secure_headers 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8e454769ab715d2e94e5451190e7ef8679810ec0
-  data.tar.gz: 9f0fd48b03bd3e8f5a60b85894492a4a9aee08a0
+  metadata.gz: 2ea3335e72b8eaea53c9fc03a77c008b73fc674c
+  data.tar.gz: 4097b301e8e7f18174abda1c6412f9652cd4c39a
 SHA512:
-  metadata.gz: 9ace533baba91512c2d8b15f12ed188d93feda9b20f7e682caaa740d413b1428e9c39deb2c2fbba4aec6462093f54126de9ca8cc5268d5b8d98851c82876fa6d
-  data.tar.gz: 9b5e12226b456e4983eb31cd75f48ccadf34d80d125ff0fb67ee84afe56f3ca3a682890213e20e2c24e2c715073c0284b4ab8fc3fc86ad722c7ae6d08c0bb207
+  metadata.gz: 53db0ad5f6d9e7a85bde9aa167a927e3bda91351ce2f57af0f505d1b6c0856ca50b295ad87e26c1b25fa0142a95d8ef8b11f12f562377e60a0b398454abdd5b9
+  data.tar.gz: a6c3c2366fcf08ed3749f6c6e9146e2fbc33fb167a504404e195bd9813c709b0d497c2c2fc64f138a482a5fcc68eb4d212895761722ae0beed4b49ccea481e81

data/.travis.yml

@@ -4,7 +4,6 @@ rvm:
   - "2.1"
   - "2.0.0"
   - "1.9.3"
-  - "1.8.7"
   - "jruby-19mode"
 
 sudo: false

data/Gemfile

@@ -10,6 +10,6 @@ group :test do
   gem 'rspec', '>= 3.1'
   gem 'growl'
   gem 'rb-fsevent'
-  gem 'coveralls', :platforms => [:ruby_19]
+  gem 'coveralls', :platforms => [:ruby_19, :ruby_20, :ruby_21]
   gem 'i18n', '< 0.7.0', :platforms => [:ruby_18]
 end

data/README.md

@@ -49,7 +49,7 @@ This gem makes a few assumptions about how you will use some features.  For exam
   config.x_permitted_cross_domain_policies = 'none'
   config.csp = {
     :default_src => "https: self",
-    :enforce => proc {|controller| contoller.current_user.enforce_csp? }
+    :enforce => proc {|controller| controller.current_user.enforce_csp? },
     :frame_src => "https: http:.twimg.com http://itunes.apple.com",
     :img_src => "https:",
     :report_uri => '//example.com/uri-directive'
@@ -415,12 +415,43 @@ def before_load
 end
 ```
 
+### Using in rack middleware
+
+The `SecureHeaders::header_hash` generates a hash of all header values, which is useful for merging with rack middleware values.
+
+```ruby
+class MySecureHeaders
+  include SecureHeaders
+  def initialize(app)
+  @app = app
+ end
+
+ def call(env)
+   status, headers, response = @app.call(env)
+   security_headers = if override?
+     SecureHeaders::header_hash(:csp => false) # uses global config, but overrides CSP config
+   else
+     SecureHeaders::header_hash # uses global config
+   end
+   [status, headers.merge(security_headers), [response.body]]
+ end
+end
+
+module Testapp
+  class Application < Rails::Application
+    config.middleware.use MySecureHeaders
+  end
+end
+```
+
 ## Similar libraries
 
+* Rack [rack-secure_headers](https://github.com/harmoni/rack-secure_headers)
 * Node.js (express) [helmet](https://github.com/evilpacket/helmet) and [hood](https://github.com/seanmonstar/hood)
-* J2EE Servlet >= 3.0 [highlines](https://github.com/sourceclear/headlines)
+* Node.js (hapi) [blankie](https://github.com/nlf/blankie)
+* J2EE Servlet >= 3.0 [headlines](https://github.com/sourceclear/headlines)
 * ASP.NET - [NWebsec](https://github.com/NWebsec/NWebsec/wiki)
-* Python - [django-csp](https://github.com/mozilla/django-csp/) + [commonware](https://github.com/jsocol/commonware/)
+* Python - [django-csp](https://github.com/mozilla/django-csp) + [commonware](https://github.com/jsocol/commonware/); [django-security](https://github.com/sdelements/django-security)
 * Go - [secureheader](https://github.com/kr/secureheader)
 
 ## Authors

data/fixtures/rails_3_2_12/spec/controllers/other_things_controller_spec.rb

@@ -13,7 +13,7 @@ describe OtherThingsController, :type => :controller do
     options = opts.merge(
       {
         'HTTPS' => 'on',
-        'HTTP_USER_AGENT' => "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        'HTTP_USER_AGENT' => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
       }
     )
 

data/fixtures/rails_3_2_12_no_init/app/controllers/other_things_controller.rb

@@ -3,4 +3,18 @@ class OtherThingsController < ApplicationController
   def index
 
   end
+
+  def other_action
+    render :text => 'yooooo'
+  end
+
+  def secure_header_options_for(header, options)
+    if params[:action] == "other_action"
+      if header == :csp
+        options.merge(:style_src => 'self')
+      end
+    else
+      options
+    end
+  end
 end

data/fixtures/rails_3_2_12_no_init/spec/controllers/other_things_controller_spec.rb

@@ -12,11 +12,17 @@ describe OtherThingsController, :type => :controller do
