RubyGems - secure_headers - Versions diffs - 1.3.0 → 1.4.0 - Mend

secure_headers 1.3.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (69) hide show

data/.travis.yml CHANGED Viewed

@@ -3,6 +3,3 @@ rvm:
   - "2.0.0"
   - "1.9.3"
   - "1.8.7"
-#  - jruby-19mode
-#  - jruby-18mode
-#script: ./travis.sh

data/Gemfile CHANGED Viewed

@@ -6,9 +6,8 @@ group :test do
   gem 'rails', '3.2.12'
   gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
   gem 'jdbc-sqlite3', :platform => :jruby
-  gem 'rspec-rails'
-  gem 'rspec'
-  gem 'guard-rspec', :platform => :ruby_19
+  gem 'rspec-rails', '>= 3.1'
+  gem 'rspec', '>= 3.1'
   gem 'growl'
   gem 'rb-fsevent'
   gem 'debugger', :platform => :ruby_19

data/HISTORY.md CHANGED Viewed

@@ -1,3 +1,38 @@
+1.3.4
+======
+* Adds X-Download-Options support
+* Adds support for X-XSS-Protection reporting
+* Defers loading of rails engine for faster boot times
+1.3.3
+======
+@agl just made a new option for HSTS representing confirmation that a site wants to be included in a browser's preload list (https://hstspreload.appspot.com).
+This just adds a new 'preload' option to the HSTS settings to specify that option.
+1.3.2
+======
+Adds the ability to "tag" requests and a new config value: :app_name
+{
+  :tag_report_uri => true,
+  :enforce => true,
+  :app_name => 'twitter',
+  :report_uri => 'csp_reports'
+}
+Results in
+report-uri csp_reports?enforce=true&app_name=twitter
+1.3.1
+======
+Bugfix release: same-origin detection would error out when the URL containined invalid values (like |)
 1.3.0
 ======

