secure_headers 1.2.0 → 2.0.0

data/spec/lib/secure_headers_spec.rb

@@ -18,26 +18,7 @@ describe SecureHeaders do
     allow(subject).to receive(:request).and_return(request)
   end
 
-  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
-  USER_AGENTS = {
-    :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
-    :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
-    :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
-    :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
-    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
-    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
-    :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
-  }
-
-  def should_assign_header name, value
-    expect(response.headers).to receive(:[]=).with(name, value)
-  end
-
-  def should_not_assign_header name
-    expect(response.headers).not_to receive(:[]=).with(name, anything)
-  end
+  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection, :x_permitted_cross_domain_policies].map{|header| [header, false]}]
 
   def stub_user_agent val
     allow(request).to receive_message_chain(:env, :[]).and_return(val)
@@ -54,6 +35,8 @@ describe SecureHeaders do
       config.x_content_type_options = nil
       config.x_xss_protection = nil
       config.csp = nil
+      config.x_download_options = nil
+      config.x_permitted_cross_domain_policies = nil
     end
   end
 
@@ -63,14 +46,8 @@ describe SecureHeaders do
     subject.set_x_frame_options_header
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
-  end
-
-  describe "#ensure_security_headers" do
-    it "sets a before filter" do
-      options = {}
-      expect(DummyClass).to receive(:before_filter).exactly(5).times
-      DummyClass.ensure_security_headers(options)
-    end
+    subject.set_x_download_options_header
+    subject.set_x_permitted_cross_domain_policies_header
   end
 
   describe "#set_header" do
@@ -86,19 +63,18 @@ describe SecureHeaders do
   end
 
   describe "#set_security_headers" do
-    before(:each) do
-      allow(SecureHeaders::ContentSecurityPolicy).to receive(:new).and_return(double.as_null_object)
-    end
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 5
+        number_of_headers = 7
         expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
         subject.set_hsts_header
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
+        subject.set_x_download_options_header
+        subject.set_x_permitted_cross_domain_policies_header
       end
     end
 
@@ -113,11 +89,21 @@ describe SecureHeaders do
       subject.set_x_xss_protection_header(false)
     end
 
+    it "does not set the X-Download-Options header if disabled" do
+      should_not_assign_header(XDO_HEADER_NAME)
+      subject.set_x_download_options_header(false)
+    end
+
     it "does not set the X-Frame-Options header if disabled" do
       should_not_assign_header(XFO_HEADER_NAME)
       subject.set_x_frame_options_header(false)
     end
 
+    it "does not set the X-Permitted-Cross-Domain-Policies header if disabled" do
+      should_not_assign_header(XPCDP_HEADER_NAME)
+      subject.set_x_permitted_cross_domain_policies_header(false)
+    end
+
     it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
@@ -131,8 +117,19 @@ describe SecureHeaders do
 
     it "does not set the CSP header if disabled" do
       stub_user_agent(USER_AGENTS[:chrome])
-      should_not_assign_header(STANDARD_HEADER_NAME)
-      subject.set_csp_header(options_for(:csp).merge(:csp => false))
+      should_not_assign_header(HEADER_NAME)
+      subject.set_csp_header(false)
+    end
+
+    it "saves the options to the env when using script hashes" do
+      opts = {
+        :default_src => 'self',
+        :script_hash_middleware => true
+      }
+      stub_user_agent(USER_AGENTS[:chrome])
+
+      expect(SecureHeaders::ContentSecurityPolicy).to receive(:add_to_env)
+      subject.set_csp_header(opts)
     end
 
     context "when disabled by configuration settings" do
@@ -143,6 +140,8 @@ describe SecureHeaders do
           config.x_content_type_options = false
           config.x_xss_protection = false
           config.csp = false
+          config.x_download_options = false
+          config.x_permitted_cross_domain_policies = false
         end
         expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
@@ -163,6 +162,18 @@ describe SecureHeaders do
     end
   end
 
