secure_headers 1.3.3 → 2.0.0

data/fixtures/rails_4_1_8/config/secrets.yml

@@ -0,0 +1,22 @@
+# Be sure to restart your server when you modify this file.
+
+# Your secret key is used for verifying the integrity of signed cookies.
+# If you change this key, all old signed cookies will become invalid!
+
+# Make sure the secret is at least 30 characters and all random,
+# no regular words or you'll be exposed to dictionary attacks.
+# You can use `rake secret` to generate a secure secret key.
+
+# Make sure the secrets in this file are kept private
+# if you're sharing your code publicly.
+
+development:
+  secret_key_base: ddba38f932720d8f18257f2a05dc278963a29cf569c45aa97ff4e9fc9bbc78af5a03fcf135caad45caee66ac09f8f9913c1f5e338a61213f420eefa8dd6363d2
+
+test:
+  secret_key_base: f73abd7eab84fa7af5a2fc0a9c2727c5bad47433e51aa0c9c6b0782dac176a8e7f337e1f93adc6d6fc17027e67a533040b6408e54d72dea2eec6e5b9820dbcb9
+
+# Do not keep production secrets in the repository,
+# instead read values from the environment.
+production:
+  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

data/fixtures/rails_4_1_8/config.ru

@@ -0,0 +1,4 @@
+# This file is used by Rack-based servers to start the application.
+
+require ::File.expand_path('../config/environment',  __FILE__)
+run Rails.application

data/fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+require 'secure_headers/headers/content_security_policy/script_hash_middleware'
+
+describe OtherThingsController, :type => :controller do
+  include Rack::Test::Methods
+
+  def app
+    OtherThingsController.action(:index)
+  end
+
+  def request(opts = {})
+    options = opts.merge(
+      {
+        'HTTPS' => 'on',
+        'HTTP_USER_AGENT' => "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+      }
+    )
+
+
+    Rack::MockRequest.env_for('/', options)
+  end
+
+
+  describe "headers" do
+    before(:each) do
+      _, @env = app.call(request)
+    end
+
+    it "sets the X-XSS-Protection header" do
+      get '/'
+      expect(@env['X-XSS-Protection']).to eq('0')
+    end
+
+    it "sets the X-Frame-Options header" do
+      get '/'
+      expect(@env['X-Frame-Options']).to eq('DENY')
+    end
+
+    it "sets the CSP header with a local reference to a nonce" do
+      middleware = ::SecureHeaders::ContentSecurityPolicy::ScriptHashMiddleware.new(app)
+      _, env = middleware.call(request(@env))
+      expect(env['Content-Security-Policy-Report-Only']).to match(/script-src[^;]*'nonce-[a-zA-Z0-9\+\/=]{44}'/)
+    end
+
+    it "sets the required hashes to whitelist inline script" do
+      middleware = ::SecureHeaders::ContentSecurityPolicy::ScriptHashMiddleware.new(app)
+      _, env = middleware.call(request(@env))
+      hashes = ['sha256-VjDxT7saxd2FgaUQQTWw/jsTnvonaoCP/ACWDBTpyhU=', 'sha256-ZXAcP8a0y1pPMTJW8pUr43c+XBkgYQBwHOPvXk9mq5A=']
+      hashes.each do |hash|
+        expect(env['Content-Security-Policy-Report-Only']).to include(hash)
+      end
+    end
+
+    it "sets the Strict-Transport-Security header" do
+      get '/'
+      expect(@env['Strict-Transport-Security']).to eq("max-age=315576000")
+    end
+
+    it "sets the X-Download-Options header" do
+      get '/'
+      expect(@env['X-Download-Options']).to eq('noopen')
+    end
+
+    it "sets the X-Content-Type-Options header" do
+      get '/'
+      expect(@env['X-Content-Type-Options']).to eq("nosniff")
+    end
+
+    it "sets the X-Permitted-Cross-Domain-Policies" do
+      get '/'
+      expect(@env['X-Permitted-Cross-Domain-Policies']).to eq("none")
+    end
+
+    context "using IE" do
+      it "sets the X-Content-Type-Options header" do
+        @env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        get '/'
+        expect(@env['X-Content-Type-Options']).to eq("nosniff")
+      end
+    end
+  end
+end

