def is_erb?(filename)
+    filename =~ /\.erb\Z/
+  end
+
+  def generate_inline_script_hashes(filename)
+    file = File.read(filename)
+    hashes = []
+
+    [INLINE_SCRIPT_REGEX, INLINE_HASH_HELPER_REGEX].each do |regex|
+      file.gsub(regex) do # TODO don't use gsub
+        inline_script = Regexp.last_match.captures.last
+        if (filename =~ /\.mustache\Z/ && inline_script =~ /\{\{.*\}\}/) || (is_erb?(filename) && inline_script =~ /<%.*%>/)
+          puts "Looks like there's some dynamic content inside of a script tag :-/"
+          puts "That pretty much means the hash value will never match."
+          puts "Code: " + inline_script
+          puts "=" * 20
+        end
+
+        hashes << hash_source(inline_script)
+      end
+    end
+
+    hashes
+  end
+
+  task :generate_hashes do |t, args|
+    script_hashes = {}
+    Dir.glob("app/{views,templates}/**/*.{erb,mustache}") do |filename|
+      hashes = generate_inline_script_hashes(filename)
+      if hashes.any?
+        script_hashes[filename] = hashes
+      end
+    end
+
+    File.open(SCRIPT_HASH_CONFIG_FILE, 'w') do |file|
+      file.write(script_hashes.to_yaml)
+    end
+
+    puts "Script hashes from " + script_hashes.keys.size.to_s + " files added to #{SCRIPT_HASH_CONFIG_FILE}"
+  end
+end

data/secure_headers.gemspec

@@ -8,10 +8,10 @@ Gem::Specification.new do |gem|
   gem.version       = SecureHeaders::VERSION
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
-  gem.description   = %q{Add easily configured browser headers to responses.}
-  gem.summary       = %q{Add easily configured browser headers to responses
-    including content security policy, x-frame-options,
-    strict-transport-security and more.}
+  gem.description   = %q{Security related headers all in one gem.}
+  gem.summary       = %q{Add easily configured security headers to responses
+    including content-security-policy, x-frame-options,
+    strict-transport-security, etc.}
   gem.homepage      = "https://github.com/twitter/secureheaders"
   gem.license       = "Apache Public License 2.0"
   gem.files         = `git ls-files`.split($/)

data/spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+require 'secure_headers/headers/content_security_policy/script_hash_middleware'
+
+module SecureHeaders
+  describe ContentSecurityPolicy::ScriptHashMiddleware do
+
+    let(:app) { double(:call => [200, headers, '']) }
+    let(:env) { double }
+    let(:headers) { double }
+
+    let(:default_config) do
+      {
+        :disable_fill_missing => true,
+        :default_src => 'https://*',
+        :report_uri => '/csp_report',
+        :script_src => 'inline eval https://* data:',
+        :style_src => "inline https://* about:"
+      }
+    end
+
+    def should_assign_header name, value
+      expect(headers).to receive(:[]=).with(name, value)
+    end
+
+    def call_middleware(hashes = [])
+      options = {
+        :ua => USER_AGENTS[:chrome]
+      }
+      expect(env).to receive(:[]).with(HASHES_ENV_KEY).and_return(hashes)
+      expect(env).to receive(:[]).with(ENV_KEY).and_return(
+        :config => default_config,
+        :options => options
+      )
+      ContentSecurityPolicy::ScriptHashMiddleware.new(app).call(env)
+    end
+
+    it "adds hashes stored in env to the header" do
+      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*'sha256-/)
+      call_middleware(['sha256-abc123'])
+    end
+
+    it "leaves things alone when no hashes are saved to env" do
+      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*(?!'sha256-)/)
+      call_middleware()
+    end
+  end
+end