       expect(response.headers['X-Frame-Options']).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
     end
 
-    it "sets the X-WebKit-CSP header" do
+    it "sets the CSP header" do
       get :index
       expect(response.headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; img-src 'self' data:;")
     end
 
+    it "sets per-action values based on secure_header_options_for" do
+      # munges :style_src => self into policy
+      get :other_action
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; img-src 'self' data:; style-src 'self';")
+    end
+
     #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'

data/fixtures/rails_4_1_8/app/controllers/other_things_controller.rb

@@ -2,4 +2,4 @@ class OtherThingsController < ApplicationController
   def index
 
   end
-end
+end

data/fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb

@@ -13,7 +13,7 @@ describe OtherThingsController, :type => :controller do
     options = opts.merge(
       {
         'HTTPS' => 'on',
-        'HTTP_USER_AGENT' => "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        'HTTP_USER_AGENT' => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
       }
     )
 

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,6 +1,8 @@
 require 'uri'
 require 'base64'
 require 'securerandom'
+require 'user_agent_parser'
+require 'json'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
@@ -38,7 +40,9 @@ module SecureHeaders
       SOURCE_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
 
       ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES + OTHER
+      CONFIG_KEY = :csp
     end
+
     include Constants
 
     attr_reader :disable_fill_missing, :ssl_request
@@ -127,6 +131,7 @@ module SecureHeaders
 
       @disable_fill_missing = !!@config.delete(:disable_fill_missing)
       @enforce = !!@config.delete(:enforce)
+      @disable_img_src_data_uri = !!@config.delete(:disable_img_src_data_uri)
       @tag_report_uri = !!@config.delete(:tag_report_uri)
       @script_hashes = @config.delete(:script_hashes) || []
 
@@ -164,6 +169,21 @@ module SecureHeaders
       end
     end
 
+    def to_json
+      build_value
+      @config.to_json.gsub(/(\w+)_src/, "\\1-src")
+    end
+
+    def self.from_json(*json_configs)
+      json_configs.inject({}) do |combined_config, one_config|
+        one_config = one_config.gsub(/(\w+)-src/, "\\1_src")
+        config = JSON.parse(one_config, :symbolize_names => true)
+        combined_config.merge(config) do |_, lhs, rhs|
+          lhs | rhs
+        end
+      end
+    end
+
     private
 
     def add_script_hashes
@@ -205,8 +225,12 @@ module SecureHeaders
       elsif %{self none}.include?(val)
         "'#{val}'"
       elsif val == 'nonce'
-        self.class.set_nonce(@controller, nonce)
-        ["'nonce-#{nonce}'", "'unsafe-inline'"]
+        if supports_nonces?(@ua)
+          self.class.set_nonce(@controller, nonce)
+          ["'nonce-#{nonce}'", "'unsafe-inline'"]
+        else
+          "'unsafe-inline'"
+        end
       else
         val
       end
@@ -233,10 +257,11 @@ module SecureHeaders
 
     def generic_directives
       header_value = ''
+      data_uri = @disable_img_src_data_uri ? [] : ["data:"]
       if @config[:img_src]
-        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
+        @config[:img_src] = @config[:img_src] + data_uri unless @config[:img_src].include?('data:')
       else
-        @config[:img_src] = @config[:default_src] + ['data:']
+        @config[:img_src] = @config[:default_src] + data_uri
       end
 
       DIRECTIVES.each do |directive_name|
@@ -258,5 +283,10 @@ module SecureHeaders
     def build_directive(key)
       "#{self.class.symbol_to_hyphen_case(key)} #{@config[key].join(" ")}; "
     end
+
+    def supports_nonces?(user_agent)
+      parsed_ua = UserAgentParser.parse(user_agent)
+      ["Chrome", "Opera", "Firefox"].include?(parsed_ua.family)
+    end
   end
 end

data/lib/secure_headers/headers/public_key_pins.rb

@@ -6,6 +6,7 @@ module SecureHeaders
       ENV_KEY = 'secure_headers.public_key_pins'
       HASH_ALGORITHMS = [:sha256]
       DIRECTIVES = [:max_age]
+      CONFIG_KEY = :hpkp
     end
     class << self
       def symbol_to_hyphen_case sym

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -8,6 +8,7 @@ module SecureHeaders
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
       VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
+      CONFIG_KEY = :hsts
     end
     include Constants
 