data/fixtures/rails_4_1_8/spec/controllers/things_controller_spec.rb

@@ -0,0 +1,59 @@
+# config.action_dispatch.default_headers defaults to:
+# {"X-Frame-Options"=>"SAMEORIGIN", "X-XSS-Protection"=>"1; mode=block", "X-Content-Type-Options"=>"nosniff"}
+# so we want to set our specs to expect something else to ensure secureheaders is taking precedence
+
+require 'spec_helper'
+
+# This controller is meant to be something that inherits config from application controller
+# all values are defaulted because no initializer is configured, and the values in app controller
+# only provide csp => false
+
+describe ThingsController, :type => :controller do
+
+  describe "headers" do
+    it "sets the X-XSS-Protection header" do
+      get :index
+      expect(response.headers['X-XSS-Protection']).to eq('0')
+    end
+
+    it "sets the X-Frame-Options header" do
+      get :index
+      expect(response.headers['X-Frame-Options']).to eq('DENY')
+    end
+
+    it "does not set CSP header" do
+      get :index
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq(nil)
+    end
+
+    #mock ssl
+    it "sets the Strict-Transport-Security header" do
+      request.env['HTTPS'] = 'on'
+      get :index
+      expect(response.headers['Strict-Transport-Security']).to eq("max-age=315576000")
+    end
+
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq('noopen')
+    end
+
+    it "sets the X-Content-Type-Options header" do
+      get :index
+      expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
+    end
+
+    it "sets the X-Permitted-Cross-Domain-Policies" do
+      get :index
+      expect(response.headers['X-Permitted-Cross-Domain-Policies']).to eq("none")
+    end
+
+    context "using IE" do
+      it "sets the X-Content-Type-Options header" do
+        request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        get :index
+        expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
+      end
+    end
+  end
+end

data/fixtures/rails_4_1_8/spec/spec_helper.rb

@@ -0,0 +1,15 @@
+require 'rubygems'
+
+#uncomment the following line to use spork with the debugger
+#require 'spork/ext/ruby-debug'
+
+# Spork.prefork do
+  # Loading more in this block will cause your tests to run faster. However,
+  # if you change any configuration or code from libraries loaded here, you'll
+  # need to restart spork for it take effect.
+# This file is copied to spec/ when you run 'rails generate rspec:install'
+  ENV["RAILS_ENV"] ||= 'test'
+  require File.expand_path("../../config/environment", __FILE__)
+  require 'rspec/rails'
+# end
+

data/lib/secure_headers/hash_helper.rb

@@ -0,0 +1,7 @@
+module SecureHeaders
+  module HashHelper
+    def hash_source(inline_script, digest = :SHA256)
+      [digest.to_s.downcase, "-", [[Digest.const_get(digest).hexdigest(inline_script)].pack("H*")].pack("m").chomp].join
+    end
+  end
+end

