secure_headers 1.2.0 → 2.0.2

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,76 +1,160 @@
 require 'uri'
+require 'base64'
+require 'securerandom'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
   class ContentSecurityPolicy < Header
     module Constants
-      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https://* about: javascript:; img-src data:"
-      STANDARD_HEADER_NAME = "Content-Security-Policy"
-      FF_CSP_ENDPOINT = "/content_security_policy/forward_report"
-      DIRECTIVES = [:default_src, :script_src, :frame_src, :style_src, :img_src, :media_src, :font_src, :object_src, :connect_src]
-      META = [:enforce, :http_additions, :disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
+      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: about: javascript:; img-src data:"
+      HEADER_NAME = "Content-Security-Policy"
+      ENV_KEY = 'secure_headers.content_security_policy'
+      DIRECTIVES = [
+        :default_src,
+        :connect_src,
+        :font_src,
+        :frame_src,
+        :img_src,
+        :media_src,
+        :object_src,
+        :script_src,
+        :style_src
+      ]
+
+      NON_DEFAULT_SOURCES = [
+        :base_uri,
+        :child_src,
+        :form_action,
+        :frame_ancestors,
+        :plugin_types,
+        :referrer,
+        :reflected_xss
+      ]
+
+      OTHER = [
+        :report_uri
+      ]
+
+      SOURCE_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
+
+      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES + OTHER
     end
     include Constants
 
-    attr_accessor *META
-    attr_reader :browser, :ssl_request, :report_uri, :request_uri, :experimental
-
-    alias :disable_chrome_extension? :disable_chrome_extension
+    attr_reader :disable_fill_missing, :ssl_request
     alias :disable_fill_missing? :disable_fill_missing
     alias :ssl_request? :ssl_request
 
+    class << self
+      def generate_nonce
+        SecureRandom.base64(32).chomp
+      end
+
+      def set_nonce(controller, nonce = generate_nonce)
+        controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+      end
+
+      def add_to_env(request, controller, config)
+        set_nonce(controller)
+        options = options_from_request(request).merge(:controller => controller)
+        request.env[Constants::ENV_KEY] = {
+          :config => config,
+          :options => options,
+        }
+      end
+
+      def options_from_request(request)
+        {
+          :ssl => request.ssl?,
+          :ua => request.env['HTTP_USER_AGENT'],
+          :request_uri => request_uri_from_request(request),
+        }
+      end
+
+      def request_uri_from_request(request)
+        if request.respond_to?(:original_url)
+          # rails 3.1+
+          request.original_url
+        else
+          # rails 2/3.0
+          request.url
+        end
+      end
+
+      def symbol_to_hyphen_case sym
+        sym.to_s.gsub('_', '-')
+      end
+    end
+
     # +options+ param contains
-    # :experimental use experimental block for config
+    # :controller used for setting instance variables for nonces/hashes
     # :ssl_request used to determine if http_additions should be used
-    # :request_uri used to determine if firefox should send the report directly
-    # or use the forwarding endpoint
     # :ua the user agent (or just use Firefox/Chrome/MSIE/etc)
     #
     # :report used to determine what :ssl_request, :ua, and :request_uri are set to
     def initialize(config=nil, options={})
-      @experimental = !!options.delete(:experimental)
-      @controller = options.delete(:controller)
+      return unless config
+
       if options[:request]
-        parse_request(options[:request])
-      else
-        @ua = options[:ua]
-        # fails open, assumes http. Bad idea? Will always include http additions.
-        # could also fail if not supplied.
-        @ssl_request = !!options.delete(:ssl)
-        # a nil value here means we always assume we are not on the same host,
-        # which causes all FF csp reports to go through the forwarder
-        @request_uri = options.delete(:request_uri)
+        options = options.merge(self.class.options_from_request(options[:request]))
       end
 
-      configure(config) if config
-    end
-
-    def configure(config)
-      @config = config.dup
+      @controller = options[:controller]
+      @ua = options[:ua]
+      @ssl_request = !!options.delete(:ssl)
+      @request_uri = options.delete(:request_uri)
+
+      # Config values can be string, array, or lamdba values
+      @config = config.inject({}) do |hash, (key, value)|
+        config_val = value.respond_to?(:call) ? value.call : value
+
+        if SOURCE_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
+          config_val = config_val.split if config_val.is_a? String
+          if config_val.is_a?(Array)
+            config_val = config_val.map do |val|
+              translate_dir_value(val)
+            end.flatten.uniq
+          end
+        end
 