+  describe "#set_x_download_options_header" do
+    it "sets the X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+      subject.set_x_download_options_header
+    end
+
+    it "allows a custom X-Download-Options header" do
+      should_assign_header(XDO_HEADER_NAME, "noopen")
+      subject.set_x_download_options_header(:value => 'noopen')
+    end
+  end
+
   describe "#set_strict_transport_security" do
     it "sets the Strict-Transport-Security header" do
       should_assign_header(HSTS_HEADER_NAME, SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
@@ -178,6 +189,11 @@ describe SecureHeaders do
       should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains")
       subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true)
     end
+
+    it "allows you to specify preload" do
+      should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains; preload")
+      subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true, :preload => true)
+    end
   end
 
   describe "#set_x_xss_protection" do
@@ -221,7 +237,7 @@ describe SecureHeaders do
     context "when using Firefox" do
       it "sets CSP headers" do
         stub_user_agent(USER_AGENTS[:firefox])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -229,7 +245,7 @@ describe SecureHeaders do
     context "when using Chrome" do
       it "sets default CSP header" do
         stub_user_agent(USER_AGENTS[:chrome])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -237,36 +253,21 @@ describe SecureHeaders do
     context "when using a browser besides chrome/firefox" do
       it "sets the CSP header" do
         stub_user_agent(USER_AGENTS[:opera])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
+  end
 
-    context "when using the experimental key" do
-      before(:each) do
-        stub_user_agent(USER_AGENTS[:chrome])
-        @opts = {
-          :enforce => true,
-          :default_src => 'self',
-          :script_src => 'https://mycdn.example.com',
-          :experimental => {
-            :script_src => 'self',
-          }
-        }
-      end
-
-      it "does not set the header in enforce mode if experimental is supplied, but enforce is disabled" do
-        opts = @opts.merge(:enforce => false)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        should_not_assign_header(STANDARD_HEADER_NAME)
-        subject.set_csp_header(opts)
-      end
+  describe "#set_x_permitted_cross_domain_policies_header" do
+    it "sets the X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+      subject.set_x_permitted_cross_domain_policies_header
+    end
 
-      it "sets a header in enforce mode as well as report-only mode" do
-        should_assign_header(STANDARD_HEADER_NAME, anything)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        subject.set_csp_header(@opts)
-      end
+    it "allows a custom X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, "master-only")
+      subject.set_x_permitted_cross_domain_policies_header(:value => 'master-only')
     end
   end
 end

data/spec/spec_helper.rb

@@ -1,24 +1,36 @@
 require 'rubygems'
-require 'spork'
+require 'rspec'
 
-unless Spork.using_spork?
-  require 'simplecov'
-  SimpleCov.start do
-    add_filter "spec"
-  end
-end
+require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-Spork.prefork do
-  require 'rspec'
+if defined?(Coveralls)
+  Coveralls.wear!
 end
 
-Spork.each_run do
-  require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
-  require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
-  include ::SecureHeaders::StrictTransportSecurity::Constants
-  include ::SecureHeaders::ContentSecurityPolicy::Constants
-  include ::SecureHeaders::XFrameOptions::Constants
-  include ::SecureHeaders::XXssProtection::Constants
-  include ::SecureHeaders::XContentTypeOptions::Constants
+include ::SecureHeaders::StrictTransportSecurity::Constants
+include ::SecureHeaders::ContentSecurityPolicy::Constants
+include ::SecureHeaders::XFrameOptions::Constants
+include ::SecureHeaders::XXssProtection::Constants
+include ::SecureHeaders::XContentTypeOptions::Constants
+include ::SecureHeaders::XDownloadOptions::Constants
+include ::SecureHeaders::XPermittedCrossDomainPolicies::Constants
+
+USER_AGENTS = {
+  :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
+  :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
+  :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
+  :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
+  :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+  :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+  :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+  :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
+  :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+}
+
+def should_assign_header name, value
+  expect(response.headers).to receive(:[]=).with(name, value)
 end
 
