secure_headers 1.3.4 → 2.0.0

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -4,12 +4,11 @@ module SecureHeaders
   describe ContentSecurityPolicy do
     let(:default_opts) do
       {
-        :disable_chrome_extension => true,
         :disable_fill_missing => true,
-        :default_src => 'https://*',
+        :default_src => 'https:',
         :report_uri => '/csp_report',
-        :script_src => 'inline eval https://* data:',
-        :style_src => "inline https://* about:"
+        :script_src => 'inline eval https: data:',
+        :style_src => "inline https: about:"
       }
     end
 
@@ -30,44 +29,41 @@ module SecureHeaders
 
     describe "#name" do
       context "when supplying options to override request" do
-        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => IE).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => FIREFOX).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => FIREFOX_23).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => CHROME).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => CHROME_25).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => IE).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => FIREFOX).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => FIREFOX_23).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => CHROME).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :ua => CHROME_25).name).to eq(HEADER_NAME + "-Report-Only")}
       end
 
       context "when in report-only mode" do
-        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(IE)).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX)).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX_23)).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME)).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME_25)).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(IE)).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX)).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX_23)).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME)).name).to eq(HEADER_NAME + "-Report-Only")}
+        specify { expect(ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME_25)).name).to eq(HEADER_NAME + "-Report-Only")}
       end
 
       context "when in enforce mode" do
         let(:opts) { default_opts.merge(:enforce => true)}
 
-        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(IE)).name).to eq(STANDARD_HEADER_NAME)}
-        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX)).name).to eq(STANDARD_HEADER_NAME)}
-        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX_23)).name).to eq(STANDARD_HEADER_NAME)}
-        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(CHROME)).name).to eq(STANDARD_HEADER_NAME)}
-        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(CHROME_25)).name).to eq(STANDARD_HEADER_NAME)}
+        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(IE)).name).to eq(HEADER_NAME)}
+        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX)).name).to eq(HEADER_NAME)}
+        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX_23)).name).to eq(HEADER_NAME)}
+        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(CHROME)).name).to eq(HEADER_NAME)}
+        specify { expect(ContentSecurityPolicy.new(opts, :request => request_for(CHROME_25)).name).to eq(HEADER_NAME)}
       end
+    end
 
-      context "when in experimental mode" do
-        let(:opts) { default_opts.merge(:enforce => true).merge(:experimental => {})}
-        specify { expect(ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(IE)}).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(FIREFOX)}).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(FIREFOX_23)}).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(CHROME)}).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
-        specify { expect(ContentSecurityPolicy.new(opts, {:experimental => true, :request => request_for(CHROME_25)}).name).to eq(STANDARD_HEADER_NAME + "-Report-Only")}
+    context "when using hash sources" do
+      it "adds hashes and unsafe-inline to the script-src" do
+        policy = ContentSecurityPolicy.new(default_opts.merge(:script_hashes => ['sha256-abc123']))
+        expect(policy.value).to match /script-src[^;]*'sha256-abc123'/
       end
     end
 
     describe "#normalize_csp_options" do
       before(:each) do
-        default_opts.delete(:disable_chrome_extension)
         default_opts.delete(:disable_fill_missing)
         default_opts[:script_src] << ' self none'
         @opts = default_opts
@@ -76,11 +72,11 @@ module SecureHeaders
       context "Content-Security-Policy" do
         it "converts the script values to their equivilents" do
           csp = ContentSecurityPolicy.new(@opts, :request => request_for(CHROME))
-          expect(csp.value).to include("script-src 'unsafe-inline' 'unsafe-eval' https://* data: 'self' 'none'")
+          expect(csp.value).to include("script-src 'unsafe-inline' 'unsafe-eval' https: data: 'self' 'none'")
         end
 
