secure_headers 1.4.1 → 2.0.0.pre2

data/spec/lib/secure_headers_spec.rb

@@ -18,26 +18,7 @@ describe SecureHeaders do
     allow(subject).to receive(:request).and_return(request)
   end
 
-  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
-  USER_AGENTS = {
-    :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
-    :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
-    :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
-    :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
-    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
-    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
-    :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
-  }
-
-  def should_assign_header name, value
-    expect(response.headers).to receive(:[]=).with(name, value)
-  end
-
-  def should_not_assign_header name
-    expect(response.headers).not_to receive(:[]=).with(name, anything)
-  end
+  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection, :x_permitted_cross_domain_policies].map{|header| [header, false]}]
 
   def stub_user_agent val
     allow(request).to receive_message_chain(:env, :[]).and_return(val)
@@ -55,6 +36,7 @@ describe SecureHeaders do
       config.x_xss_protection = nil
       config.csp = nil
       config.x_download_options = nil
+      config.x_permitted_cross_domain_policies = nil
     end
   end
 
@@ -65,14 +47,7 @@ describe SecureHeaders do
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
     subject.set_x_download_options_header
-  end
-
-  describe "#ensure_security_headers" do
-    it "sets a before filter" do
-      options = {}
-      expect(DummyClass).to receive(:before_filter).exactly(6).times
-      DummyClass.ensure_security_headers(options)
-    end
+    subject.set_x_permitted_cross_domain_policies_header
   end
 
   describe "#set_header" do
@@ -88,13 +63,10 @@ describe SecureHeaders do
   end
 
   describe "#set_security_headers" do
-    before(:each) do
-      allow(SecureHeaders::ContentSecurityPolicy).to receive(:new).and_return(double.as_null_object)
-    end
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 6
+        number_of_headers = 7
         expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
@@ -102,6 +74,7 @@ describe SecureHeaders do
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
         subject.set_x_download_options_header
+        subject.set_x_permitted_cross_domain_policies_header
       end
     end
 
@@ -126,6 +99,11 @@ describe SecureHeaders do
       subject.set_x_frame_options_header(false)
     end
 
+    it "does not set the X-Permitted-Cross-Domain-Policies header if disabled" do
+      should_not_assign_header(XPCDP_HEADER_NAME)
+      subject.set_x_permitted_cross_domain_policies_header(false)
+    end
+
     it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
@@ -139,8 +117,19 @@ describe SecureHeaders do
 
     it "does not set the CSP header if disabled" do
       stub_user_agent(USER_AGENTS[:chrome])
-      should_not_assign_header(STANDARD_HEADER_NAME)
-      subject.set_csp_header(options_for(:csp).merge(:csp => false))
+      should_not_assign_header(HEADER_NAME)
+      subject.set_csp_header(false)
+    end
+
+    it "saves the options to the env when using script hashes" do
+      opts = {
+        :default_src => 'self',
+        :script_hash_middleware => true
+      }
+      stub_user_agent(USER_AGENTS[:chrome])
+
+      expect(SecureHeaders::ContentSecurityPolicy).to receive(:add_to_env)
+      subject.set_csp_header(opts)
     end
 
     context "when disabled by configuration settings" do
@@ -152,6 +141,7 @@ describe SecureHeaders do
           config.x_xss_protection = false
           config.csp = false
           config.x_download_options = false
+          config.x_permitted_cross_domain_policies = false
         end
         expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
@@ -247,7 +237,7 @@ describe SecureHeaders do
     context "when using Firefox" do
       it "sets CSP headers" do
         stub_user_agent(USER_AGENTS[:firefox])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -255,7 +245,7 @@ describe SecureHeaders do
     context "when using Chrome" do
       it "sets default CSP header" do
         stub_user_agent(USER_AGENTS[:chrome])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
@@ -263,36 +253,21 @@ describe SecureHeaders do
     context "when using a browser besides chrome/firefox" do
       it "sets the CSP header" do
         stub_user_agent(USER_AGENTS[:opera])
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
+        should_assign_header(HEADER_NAME + "-Report-Only", DEFAULT_CSP_HEADER)
         subject.set_csp_header
       end
     end
+  end
 