-      experimental_config = @config.delete(:experimental)
-      if @experimental && experimental_config
-        @config[:http_additions] = experimental_config[:http_additions]
-        @config.merge!(experimental_config)
+        hash[key] = config_val
+        hash
       end
 
-      META.each do |meta|
-        self.send("#{meta}=", @config.delete(meta))
-      end
+      @http_additions = @config.delete(:http_additions)
+      @app_name = @config.delete(:app_name)
+      @report_uri = @config.delete(:report_uri)
+
+      @disable_fill_missing = !!@config.delete(:disable_fill_missing)
+      @enforce = !!@config.delete(:enforce)
+      @tag_report_uri = !!@config.delete(:tag_report_uri)
+      @script_hashes = @config.delete(:script_hashes) || []
 
-      normalize_csp_options
-      normalize_reporting_endpoint
+      add_script_hashes if @script_hashes.any?
       fill_directives unless disable_fill_missing?
     end
 
+    ##
+    # Return or initialize the nonce value used for this header.
+    # If a reference to a controller is passed in the config, this method
+    # will check if a nonce has already been set and use it.
+    def nonce
+      @nonce ||= @controller.instance_variable_get(:@content_security_policy_nonce) || self.class.generate_nonce
+    end
+
+    ##
+    # Returns the name to use for the header. Either "Content-Security-Policy" or
+    # "Content-Security-Policy-Report-Only"
     def name
-      base = STANDARD_HEADER_NAME
-      if !enforce || experimental
+      base = HEADER_NAME
+      if !@enforce
         base += "-Report-Only"
       end
       base
     end
 
+    ##
+    # Return the value of the CSP header
     def value
       return @config if @config.is_a?(String)
       if @config
@@ -82,97 +166,52 @@ module SecureHeaders
 
     private
 
+    def add_script_hashes
+      @config[:script_src] << @script_hashes.map {|hash| "'#{hash}'"} << ["'unsafe-inline'"]
+    end
+
     def build_value
       raise "Expected to find default_src directive value" unless @config[:default_src]
       append_http_additions unless ssl_request?
       header_value = [
-        # ensure default-src is first
-        build_directive(:default_src),
-        generic_directives(@config),
+        generic_directives,
+        non_default_directives,
         report_uri_directive
-      ].join
-
-      #store the value for next time
-      @config = header_value
-      header_value.strip
-    rescue StandardError => e
-      raise ContentSecurityPolicyBuildError.new("Couldn't build CSP header :( #{e}")
+      ].join.strip
     end
 
     def fill_directives
-      return unless @config[:default_src]
-      default = @config[:default_src]
-      DIRECTIVES.each do |directive|
-        unless @config[directive]
-          @config[directive] = default
+      if default = @config[:default_src]
+        DIRECTIVES.each do |directive|
+          unless @config[directive]
+            @config[directive] = default
+          end
         end
       end
-      @config
     end
 
     def append_http_additions
-      return unless http_additions
-      http_additions.each do |k, v|
+      return unless @http_additions
+      @http_additions.each do |k, v|
         @config[k] ||= []
         @config[k] << v
       end
     end
 
-    def normalize_csp_options
-      @config = @config.inject({}) do |hash, (k, v)|
-        config_val = if v.respond_to?(:call)
-          v.call
-        else
-          v
-        end
-
-        config_val = config_val.split if config_val.is_a? String
-        config_val = config_val.map do |val|
-          translate_dir_value(val)
-        end
-
-        hash[k] = config_val
-        hash
-      end
-
-      @report_uri = @config.delete(:report_uri).join(" ") if @config[:report_uri]
-    end
-
-    # translates 'inline','self', 'none' and 'eval' to their respective impl-specific values.
     def translate_dir_value val
       if %w{inline eval}.include?(val)
         val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
-        # self/none are special sources/src-dir-values and need to be quoted in chrome
+        # self/none are special sources/src-dir-values and need to be quoted
       elsif %{self none}.include?(val)
         "'#{val}'"
+      elsif val == 'nonce'
+        self.class.set_nonce(@controller, nonce)
+        ["'nonce-#{nonce}'", "'unsafe-inline'"]
       else
         val
       end
     end
 
-    # if we have a forwarding endpoint setup and we are not on the same origin as our report_uri
-    # or only a path was supplied (in which case we assume cross-host)
-    # we need to forward the request for Firefox.
-    def normalize_reporting_endpoint
-      if @ua && @ua =~ /Firefox/
-        if same_origin? || report_uri.nil? || URI.parse(report_uri).host.nil?
-          return
-        end
-
-        if forward_endpoint
-          @report_uri = FF_CSP_ENDPOINT
-        end
-      end
-    end
-
-    def same_origin?
-      return unless report_uri && request_uri
-
-      origin = URI.parse(request_uri)
-      uri = URI.parse(report_uri)
-      uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
-    end
-
     def report_uri_directive
       return '' if @report_uri.nil?
 