         it "adds a @enforce and @app_name variables to the report uri" do
-          opts = @opts.merge(:tag_report_uri => true, :enforce => true, :app_name => 'twitter')
+          opts = @opts.merge(:tag_report_uri => true, :enforce => true, :app_name => lambda { 'twitter' })
           csp = ContentSecurityPolicy.new(opts, :request => request_for(CHROME))
           expect(csp.value).to include("/csp_report?enforce=true&app_name=twitter")
         end
@@ -98,7 +94,7 @@ module SecureHeaders
           }
 
           csp = ContentSecurityPolicy.new(opts)
-          expect(csp.report_uri).to eq("http://lambda/result")
+          expect(csp.value).to match("report-uri http://lambda/result")
         end
 
         it "accepts procs for other fields" do
@@ -115,130 +111,34 @@ module SecureHeaders
       end
     end
 
-    describe "#same_origin?" do
-      let(:origin) {"https://example.com:123"}
-
-      it "matches when host, scheme, and port match" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'https://example.com'}, :request => request_for(FIREFOX, "https://example.com"))
-        expect(csp.send(:same_origin?)).to be true
-
-        csp = ContentSecurityPolicy.new({:report_uri => 'https://example.com'}, :request => request_for(FIREFOX, "https://example.com:443"))
-        expect(csp.send(:same_origin?)).to be true
-
-        csp = ContentSecurityPolicy.new({:report_uri => 'https://example.com:123'}, :request => request_for(FIREFOX, "https://example.com:123"))
-        expect(csp.send(:same_origin?)).to be true
-
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://example.com'}, :request => request_for(FIREFOX, "http://example.com"))
-        expect(csp.send(:same_origin?)).to be true
-
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://example.com:80'}, :request => request_for(FIREFOX, "http://example.com"))
-        expect(csp.send(:same_origin?)).to be true
-
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://example.com'}, :request => request_for(FIREFOX, "http://example.com:80"))
-        expect(csp.send(:same_origin?)).to be true
-      end
-
-      it "does not match port mismatches" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://example.com'}, :request => request_for(FIREFOX, "http://example.com:81"))
-        expect(csp.send(:same_origin?)).to be false
-      end
-
-      it "does not match host mismatches" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://twitter.com'}, :request => request_for(FIREFOX, "http://example.com"))
-        expect(csp.send(:same_origin?)).to be false
-      end
-
-      it "does not match host mismatches because of subdomains" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'http://example.com'}, :request => request_for(FIREFOX, "http://sub.example.com"))
-        expect(csp.send(:same_origin?)).to be false
-      end
-
-      it "does not match scheme mismatches" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'https://example.com'}, :request => request_for(FIREFOX, "ftp://example.com"))
-        expect(csp.send(:same_origin?)).to be false
-      end
-
-      it "does not match on substring collisions" do
-        csp = ContentSecurityPolicy.new({:report_uri => 'https://example.com'}, :request => request_for(FIREFOX, "https://anotherexample.com"))
-        expect(csp.send(:same_origin?)).to be false
-      end
-    end
-
-    describe "#normalize_reporting_endpoint" do
-      let(:opts) {{:report_uri => 'https://example.com/csp', :forward_endpoint => anything}}
-
-      context "when using firefox" do
