secure_headers 2.0.0.pre → 2.1.0

data/lib/secure_headers/headers/content_security_policy.rb

@@ -31,7 +31,13 @@ module SecureHeaders
         :reflected_xss
       ]
 
-      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
+      OTHER = [
+        :report_uri
+      ]
+
+      SOURCE_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
+
+      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES + OTHER
     end
     include Constants
 
@@ -102,7 +108,7 @@ module SecureHeaders
       @config = config.inject({}) do |hash, (key, value)|
         config_val = value.respond_to?(:call) ? value.call : value
 
-        if ALL_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
+        if SOURCE_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
           config_val = config_val.split if config_val.is_a? String
           if config_val.is_a?(Array)
             config_val = config_val.map do |val|

data/lib/secure_headers/headers/public_key_pins.rb

@@ -0,0 +1,95 @@
+module SecureHeaders
+  class PublicKeyPinsBuildError < StandardError; end
+  class PublicKeyPins < Header
+    module Constants
+      HPKP_HEADER_NAME = "Public-Key-Pins"
+      ENV_KEY = 'secure_headers.public_key_pins'
+      HASH_ALGORITHMS = [:sha256]
+      DIRECTIVES = [:max_age]
+    end
+    class << self
+      def symbol_to_hyphen_case sym
+        sym.to_s.gsub('_', '-')
+      end
+    end
+    include Constants
+
+    def initialize(config=nil)
+      @config = validate_config(config)
+
+      @pins = @config.fetch(:pins, nil)
+      @report_uri = @config.fetch(:report_uri, nil)
+      @app_name = @config.fetch(:app_name, nil)
+      @enforce = !!@config.fetch(:enforce, nil)
+      @include_subdomains = !!@config.fetch(:include_subdomains, nil)
+      @tag_report_uri = !!@config.fetch(:tag_report_uri, nil)
+    end
+
+    def name
+      base = HPKP_HEADER_NAME
+      if !@enforce
+        base += "-Report-Only"
+      end
+      base
+    end
+
+    def value
+      header_value = [
+        generic_directives,
+        pin_directives,
+        report_uri_directive,
+        subdomain_directive
+      ].compact.join('; ').strip
+    end
+
+    def validate_config(config)
+      raise PublicKeyPinsBuildError.new("config must be a hash.") unless config.is_a? Hash
+
+      if !config[:max_age]
+        raise PublicKeyPinsBuildError.new("max-age is a required directive.")
+      elsif config[:max_age].to_s !~ /\A\d+\z/
+        raise PublicKeyPinsBuildError.new("max-age must be a number.
+                                          #{config[:max_age]} was supplied.")
+      elsif config[:pins] && config[:pins].length < 2
+        raise PublicKeyPinsBuildError.new("A minimum of 2 pins are required.")
+      end
+
+      config
+    end
+
+    def pin_directives
+      return nil if @pins.nil?
+      @pins.collect do |pin|
+        pin.map do |token, hash|
+          "pin-#{token}=\"#{hash}\"" if HASH_ALGORITHMS.include?(token)
+        end
+      end.join('; ')
+    end
+
+    def generic_directives
+      DIRECTIVES.collect do |directive_name|
+        build_directive(directive_name) if @config[directive_name]
+      end.join('; ')
+    end
+
+    def build_directive(key)
+      "#{self.class.symbol_to_hyphen_case(key)}=#{@config[key]}"
+    end
+
+    def report_uri_directive
+      return nil if @report_uri.nil?
+
+      if @tag_report_uri
+        @report_uri = "#{@report_uri}?enforce=#{@enforce}"
+        @report_uri += "&app_name=#{@app_name}" if @app_name
+      end
+
+      "report-uri=\"#{@report_uri}\""
+    end
+
+
+    def subdomain_directive
+      @include_subdomains ? 'includeSubDomains' : nil
+    end
+  end
+end