+def should_not_assign_header name
+  expect(response.headers).not_to receive(:[]=).with(name, anything)
+end

metadata

@@ -1,18 +1,20 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 2.0.0
+  prerelease: 
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-06-13 00:00:00.000000000 Z
+date: 2015-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -20,11 +22,12 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
-description: Add easily configured browser headers to responses.
+description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
 executables: []
@@ -36,46 +39,28 @@ files:
 - .ruby-version
 - .travis.yml
 - Gemfile
-- Guardfile
-- HISTORY.md
 - LICENSE
 - README.md
 - Rakefile
-- app/controllers/content_security_policy_controller.rb
-- config/curl-ca-bundle.crt
-- config/routes.rb
 - fixtures/rails_3_2_12/.rspec
 - fixtures/rails_3_2_12/Gemfile
-- fixtures/rails_3_2_12/Guardfile
 - fixtures/rails_3_2_12/README.rdoc
 - fixtures/rails_3_2_12/Rakefile
 - fixtures/rails_3_2_12/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12/app/models/.gitkeep
-- fixtures/rails_3_2_12/app/models/thing.rb
 - fixtures/rails_3_2_12/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12/app/views/other_things/index.html.erb
 - fixtures/rails_3_2_12/app/views/things/index.html.erb
 - fixtures/rails_3_2_12/config.ru
 - fixtures/rails_3_2_12/config/application.rb
 - fixtures/rails_3_2_12/config/boot.rb
-- fixtures/rails_3_2_12/config/database.yml
 - fixtures/rails_3_2_12/config/environment.rb
-- fixtures/rails_3_2_12/config/environments/development.rb
-- fixtures/rails_3_2_12/config/environments/production.rb
 - fixtures/rails_3_2_12/config/environments/test.rb
-- fixtures/rails_3_2_12/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12/config/initializers/inflections.rb
-- fixtures/rails_3_2_12/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12/config/initializers/secret_token.rb
 - fixtures/rails_3_2_12/config/initializers/secure_headers.rb
-- fixtures/rails_3_2_12/config/initializers/session_store.rb
-- fixtures/rails_3_2_12/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12/config/locales/en.yml
 - fixtures/rails_3_2_12/config/routes.rb
-- fixtures/rails_3_2_12/db/schema.rb
-- fixtures/rails_3_2_12/db/seeds.rb
+- fixtures/rails_3_2_12/config/script_hashes.yml
 - fixtures/rails_3_2_12/lib/assets/.gitkeep
 - fixtures/rails_3_2_12/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12/log/.gitkeep
@@ -87,39 +72,21 @@ files:
 - fixtures/rails_3_2_12/vendor/plugins/.gitkeep
 - fixtures/rails_3_2_12_no_init/.rspec
 - fixtures/rails_3_2_12_no_init/Gemfile
-- fixtures/rails_3_2_12_no_init/Guardfile
 - fixtures/rails_3_2_12_no_init/README.rdoc
 - fixtures/rails_3_2_12_no_init/Rakefile
 - fixtures/rails_3_2_12_no_init/app/controllers/application_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/other_things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/controllers/things_controller.rb
 - fixtures/rails_3_2_12_no_init/app/models/.gitkeep
-- fixtures/rails_3_2_12_no_init/app/models/thing.rb
 - fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/other_things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/_form.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/edit.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/new.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/show.html.erb
 - fixtures/rails_3_2_12_no_init/config.ru
 - fixtures/rails_3_2_12_no_init/config/application.rb
 - fixtures/rails_3_2_12_no_init/config/boot.rb
-- fixtures/rails_3_2_12_no_init/config/database.yml
 - fixtures/rails_3_2_12_no_init/config/environment.rb
-- fixtures/rails_3_2_12_no_init/config/environments/development.rb
-- fixtures/rails_3_2_12_no_init/config/environments/production.rb
 - fixtures/rails_3_2_12_no_init/config/environments/test.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/inflections.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/secret_token.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/session_store.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12_no_init/config/locales/en.yml
 - fixtures/rails_3_2_12_no_init/config/routes.rb
-- fixtures/rails_3_2_12_no_init/db/schema.rb
-- fixtures/rails_3_2_12_no_init/db/seeds.rb
 - fixtures/rails_3_2_12_no_init/lib/assets/.gitkeep
 - fixtures/rails_3_2_12_no_init/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12_no_init/log/.gitkeep
@@ -129,21 +96,59 @@ files:
 - fixtures/rails_3_2_12_no_init/vendor/assets/javascripts/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
+- fixtures/rails_4_1_8/Gemfile
+- fixtures/rails_4_1_8/README.rdoc
+- fixtures/rails_4_1_8/Rakefile
+- fixtures/rails_4_1_8/app/controllers/application_controller.rb
+- fixtures/rails_4_1_8/app/controllers/concerns/.keep
+- fixtures/rails_4_1_8/app/controllers/other_things_controller.rb
+- fixtures/rails_4_1_8/app/controllers/things_controller.rb
+- fixtures/rails_4_1_8/app/models/.keep
+- fixtures/rails_4_1_8/app/models/concerns/.keep
+- fixtures/rails_4_1_8/app/views/layouts/application.html.erb
+- fixtures/rails_4_1_8/app/views/other_things/index.html.erb
+- fixtures/rails_4_1_8/app/views/things/index.html.erb
+- fixtures/rails_4_1_8/config.ru
+- fixtures/rails_4_1_8/config/application.rb
+- fixtures/rails_4_1_8/config/boot.rb
+- fixtures/rails_4_1_8/config/environment.rb
+- fixtures/rails_4_1_8/config/environments/test.rb
+- fixtures/rails_4_1_8/config/initializers/secure_headers.rb
+- fixtures/rails_4_1_8/config/routes.rb
+- fixtures/rails_4_1_8/config/script_hashes.yml
+- fixtures/rails_4_1_8/config/secrets.yml
+- fixtures/rails_4_1_8/lib/assets/.keep
+- fixtures/rails_4_1_8/lib/tasks/.keep
+- fixtures/rails_4_1_8/log/.keep
+- fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/controllers/things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/spec_helper.rb
+- fixtures/rails_4_1_8/vendor/assets/javascripts/.keep
+- fixtures/rails_4_1_8/vendor/assets/stylesheets/.keep
 - lib/secure_headers.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/header.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
+- lib/secure_headers/headers/x_download_options.rb
 - lib/secure_headers/headers/x_frame_options.rb
+- lib/secure_headers/headers/x_permitted_cross_domain_policies.rb
 - lib/secure_headers/headers/x_xss_protection.rb
+- lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
 - lib/secure_headers/version.rb
+- lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
@@ -151,34 +156,37 @@ files:
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 1.8.23
 signing_key: 
-specification_version: 4
-summary: Add easily configured browser headers to responses including content security
-  policy, x-frame-options, strict-transport-security and more.
+specification_version: 3
+summary: Add easily configured security headers to responses including content-security-policy,
+  x-frame-options, strict-transport-security, etc.
 test_files:
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
+- spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb

checksums.yaml

@@ -1,15 +0,0 @@
----
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    ZDFmNDM2NjIwYzU4MjcyYWU0ODkwMjkxMjM0MDMwYTAyNjY3YWM2ZA==
-  data.tar.gz: !binary |-
-    N2VjN2M3MGMyY2Y5ODliOTVmZTIxZDgwOTdjYTM1NTg3MDZiMjdjNw==
-SHA512:
-  metadata.gz: !binary |-
-    MTRiN2Y5NDFhYTE3ZmM2MjE4MThmMDQ3OTZmOWVhMWM5OTgxOThlNzFiOGNm
-    MzQ2ZmFiMjUyZjdmNWU4MWQwZTY3Yjc4YmM4NzVjMWNhZWE0YzI3YjlmMjcy
-    MDk3YmNiZmI3NGNmMzFmMDkxNjEyOTFkMmE5YjNlNjJlMDBkYWY=
-  data.tar.gz: !binary |-
-    NzRhM2Y5NTk0OTZhMmRlYjk0ZThkYTM3ZTQxYzc3Mjk3ZTY2MjQ4MjUwN2Rm
-    YzUwMGY4ZTdlY2Q2M2M4NDgyODQ1MTc2ZWM3ZmEyOWU5NWIwNWExMjBlMDBi
-    YWNlYjllMmZmN2M4MTU0NWE3NjIwOGNjMmQ5ODBlYzE4NzM1Njk=