-    context "when using the experimental key" do
-      before(:each) do
-        stub_user_agent(USER_AGENTS[:chrome])
-        @opts = {
-          :enforce => true,
-          :default_src => 'self',
-          :script_src => 'https://mycdn.example.com',
-          :experimental => {
-            :script_src => 'self',
-          }
-        }
-      end
-
-      it "does not set the header in enforce mode if experimental is supplied, but enforce is disabled" do
-        opts = @opts.merge(:enforce => false)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        should_not_assign_header(STANDARD_HEADER_NAME)
-        subject.set_csp_header(opts)
-      end
+  describe "#set_x_permitted_cross_domain_policies_header" do
+    it "sets the X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+      subject.set_x_permitted_cross_domain_policies_header
+    end
 
-      it "sets a header in enforce mode as well as report-only mode" do
-        should_assign_header(STANDARD_HEADER_NAME, anything)
-        should_assign_header(STANDARD_HEADER_NAME + "-Report-Only", anything)
-        subject.set_csp_header(@opts)
-      end
+    it "allows a custom X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, "master-only")
+      subject.set_x_permitted_cross_domain_policies_header(:value => 'master-only')
     end
   end
 end

data/spec/spec_helper.rb

@@ -2,10 +2,35 @@ require 'rubygems'
 require 'rspec'
 
 require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
-require File.join(File.dirname(__FILE__), '..', 'app', 'controllers', 'content_security_policy_controller')
+
+if defined?(Coveralls)
+  Coveralls.wear!
+end
+
 include ::SecureHeaders::StrictTransportSecurity::Constants
 include ::SecureHeaders::ContentSecurityPolicy::Constants
 include ::SecureHeaders::XFrameOptions::Constants
 include ::SecureHeaders::XXssProtection::Constants
 include ::SecureHeaders::XContentTypeOptions::Constants
 include ::SecureHeaders::XDownloadOptions::Constants
+include ::SecureHeaders::XPermittedCrossDomainPolicies::Constants
+
+USER_AGENTS = {
+  :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
+  :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
+  :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
+  :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
+  :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+  :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+  :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+  :safari5_1 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
+  :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+}
+
+def should_assign_header name, value
+  expect(response.headers).to receive(:[]=).with(name, value)
+end
+
+def should_not_assign_header name
+  expect(response.headers).not_to receive(:[]=).with(name, anything)
+end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.4.1
-  prerelease: 
+  version: 2.0.0.pre2
+  prerelease: 6
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-08 00:00:00.000000000 Z
+date: 2014-12-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -27,7 +27,7 @@ dependencies:
     - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
-description: Add easily configured browser headers to responses.
+description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
 executables: []
@@ -39,13 +39,10 @@ files:
 - .ruby-version
 - .travis.yml
 - Gemfile
-- HISTORY.md
+- Guardfile
 - LICENSE
 - README.md
 - Rakefile
-- app/controllers/content_security_policy_controller.rb
-- config/curl-ca-bundle.crt
-- config/routes.rb
 - fixtures/rails_3_2_12/.rspec
 - fixtures/rails_3_2_12/Gemfile
 - fixtures/rails_3_2_12/README.rdoc
@@ -64,6 +61,7 @@ files:
 - fixtures/rails_3_2_12/config/environments/test.rb
 - fixtures/rails_3_2_12/config/initializers/secure_headers.rb
 - fixtures/rails_3_2_12/config/routes.rb
+- fixtures/rails_3_2_12/config/script_hashes.yml
 - fixtures/rails_3_2_12/lib/assets/.gitkeep
 - fixtures/rails_3_2_12/lib/tasks/.gitkeep
 - fixtures/rails_3_2_12/log/.gitkeep
@@ -100,23 +98,29 @@ files:
 - fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
 - fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
 - lib/secure_headers.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/header.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
 - lib/secure_headers/headers/x_download_options.rb
 - lib/secure_headers/headers/x_frame_options.rb
+- lib/secure_headers/headers/x_permitted_cross_domain_policies.rb
 - lib/secure_headers/headers/x_xss_protection.rb
 - lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
 - lib/secure_headers/version.rb
+- lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
@@ -137,23 +141,24 @@ required_ruby_version: !ruby/object:Gem::Requirement
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
-  - - ! '>='
+  - - ! '>'
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.23
 signing_key: 
 specification_version: 3
-summary: Add easily configured browser headers to responses including content security
-  policy, x-frame-options, strict-transport-security and more.
+summary: Add easily configured security headers to responses including content-security-policy,
+  x-frame-options, strict-transport-security, etc.
 test_files:
-- spec/controllers/content_security_policy_controller_spec.rb
+- spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
 - spec/lib/secure_headers/headers/x_frame_options_spec.rb
+- spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb

data/HISTORY.md

@@ -1,162 +0,0 @@
-1.3.4
-======
-
-* Adds X-Download-Options support
-* Adds support for X-XSS-Protection reporting
-* Defers loading of rails engine for faster boot times
-
-1.3.3
-======
-
-@agl just made a new option for HSTS representing confirmation that a site wants to be included in a browser's preload list (https://hstspreload.appspot.com).
-
-This just adds a new 'preload' option to the HSTS settings to specify that option.
-
-1.3.2
-======
-
-Adds the ability to "tag" requests and a new config value: :app_name
-
-{
-  :tag_report_uri => true,
-  :enforce => true,
-  :app_name => 'twitter',
-  :report_uri => 'csp_reports'
-}
-
-Results in
-report-uri csp_reports?enforce=true&app_name=twitter
-
-
-1.3.1
-======
-
-Bugfix release: same-origin detection would error out when the URL containined invalid values (like |)
-
-1.3.0
-======
-
-- CSP nonce support was added back and is compliant.
-- Bugs:
--- enforce, disable_fill_missing, and disable_chrome_extension did not accept lambdas for no good reason
--- IF a default-src was specified, and an img-src was not, and disable_fill_missing was true, the img-src value would be :data
-
-1.2.0
-======
-- Allow procs to be used as config values.
-
-1.1.1
-======
-
-Bug fix release.
-- Parsing of CSP reports was busted.
-- Forwarded reports did not include the original referer, ip, UA
-
-1.1.0
-======
-
-- Remove brwsr dependency (no more runtime dependencies)
-- Stop serving X- prefixed CSP headers
-
-This change means that all requests get all headers, even if the browser doesn't grok it.
-
-1.0.0
-======
-
-Features:
-
-- Use non-prefixed header names for Firefox >= 23, Chrome >= 25
-- Use csp 1.0 compliant header for firefox >= 23
-
-Bug Fix:
-
-- Stop sending CSP on safari 5.1+
-
-0.5.0
-======
-
-- X-Content-Type-Options also applied to Chrome requests
-
-0.4.3
-======
-
-- Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
-
-0.4.2
-======
-
-- Stupid bug where Fixnums couldn't be used for config values
-- Doc updates
-
-0.4.1
-======
-
-- Allow strings or ints in the HSTS max-age (@reedloden)
-
-0.4.0
-=======
-
-- Treat each header as it's own before_filter. This allows you to `skip_before_filter :set_X_header, :only => :bad_idea
-- Should be backwards compatible, but it is a change to the API.
-
-0.3.0
-=======
-
-- Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
-
-0.2.3
-=======
-
-- Fix error in report-uri logic for Firefox forwarding.
-
-0.2.2
-=======
-
-- Stop applying chrome-extension: to Firefox directives.
-
-0.2.1
-=======
-
-- Firefox headers will now stop overriding report_uri when only a path is supplied
-
-0.2.0
-=======
-
-- 0.1.0 introduced a serious regression in which child controllers overwrote parent controller config values
-- Decoupling of CSP headers and the request object. Allows you to generate static values to save cycles:
-
-```ruby
-FIREFOX = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Firefox", :ssl => true).value
-CHROME = SecureHeaders::ContentSecurityPolicy.new(config, :ua => "Chrome", :ssl => true).value
-```
-- :forward_endpoint now acts as the endpoint that reports are forwarded to (when using the internal forwarder feature for cross-host reporting)
-- Skeleton applications have been added to test isolated application configurations
-- Cleanup by @bemurphy
-
-0.1.1
-=======
-
-Bug fix. Firefox doesn't seem to like the default-src directive, reverting back to 'allow'
-
-0.1.0
-=======
-
-Notes:
-------
-
-- Gem is renamed to secure_headers. This will make bundler happy. https://github.com/twitter/secureheaders/pull/26
-
-Features:
-------
-
-- ability to apply two headers, one in enforce mode, one in "experimental" mode https://github.com/twitter/secureheaders/pull/11
-- Rails 3.0 support https://github.com/twitter/secureheaders/pull/28
-
-Bug fixes, misc:
-------
-
-- Fix issue where settings in application_controller were ignored if no intializer was supplied https://github.com/twitter/secureheaders/pull/25
-- Better support for other frameworks, including docs from @achui, @bmaland
-- Rails 4 routes support from @jviney https://github.com/twitter/secureheaders/pull/13
-- data: automatically whitelisted for img-src
-- Doc updates from @ming13, @theverything, @dcollazo