data/lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb

@@ -0,0 +1,22 @@
+module SecureHeaders
+  class ContentSecurityPolicy
+    class ScriptHashMiddleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, response = @app.call(env)
+        metadata = env[ContentSecurityPolicy::ENV_KEY]
+        if !metadata.nil?
+          config, options = metadata.values_at(:config, :options)
+          config.merge!(:script_hashes => env[HASHES_ENV_KEY])
+          csp_header = ContentSecurityPolicy.new(config, options)
+          headers[csp_header.name] = csp_header.value
+        end
+
+        [status, headers, response]
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,90 +1,154 @@
 require 'uri'
 require 'base64'
+require 'securerandom'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
   class ContentSecurityPolicy < Header
     module Constants
-      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https://* about: javascript:; img-src data:"
-      STANDARD_HEADER_NAME = "Content-Security-Policy"
-      FF_CSP_ENDPOINT = "/content_security_policy/forward_report"
-      DIRECTIVES = [:default_src, :script_src, :frame_src, :style_src, :img_src, :media_src, :font_src, :object_src, :connect_src]
-      META = [:disable_chrome_extension, :disable_fill_missing, :forward_endpoint]
+      DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: about: javascript:; img-src data:"
+      HEADER_NAME = "Content-Security-Policy"
+      ENV_KEY = 'secure_headers.content_security_policy'
+      DIRECTIVES = [
+        :default_src,
+        :connect_src,
+        :font_src,
+        :frame_src,
+        :img_src,
+        :media_src,
+        :object_src,
+        :script_src,
+        :style_src
+      ]
+
+      NON_DEFAULT_SOURCES = [
+        :base_uri,
+        :child_src,
+        :form_action,
+        :frame_ancestors,
+        :plugin_types,
+        :referrer,
+        :reflected_xss
+      ]
+
+      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
     end
     include Constants
 
-    attr_accessor *META
-    attr_reader :browser, :ssl_request, :report_uri, :request_uri, :experimental
-
-    alias :disable_chrome_extension? :disable_chrome_extension
+    attr_reader :disable_fill_missing, :ssl_request
     alias :disable_fill_missing? :disable_fill_missing
     alias :ssl_request? :ssl_request
 
+    class << self
+      def generate_nonce
+        SecureRandom.base64(32).chomp
+      end
+
+      def set_nonce(controller, nonce = generate_nonce)
+        controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+      end
+
+      def add_to_env(request, controller, config)
+        set_nonce(controller)
+        options = options_from_request(request).merge(:controller => controller)
+        request.env[Constants::ENV_KEY] = {
+          :config => config,
+          :options => options,
+        }
+      end
+
+      def options_from_request(request)
+        {
+          :ssl => request.ssl?,
+          :ua => request.env['HTTP_USER_AGENT'],
+          :request_uri => request_uri_from_request(request),
+        }
+      end
+
+      def request_uri_from_request(request)
+        if request.respond_to?(:original_url)
+          # rails 3.1+
+          request.original_url
+        else
+          # rails 2/3.0
+          request.url
+        end
+      end
+
+      def symbol_to_hyphen_case sym
+        sym.to_s.gsub('_', '-')
+      end
+    end
+
     # +options+ param contains
-    # :experimental use experimental block for config
+    # :controller used for setting instance variables for nonces/hashes
     # :ssl_request used to determine if http_additions should be used
-    # :request_uri used to determine if firefox should send the report directly
-    # or use the forwarding endpoint
     # :ua the user agent (or just use Firefox/Chrome/MSIE/etc)
     #
     # :report used to determine what :ssl_request, :ua, and :request_uri are set to
     def initialize(config=nil, options={})
-      @experimental = !!options.delete(:experimental)
-      @controller = options.delete(:controller)
+      return unless config
 
       if options[:request]
-        parse_request(options[:request])
-      else
-        @ua = options[:ua]
-        # fails open, assumes http. Bad idea? Will always include http additions.
-        # could also fail if not supplied.
-        @ssl_request = !!options.delete(:ssl)
-        # a nil value here means we always assume we are not on the same host,
-        # which causes all FF csp reports to go through the forwarder
-        @request_uri = options.delete(:request_uri)
+        options = options.merge(self.class.options_from_request(options[:request]))
       end
 
-      configure(config) if config
-    end
+      @controller = options[:controller]
+      @ua = options[:ua]
+      @ssl_request = !!options.delete(:ssl)
+      @request_uri = options.delete(:request_uri)
 
-    def nonce
-      @nonce ||= SecureRandom.base64(32).chomp
-    end
+      # Config values can be string, array, or lamdba values
+      @config = config.inject({}) do |hash, (key, value)|
+        config_val = value.respond_to?(:call) ? value.call : value
 