-        it "updates the report-uri when posting to a different host" do
-          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX, "https://anexample.com"))
-          expect(csp.report_uri).to eq(FF_CSP_ENDPOINT)
-        end
-
-        it "doesn't change report-uri if a path supplied" do
-          csp = ContentSecurityPolicy.new({:report_uri => "/csp_reports"}, :request => request_for(FIREFOX, "https://anexample.com"))
-          expect(csp.report_uri).to eq("/csp_reports")
-        end
-
-        it "forwards if the request_uri is set to a non-matching value" do
-          csp = ContentSecurityPolicy.new({:report_uri => "https://another.example.com", :forward_endpoint => '/somewhere'}, :ua => "Firefox", :request_uri => "https://anexample.com")
-          expect(csp.report_uri).to eq(FF_CSP_ENDPOINT)
-        end
-      end
-
-      it "does not update the URI is the report_uri is on the same origin" do
-        opts = {:report_uri => 'https://example.com/csp', :forward_endpoint => 'https://anotherexample.com'}
-        csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX, "https://example.com/somewhere"))
-        expect(csp.report_uri).to eq('https://example.com/csp')
-      end
-
-      it "does not update the report-uri when using a non-firefox browser" do
-        csp = ContentSecurityPolicy.new(opts, :request => request_for(CHROME))
-        expect(csp.report_uri).to eq('https://example.com/csp')
-      end
-
-      context "when using a protocol-relative value for report-uri" do
-        let(:opts) {
-          {
-            :default_src => 'self',
-            :report_uri => '//example.com/csp'
-          }
-        }
-
-        it "uses the current protocol" do
-          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX, '/', :ssl => true))
-          expect(csp.value).to match(%r{report-uri https://example.com/csp;})
-
-          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX))
-          expect(csp.value).to match(%r{report-uri http://example.com/csp;})
-        end
-
-        it "uses the pre-configured https protocol" do
-          csp = ContentSecurityPolicy.new(opts, :ua => "Firefox", :ssl => true)
-          expect(csp.value).to match(%r{report-uri https://example.com/csp;})
-        end
-
-        it "uses the pre-configured http protocol" do
-          csp = ContentSecurityPolicy.new(opts, :ua => "Firefox", :ssl => false)
-          expect(csp.value).to match(%r{report-uri http://example.com/csp;})
-        end
-      end
-    end
-
     describe "#value" do
       it "raises an exception when default-src is missing" do
         csp = ContentSecurityPolicy.new({:script_src => 'anything'}, :request => request_for(CHROME))
         expect {
           csp.value
-        }.to raise_error(ContentSecurityPolicyBuildError, "Couldn't build CSP header :( Expected to find default_src directive value")
+        }.to raise_error(RuntimeError)
+      end
+
+      context "CSP level 2 directives" do
+        let(:config) { {:default_src => 'self'} }
+        ::SecureHeaders::ContentSecurityPolicy::Constants::NON_DEFAULT_SOURCES.each do |non_default_source|
+          it "supports all level 2 directives" do
+            directive_name = ::SecureHeaders::ContentSecurityPolicy.send(:symbol_to_hyphen_case, non_default_source)
+            config.merge!({ non_default_source => "value" })
+            csp = ContentSecurityPolicy.new(config, :request => request_for(CHROME))
+            expect(csp.value).to match(/#{directive_name} value;/)
+          end
+        end
       end
 
