secure_headers 1.3.4 → 2.0.0

data/spec/spec_helper.rb

@@ -2,10 +2,35 @@ require 'rubygems'
 require 'rspec'
 
 require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
-require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
+
+if defined?(Coveralls)
+  Coveralls.wear!
+end
+
 include ::SecureHeaders::StrictTransportSecurity::Constants
 include ::SecureHeaders::ContentSecurityPolicy::Constants
 include ::SecureHeaders::XFrameOptions::Constants
 include ::SecureHeaders::XXssProtection::Constants
 include ::SecureHeaders::XContentTypeOptions::Constants
 include ::SecureHeaders::XDownloadOptions::Constants
+include ::SecureHeaders::XPermittedCrossDomainPolicies::Constants
+
+USER_AGENTS = {
+  :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
+  :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
+  :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
+  :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
+  :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+  :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+  :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+  :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
+  :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+}
+
+def should_assign_header name, value
+  expect(response.headers).to receive(:[]=).with(name, value)
+end
+
+def should_not_assign_header name
+  expect(response.headers).not_to receive(:[]=).with(name, anything)
+end

metadata

@@ -1,18 +1,20 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 2.0.0
+  prerelease: 
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-13 00:00:00.000000000 Z
+date: 2015-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -20,11 +22,12 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
-description: Add easily configured browser headers to responses.
+description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
 executables: []
@@ -36,14 +39,9 @@ files:
 - .ruby-version
 - .travis.yml
 - Gemfile
-- Guardfile
-- HISTORY.md
 - LICENSE
 - README.md
 - Rakefile
-- app/controllers/content_security_policy_controller.rb
-- config/curl-ca-bundle.crt
-- config/routes.rb
 - fixtures/rails_3_2_12/.rspec
 - fixtures/rails_3_2_12/Gemfile
 - fixtures/rails_3_2_12/README.rdoc
@@ -59,18 +57,10 @@ files:
 - fixtures/rails_3_2_12/config/application.rb
 - fixtures/rails_3_2_12/config/boot.rb
 - fixtures/rails_3_2_12/config/environment.rb
-- fixtures/rails_3_2_12/config/environments/development.rb
-- fixtures/rails_3_2_12/config/environments/production.rb
 - fixtures/rails_3_2_12/config/environments/test.rb
-- fixtures/rails_3_2_12/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12/config/initializers/inflections.rb
-- fixtures/rails_3_2_12/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12/config/initializers/secret_token.rb
 - fixtures/rails_3_2_12/config/initializers/secure_headers.rb
-- fixtures/rails_3_2_12/config/initializers/session_store.rb
-- fixtures/rails_3_2_12/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12/config/locales/en.yml
 - fixtures/rails_3_2_12/config/routes.rb
+- fixtures/rails_3_2_12/config/script_hashes.yml
 - fixtures/rails_3_2_12/lib/assets/.gitkeep
 - fixtures/rails_3_2_12/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12/log/.gitkeep
@@ -90,25 +80,12 @@ files:
 - fixtures/rails_3_2_12_no_init/app/models/.gitkeep
 - fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/other_things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/_form.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/edit.html.erb
 - fixtures/rails_3_2_12_no_init/app/views/things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/new.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/show.html.erb
 - fixtures/rails_3_2_12_no_init/config.ru
 - fixtures/rails_3_2_12_no_init/config/application.rb
 - fixtures/rails_3_2_12_no_init/config/boot.rb
 - fixtures/rails_3_2_12_no_init/config/environment.rb
-- fixtures/rails_3_2_12_no_init/config/environments/development.rb