-    def configure(config)
-      @config = config.dup
+        if ALL_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
+          config_val = config_val.split if config_val.is_a? String
+          if config_val.is_a?(Array)
+            config_val = config_val.map do |val|
+              translate_dir_value(val)
+            end.flatten.uniq
+          end
+        end
 
-      experimental_config = @config.delete(:experimental)
-      if @experimental && experimental_config
-        @config[:http_additions] = experimental_config[:http_additions]
-        @config.merge!(experimental_config)
+        hash[key] = config_val
+        hash
       end
 
-      # these values don't support lambdas because this needs to be rewritten
       @http_additions = @config.delete(:http_additions)
       @app_name = @config.delete(:app_name)
+      @report_uri = @config.delete(:report_uri)
 
-      normalize_csp_options
-
-      META.each do |meta|
-        self.send("#{meta}=", @config.delete(meta))
-      end
-
+      @disable_fill_missing = !!@config.delete(:disable_fill_missing)
       @enforce = !!@config.delete(:enforce)
-      @tag_report_uri = @config.delete(:tag_report_uri)
+      @tag_report_uri = !!@config.delete(:tag_report_uri)
+      @script_hashes = @config.delete(:script_hashes) || []
 
-      normalize_reporting_endpoint
+      add_script_hashes if @script_hashes.any?
       fill_directives unless disable_fill_missing?
     end
 
+    ##
+    # Return or initialize the nonce value used for this header.
+    # If a reference to a controller is passed in the config, this method
+    # will check if a nonce has already been set and use it.
+    def nonce
+      @nonce ||= @controller.instance_variable_get(:@content_security_policy_nonce) || self.class.generate_nonce
+    end
+
+    ##
+    # Returns the name to use for the header. Either "Content-Security-Policy" or
+    # "Content-Security-Policy-Report-Only"
     def name
-      base = STANDARD_HEADER_NAME
-      if !@enforce || experimental
+      base = HEADER_NAME
+      if !@enforce
         base += "-Report-Only"
       end
       base
     end
 
+    ##
+    # Return the value of the CSP header
     def value
       return @config if @config.is_a?(String)
       if @config
@@ -96,26 +160,28 @@ module SecureHeaders
 
     private
 
+    def add_script_hashes
+      @config[:script_src] << @script_hashes.map {|hash| "'#{hash}'"} << ["'unsafe-inline'"]
+    end
+
     def build_value
       raise "Expected to find default_src directive value" unless @config[:default_src]
       append_http_additions unless ssl_request?
       header_value = [
-        generic_directives(@config),
+        generic_directives,
+        non_default_directives,
         report_uri_directive
       ].join.strip
-    rescue StandardError => e
-      raise ContentSecurityPolicyBuildError.new("Couldn't build CSP header :( #{e}")
     end
 
     def fill_directives
-      return unless @config[:default_src]
-      default = @config[:default_src]
-      DIRECTIVES.each do |directive|
-        unless @config[directive]
-          @config[directive] = default
+      if default = @config[:default_src]
+        DIRECTIVES.each do |directive|
+          unless @config[directive]
+            @config[directive] = default
+          end
         end
       end
-      @config
     end
 
     def append_http_additions
@@ -126,74 +192,20 @@ module SecureHeaders
       end
     end
 