       context "auto-whitelists data: uris for img-src" do
         it "sets the value if no img-src specified" do
-          csp = ContentSecurityPolicy.new({:default_src => 'self', :disable_fill_missing => true, :disable_chrome_extension => true}, :request => request_for(CHROME))
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
 
         it "appends the value if img-src is specified" do
-          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_fill_missing => true, :disable_chrome_extension => true}, :request => request_for(CHROME))
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
       end
@@ -246,7 +146,7 @@ module SecureHeaders
       it "fills in directives without values with default-src value" do
         options = default_opts.merge(:disable_fill_missing => false)
         csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-        value = "default-src https://*; connect-src https://*; font-src https://*; frame-src https://*; img-src https://* data:; media-src https://*; object-src https://*; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"
+        value = "default-src https:; connect-src https:; font-src https:; frame-src https:; img-src https: data:; media-src https:; object-src https:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https: about:; report-uri /csp_report;"
         expect(csp.value).to eq(value)
       end
 
@@ -258,19 +158,14 @@ module SecureHeaders
       context "Firefox" do
         it "builds a csp header for firefox" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX))
-          expect(csp.value).to eq("default-src https://*; img-src https://* data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;")
+          expect(csp.value).to eq("default-src https:; img-src https: data:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https: about:; report-uri /csp_report;")
         end
       end
 
       context "Chrome" do
         it "builds a csp header for chrome" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME))
-          expect(csp.value).to eq("default-src https://*; img-src https://* data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;")
-        end
-
-        it "ignores :forward_endpoint settings" do
-          csp = ContentSecurityPolicy.new(@options_with_forwarding, :request => request_for(CHROME))
-          expect(csp.value).to match(/report-uri #{@options_with_forwarding[:report_uri]};/)
+          expect(csp.value).to eq("default-src https:; img-src https: data:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https: about:; report-uri /csp_report;")
         end
       end
 
@@ -299,41 +194,19 @@ module SecureHeaders
         end
       end
 
-      context "when supplying a experimental values" do
-        let(:options) {{
-          :disable_chrome_extension => true,
-          :disable_fill_missing => true,
-          :default_src => 'self',
-          :script_src => 'https://*',
-          :experimental => {
-            :script_src => 'self'
-          }
-        }}
-
-        it "returns the original value" do
-          header = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-          expect(header.value).to eq("default-src 'self'; img-src 'self' data:; script-src https://*;")
-        end
-
-        it "it returns the experimental value if requested" do
-          header = ContentSecurityPolicy.new(options, {:request => request_for(CHROME), :experimental => true})
-          expect(header.value).not_to match(/https/)
-        end
-      end
-
       context "when supplying additional http directive values" do
         let(:options) {
           default_opts.merge({
             :http_additions => {
-              :frame_src => "http://*",
-              :img_src => "http://*"
+              :frame_src => "http:",
+              :img_src => "http:"
             }
           })
         }
 
         it "adds directive values for headers on http" do
           csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-          expect(csp.value).to eq("default-src https://*; frame-src http://*; img-src http://* data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;")
+          expect(csp.value).to eq("default-src https:; frame-src http:; img-src http: data:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https: about:; report-uri /csp_report;")
         end
 
         it "does not add the directive values if requesting https" do
@@ -345,45 +218,47 @@ module SecureHeaders
           csp = ContentSecurityPolicy.new(options, :ua => "Chrome", :ssl => true)
           expect(csp.value).not_to match(/http:/)
         end
+      end
 
-        context "when supplying an experimental block" do
-          # this simulates the situation where we are enforcing that scripts
-          # only come from http[s]? depending if we're on ssl or not. The
-          # report only tag will allow scripts from self over ssl, and
-          # from a secure CDN over non-ssl
-          let(:options) {{
-            :disable_chrome_extension => true,
-            :disable_fill_missing => true,
-            :default_src => 'self',
-            :script_src => 'https://*',
-            :http_additions => {
-              :script_src => 'http://*'
-            },
-            :experimental => {
-              :script_src => 'self',
-              :http_additions => {
-                :script_src => 'https://mycdn.example.com'
-              }
-            }
-          }}
-          # for comparison purposes, if not using the experimental header this would produce
-          # "allow 'self'; script-src https://*" for https requests
-          # and
-          # "allow 'self'; script-src https://* http://*" for http requests
-
-          it "uses the value in the experimental block over SSL" do
-            csp = ContentSecurityPolicy.new(options, :experimental => true, :request => request_for(FIREFOX, '/', :ssl => true))
-            expect(csp.value).to eq("default-src 'self'; img-src 'self' data:; script-src 'self';")
+      describe "class methods" do
+        let(:ua) { CHROME }
+        let(:env) do
+          double.tap do |env|
+            allow(env).to receive(:[]).with('HTTP_USER_AGENT').and_return(ua)
           end
+        end
+        let(:request) do
+          double(
+            :ssl? => true,
+            :url => 'https://example.com',
+            :env => env
+          )
+        end
+
+        describe ".add_to_env" do
+          let(:controller) { double }
+          let(:config) { {:default_src => 'self'} }
+          let(:options) { {:controller => controller} }
 