@@ -184,43 +223,40 @@ module SecureHeaders
                       end
       end
 
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
+
       "report-uri #{@report_uri};"
     end
 
-    def generic_directives(config)
+    def generic_directives
       header_value = ''
-      if config[:img_src]
-        config[:img_src] = config[:img_src] + ['data:'] unless config[:img_src].include?('data:')
+      if @config[:img_src]
+        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
       else
-        config[:img_src] = ['data:']
+        @config[:img_src] = @config[:default_src] + ['data:']
       end
 
-      config.keys.sort_by{|k| k.to_s}.each do |k| # ensure consistent ordering
-        header_value += build_directive(k)
+      DIRECTIVES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
       end
 
       header_value
     end
 
-    # build and deletes the directive
-    def build_directive(key)
-      "#{symbol_to_hyphen_case(key)} #{@config.delete(key).join(" ")}; "
-    end
+    def non_default_directives
+      header_value = ''
+      NON_DEFAULT_SOURCES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
+      end
 
-    def symbol_to_hyphen_case sym
-      sym.to_s.gsub('_', '-')
+      header_value
     end
 
-    def parse_request request
-      @ssl_request = request.ssl?
-      @ua = request.env['HTTP_USER_AGENT']
-      @request_uri = if request.respond_to?(:original_url)
-        # rails 3.1+
-        request.original_url
-      else
-        # rails 2/3.0
-        request.url
-      end
+    def build_directive(key)
+      "#{self.class.symbol_to_hyphen_case(key)} #{@config[key].join(" ")}; "
     end
   end
 end

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -6,7 +6,7 @@ module SecureHeaders
       HSTS_HEADER_NAME = 'Strict-Transport-Security'
       HSTS_MAX_AGE = "631138519"
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
-      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?\z/i
+      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
     end
     include Constants
@@ -31,6 +31,7 @@ module SecureHeaders
       max_age = @config.fetch(:max_age, HSTS_MAX_AGE)
       value = "max-age=" + max_age.to_s
       value += "; includeSubdomains" if @config[:include_subdomains]
+      value += "; preload" if @config[:preload]
 
       value
     end

data/lib/secure_headers/headers/x_download_options.rb

@@ -0,0 +1,39 @@
+module SecureHeaders
+  class XDOBuildError < StandardError; end
+  class XDownloadOptions < Header
+    module Constants
+      XDO_HEADER_NAME = "X-Download-Options"
+      DEFAULT_VALUE = 'noopen'
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XDO_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless value.casecmp(DEFAULT_VALUE) == 0
+        raise XDOBuildError.new("Value can only be nil or 'noopen'")
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -0,0 +1,40 @@
+module SecureHeaders
+  class XPCDPBuildError < StandardError; end
+  class XPermittedCrossDomainPolicies < Header
+    module Constants
+      XPCDP_HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
+      DEFAULT_VALUE = 'none'
+      VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XPCDP_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless VALID_POLICIES.include?(value.downcase)
+        raise XPCDPBuildError.new("Value can only be one of #{VALID_POLICIES.join(', ')}")
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -4,7 +4,7 @@ module SecureHeaders
     module Constants
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"
-      VALID_X_XSS_HEADER = /\A[01](; mode=block)?\z/i
+      VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
     end
     include Constants
 
@@ -26,6 +26,7 @@ module SecureHeaders
       else
         value = @config[:value].to_s
         value += "; mode=#{@config[:mode]}" if @config[:mode]
+        value += "; report=#{@config[:report_uri]}" if @config[:report_uri]
         value
       end
     end

data/lib/secure_headers/padrino.rb

@@ -0,0 +1,14 @@
+module SecureHeaders
+  module Padrino
+    class << self
+      ##
+      # Main class that register this extension.
+      #
+      def registered(app)
+        app.extend SecureHeaders::ClassMethods
+        app.helpers SecureHeaders::InstanceMethods
+      end
+      alias :included :registered
+    end
+  end
+end