data/Guardfile

@@ -1,6 +0,0 @@
-guard 'rspec' do
-  watch(%r{^spec/.+_spec\.rb$})
-  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
-  watch(%r{^app/controllers/(.+)\.rb$})     { |m| "spec/controllers/#{m[1]}_spec.rb" }
-  watch('spec/spec_helper.rb')  { "spec" }
-end

data/HISTORY.md

@@ -1,131 +0,0 @@
-1.2.0
-======
-
-Add support for procs (anything that respond_to?(:call)) as config values.
-
-csp = {
-  :default_src => 'self',
-  :report_uri => lambda {
-    if FeatureToggle.available?(:new_csp_endpoint)
-      '//example.com/new_csp'
-    else
-      '//example.com/old_csp'
-    end
-  }
-}
-
-1.1.1
-======
-
-Bug fix release.
-- Parsing of CSP reports was busted.
-- Forwarded reports did not include the original referer, ip, UA
-
-1.1.0
-======
-
-- Remove brwsr dependency (no more runtime dependencies)
-- Stop serving X- prefixed CSP headers
-
-This change means that all requests get all headers, even if the browser doesn't grok it.
-
-1.0.0
-======
-
-Features:
-
-- Use non-prefixed header names for Firefox >= 23, Chrome >= 25
-- Use csp 1.0 compliant header for firefox >= 23
-
-Bug Fix:
-
-- Stop sending CSP on safari 5.1+
-
-0.5.0
-======
-
-- X-Content-Type-Options also applied to Chrome requests
-
-0.4.3
-======
-
-- Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
-
-0.4.2
-======
-
-- Stupid bug where Fixnums couldn't be used for config values
-- Doc updates
-
-0.4.1
-======
-
-- Allow strings or ints in the HSTS max-age (@reedloden)
-
-0.4.0
-=======
-
-- Treat each header as it's own before_filter. This allows you to `skip_before_filter :set_X_header, :only => :bad_idea
-- Should be backwards compatible, but it is a change to the API.
-
-0.3.0
-=======
-
-- Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
-
-0.2.3
-=======
-
-- Fix error in report-uri logic for Firefox forwarding.
-
-0.2.2
-=======
-
-- Stop applying chrome-extension: to Firefox directives.
-
-0.2.1
-=======
-
-- Firefox headers will now stop overriding report_uri when only a path is supplied
-
-0.2.0
-=======
-
-- 0.1.0 introduced a serious regression in which child controllers overwrote parent controller config values
-- Decoupling of CSP headers and the request object. Allows you to generate static values to save cycles:
-
-```ruby
-FIREFOX = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Firefox", :ssl => true).value
-CHROME = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Chrome", :ssl => true).value
-```
-- :forward_endpoint now acts as the endpoint that reports are forwarded to (when using the internal forwarder feature for cross-host reporting)
-- Skeleton applications have been added to test isolated application configurations
-- Cleanup by @bemurphy
-
-0.1.1
-=======
-
-Bug fix. Firefox doesn't seem to like the default-src directive, reverting back to 'allow'
-
-0.1.0
-=======
-
-Notes:
-------
-
-- Gem is renamed to secure_headers. This will make bundler happy. https://github.com/twitter/secureheaders/pull/26
-
-Features:
-------
-
-- ability to apply two headers, one in enforce mode, one in "experimental" mode https://github.com/twitter/secureheaders/pull/11
-- Rails 3.0 support https://github.com/twitter/secureheaders/pull/28
-
-Bug fixes, misc:
-------
-
-- Fix issue where settings in application_controller were ignored if no intializer was supplied https://github.com/twitter/secureheaders/pull/25
-- Better support for other frameworks, including docs from @achui, @bmaland
-- Rails 4 routes support from @jviney https://github.com/twitter/secureheaders/pull/13
-- data: automatically whitelisted for img-src
-- Doc updates from @ming13, @theverything, @dcollazo