-          it "detects the :ssl => true option" do
-            csp = ContentSecurityPolicy.new(options, :experimental => true, :ua => FIREFOX, :ssl => true)
-            expect(csp.value).to eq("default-src 'self'; img-src 'self' data:; script-src 'self';")
+          it "adds metadata to env" do
+            metadata = {
+              :config => config,
+              :options => options
+            }
+            expect(ContentSecurityPolicy).to receive(:options_from_request).and_return(options)
+            expect(env).to receive(:[]=).with(ContentSecurityPolicy::ENV_KEY, metadata)
+            ContentSecurityPolicy.add_to_env(request, controller, config)
           end
+        end
 
-          it "merges the values from experimental/http_additions when not over SSL" do
-            csp = ContentSecurityPolicy.new(options, :experimental => true, :request => request_for(FIREFOX))
-            expect(csp.value).to eq("default-src 'self'; img-src 'self' data:; script-src 'self' https://mycdn.example.com;")
+        describe ".options_from_request" do
+          it "extracts options from request" do
+            options = ContentSecurityPolicy.options_from_request(request)
+            expect(options).to eql({
+              :ua => ua,
+              :ssl => true,
+              :request_uri => 'https://example.com'
+            })
           end
         end
       end

data/spec/lib/secure_headers/headers/x_download_options_spec.rb

@@ -24,7 +24,7 @@ module SecureHeaders
 
       it "doesn't accept anything besides noopen" do
         expect {
-          XContentTypeOptions.new("open")
+          XDownloadOptions.new("open")
         }.to raise_error
       end
     end

data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb

@@ -0,0 +1,64 @@
+module SecureHeaders
+  describe XPermittedCrossDomainPolicies do
+    specify { expect(XPermittedCrossDomainPolicies.new.name).to eq(XPermittedCrossDomainPolicies::Constants::XPCDP_HEADER_NAME)}
+    specify { expect(XPermittedCrossDomainPolicies.new.value).to eq("none")}
+    specify { expect(XPermittedCrossDomainPolicies.new('master-only').value).to eq('master-only')}
+    specify { expect(XPermittedCrossDomainPolicies.new(:value => 'master-only').value).to eq('master-only') }
+
+    context "valid configuration values" do
+      it "accepts 'all'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("all")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "all")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-ftp-filename'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-ftp-filename")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-ftp-filename")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-content-type'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-content-type")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-content-type")
+        }.not_to raise_error
+      end
+      it "accepts 'master-only'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("master-only")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "master-only")
+        }.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect {
+          XPermittedCrossDomainPolicies.new
+        }.not_to raise_error
+      end
+    end
+
+    context 'invlaid configuration values' do
+
+      it "doesn't accept invalid values" do
+        expect {
+          XPermittedCrossDomainPolicies.new("open")
+        }.to raise_error
+      end
+    end
+  end
+end

data/spec/lib/secure_headers_spec.rb

@@ -18,26 +18,7 @@ describe SecureHeaders do
     allow(subject).to receive(:request).and_return(request)
   end
 
-  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
-  USER_AGENTS = {
-    :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
-    :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
-    :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
-    :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
-    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
-    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
-    :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
-  }
-
-  def should_assign_header name, value
-    expect(response.headers).to receive(:[]=).with(name, value)
-  end
-
-  def should_not_assign_header name
-    expect(response.headers).not_to receive(:[]=).with(name, anything)
-  end
+  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection, :x_permitted_cross_domain_policies].map{|header| [header, false]}]
 
   def stub_user_agent val
     allow(request).to receive_message_chain(:env, :[]).and_return(val)
@@ -55,6 +36,7 @@ describe SecureHeaders do
       config.x_xss_protection = nil
       config.csp = nil
       config.x_download_options = nil
+      config.x_permitted_cross_domain_policies = nil
     end
   end
 