data/README.md CHANGED Viewed

@@ -197,6 +197,24 @@ and [Mozilla CSP specification](https://wiki.mozilla.org/Security/CSP/Specificat
 "default-src  'self'; img-src *; object-src media1.com media2.com *.cdn.com; script-src trustedscripts.example.com;"
 ```
+### Tagging Requests
+It's often valuable to send extra information in the report uri that is not available in the reports themselves. Namely, "was the policy enforced" and "where did the report come from"
+```ruby
+{
+  :tag_report_uri => true,
+  :enforce => true,
+  :app_name => 'twitter',
+  :report_uri => 'csp_reports'
+}
+```
+Results in
+```
+report-uri csp_reports?enforce=true&app_name=twitter
+```
 ### CSP Level 2 features
 script/style-nonce can be used to whitelist inline content. To do this, add "nonce" to your script/style-src configuration, then set the nonce attributes on the various tags.
@@ -350,6 +368,6 @@ end
 ## License
-Copyright 2013 Twitter, Inc.
+Copyright 2013-2014 Twitter, Inc and other contributors.
 Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

data/app/controllers/content_security_policy_controller.rb CHANGED Viewed

@@ -5,6 +5,7 @@ class ContentSecurityPolicyController < ActionController::Base
   CA_FILE = File.expand_path(File.join('..','..', '..', 'config', 'curl-ca-bundle.crt'), __FILE__)
   def scribe
+    warn "[DEPRECATION] ContentSecurityPolicyController is removed in 2.0"
     csp = ::SecureHeaders::Configuration.csp || {}
     forward_endpoint = csp[:forward_endpoint]

data/fixtures/rails_3_2_12/Gemfile CHANGED Viewed

@@ -1,12 +1,6 @@
 source 'https://rubygems.org'
 gem 'rails', '3.2.12'
-gem 'sqlite3'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'
-gem 'debugger', :platform => :ruby_19
-gem 'ruby-debug', :platform => :ruby_18
-gem 'guard-rspec'
-gem 'rb-fsevent'
-gem 'growl'

data/fixtures/rails_3_2_12/app/controllers/things_controller.rb CHANGED Viewed

@@ -1,6 +1,5 @@
 class ThingsController < ApplicationController
   ensure_security_headers :csp => false
   def index
-    ######## : ) <- Marge Simpson?
   end
 end

data/fixtures/rails_3_2_12/app/views/layouts/application.html.erb CHANGED Viewed

@@ -2,9 +2,6 @@
 <html>
 <head>
   <title>Rails3212</title>
-  <%= stylesheet_link_tag    "application", :media => "all" %>
-  <%= javascript_include_tag "application" %>
-  <%= csrf_meta_tags %>
 </head>
 <body>

data/fixtures/rails_3_2_12/app/views/things/index.html.erb CHANGED Viewed

@@ -1,21 +1 @@
-<h1>Listing things</h1>
-<table>
-  <tr>
-    <th></th>
-    <th></th>
-    <th></th>
-  </tr>
-<% @things.each do |thing| %>
-  <tr>
-    <td><%= link_to 'Show', thing %></td>
-    <td><%= link_to 'Edit', edit_thing_path(thing) %></td>
-    <td><%= link_to 'Destroy', thing, method: :delete, data: { confirm: 'Are you sure?' } %></td>
-  </tr>
-<% end %>
-</table>
-<br />
-<%= link_to 'New Thing', new_thing_path %>
+things

data/fixtures/rails_3_2_12/config/application.rb CHANGED Viewed

@@ -1,68 +1,14 @@
 require File.expand_path('../boot', __FILE__)
-# Pick the frameworks you want:
-require "active_record/railtie"
 require "action_controller/railtie"
-require "action_mailer/railtie"
-require "active_resource/railtie"
 require "sprockets/railtie"
-# require "rails/test_unit/railtie"
 if defined?(Bundler)
-  # If you precompile assets before deploying to production, use this line
   Bundler.require(*Rails.groups(:assets => %w(development test)))
-  # If you want your assets lazily compiled in production, use this line
-  # Bundler.require(:default, :assets, Rails.env)
 end
 module Rails3212
   class Application < Rails::Application
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-    # Custom directories with classes and modules you want to be autoloadable.
-    # config.autoload_paths += %W(#{config.root}/extras)
-    # Only load the plugins named here, in the order given (default is alphabetical).
-    # :all can be used as a placeholder for all plugins not explicitly named.
-    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
-    # Activate observers that should always be running.
-    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
-    # config.time_zone = 'Central Time (US & Canada)'
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
-    # config.i18n.default_locale = :de
-    # Configure the default encoding used in templates for Ruby 1.9.
-    config.encoding = "utf-8"
-    # Configure sensitive parameters which will be filtered from the log file.
-    config.filter_parameters += [:password]
-    # Enable escaping HTML in JSON.
-    config.active_support.escape_html_entities_in_json = true
-    # Use SQL instead of Active Record's schema dumper when creating the database.