-- fixtures/rails_3_2_12_no_init/config/environments/production.rb
 - fixtures/rails_3_2_12_no_init/config/environments/test.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/backtrace_silencers.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/inflections.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/mime_types.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/secret_token.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/session_store.rb
-- fixtures/rails_3_2_12_no_init/config/initializers/wrap_parameters.rb
-- fixtures/rails_3_2_12_no_init/config/locales/en.yml
 - fixtures/rails_3_2_12_no_init/config/routes.rb
 - fixtures/rails_3_2_12_no_init/lib/assets/.gitkeep
 - fixtures/rails_3_2_12_no_init/lib/tasks/.gitkeep
@@ -119,24 +96,59 @@ files:
 - fixtures/rails_3_2_12_no_init/vendor/assets/javascripts/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
+- fixtures/rails_4_1_8/Gemfile
+- fixtures/rails_4_1_8/README.rdoc
+- fixtures/rails_4_1_8/Rakefile
+- fixtures/rails_4_1_8/app/controllers/application_controller.rb
+- fixtures/rails_4_1_8/app/controllers/concerns/.keep
+- fixtures/rails_4_1_8/app/controllers/other_things_controller.rb
+- fixtures/rails_4_1_8/app/controllers/things_controller.rb
+- fixtures/rails_4_1_8/app/models/.keep
+- fixtures/rails_4_1_8/app/models/concerns/.keep
+- fixtures/rails_4_1_8/app/views/layouts/application.html.erb
+- fixtures/rails_4_1_8/app/views/other_things/index.html.erb
+- fixtures/rails_4_1_8/app/views/things/index.html.erb
+- fixtures/rails_4_1_8/config.ru
+- fixtures/rails_4_1_8/config/application.rb
+- fixtures/rails_4_1_8/config/boot.rb
+- fixtures/rails_4_1_8/config/environment.rb
+- fixtures/rails_4_1_8/config/environments/test.rb
+- fixtures/rails_4_1_8/config/initializers/secure_headers.rb
+- fixtures/rails_4_1_8/config/routes.rb
+- fixtures/rails_4_1_8/config/script_hashes.yml
+- fixtures/rails_4_1_8/config/secrets.yml
+- fixtures/rails_4_1_8/lib/assets/.keep
+- fixtures/rails_4_1_8/lib/tasks/.keep
+- fixtures/rails_4_1_8/log/.keep
+- fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/controllers/things_controller_spec.rb
+- fixtures/rails_4_1_8/spec/spec_helper.rb
+- fixtures/rails_4_1_8/vendor/assets/javascripts/.keep
+- fixtures/rails_4_1_8/vendor/assets/stylesheets/.keep
 - lib/secure_headers.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/header.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
 - lib/secure_headers/headers/x_download_options.rb
 - lib/secure_headers/headers/x_frame_options.rb
+- lib/secure_headers/headers/x_permitted_cross_domain_policies.rb
 - lib/secure_headers/headers/x_xss_protection.rb
 - lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
 - lib/secure_headers/version.rb
+- lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
@@ -144,35 +156,37 @@ files:
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.1
+rubygems_version: 1.8.23
 signing_key: 
-specification_version: 4
-summary: Add easily configured browser headers to responses including content security
-  policy, x-frame-options, strict-transport-security and more.
+specification_version: 3
+summary: Add easily configured security headers to responses including content-security-policy,
+  x-frame-options, strict-transport-security, etc.
 test_files:
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb

checksums.yaml

@@ -1,15 +0,0 @@
----
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    NzcxMzdhM2IwMTAxN2IyNTc5OTg5OGY1MmJlZGFlNWJmNjBjM2MzMw==
-  data.tar.gz: !binary |-
-    ODNmNjA1YmY1ODEzMWIxYTU2YWYzYmY3NGFjM2Y1ZDU4MDQ0ODkwMQ==
-SHA512:
-  metadata.gz: !binary |-
-    NGEwNTVlZjBmMTcwN2QxYjI5YjVkZGJhZmJiYTJlY2M3YzEyM2JiN2Q3MzY0
-    NzdmNWNhMDIzMmVhNzNkZWRmZTZiYmQ1OWE5MjMwYTY2MDE1NGVhMWU3Mjg4
-    OTdmZTZiOGI0N2NhNGYzZThkMjc3ZWYxMjU5YzhiYTNjNmFmZjE=
-  data.tar.gz: !binary |-
-    MTI1NTNhYzExYjVmYjMwNjNjMGUzMDlmYmVmZTk1YjJiN2UwODM4MzYwNzhj
-    Y2ZhMzYxNTNkM2Y0MWY1YTQ1ZWMyYmQ4NDA3NjJhOGViNTU0MmEwYWY4MTNm
-    MTczMzNjOTliYWYzODFiY2RiNDZmOGQ2ZWU4ZjdiNWJhMTZlMzA=