data/lib/secure_headers/railtie.rb

@@ -3,7 +3,24 @@ if defined?(Rails::Railtie)
   module SecureHeaders
     class Railtie < Rails::Engine
       isolate_namespace ::SecureHeaders if defined? isolate_namespace # rails 3.0
-      ActionController::Base.send :include, ::SecureHeaders
+      conflicting_headers = ['X-Frame-Options', 'X-XSS-Protection', 'X-Content-Type-Options',
+                             'X-Permitted-Cross-Domain-Policies', 'X-Download-Options',
+                             'X-Content-Type-Options', 'Strict-Transport-Security',
+                             'Content-Security-Policy', 'Content-Security-Policy-Report-Only',
+                             'X-Permitted-Cross-Domain-Policies','Public-Key-Pins','Public-Key-Pins-Report-Only']
+
+      initializer "secure_headers.action_controller" do
+        ActiveSupport.on_load(:action_controller) do
+          include ::SecureHeaders
+
+          unless Rails.application.config.action_dispatch.default_headers.nil?
+            conflicting_headers.each do |header|
+              Rails.application.config.action_dispatch.default_headers.delete(header)
+            end
+          end
+
+        end
+      end
     end
   end
 else
@@ -12,26 +29,4 @@ else
       include ::SecureHeaders
     end
   end
-
-  module SecureHeaders
-    module Routing
-      module MapperExtensions
-        def csp_endpoint
-          @set.add_route(ContentSecurityPolicy::FF_CSP_ENDPOINT, {:controller => "content_security_policy", :action => "scribe"})
-        end
-      end
-    end
-  end
-
-  if defined?(ActiveSupport::Dependencies)
-    if ActiveSupport::Dependencies.autoload_paths
-      ActiveSupport::Dependencies.autoload_paths << File.expand_path(File.join("..", "..", "..", "app", "controllers"), __FILE__)
-    else
-      ActiveSupport::Dependencies.autoload_paths = [File.expand_path(File.join("..", "..", "..", "app", "controllers"), __FILE__)]
-    end
-  end
-
-  if defined? ActionController::Routing
-    ActionController::Routing::RouteSet::Mapper.send :include, ::SecureHeaders::Routing::MapperExtensions
-  end
-end
+end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "1.2.0"
+  VERSION = "2.0.2"
 end

data/lib/secure_headers/view_helper.rb

@@ -0,0 +1,68 @@
+module SecureHeaders
+  class UnexpectedHashedScriptException < StandardError
+
+  end
+
+  module ViewHelpers
+    include SecureHeaders::HashHelper
+    SECURE_HEADERS_RAKE_TASK = "rake secure_headers:generate_hashes"
+
+    def nonced_style_tag(content = nil, &block)
+      nonced_tag(content, :style, block)
+    end
+
+    def nonced_javascript_tag(content = nil, &block)
+      nonced_tag(content, :script, block)
+    end
+
+    def hashed_javascript_tag(raise_error_on_unrecognized_hash = false, &block)
+      content = capture(&block)
+
+      if ['development', 'test'].include?(ENV["RAILS_ENV"])
+        hash_value = hash_source(content)
+        file_path = File.join('app', 'views', self.instance_variable_get(:@virtual_path) + '.html.erb')
+        script_hashes = controller.instance_variable_get(:@script_hashes)[file_path]
+        unless script_hashes && script_hashes.include?(hash_value)
+          message = unexpected_hash_error_message(file_path, hash_value, content)
+          if raise_error_on_unrecognized_hash
+            raise UnexpectedHashedScriptException.new(message)
+          else
+            puts message
+            request.env[HASHES_ENV_KEY] = (request.env[HASHES_ENV_KEY] || []) << hash_value
+          end
+        end
+      end
+
+      content_tag :script, content
+    end
+
+    private
+
+    def nonced_tag(content, type, block)
+      content = if block
+        capture(&block)
+      else
+        content.html_safe # :'(
+      end
+
+      content_tag type, content, :nonce => @content_security_policy_nonce
+    end
+
+    def unexpected_hash_error_message(file_path, hash_value, content)
+      <<-EOF
+\n\n*** WARNING: Unrecognized hash in #{file_path}!!! Value: #{hash_value} ***
+<script>#{content}</script>
+*** This is fine in dev/test, but will raise exceptions in production. ***
+*** Run #{SECURE_HEADERS_RAKE_TASK} or add the following to config/script_hashes.yml:***
+#{file_path}:
+- #{hash_value}\n\n
+      EOF
+    end
+  end
+end
+
+module ActionView #:nodoc:
+  class Base #:nodoc:
+    include SecureHeaders::ViewHelpers
+  end
+end