data/lib/secure_headers/headers/x_content_type_options.rb

@@ -5,6 +5,7 @@ module SecureHeaders
     module Constants
       X_CONTENT_TYPE_OPTIONS_HEADER_NAME = "X-Content-Type-Options"
       DEFAULT_VALUE = "nosniff"
+      CONFIG_KEY = :x_content_type_options
     end
     include Constants
 
@@ -37,4 +38,4 @@ module SecureHeaders
       end
     end
   end
-end
+end

data/lib/secure_headers/headers/x_download_options.rb

@@ -4,6 +4,7 @@ module SecureHeaders
     module Constants
       XDO_HEADER_NAME = "X-Download-Options"
       DEFAULT_VALUE = 'noopen'
+      CONFIG_KEY = :x_download_options
     end
     include Constants
 

data/lib/secure_headers/headers/x_frame_options.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       XFO_HEADER_NAME = "X-Frame-Options"
       DEFAULT_VALUE = 'SAMEORIGIN'
       VALID_XFO_HEADER = /\A(SAMEORIGIN\z|DENY\z|ALLOW-FROM[:\s])/i
+      CONFIG_KEY = :x_frame_options
     end
     include Constants
 

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       XPCDP_HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
       DEFAULT_VALUE = 'none'
       VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
+      CONFIG_KEY = :x_permitted_cross_domain_policies
     end
     include Constants
 

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"
       VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
+      CONFIG_KEY = :x_xss_protection
     end
     include Constants
 

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.2.0"
+  VERSION = "2.3.0"
 end

data/lib/secure_headers.rb

@@ -1,7 +1,32 @@
+require "secure_headers/version"
+require "secure_headers/header"
+require "secure_headers/headers/public_key_pins"
+require "secure_headers/headers/content_security_policy"
+require "secure_headers/headers/x_frame_options"
+require "secure_headers/headers/strict_transport_security"
+require "secure_headers/headers/x_xss_protection"
+require "secure_headers/headers/x_content_type_options"
+require "secure_headers/headers/x_download_options"
+require "secure_headers/headers/x_permitted_cross_domain_policies"
+require "secure_headers/railtie"
+require "secure_headers/hash_helper"
+require "secure_headers/view_helper"
+
 module SecureHeaders
   SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
   HASHES_ENV_KEY = 'secure_headers.script_hashes'
 
+  ALL_HEADER_CLASSES = [
+    SecureHeaders::ContentSecurityPolicy,
+    SecureHeaders::StrictTransportSecurity,
+    SecureHeaders::PublicKeyPins,
+    SecureHeaders::XContentTypeOptions,
+    SecureHeaders::XDownloadOptions,
+    SecureHeaders::XFrameOptions,
+    SecureHeaders::XPermittedCrossDomainPolicies,
+    SecureHeaders::XXssProtection
+  ]
+
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
@@ -24,6 +49,27 @@ module SecureHeaders
         include InstanceMethods
       end
     end
+
+    def header_hash(options = nil)
+      ALL_HEADER_CLASSES.inject({}) do |memo, klass|
+        config = if options.is_a?(Hash) && options[klass::Constants::CONFIG_KEY]
+          options[klass::Constants::CONFIG_KEY]
+        else
+          ::SecureHeaders::Configuration.send(klass::Constants::CONFIG_KEY)
+        end
+
+        unless klass == SecureHeaders::PublicKeyPins && !config.is_a?(Hash)
+          header = get_a_header(klass::Constants::CONFIG_KEY, klass, config)
+          memo[header.name] = header.value
+        end
+        memo
+      end
+    end
+
+    def get_a_header(name, klass, options)
+      return if options == false
+      klass.new(options)
+    end
   end
 
   module ClassMethods
@@ -39,6 +85,9 @@ module SecureHeaders
     end
 
     def ensure_security_headers options = {}
+      if RUBY_VERSION == "1.8.7"
+        warn "[DEPRECATION] secure_headers ruby 1.8.7 support will dropped in the next release"
+      end
       self.secure_headers_options = options
       before_filter :prep_script_hash
       before_filter :set_hsts_header
@@ -50,12 +99,6 @@ module SecureHeaders
       before_filter :set_x_download_options_header
       before_filter :set_x_permitted_cross_domain_policies_header
     end
-
-    # we can't use ||= because I'm overloading false => disable, nil => default
-    # both of which trigger the conditional assignment
-    def options_for(type, options)
-      options.nil? ? ::SecureHeaders::Configuration.send(type) : options
-    end
   end
 
   module InstanceMethods
@@ -80,7 +123,7 @@ module SecureHeaders
       end
 
       config = self.class.secure_headers_options[:csp] if config.nil?
