secure_headers 1.1.1 → 2.1.0

metadata

@@ -1,83 +1,63 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.1.1
-  prerelease: 
+  version: 2.1.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-19 00:00:00.000000000 Z
+date: 2015-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Add easily configured browser headers to responses.
+description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .rvmrc
-- .travis.yml
+- ".gitignore"
+- ".ruby-gemset"
+- ".ruby-version"
+- ".travis.yml"
 - Gemfile
-- Guardfile
-- HISTORY.md
 - LICENSE
 - README.md
 - Rakefile
-- app/controllers/content_security_policy_controller.rb
-- config/curl-ca-bundle.crt
-- config/routes.rb
 - fixtures/rails_3_2_12/.rspec
 - fixtures/rails_3_2_12/Gemfile
-- fixtures/rails_3_2_12/Guardfile
 - fixtures/rails_3_2_12/README.rdoc
 - fixtures/rails_3_2_12/Rakefile
 - fixtures/rails_3_2_12/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12/app/models/.gitkeep
-- fixtures/rails_3_2_12/app/models/thing.rb
 - fixtures/rails_3_2_12/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12/app/views/other_things/index.html.erb
 - fixtures/rails_3_2_12/app/views/things/index.html.erb
 - fixtures/rails_3_2_12/config.ru
 - fixtures/rails_3_2_12/config/application.rb
 - fixtures/rails_3_2_12/config/boot.rb
-- fixtures/rails_3_2_12/config/database.yml
 - fixtures/rails_3_2_12/config/environment.rb
-- fixtures/rails_3_2_12/config/environments/development.rb
-- fixtures/rails_3_2_12/config/environments/production.rb
 - fixtures/rails_3_2_12/config/environments/test.rb
-- fixtures/rails_3_2_12/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12/config/initializers/inflections.rb
-- fixtures/rails_3_2_12/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12/config/initializers/secret_token.rb
 - fixtures/rails_3_2_12/config/initializers/secure_headers.rb
-- fixtures/rails_3_2_12/config/initializers/session_store.rb
-- fixtures/rails_3_2_12/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12/config/locales/en.yml
 - fixtures/rails_3_2_12/config/routes.rb
-- fixtures/rails_3_2_12/db/schema.rb
-- fixtures/rails_3_2_12/db/seeds.rb
+- fixtures/rails_3_2_12/config/script_hashes.yml
 - fixtures/rails_3_2_12/lib/assets/.gitkeep
 - fixtures/rails_3_2_12/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12/log/.gitkeep
@@ -89,39 +69,21 @@ files:
 - fixtures/rails_3_2_12/vendor/plugins/.gitkeep
 - fixtures/rails_3_2_12_no_init/.rspec
 - fixtures/rails_3_2_12_no_init/Gemfile
-- fixtures/rails_3_2_12_no_init/Guardfile
 - fixtures/rails_3_2_12_no_init/README.rdoc
 - fixtures/rails_3_2_12_no_init/Rakefile
 - fixtures/rails_3_2_12_no_init/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/models/.gitkeep
-- fixtures/rails_3_2_12_no_init/app/models/thing.rb
 - fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/other_things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/_form.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/edit.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/new.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/show.html.erb
 - fixtures/rails_3_2_12_no_init/config.ru
 - fixtures/rails_3_2_12_no_init/config/application.rb
 - fixtures/rails_3_2_12_no_init/config/boot.rb
-- fixtures/rails_3_2_12_no_init/config/database.yml
 - fixtures/rails_3_2_12_no_init/config/environment.rb
-- fixtures/rails_3_2_12_no_init/config/environments/development.rb