-    def normalize_csp_options
-      @config = @config.inject({}) do |hash, (key, value)|
-        # lambdas
-        config_val = value.respond_to?(:call) ? value.call : value
-        # space-delimeted strings
-        config_val = config_val.split if config_val.is_a? String
-        # array of strings
-        if config_val.respond_to?(:map) #skip booleans
-          config_val = config_val.map do |val|
-            translate_dir_value(val)
-          end.flatten.uniq
-        end
-
-        hash[key] = config_val
-        hash
-      end
-
-      @report_uri = @config.delete(:report_uri).join(" ") if @config[:report_uri]
-    end
-
-    # translates 'inline','self', 'none' and 'eval' to their respective impl-specific values.
     def translate_dir_value val
       if %w{inline eval}.include?(val)
         val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
-        # self/none are special sources/src-dir-values and need to be quoted in chrome
+        # self/none are special sources/src-dir-values and need to be quoted
       elsif %{self none}.include?(val)
         "'#{val}'"
       elsif val == 'nonce'
-        @controller.instance_variable_set(:@content_security_policy_nonce, nonce)
+        self.class.set_nonce(@controller, nonce)
         ["'nonce-#{nonce}'", "'unsafe-inline'"]
       else
         val
       end
     end
 
-    # if we have a forwarding endpoint setup and we are not on the same origin as our report_uri
-    # or only a path was supplied (in which case we assume cross-host)
-    # we need to forward the request for Firefox.
-    def normalize_reporting_endpoint
-      if @ua && @ua =~ /Firefox/
-        if same_origin? || report_uri.nil? || URI.parse(report_uri).host.nil?
-          return
-        end
-
-        if forward_endpoint
-          @report_uri = FF_CSP_ENDPOINT
-        end
-      end
-
-      if @tag_report_uri
-        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
-        @report_uri += "&app_name=#{@app_name}" if @app_name
-      end
-    end
-
-    def same_origin?
-      return unless report_uri && request_uri
-
-      begin
-        origin = URI.parse(request_uri)
-        uri = URI.parse(report_uri)
-      rescue URI::InvalidURIError
-        return false
-      end
-
-      uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
-    end
-
     def report_uri_directive
       return '' if @report_uri.nil?
 
@@ -205,44 +217,40 @@ module SecureHeaders
                       end
       end
 
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
+
       "report-uri #{@report_uri};"
     end
 
-    def generic_directives(config)
+    def generic_directives
       header_value = ''
-      if config[:img_src]
-        config[:img_src] = config[:img_src] + ['data:'] unless config[:img_src].include?('data:')
+      if @config[:img_src]
+        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
       else
-        config[:img_src] = config[:default_src] + ['data:']
+        @config[:img_src] = @config[:default_src] + ['data:']
       end
 
-      header_value = build_directive(:default_src)
-      config.keys.sort_by{|k| k.to_s}.each do |k| # ensure consistent ordering
-        header_value += build_directive(k)
+      DIRECTIVES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
       end
 
       header_value
     end
 
-    # build and deletes the directive
-    def build_directive(key)
-      "#{symbol_to_hyphen_case(key)} #{@config.delete(key).join(" ")}; "
-    end
+    def non_default_directives
+      header_value = ''
+      NON_DEFAULT_SOURCES.each do |directive_name|
+        header_value += build_directive(directive_name) if @config[directive_name]
+      end
 
-    def symbol_to_hyphen_case sym
-      sym.to_s.gsub('_', '-')
+      header_value
     end
 
-    def parse_request request
-      @ssl_request = request.ssl?
-      @ua = request.env['HTTP_USER_AGENT']
-      @request_uri = if request.respond_to?(:original_url)
-        # rails 3.1+
-        request.original_url
-      else
-        # rails 2/3.0
-        request.url
-      end
+    def build_directive(key)
+      "#{self.class.symbol_to_hyphen_case(key)} #{@config[key].join(" ")}; "
     end
   end
 end

data/lib/secure_headers/headers/x_download_options.rb

@@ -0,0 +1,39 @@
+module SecureHeaders
+  class XDOBuildError < StandardError; end
+  class XDownloadOptions < Header
+    module Constants
+      XDO_HEADER_NAME = "X-Download-Options"
+      DEFAULT_VALUE = 'noopen'
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XDO_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless value.casecmp(DEFAULT_VALUE) == 0
+        raise XDOBuildError.new("Value can only be nil or 'noopen'")
+      end
+    end
+  end
+end