-    # This is necessary if your schema can't be completely dumped by the schema dumper,
-    # like if you have constraints or database-specific column types
-    # config.active_record.schema_format = :sql
-    # Enforce whitelist mode for mass assignment.
-    # This will create an empty whitelist of attributes available for mass-assignment for all models
-    # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
-    # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
-    # Enable the asset pipeline
-    config.assets.enabled = true
-    # Version of your assets, change this if you want to expire all your assets
-    config.assets.version = '1.0'
   end
 end

data/fixtures/rails_3_2_12/config/environments/test.rb CHANGED Viewed

@@ -27,10 +27,10 @@ Rails3212::Application.configure do
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
-  config.action_mailer.delivery_method = :test
+  # config.action_mailer.delivery_method = :test
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr

data/fixtures/rails_3_2_12/config/routes.rb CHANGED Viewed

@@ -1,61 +1,4 @@
 Rails3212::Application.routes.draw do
   resources :things
-  # The priority is based upon order of creation:
-  # first created -> highest priority.
-  # Sample of regular route:
-  #   match 'products/:id' => 'catalog#view'
-  # Keep in mind you can assign values other than :controller and :action
-  # Sample of named route:
-  #   match 'products/:id/purchase' => 'catalog#purchase', :as => :purchase
-  # This route can be invoked with purchase_url(:id => product.id)
-  # Sample resource route (maps HTTP verbs to controller actions automatically):
-  #   resources :products
-  # Sample resource route with options:
-  #   resources :products do
-  #     member do
-  #       get 'short'
-  #       post 'toggle'
-  #     end
-  #
-  #     collection do
-  #       get 'sold'
-  #     end
-  #   end
-  # Sample resource route with sub-resources:
-  #   resources :products do
-  #     resources :comments, :sales
-  #     resource :seller
-  #   end
-  # Sample resource route with more complex sub-resources
-  #   resources :products do
-  #     resources :comments
-  #     resources :sales do
-  #       get 'recent', :on => :collection
-  #     end
-  #   end
-  # Sample resource route within a namespace:
-  #   namespace :admin do
-  #     # Directs /admin/products/* to Admin::ProductsController
-  #     # (app/controllers/admin/products_controller.rb)
-  #     resources :products
-  #   end
-  # You can have the root of your site routed with "root"
-  # just remember to delete public/index.html.
-  # root :to => 'welcome#index'
-  # See how all your routes lay out with "rake routes"
-  # This is a legacy wild controller route that's not recommended for RESTful applications.
-  # Note: This route will make all actions in every controller accessible via GET requests.
   match ':controller(/:action(/:id))(.:format)'
 end

data/fixtures/rails_3_2_12/spec/controllers/other_things_controller_spec.rb CHANGED Viewed

@@ -25,6 +25,11 @@ describe OtherThingsController, :type => :controller do
       expect(response.headers['Strict-Transport-Security']).to eq("max-age=315576000")
     end
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq('noopen')
+    end
     it "sets the X-Content-Type-Options header" do
       get :index
       expect(response.headers['X-Content-Type-Options']).to eq("nosniff")

data/fixtures/rails_3_2_12/spec/controllers/things_controller_spec.rb CHANGED Viewed

@@ -28,6 +28,11 @@ describe ThingsController, :type => :controller do
       expect(response.headers['Strict-Transport-Security']).to eq("max-age=315576000")
     end
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq('noopen')
+    end
     it "sets the X-Content-Type-Options header" do
       get :index
       expect(response.headers['X-Content-Type-Options']).to eq("nosniff")

data/fixtures/rails_3_2_12_no_init/Gemfile CHANGED Viewed

@@ -1,12 +1,5 @@
 source 'https://rubygems.org'
 gem 'rails', '3.2.12'
-gem 'sqlite3'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'
-gem 'debugger', :platform => :ruby_19
-gem 'ruby-debug', :platform => :ruby_18
-gem 'guard-rspec'
-gem 'rb-fsevent'
-gem 'growl'

data/fixtures/rails_3_2_12_no_init/app/controllers/things_controller.rb CHANGED Viewed

@@ -1,5 +1,5 @@
 class ThingsController < ApplicationController
   def index
-    ######## : ) <- Marge Simpson?
   end
 end

data/fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb CHANGED Viewed

@@ -3,8 +3,6 @@
 <head>
   <title>Rails3212</title>
   <%= stylesheet_link_tag    "application", :media => "all" %>
-  <%= javascript_include_tag "application" %>
-  <%= csrf_meta_tags %>