-      config = self.class.options_for :csp, config
+      config = secure_header_options_for :csp, config
 
       return if config == false
 
@@ -140,7 +183,7 @@ module SecureHeaders
 
     def set_hpkp_header(options=self.class.secure_headers_options[:hpkp])
       return unless request.ssl?
-      config = self.class.options_for :hpkp, options
+      config = secure_header_options_for :hpkp, options
 
       return if config == false || config.nil?
 
@@ -158,12 +201,16 @@ module SecureHeaders
 
     private
 
+    # we can't use ||= because I'm overloading false => disable, nil => default
+    # both of which trigger the conditional assignment
+    def secure_header_options_for(type, options)
+      options.nil? ? ::SecureHeaders::Configuration.send(type) : options
+    end
+
     def set_a_header(name, klass, options=nil)
-      options = self.class.options_for name, options
+      options = secure_header_options_for(name, options)
       return if options == false
-
-      header = klass.new(options)
-      set_header(header)
+      set_header(SecureHeaders::get_a_header(name, klass, options))
     end
 
     def set_header(name_or_header, value=nil)
@@ -176,18 +223,3 @@ module SecureHeaders
     end
   end
 end
-
-
-require "secure_headers/version"
-require "secure_headers/header"
-require "secure_headers/headers/public_key_pins"
-require "secure_headers/headers/content_security_policy"
-require "secure_headers/headers/x_frame_options"
-require "secure_headers/headers/strict_transport_security"
-require "secure_headers/headers/x_xss_protection"
-require "secure_headers/headers/x_content_type_options"
-require "secure_headers/headers/x_download_options"
-require "secure_headers/headers/x_permitted_cross_domain_policies"
-require "secure_headers/railtie"
-require "secure_headers/hash_helper"
-require "secure_headers/view_helper"

data/secure_headers.gemspec

@@ -19,5 +19,5 @@ Gem::Specification.new do |gem|
   gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
   gem.require_paths = ["lib"]
   gem.add_development_dependency "rake"
-  gem.post_install_message = "Warning: lambda config values will be broken until you add |controller|. e.g. :enforce => lambda { |controller| some_expression }"
+  gem.add_dependency "user_agent_parser"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -17,7 +17,8 @@ module SecureHeaders
     FIREFOX_23 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0"
     CHROME = "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4"
     CHROME_25 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
-
+    SAFARI = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A"
+    OPERA = "Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16"
 
     def request_for user_agent, request_uri=nil, options={:ssl => false}
       double(:ssl? => options[:ssl], :env => {'HTTP_USER_AGENT' => user_agent}, :url => (request_uri || 'http://areallylongdomainexample.com') )
@@ -55,6 +56,23 @@ module SecureHeaders
       end
     end
 
+    it "exports a policy to JSON" do
+      policy = ContentSecurityPolicy.new(default_opts)
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
+    it "imports JSON to build a policy" do
+      json1 = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"]})
+      json2 = %({"style-src":["'unsafe-inline'"],"img-src":["https:","data:"]})
+      json3 = %({"style-src":["https:","about:"]})
+      config = ContentSecurityPolicy.from_json(json1, json2, json3)
+      policy = ContentSecurityPolicy.new(config.merge(:disable_fill_missing => true))
+
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
     context "when using hash sources" do
       it "adds hashes and unsafe-inline to the script-src" do
         policy = ContentSecurityPolicy.new(default_opts.merge(:script_hashes => ['sha256-abc123']))
@@ -155,6 +173,16 @@ module SecureHeaders
           csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
+
+        it "doesn't add a duplicate data uri if img-src specifies it already" do
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self data:', :disable_fill_missing => true}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
+        end
+
+        it "allows the user to disable img-src data: uris auto-whitelisting" do
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_img_src_data_uri => true, :disable_fill_missing => true}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self';")
+        end
       end
 
       it "fills in directives without values with default-src value" do
@@ -184,11 +212,33 @@ module SecureHeaders
       end
 
       context "when using a nonce" do
-        it "adds a nonce and unsafe-inline to the script-src value" do
+        it "adds a nonce and unsafe-inline to the script-src value when using chrome" do
           header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(CHROME))
           expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
         end
 