data/Guardfile

@@ -1,6 +0,0 @@
-guard 'rspec' do
-  watch(%r{^spec/.+_spec\.rb$})
-  watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
-  watch(%r{^app/controllers/(.+)\.rb$})     { |m| "spec/controllers/#{m[1]}_spec.rb" }
-  watch('spec/spec_helper.rb')  { "spec" }
-end

data/HISTORY.md

@@ -1,162 +0,0 @@
-1.3.4
-======
-
-* Adds X-Download-Options support
-* Adds support for X-XSS-Protection reporting
-* Defers loading of rails engine for faster boot times
-
-1.3.3
-======
-
-@agl just made a new option for HSTS representing confirmation that a site wants to be included in a browser's preload list (https://hstspreload.appspot.com).
-
-This just adds a new 'preload' option to the HSTS settings to specify that option.
-
-1.3.2
-======
-
-Adds the ability to "tag" requests and a new config value: :app_name
-
-{
-  :tag_report_uri => true,
-  :enforce => true,
-  :app_name => 'twitter',
-  :report_uri => 'csp_reports'
-}
-
-Results in
-report-uri csp_reports?enforce=true&app_name=twitter
-
-
-1.3.1
-======
-
-Bugfix release: same-origin detection would error out when the URL containined invalid values (like |)
-
-1.3.0
-======
-
-- CSP nonce support was added back and is compliant.
-- Bugs:
--- enforce, disable_fill_missing, and disable_chrome_extension did not accept lambdas for no good reason
--- IF a default-src was specified, and an img-src was not, and disable_fill_missing was true, the img-src value would be :data
-
-1.2.0
-======
-- Allow procs to be used as config values.
-
-1.1.1
-======
-
-Bug fix release.
-- Parsing of CSP reports was busted.
-- Forwarded reports did not include the original referer, ip, UA
-
-1.1.0
-======
-
-- Remove brwsr dependency (no more runtime dependencies)
-- Stop serving X- prefixed CSP headers
-
-This change means that all requests get all headers, even if the browser doesn't grok it.
-
-1.0.0
-======
-
-Features:
-
-- Use non-prefixed header names for Firefox >= 23, Chrome >= 25
-- Use csp 1.0 compliant header for firefox >= 23
-
-Bug Fix:
-
-- Stop sending CSP on safari 5.1+
-
-0.5.0
-======
-
-- X-Content-Type-Options also applied to Chrome requests
-
-0.4.3
-======
-
-- Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
-
-0.4.2
-======
-
-- Stupid bug where Fixnums couldn't be used for config values
-- Doc updates
-
-0.4.1
-======
-
-- Allow strings or ints in the HSTS max-age (@reedloden)
-
-0.4.0
-=======
-
-- Treat each header as it's own before_filter. This allows you to `skip_before_filter :set_X_header, :only => :bad_idea
-- Should be backwards compatible, but it is a change to the API.
-
-0.3.0
-=======
-
-- Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
-
-0.2.3
-=======
-
-- Fix error in report-uri logic for Firefox forwarding.
-
-0.2.2
-=======
-
-- Stop applying chrome-extension: to Firefox directives.
-
-0.2.1
-=======
-
-- Firefox headers will now stop overriding report_uri when only a path is supplied
-
-0.2.0
-=======
-
-- 0.1.0 introduced a serious regression in which child controllers overwrote parent controller config values
-- Decoupling of CSP headers and the request object. Allows you to generate static values to save cycles:
-
-```ruby
-FIREFOX = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Firefox", :ssl => true).value
-CHROME = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Chrome", :ssl => true).value
-```
-- :forward_endpoint now acts as the endpoint that reports are forwarded to (when using the internal forwarder feature for cross-host reporting)
-- Skeleton applications have been added to test isolated application configurations
-- Cleanup by @bemurphy
-
-0.1.1
-=======
-
-Bug fix. Firefox doesn't seem to like the default-src directive, reverting back to 'allow'
-
-0.1.0
-=======
-
-Notes:
-------
-
-- Gem is renamed to secure_headers. This will make bundler happy. https://github.com/twitter/secureheaders/pull/26
-
-Features:
-------
-
-- ability to apply two headers, one in enforce mode, one in "experimental" mode https://github.com/twitter/secureheaders/pull/11
-- Rails 3.0 support https://github.com/twitter/secureheaders/pull/28
-
-Bug fixes, misc:
-------
-
-- Fix issue where settings in application_controller were ignored if no intializer was supplied https://github.com/twitter/secureheaders/pull/25
-- Better support for other frameworks, including docs from @achui, @bmaland
-- Rails 4 routes support from @jviney https://github.com/twitter/secureheaders/pull/13
-- data: automatically whitelisted for img-src
-- Doc updates from @ming13, @theverything, @dcollazo