-- fixtures/rails_3_2_12_no_init/config/environments/production.rb
 - fixtures/rails_3_2_12_no_init/config/environments/test.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/inflections.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/secret_token.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/session_store.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12_no_init/config/locales/en.yml
 - fixtures/rails_3_2_12_no_init/config/routes.rb
-- fixtures/rails_3_2_12_no_init/db/schema.rb
-- fixtures/rails_3_2_12_no_init/db/seeds.rb
 - fixtures/rails_3_2_12_no_init/lib/assets/.gitkeep
 - fixtures/rails_3_2_12_no_init/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12_no_init/log/.gitkeep
@@ -131,21 +93,61 @@ files:
 - fixtures/rails_3_2_12_no_init/vendor/assets/javascripts/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
+- fixtures/rails_4_1_8/Gemfile
+- fixtures/rails_4_1_8/README.rdoc
+- fixtures/rails_4_1_8/Rakefile
+- fixtures/rails_4_1_8/app/controllers/application_controller.rb
+- fixtures/rails_4_1_8/app/controllers/concerns/.keep
+- fixtures/rails_4_1_8/app/controllers/other_things_controller.rb
+- fixtures/rails_4_1_8/app/controllers/things_controller.rb
+- fixtures/rails_4_1_8/app/models/.keep
+- fixtures/rails_4_1_8/app/models/concerns/.keep
+- fixtures/rails_4_1_8/app/views/layouts/application.html.erb
+- fixtures/rails_4_1_8/app/views/other_things/index.html.erb
+- fixtures/rails_4_1_8/app/views/things/index.html.erb
+- fixtures/rails_4_1_8/config.ru
+- fixtures/rails_4_1_8/config/application.rb
+- fixtures/rails_4_1_8/config/boot.rb
+- fixtures/rails_4_1_8/config/environment.rb
+- fixtures/rails_4_1_8/config/environments/test.rb
+- fixtures/rails_4_1_8/config/initializers/secure_headers.rb
+- fixtures/rails_4_1_8/config/routes.rb
+- fixtures/rails_4_1_8/config/script_hashes.yml
+- fixtures/rails_4_1_8/config/secrets.yml
+- fixtures/rails_4_1_8/lib/assets/.keep
+- fixtures/rails_4_1_8/lib/tasks/.keep
+- fixtures/rails_4_1_8/log/.keep
+- fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/controllers/things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/spec_helper.rb
+- fixtures/rails_4_1_8/vendor/assets/javascripts/.keep
+- fixtures/rails_4_1_8/vendor/assets/stylesheets/.keep
 - lib/secure_headers.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/header.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb
+- lib/secure_headers/headers/public_key_pins.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
+- lib/secure_headers/headers/x_download_options.rb
 - lib/secure_headers/headers/x_frame_options.rb
+- lib/secure_headers/headers/x_permitted_cross_domain_policies.rb
 - lib/secure_headers/headers/x_xss_protection.rb
+- lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
 - lib/secure_headers/version.rb
+- lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
@@ -153,35 +155,37 @@ files:
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 2.2.3
 signing_key: 
-specification_version: 3
-summary: Add easily configured browser headers to responses including content security
-  policy, x-frame-options, strict-transport-security and more.
+specification_version: 4
+summary: Add easily configured security headers to responses including content-security-policy,
+  x-frame-options, strict-transport-security, etc.
 test_files:
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb

data/.rvmrc

@@ -1 +0,0 @@
-rvm use 1.9.3@secureheaders --create

data/Guardfile

@@ -1,10 +0,0 @@
-guard 'spork', :aggressive_kill => false do
-  watch('spec/spec_helper.rb') { :rspec }
-end
-
-guard 'rspec', :cli => "--color --drb --debug", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
-  watch(%r{^spec/.+_spec\.rb$})
-  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
-  watch(%r{^app/controllers/(.+)\.rb$})     { |m| "spec/controllers/#{m[1]}_spec.rb" }
-  watch('spec/spec_helper.rb')  { "spec" }
-end

data/HISTORY.md

@@ -1,115 +0,0 @@
-1.1.1
-======
-
-Bug fix release.
-- Parsing of CSP reports was busted.
-- Forwarded reports did not include the original referer, ip, UA
-
-1.1.0
-======
-
-- Remove brwsr dependency (no more runtime dependencies)
-- Stop serving X- prefixed CSP headers
-
-This change means that all requests get all headers, even if the browser doesn't grok it.
-
-1.0.0
-======
-
-Features:
-
-- Use non-prefixed header names for Firefox >= 23, Chrome >= 25
-- Use csp 1.0 compliant header for firefox >= 23
-
-Bug Fix:
-
-- Stop sending CSP on safari 5.1+
-
-0.5.0
-======
-
-- X-Content-Type-Options also applied to Chrome requests
-
-0.4.3
-======
-
-- Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
-
-0.4.2
-======
-
-- Stupid bug where Fixnums couldn't be used for config values
-- Doc updates
-
-0.4.1
-======
-
-- Allow strings or ints in the HSTS max-age (@reedloden)
-
-0.4.0
-=======
-
-- Treat each header as it's own before_filter. This allows you to `skip_before_filter :set_X_header, :only => :bad_idea
-- Should be backwards compatible, but it is a change to the API.
-
-0.3.0
-=======
-
-- Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
-
-0.2.3
-=======
-
-- Fix error in report-uri logic for Firefox forwarding.
-
-0.2.2
-=======
-
-- Stop applying chrome-extension: to Firefox directives.
-
-0.2.1
-=======
-
-- Firefox headers will now stop overriding report_uri when only a path is supplied
-
-0.2.0
-=======
-
-- 0.1.0 introduced a serious regression in which child controllers overwrote parent controller config values
-- Decoupling of CSP headers and the request object. Allows you to generate static values to save cycles:
-
-```ruby
-FIREFOX = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Firefox", :ssl => true).value
-CHROME = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Chrome", :ssl => true).value
-```
-- :forward_endpoint now acts as the endpoint that reports are forwarded to (when using the internal forwarder feature for cross-host reporting)
-- Skeleton applications have been added to test isolated application configurations
-- Cleanup by @bemurphy
-
-0.1.1
-=======
-
-Bug fix. Firefox doesn't seem to like the default-src directive, reverting back to 'allow'
-
-0.1.0
-=======
-
-Notes:
-------
-
-- Gem is renamed to secure_headers. This will make bundler happy. https://github.com/twitter/secureheaders/pull/26
-
-Features:
-------
-
-- ability to apply two headers, one in enforce mode, one in "experimental" mode https://github.com/twitter/secureheaders/pull/11
-- Rails 3.0 support https://github.com/twitter/secureheaders/pull/28
-
-Bug fixes, misc:
-------
-
-- Fix issue where settings in application_controller were ignored if no intializer was supplied https://github.com/twitter/secureheaders/pull/25
-- Better support for other frameworks, including docs from @achui, @bmaland
-- Rails 4 routes support from @jviney https://github.com/twitter/secureheaders/pull/13
-- data: automatically whitelisted for img-src
-- Doc updates from @ming13, @theverything, @dcollazo

data/app/controllers/content_security_policy_controller.rb

@@ -1,75 +0,0 @@
-require 'net/https'
-require 'openssl'
-
-class ContentSecurityPolicyController < ActionController::Base
-  CA_FILE = File.expand_path(File.join('..','..', '..', 'config', 'curl-ca-bundle.crt'), __FILE__)
-
-  def scribe
-    csp = ::SecureHeaders::Configuration.csp || {}
-
-    forward_endpoint = csp[:forward_endpoint]
-    if forward_endpoint
-      forward_params_to(forward_endpoint)
-    end
-
-    head :ok
-  rescue StandardError => e
-    log_warning(forward_endpoint, e)
-    head :bad_request
-  end
-
-  private
-
-  def forward_params_to(forward_endpoint)
-    uri = URI.parse(forward_endpoint)
-    http = Net::HTTP.new(uri.host, uri.port)
-    if uri.scheme == 'https'
-      use_ssl(http)
-    end
-
-    if request.content_type == "application/csp-report"
-      request.body.rewind
-      params.merge!(ActiveSupport::JSON.decode(request.body.read))
-    end
-
-    ua = request.user_agent
-    xff = forwarded_for
-
-    request = Net::HTTP::Post.new(uri.to_s)
-    request.initialize_http_header({
-      'User-Agent' => ua,
-      'X-Forwarded-For' => xff,
-      'Content-Type' => 'application/json',
-    })
-    request.body = params.to_json
-
-    # fire and forget
-    if defined?(Delayed::Job)
-      http.delay.request(request)
-    else
-      http.request(request)
-    end
-  end
-
-  def forwarded_for
-    req_xff = request.env["HTTP_X_FORWARDED_FOR"]
-    if req_xff && req_xff != ""
-      "#{req_xff}, #{request.remote_ip}"
-    else
-      request.remote_ip
-    end
-  end
-
-  def use_ssl request
-    request.use_ssl = true
-    request.ca_file = CA_FILE
-    request.verify_mode = OpenSSL::SSL::VERIFY_PEER
-    request.verify_depth = 9
-  end
-
-  def log_warning(forward_endpoint, e)
-    if defined?(Rails.logger)
-      Rails.logger.warn("Unable to POST CSP report to #{forward_endpoint} because #{e}")
-    end
-  end
-end