@@ -65,14 +47,7 @@ describe SecureHeaders do
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
     subject.set_x_download_options_header
-  end
-
-  describe "#ensure_security_headers" do
-    it "sets a before filter" do
-      options = {}
-      expect(DummyClass).to receive(:before_filter).exactly(6).times
-      DummyClass.ensure_security_headers(options)
-    end
+    subject.set_x_permitted_cross_domain_policies_header
   end
 
   describe "#set_header" do
@@ -88,13 +63,10 @@ describe SecureHeaders do
   end
 
   describe "#set_security_headers" do
-    before(:each) do
-      allow(SecureHeaders::ContentSecurityPolicy).to receive(:new).and_return(double.as_null_object)
-    end
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 6
+        number_of_headers = 7
         expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
@@ -102,6 +74,7 @@ describe SecureHeaders do
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
         subject.set_x_download_options_header
+        subject.set_x_permitted_cross_domain_policies_header
       end
     end
 
@@ -126,6 +99,11 @@ describe SecureHeaders do
       subject.set_x_frame_options_header(false)
     end
 
+    it "does not set the X-Permitted-Cross-Domain-Policies header if disabled" do
+      should_not_assign_header(XPCDP_HEADER_NAME)
+      subject.set_x_permitted_cross_domain_policies_header(false)
+    end
+
     it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
@@ -139,8 +117,19 @@ describe SecureHeaders do
 
     it "does not set the CSP header if disabled" do
       stub_user_agent(USER_AGENTS[:chrome])
-      should_not_assign_header(STANDARD_HEADER_NAME)
-      subject.set_csp_header(options_for(:csp).merge(:csp => false))
+      should_not_assign_header(HEADER_NAME)
+      subject.set_csp_header(false)
+    end
+
+    it "saves the options to the env when using script hashes" do
+      opts = {
+        :default_src => 'self',
+        :script_hash_middleware => true
+      }
+      stub_user_agent(USER_AGENTS[:chrome])
+
+      expect(SecureHeaders::ContentSecurityPolicy).to receive(:add_to_env)
+      subject.set_csp_header(opts)
     end
 
     context "when disabled by configuration settings" do
@@ -152,6 +141,7 @@ describe SecureHeaders do
           config.x_xss_protection = false
           config.csp = false
           config.x_download_options = false
+          config.x_permitted_cross_domain_policies = false
         end
         expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
@@ -247,7 +237,7 @@ describe SecureHeaders do
     context "when using Firefox" do
       it "sets CSP headers" do
         stub_user_agent(USER_AGENTS[:firefox])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -255,7 +245,7 @@ describe SecureHeaders do
     context "when using Chrome" do
       it "sets default CSP header" do
         stub_user_agent(USER_AGENTS[:chrome])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -263,36 +253,21 @@ describe SecureHeaders do
     context "when using a browser besides chrome/firefox" do
       it "sets the CSP header" do
         stub_user_agent(USER_AGENTS[:opera])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
+  end
 
-    context "when using the experimental key" do
-      before(:each) do
-        stub_user_agent(USER_AGENTS[:chrome])
-        @opts = {
-          :enforce => true,
-          :default_src => 'self',
-          :script_src => 'https://mycdn.example.com',
-          :experimental => {
-            :script_src => 'self',
-          }
-        }
-      end
-
-      it "does not set the header in enforce mode if experimental is supplied, but enforce is disabled" do
-        opts = @opts.merge(:enforce => false)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        should_not_assign_header(STANDARD_HEADER_NAME)
-        subject.set_csp_header(opts)
-      end
+  describe "#set_x_permitted_cross_domain_policies_header" do
+    it "sets the X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+      subject.set_x_permitted_cross_domain_policies_header
+    end
 
-      it "sets a header in enforce mode as well as report-only mode" do
-        should_assign_header(STANDARD_HEADER_NAME, anything)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        subject.set_csp_header(@opts)
-      end
+    it "allows a custom X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, "master-only")
+      subject.set_x_permitted_cross_domain_policies_header(:value => 'master-only')
     end
   end
 end