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -0,0 +1,40 @@
+module SecureHeaders
+  class XPCDPBuildError < StandardError; end
+  class XPermittedCrossDomainPolicies < Header
+    module Constants
+      XPCDP_HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
+      DEFAULT_VALUE = 'none'
+      VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
+    end
+    include Constants
+
+    def initialize(config = nil)
+      @config = config
+      validate_config unless @config.nil?
+    end
+
+    def name
+      XPCDP_HEADER_NAME
+    end
+
+    def value
+      case @config
+      when NilClass
+        DEFAULT_VALUE
+      when String
+        @config
+      else
+        @config[:value]
+      end
+    end
+
+    private
+
+    def validate_config
+      value = @config.is_a?(Hash) ? @config[:value] : @config
+      unless VALID_POLICIES.include?(value.downcase)
+        raise XPCDPBuildError.new("Value can only be one of #{VALID_POLICIES.join(', ')}")
+      end
+    end
+  end
+end

data/lib/secure_headers/railtie.rb

@@ -3,9 +3,22 @@ if defined?(Rails::Railtie)
   module SecureHeaders
     class Railtie < Rails::Engine
       isolate_namespace ::SecureHeaders if defined? isolate_namespace # rails 3.0
+      conflicting_headers = ['X-Frame-Options', 'X-XSS-Protection', 'X-Content-Type-Options',
+                             'X-Permitted-Cross-Domain-Policies', 'X-Download-Options',
+                             'X-Content-Type-Options', 'Strict-Transport-Security',
+                             'Content-Security-Policy', 'Content-Security-Policy-Report-Only',
+                             'X-Permitted-Cross-Domain-Policies','Public-Key-Pins','Public-Key-Pins-Report-Only']
+
       initializer "secure_headers.action_controller" do
         ActiveSupport.on_load(:action_controller) do
           include ::SecureHeaders
+
+          unless Rails.application.config.action_dispatch.default_headers.nil?
+            conflicting_headers.each do |header|
+              Rails.application.config.action_dispatch.default_headers.delete(header)
+            end
+          end
+
         end
       end
     end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.0.0.pre"
+  VERSION = "2.1.0"
 end

data/lib/secure_headers/view_helper.rb

@@ -62,7 +62,7 @@ module SecureHeaders
 end
 
 module ActionView #:nodoc:
-  module Helpers #:nodoc:
+  class Base #:nodoc:
     include SecureHeaders::ViewHelpers
   end
 end

data/lib/secure_headers.rb

@@ -5,7 +5,8 @@ module SecureHeaders
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-        :x_xss_protection, :csp, :x_download_options, :script_hashes
+        :x_xss_protection, :csp, :x_download_options, :script_hashes,
+        :x_permitted_cross_domain_policies, :hpkp
 
       def configure &block
         instance_eval &block
@@ -41,11 +42,13 @@ module SecureHeaders
       self.secure_headers_options = options
       before_filter :prep_script_hash
       before_filter :set_hsts_header
+      before_filter :set_hpkp_header
       before_filter :set_x_frame_options_header
       before_filter :set_csp_header
       before_filter :set_x_xss_protection_header
       before_filter :set_x_content_type_options_header
       before_filter :set_x_download_options_header
+      before_filter :set_x_permitted_cross_domain_policies_header
     end
 
     # we can't use ||= because I'm overloading false => disable, nil => default
@@ -59,10 +62,12 @@ module SecureHeaders
     def set_security_headers(options = self.class.secure_headers_options)
       set_csp_header(request, options[:csp])
       set_hsts_header(options[:hsts])
+      set_hpkp_header(options[:hpkp])
       set_x_frame_options_header(options[:x_frame_options])
       set_x_xss_protection_header(options[:x_xss_protection])
       set_x_content_type_options_header(options[:x_content_type_options])
       set_x_download_options_header(options[:x_download_options])
+      set_x_permitted_cross_domain_policies_header(options[:x_permitted_cross_domain_policies])
     end
 
     # set_csp_header - uses the request accessor and SecureHeader::Configuration settings
@@ -133,10 +138,24 @@ module SecureHeaders
       set_a_header(:hsts, StrictTransportSecurity, options)
     end
 