 </head>
 <body>

data/fixtures/rails_3_2_12_no_init/app/views/things/index.html.erb CHANGED Viewed

@@ -1,21 +0,0 @@
-<h1>Listing things</h1>
-<table>
-  <tr>
-    <th></th>
-    <th></th>
-    <th></th>
-  </tr>
-<% @things.each do |thing| %>
-  <tr>
-    <td><%= link_to 'Show', thing %></td>
-    <td><%= link_to 'Edit', edit_thing_path(thing) %></td>
-    <td><%= link_to 'Destroy', thing, method: :delete, data: { confirm: 'Are you sure?' } %></td>
-  </tr>
-<% end %>
-</table>
-<br />
-<%= link_to 'New Thing', new_thing_path %>

data/fixtures/rails_3_2_12_no_init/config/application.rb CHANGED Viewed

@@ -1,12 +1,8 @@
 require File.expand_path('../boot', __FILE__)
 # Pick the frameworks you want:
-require "active_record/railtie"
 require "action_controller/railtie"
-require "action_mailer/railtie"
-require "active_resource/railtie"
 require "sprockets/railtie"
-# require "rails/test_unit/railtie"
 if defined?(Bundler)
   # If you precompile assets before deploying to production, use this line
@@ -17,52 +13,5 @@ end
 module Rails3212
   class Application < Rails::Application
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-    # Custom directories with classes and modules you want to be autoloadable.
-    # config.autoload_paths += %W(#{config.root}/extras)
-    # Only load the plugins named here, in the order given (default is alphabetical).
-    # :all can be used as a placeholder for all plugins not explicitly named.
-    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
-    # Activate observers that should always be running.
-    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
-    # config.time_zone = 'Central Time (US & Canada)'
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
-    # config.i18n.default_locale = :de
-    # Configure the default encoding used in templates for Ruby 1.9.
-    config.encoding = "utf-8"
-    # Configure sensitive parameters which will be filtered from the log file.
-    config.filter_parameters += [:password]
-    # Enable escaping HTML in JSON.
-    config.active_support.escape_html_entities_in_json = true
-    # Use SQL instead of Active Record's schema dumper when creating the database.
-    # This is necessary if your schema can't be completely dumped by the schema dumper,
-    # like if you have constraints or database-specific column types
-    # config.active_record.schema_format = :sql
-    # Enforce whitelist mode for mass assignment.
-    # This will create an empty whitelist of attributes available for mass-assignment for all models
-    # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
-    # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
-    # Enable the asset pipeline
-    config.assets.enabled = true
-    # Version of your assets, change this if you want to expire all your assets
-    config.assets.version = '1.0'
   end
 end

data/fixtures/rails_3_2_12_no_init/config/environments/test.rb CHANGED Viewed

@@ -27,10 +27,10 @@ Rails3212::Application.configure do
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
-  config.action_mailer.delivery_method = :test
+  # config.action_mailer.delivery_method = :test
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr

data/fixtures/rails_3_2_12_no_init/config/routes.rb CHANGED Viewed

@@ -1,61 +1,4 @@
 Rails3212::Application.routes.draw do
   resources :things
-  # The priority is based upon order of creation:
-  # first created -> highest priority.
-  # Sample of regular route:
-  #   match 'products/:id' => 'catalog#view'
-  # Keep in mind you can assign values other than :controller and :action
-  # Sample of named route:
-  #   match 'products/:id/purchase' => 'catalog#purchase', :as => :purchase
-  # This route can be invoked with purchase_url(:id => product.id)
-  # Sample resource route (maps HTTP verbs to controller actions automatically):
-  #   resources :products
-  # Sample resource route with options:
-  #   resources :products do
-  #     member do
-  #       get 'short'
-  #       post 'toggle'
-  #     end
-  #
-  #     collection do
-  #       get 'sold'
-  #     end
-  #   end
-  # Sample resource route with sub-resources:
-  #   resources :products do
-  #     resources :comments, :sales
-  #     resource :seller
-  #   end
-  # Sample resource route with more complex sub-resources
-  #   resources :products do
-  #     resources :comments
-  #     resources :sales do
-  #       get 'recent', :on => :collection
-  #     end
-  #   end
-  # Sample resource route within a namespace:
-  #   namespace :admin do
-  #     # Directs /admin/products/* to Admin::ProductsController
-  #     # (app/controllers/admin/products_controller.rb)
-  #     resources :products