data/app/controllers/content_security_policy_controller.rb

@@ -1,76 +0,0 @@
-require 'net/https'
-require 'openssl'
-
-class ContentSecurityPolicyController < ActionController::Base
-  CA_FILE = File.expand_path(File.join('..','..', '..', 'config', 'curl-ca-bundle.crt'), __FILE__)
-
-  def scribe
-    warn "[DEPRECATION] ContentSecurityPolicyController is removed in 2.0"
-    csp = ::SecureHeaders::Configuration.csp || {}
-
-    forward_endpoint = csp[:forward_endpoint]
-    if forward_endpoint
-      forward_params_to(forward_endpoint)
-    end
-
-    head :ok
-  rescue StandardError => e
-    log_warning(forward_endpoint, e)
-    head :bad_request
-  end
-
-  private
-
-  def forward_params_to(forward_endpoint)
-    uri = URI.parse(forward_endpoint)
-    http = Net::HTTP.new(uri.host, uri.port)
-    if uri.scheme == 'https'
-      use_ssl(http)
-    end
-
-    if request.content_type == "application/csp-report"
-      request.body.rewind
-      params.merge!(ActiveSupport::JSON.decode(request.body.read))
-    end
-
-    ua = request.user_agent
-    xff = forwarded_for
-
-    request = Net::HTTP::Post.new(uri.to_s)
-    request.initialize_http_header({
-      'User-Agent' => ua,
-      'X-Forwarded-For' => xff,
-      'Content-Type' => 'application/json',
-    })
-    request.body = params.to_json
-
-    # fire and forget
-    if defined?(Delayed::Job)
-      http.delay.request(request)
-    else
-      http.request(request)
-    end
-  end
-
-  def forwarded_for
-    req_xff = request.env["HTTP_X_FORWARDED_FOR"]
-    if req_xff && req_xff != ""
-      "#{req_xff}, #{request.remote_ip}"
-    else
-      request.remote_ip
-    end
-  end
-
-  def use_ssl request
-    request.use_ssl = true
-    request.ca_file = CA_FILE
-    request.verify_mode = OpenSSL::SSL::VERIFY_PEER
-    request.verify_depth = 9
-  end
-
-  def log_warning(forward_endpoint, e)
-    if defined?(Rails.logger)
-      Rails.logger.warn("Unable to POST CSP report to #{forward_endpoint} because #{e}")
-    end
-  end
-end