+    def set_hpkp_header(options=self.class.secure_headers_options[:hpkp])
+      return unless request.ssl?
+      config = self.class.options_for :hpkp, options
+
+      return if config == false || config.nil?
+
+      hpkp_header = PublicKeyPins.new(config)
+      set_header(hpkp_header)
+    end
+
     def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
       set_a_header(:x_download_options, XDownloadOptions, options)
     end
 
+    def set_x_permitted_cross_domain_policies_header(options=self.class.secure_headers_options[:x_permitted_cross_domain_policies])
+      set_a_header(:x_permitted_cross_domain_policies, XPermittedCrossDomainPolicies, options)
+    end
+
     private
 
     def set_a_header(name, klass, options=nil)
@@ -161,12 +180,14 @@ end
 
 require "secure_headers/version"
 require "secure_headers/header"
+require "secure_headers/headers/public_key_pins"
 require "secure_headers/headers/content_security_policy"
 require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"
 require "secure_headers/headers/x_content_type_options"
 require "secure_headers/headers/x_download_options"
+require "secure_headers/headers/x_permitted_cross_domain_policies"
 require "secure_headers/railtie"
 require "secure_headers/hash_helper"
 require "secure_headers/view_helper"

data/secure_headers.gemspec

@@ -8,10 +8,10 @@ Gem::Specification.new do |gem|
   gem.version       = SecureHeaders::VERSION
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
-  gem.description   = %q{Add easily configured browser headers to responses.}
-  gem.summary       = %q{Add easily configured browser headers to responses
-    including content security policy, x-frame-options,
-    strict-transport-security and more.}
+  gem.description   = %q{Security related headers all in one gem.}
+  gem.summary       = %q{Add easily configured security headers to responses
+    including content-security-policy, x-frame-options,
+    strict-transport-security, etc.}
   gem.homepage      = "https://github.com/twitter/secureheaders"
   gem.license       = "Apache Public License 2.0"
   gem.files         = `git ls-files`.split($/)

data/spec/lib/secure_headers/headers/public_key_pins_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe PublicKeyPins do
+    specify{ expect(PublicKeyPins.new(:max_age => 1234).name).to eq("Public-Key-Pins-Report-Only") }
+    specify{ expect(PublicKeyPins.new(:max_age => 1234, :enforce => true).name).to eq("Public-Key-Pins") }
+
+    specify { expect(PublicKeyPins.new({:max_age => 1234}).value).to eq("max-age=1234")}
+    specify { expect(PublicKeyPins.new(:max_age => 1234).value).to eq("max-age=1234")}
+    specify {
+      config = {:max_age => 1234, :pins => [{:sha256 => 'base64encodedpin1'}, {:sha256 => 'base64encodedpin2'}]}
+      header_value = "max-age=1234; pin-sha256=\"base64encodedpin1\"; pin-sha256=\"base64encodedpin2\""
+      expect(PublicKeyPins.new(config).value).to eq(header_value)
+    }
+
+    context "with an invalid configuration" do
+      it "raises an exception when max-age is not provided" do
+        expect {
+          PublicKeyPins.new(:foo => 'bar')
+        }.to raise_error(PublicKeyPinsBuildError)
+      end
+
+      it "raises an exception with an invalid max-age" do
+        expect {
+          PublicKeyPins.new(:max_age => 'abc123')
+        }.to raise_error(PublicKeyPinsBuildError)
+      end
+
+      it 'raises an exception with less than 2 pins' do
+        expect {
+          config = {:max_age => 1234, :pins => [{:sha256 => 'base64encodedpin'}]}
+          PublicKeyPins.new(config)
+        }.to raise_error(PublicKeyPinsBuildError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/x_download_options_spec.rb