data/app/controllers/content_security_policy_controller.rb

@@ -1,75 +0,0 @@
-require 'net/https'
-require 'openssl'
-
-class ContentSecurityPolicyController < ActionController::Base
-  CA_FILE = File.expand_path(File.join('..','..', '..', 'config', 'curl-ca-bundle.crt'), __FILE__)
-
-  def scribe
-    csp = ::SecureHeaders::Configuration.csp || {}
-
-    forward_endpoint = csp[:forward_endpoint]
-    if forward_endpoint
-      forward_params_to(forward_endpoint)
-    end
-
-    head :ok
-  rescue StandardError => e
-    log_warning(forward_endpoint, e)
-    head :bad_request
-  end
-
-  private
-
-  def forward_params_to(forward_endpoint)
-    uri = URI.parse(forward_endpoint)
-    http = Net::HTTP.new(uri.host, uri.port)
-    if uri.scheme == 'https'
-      use_ssl(http)
-    end
-
-    if request.content_type == "application/csp-report"
-      request.body.rewind
-      params.merge!(ActiveSupport::JSON.decode(request.body.read))
-    end
-
-    ua = request.user_agent
-    xff = forwarded_for
-
-    request = Net::HTTP::Post.new(uri.to_s)
-    request.initialize_http_header({
-      'User-Agent' => ua,
-      'X-Forwarded-For' => xff,
-      'Content-Type' => 'application/json',
-    })
-    request.body = params.to_json
-
-    # fire and forget
-    if defined?(Delayed::Job)
-      http.delay.request(request)
-    else
-      http.request(request)
-    end
-  end
-
-  def forwarded_for
-    req_xff = request.env["HTTP_X_FORWARDED_FOR"]
-    if req_xff && req_xff != ""
-      "#{req_xff}, #{request.remote_ip}"
-    else
-      request.remote_ip
-    end
-  end
-
-  def use_ssl request
-    request.use_ssl = true
-    request.ca_file = CA_FILE
-    request.verify_mode = OpenSSL::SSL::VERIFY_PEER
-    request.verify_depth = 9
-  end
-
-  def log_warning(forward_endpoint, e)
-    if defined?(Rails.logger)
-      Rails.logger.warn("Unable to POST CSP report to #{forward_endpoint} because #{e}")
-    end
-  end
-end