+        it "adds a nonce and unsafe-inline to the script-src value when using firefox" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(FIREFOX))
+          expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
+        end
+
+        it "adds a nonce and unsafe-inline to the script-src value when using opera" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(OPERA))
+          expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
+        end
+
+        it "does not add a nonce and unsafe-inline to the script-src value when using Safari" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(SAFARI))
+          expect(header.value).to include("script-src 'self' 'unsafe-inline'")
+          expect(header.value).not_to include("nonce")
+        end
+
+        it "does not add a nonce and unsafe-inline to the script-src value when using IE" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(IE))
+          expect(header.value).to include("script-src 'self' 'unsafe-inline'")
+          expect(header.value).not_to include("nonce")
+        end
+
         it "adds a nonce and unsafe-inline to the style-src value" do
           header = ContentSecurityPolicy.new(default_opts.merge(:style_src => "self nonce"), :request => request_for(CHROME))
           expect(header.value).to include("style-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")

data/spec/lib/secure_headers_spec.rb

@@ -159,6 +159,56 @@ describe SecureHeaders do
     end
   end
 
+  describe "SecureHeaders#header_hash" do
+    def expect_default_values(hash)
+      expect(hash[XFO_HEADER_NAME]).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
+      expect(hash[XDO_HEADER_NAME]).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+      expect(hash[HSTS_HEADER_NAME]).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+      expect(hash[X_XSS_PROTECTION_HEADER_NAME]).to eq(SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
+      expect(hash[X_CONTENT_TYPE_OPTIONS_HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
+      expect(hash[XPCDP_HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+    end
+
+    it "produces a hash of headers given a hash as config" do
+      hash = SecureHeaders::header_hash(:csp => {:default_src => 'none', :img_src => "data:", :disable_fill_missing => true})
+      expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'none'; img-src data:;")
+      expect_default_values(hash)
+    end
+
+    it "produces a hash with a mix of config values, override values, and default values" do
+      ::SecureHeaders::Configuration.configure do |config|
+        config.hsts = { :max_age => '123456'}
+        config.hpkp = {
+          :enforce => true,
+          :max_age => 1000000,
+          :include_subdomains => true,
+          :report_uri => '//example.com/uri-directive',
+          :pins => [
+            {:sha256 => 'abc'},
+            {:sha256 => '123'}
+          ]
+        }
+      end
+
+      hash = SecureHeaders::header_hash(:csp => {:default_src => 'none', :img_src => "data:", :disable_fill_missing => true})
+      ::SecureHeaders::Configuration.configure do |config|
+        config.hsts = nil
+        config.hpkp = nil
+      end
+
+      expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'none'; img-src data:;")
+      expect(hash[XFO_HEADER_NAME]).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
+      expect(hash[HSTS_HEADER_NAME]).to eq("max-age=123456")
+      expect(hash[HPKP_HEADER_NAME]).to eq(%{max-age=1000000; pin-sha256="abc"; pin-sha256="123"; report-uri="//example.com/uri-directive"; includeSubDomains})
+    end
+
+    it "produces a hash of headers with default config" do
+      hash = SecureHeaders::header_hash
+      expect(hash['Content-Security-Policy-Report-Only']).to eq(SecureHeaders::ContentSecurityPolicy::Constants::DEFAULT_CSP_HEADER)
+      expect_default_values(hash)
+    end
+  end
+
   describe "#set_x_frame_options_header" do
     it "sets the X-Frame-Options header" do
       should_assign_header(XFO_HEADER_NAME, SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)

data/spec/spec_helper.rb

@@ -3,8 +3,11 @@ require 'rspec'
 
 require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-if defined?(Coveralls)
+begin
+  require 'coveralls'
   Coveralls.wear!
+rescue LoadError
+  # damn you 1.8.7
 end
 
 include ::SecureHeaders::PublicKeyPins::Constants

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-18 00:00:00.000000000 Z
+date: 2015-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: user_agent_parser
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
@@ -156,8 +170,7 @@ homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
 metadata: {}
-post_install_message: 'Warning: lambda config values will be broken until you add
-  |controller|. e.g. :enforce => lambda { |controller| some_expression }'
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -173,7 +186,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.3
+rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,