@@ -24,7 +24,7 @@ module SecureHeaders
 
       it "doesn't accept anything besides noopen" do
         expect {
-          XContentTypeOptions.new("open")
+          XDownloadOptions.new("open")
         }.to raise_error
       end
     end

data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb

@@ -0,0 +1,64 @@
+module SecureHeaders
+  describe XPermittedCrossDomainPolicies do
+    specify { expect(XPermittedCrossDomainPolicies.new.name).to eq(XPermittedCrossDomainPolicies::Constants::XPCDP_HEADER_NAME)}
+    specify { expect(XPermittedCrossDomainPolicies.new.value).to eq("none")}
+    specify { expect(XPermittedCrossDomainPolicies.new('master-only').value).to eq('master-only')}
+    specify { expect(XPermittedCrossDomainPolicies.new(:value => 'master-only').value).to eq('master-only') }
+
+    context "valid configuration values" do
+      it "accepts 'all'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("all")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "all")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-ftp-filename'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-ftp-filename")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-ftp-filename")
+        }.not_to raise_error
+      end
+
+      it "accepts 'by-content-type'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("by-content-type")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "by-content-type")
+        }.not_to raise_error
+      end
+      it "accepts 'master-only'" do
+        expect {
+          XPermittedCrossDomainPolicies.new("master-only")
+        }.not_to raise_error
+
+        expect {
+          XPermittedCrossDomainPolicies.new(:value => "master-only")
+        }.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect {
+          XPermittedCrossDomainPolicies.new
+        }.not_to raise_error
+      end
+    end
+
+    context 'invlaid configuration values' do
+
+      it "doesn't accept invalid values" do
+        expect {
+          XPermittedCrossDomainPolicies.new("open")
+        }.to raise_error
+      end
+    end
+  end
+end

data/spec/lib/secure_headers_spec.rb

@@ -18,34 +18,32 @@ describe SecureHeaders do
     allow(subject).to receive(:request).and_return(request)
   end
 
-  ALL_HEADERS = Hash[[:hsts, :csp, :x_frame_options, :x_content_type_options, :x_xss_protection].map{|header| [header, false]}]
-
   def stub_user_agent val
     allow(request).to receive_message_chain(:env, :[]).and_return(val)
   end
 
-  def options_for header
-    ALL_HEADERS.reject{|k,v| k == header}
-  end
-
   def reset_config
     ::SecureHeaders::Configuration.configure do |config|
+      config.hpkp = nil
       config.hsts = nil
       config.x_frame_options = nil
       config.x_content_type_options = nil
       config.x_xss_protection = nil
       config.csp = nil
       config.x_download_options = nil
+      config.x_permitted_cross_domain_policies = nil
     end
   end
 
   def set_security_headers(subject)
     subject.set_csp_header
+    subject.set_hpkp_header
     subject.set_hsts_header
     subject.set_x_frame_options_header
     subject.set_x_content_type_options_header
     subject.set_x_xss_protection_header
     subject.set_x_download_options_header
+    subject.set_x_permitted_cross_domain_policies_header
   end
 
   describe "#set_header" do
@@ -64,14 +62,16 @@ describe SecureHeaders do
     USER_AGENTS.each do |name, useragent|
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
-        number_of_headers = 6
+        number_of_headers = 7
         expect(subject).to receive(:set_header).exactly(number_of_headers).times # a request for a given header
         subject.set_csp_header
         subject.set_x_frame_options_header
         subject.set_hsts_header
+        subject.set_hpkp_header
         subject.set_x_xss_protection_header
         subject.set_x_content_type_options_header
         subject.set_x_download_options_header
+        subject.set_x_permitted_cross_domain_policies_header
       end
     end
 
@@ -96,6 +96,11 @@ describe SecureHeaders do
       subject.set_x_frame_options_header(false)
     end
 
+    it "does not set the X-Permitted-Cross-Domain-Policies header if disabled" do
+      should_not_assign_header(XPCDP_HEADER_NAME)
+      subject.set_x_permitted_cross_domain_policies_header(false)
+    end
+
     it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
@@ -107,6 +112,17 @@ describe SecureHeaders do
       subject.set_hsts_header({:include_subdomains => true})
     end
 