-  #   end
-  # You can have the root of your site routed with "root"
-  # just remember to delete public/index.html.
-  # root :to => 'welcome#index'
-  # See how all your routes lay out with "rake routes"
-  # This is a legacy wild controller route that's not recommended for RESTful applications.
-  # Note: This route will make all actions in every controller accessible via GET requests.
   match ':controller(/:action(/:id))(.:format)'
 end

data/fixtures/rails_3_2_12_no_init/spec/controllers/other_things_controller_spec.rb CHANGED Viewed

@@ -24,6 +24,11 @@ describe OtherThingsController, :type => :controller do
       expect(response.headers['Strict-Transport-Security']).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
     end
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+    end
     it "sets the X-Content-Type-Options header" do
       get :index
       expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)

data/fixtures/rails_3_2_12_no_init/spec/controllers/things_controller_spec.rb CHANGED Viewed

@@ -28,6 +28,11 @@ describe ThingsController, :type => :controller do
       expect(response.headers['Strict-Transport-Security']).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
     end
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+    end
     it "sets the X-Content-Type-Options header" do
       get :index
       expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)

data/lib/secure_headers/headers/content_security_policy.rb CHANGED Viewed

@@ -30,6 +30,7 @@ module SecureHeaders
     # :report used to determine what :ssl_request, :ua, and :request_uri are set to
     def initialize(config=nil, options={})
       @experimental = !!options.delete(:experimental)
+      warn "[DEPRECATION] 'experimental' config is removed in 2.0"
       @controller = options.delete(:controller)
       if options[:request]
@@ -60,9 +61,9 @@ module SecureHeaders
         @config.merge!(experimental_config)
       end
-      # http_additions will be the only field that still doesn't support
-      # lambdas because it's an ugly api that's showing it's age.
+      # these values don't support lambdas because this needs to be rewritten
       @http_additions = @config.delete(:http_additions)
+      @app_name = @config.delete(:app_name)
       normalize_csp_options
@@ -70,7 +71,9 @@ module SecureHeaders
         self.send("#{meta}=", @config.delete(meta))
       end
-      @enforce = @config.delete(:enforce)
+      @enforce = !!@config.delete(:enforce)
+      @tag_report_uri = @config.delete(:tag_report_uri)
       normalize_reporting_endpoint
       fill_directives unless disable_fill_missing?
     end
@@ -169,16 +172,27 @@ module SecureHeaders
         end
         if forward_endpoint
+          warn "[DEPRECATION] forwarder is removed in 2.0"
           @report_uri = FF_CSP_ENDPOINT
         end
       end
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
     end
     def same_origin?
       return unless report_uri && request_uri
-      origin = URI.parse(request_uri)
-      uri = URI.parse(report_uri)
+      begin
+        origin = URI.parse(request_uri)
+        uri = URI.parse(report_uri)
+      rescue URI::InvalidURIError
+        return false
+      end
       uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
     end

data/lib/secure_headers/headers/strict_transport_security.rb CHANGED Viewed

@@ -6,7 +6,7 @@ module SecureHeaders
       HSTS_HEADER_NAME = 'Strict-Transport-Security'
       HSTS_MAX_AGE = "631138519"
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
-      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?\z/i
+      VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
     end
     include Constants
@@ -31,6 +31,7 @@ module SecureHeaders
       max_age = @config.fetch(:max_age, HSTS_MAX_AGE)
       value = "max-age=" + max_age.to_s
       value += "; includeSubdomains" if @config[:include_subdomains]
+      value += "; preload" if @config[:preload]
       value
     end

data/lib/secure_headers/headers/x_download_options.rb ADDED Viewed

@@ -0,0 +1,39 @@
+module SecureHeaders
+  class XDOBuildError < StandardError; end
+  class XDownloadOptions < Header
+    module Constants
+      XDO_HEADER_NAME = "X-Download-Options"
+      DEFAULT_VALUE = 'noopen'
+    end
+    include Constants
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+    def name
+      XDO_HEADER_NAME
+    end
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+    private
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless value.casecmp(DEFAULT_VALUE) == 0
+        raise XDOBuildError.new("Value can only be nil or 'noopen'")
+      end
+    end
+  end
+end