+    it "does not set the HPKP header if disabled" do
+      should_not_assign_header(HPKP_HEADER_NAME)
+      subject.set_hpkp_header
+    end
+
+    it "does not set the HPKP header if request is over HTTP" do
+      allow(subject).to receive_message_chain(:request, :ssl?).and_return(false)
+      should_not_assign_header(HPKP_HEADER_NAME)
+      subject.set_hpkp_header(:max_age => 1234)
+    end
+
     it "does not set the CSP header if disabled" do
       stub_user_agent(USER_AGENTS[:chrome])
       should_not_assign_header(HEADER_NAME)
@@ -128,11 +144,13 @@ describe SecureHeaders do
       it "does not set any headers when disabled" do
         ::SecureHeaders::Configuration.configure do |config|
           config.hsts = false
+          config.hpkp = false
           config.x_frame_options = false
           config.x_content_type_options = false
           config.x_xss_protection = false
           config.csp = false
           config.x_download_options = false
+          config.x_permitted_cross_domain_policies = false
         end
         expect(subject).not_to receive(:set_header)
         set_security_headers(subject)
@@ -187,6 +205,38 @@ describe SecureHeaders do
     end
   end
 
+  describe "#set_public_key_pins" do
+    it "sets the Public-Key-Pins header" do
+      should_assign_header(HPKP_HEADER_NAME + "-Report-Only", "max-age=1234")
+      subject.set_hpkp_header(:max_age => 1234)
+    end
+
+    it "allows you to enforce public key pinning" do
+      should_assign_header(HPKP_HEADER_NAME, "max-age=1234")
+      subject.set_hpkp_header(:max_age => 1234, :enforce => true)
+    end
+
+    it "allows you to specific a custom max-age value" do
+      should_assign_header(HPKP_HEADER_NAME + "-Report-Only", 'max-age=1234')
+      subject.set_hpkp_header(:max_age => 1234)
+    end
+
+    it "allows you to specify includeSubdomains" do
+      should_assign_header(HPKP_HEADER_NAME, "max-age=1234; includeSubDomains")
+      subject.set_hpkp_header(:max_age => 1234, :include_subdomains => true, :enforce => true)
+    end
+
+    it "allows you to specify a report-uri" do
+      should_assign_header(HPKP_HEADER_NAME, "max-age=1234; report-uri=\"https://foobar.com\"")
+      subject.set_hpkp_header(:max_age => 1234, :report_uri => "https://foobar.com", :enforce => true)
+    end
+
+    it "allows you to specify a report-uri with app_name" do
+      should_assign_header(HPKP_HEADER_NAME, "max-age=1234; report-uri=\"https://foobar.com?enforce=true&app_name=my_app\"")
+      subject.set_hpkp_header(:max_age => 1234, :report_uri => "https://foobar.com", :app_name => "my_app", :tag_report_uri => true, :enforce => true)
+    end
+  end
+
   describe "#set_x_xss_protection" do
     it "sets the X-XSS-Protection header" do
       should_assign_header(X_XSS_PROTECTION_HEADER_NAME, SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
@@ -249,4 +299,16 @@ describe SecureHeaders do
       end
     end
   end
+
+  describe "#set_x_permitted_cross_domain_policies_header" do
+    it "sets the X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+      subject.set_x_permitted_cross_domain_policies_header
+    end
+
+    it "allows a custom X-Permitted-Cross-Domain-Policies header" do
+      should_assign_header(XPCDP_HEADER_NAME, "master-only")
+      subject.set_x_permitted_cross_domain_policies_header(:value => 'master-only')
+    end
+  end
 end

data/spec/spec_helper.rb

@@ -7,12 +7,14 @@ if defined?(Coveralls)
   Coveralls.wear!
 end
 
+include ::SecureHeaders::PublicKeyPins::Constants
 include ::SecureHeaders::StrictTransportSecurity::Constants
 include ::SecureHeaders::ContentSecurityPolicy::Constants
 include ::SecureHeaders::XFrameOptions::Constants
 include ::SecureHeaders::XXssProtection::Constants
 include ::SecureHeaders::XContentTypeOptions::Constants
 include ::SecureHeaders::XDownloadOptions::Constants
+include ::SecureHeaders::XPermittedCrossDomainPolicies::Constants
 
 USER_AGENTS = {
   :firefox => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',