secure_headers 2.2.0 → 2.4.0

data/lib/secure_headers.rb

@@ -1,7 +1,32 @@
+require "secure_headers/version"
+require "secure_headers/header"
+require "secure_headers/headers/public_key_pins"
+require "secure_headers/headers/content_security_policy"
+require "secure_headers/headers/x_frame_options"
+require "secure_headers/headers/strict_transport_security"
+require "secure_headers/headers/x_xss_protection"
+require "secure_headers/headers/x_content_type_options"
+require "secure_headers/headers/x_download_options"
+require "secure_headers/headers/x_permitted_cross_domain_policies"
+require "secure_headers/railtie"
+require "secure_headers/hash_helper"
+require "secure_headers/view_helper"
+
 module SecureHeaders
   SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
   HASHES_ENV_KEY = 'secure_headers.script_hashes'
 
+  ALL_HEADER_CLASSES = [
+    SecureHeaders::ContentSecurityPolicy,
+    SecureHeaders::StrictTransportSecurity,
+    SecureHeaders::PublicKeyPins,
+    SecureHeaders::XContentTypeOptions,
+    SecureHeaders::XDownloadOptions,
+    SecureHeaders::XFrameOptions,
+    SecureHeaders::XPermittedCrossDomainPolicies,
+    SecureHeaders::XXssProtection
+  ]
+
   module Configuration
     class << self
       attr_accessor :hsts, :x_frame_options, :x_content_type_options,
@@ -24,6 +49,27 @@ module SecureHeaders
         include InstanceMethods
       end
     end
+
+    def header_hash(options = nil)
+      ALL_HEADER_CLASSES.inject({}) do |memo, klass|
+        config = if options.is_a?(Hash) && options[klass::Constants::CONFIG_KEY]
+          options[klass::Constants::CONFIG_KEY]
+        else
+          ::SecureHeaders::Configuration.send(klass::Constants::CONFIG_KEY)
+        end
+
+        unless klass == SecureHeaders::PublicKeyPins && !config.is_a?(Hash)
+          header = get_a_header(klass::Constants::CONFIG_KEY, klass, config)
+          memo[header.name] = header.value
+        end
+        memo
+      end
+    end
+
+    def get_a_header(name, klass, options)
+      return if options == false
+      klass.new(options)
+    end
   end
 
   module ClassMethods
@@ -39,6 +85,9 @@ module SecureHeaders
     end
 
     def ensure_security_headers options = {}
+      if RUBY_VERSION == "1.8.7"
+        warn "[DEPRECATION] secure_headers ruby 1.8.7 support will dropped in the next release"
+      end
       self.secure_headers_options = options
       before_filter :prep_script_hash
       before_filter :set_hsts_header
@@ -50,12 +99,6 @@ module SecureHeaders
       before_filter :set_x_download_options_header
       before_filter :set_x_permitted_cross_domain_policies_header
     end
-
-    # we can't use ||= because I'm overloading false => disable, nil => default
-    # both of which trigger the conditional assignment
-    def options_for(type, options)
-      options.nil? ? ::SecureHeaders::Configuration.send(type) : options
-    end
   end
 
   module InstanceMethods
@@ -80,7 +123,7 @@ module SecureHeaders
       end
 
       config = self.class.secure_headers_options[:csp] if config.nil?
-      config = self.class.options_for :csp, config
+      config = secure_header_options_for :csp, config
 
       return if config == false
 
@@ -140,7 +183,7 @@ module SecureHeaders
 
     def set_hpkp_header(options=self.class.secure_headers_options[:hpkp])
       return unless request.ssl?
-      config = self.class.options_for :hpkp, options
+      config = secure_header_options_for :hpkp, options
 
       return if config == false || config.nil?
 
@@ -158,12 +201,16 @@ module SecureHeaders
 
     private
 
+    # we can't use ||= because I'm overloading false => disable, nil => default
+    # both of which trigger the conditional assignment
+    def secure_header_options_for(type, options)
+      options.nil? ? ::SecureHeaders::Configuration.send(type) : options
+    end
+
     def set_a_header(name, klass, options=nil)
-      options = self.class.options_for name, options
+      options = secure_header_options_for(name, options)
       return if options == false
-
-      header = klass.new(options)
-      set_header(header)
+      set_header(SecureHeaders::get_a_header(name, klass, options))
     end
 
     def set_header(name_or_header, value=nil)
@@ -176,18 +223,3 @@ module SecureHeaders
     end
   end
 end
-
-
-require "secure_headers/version"
-require "secure_headers/header"
-require "secure_headers/headers/public_key_pins"
-require "secure_headers/headers/content_security_policy"
-require "secure_headers/headers/x_frame_options"
-require "secure_headers/headers/strict_transport_security"
-require "secure_headers/headers/x_xss_protection"
-require "secure_headers/headers/x_content_type_options"
-require "secure_headers/headers/x_download_options"
-require "secure_headers/headers/x_permitted_cross_domain_policies"
-require "secure_headers/railtie"
-require "secure_headers/hash_helper"
-require "secure_headers/view_helper"

data/secure_headers.gemspec

@@ -19,5 +19,5 @@ Gem::Specification.new do |gem|
   gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
   gem.require_paths = ["lib"]
   gem.add_development_dependency "rake"
-  gem.post_install_message = "Warning: lambda config values will be broken until you add |controller|. e.g. :enforce => lambda { |controller| some_expression }"
+  gem.add_dependency "user_agent_parser"
 end

data/spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb

@@ -13,8 +13,8 @@ module SecureHeaders
         :disable_fill_missing => true,
         :default_src => 'https://*',
         :report_uri => '/csp_report',
-        :script_src => 'inline eval https://* data:',
-        :style_src => "inline https://* about:"
+        :script_src => "'unsafe-inline' 'unsafe-eval' https://* data:",
+        :style_src => "'unsafe-inline' https://* about:"
       }
     end
 

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -4,20 +4,21 @@ module SecureHeaders
   describe ContentSecurityPolicy do
     let(:default_opts) do
       {
-        :disable_fill_missing => true,
         :default_src => 'https:',
         :report_uri => '/csp_report',
-        :script_src => 'inline eval https: data:',
-        :style_src => "inline https: about:"
+        :script_src => "'unsafe-inline' 'unsafe-eval' https: data:",
+        :style_src => "'unsafe-inline' https: about:"
       }
     end
+    let(:controller) { DummyClass.new }
 
     IE = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
     FIREFOX = "Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.2) Gecko/20121223 Ubuntu/9.25 (jaunty) Firefox/3.8"
     FIREFOX_23 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0"
     CHROME = "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4"
     CHROME_25 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
-
+    SAFARI = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A"
+    OPERA = "Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16"
 
     def request_for user_agent, request_uri=nil, options={:ssl => false}
       double(:ssl? => options[:ssl], :env => {'HTTP_USER_AGENT' => user_agent}, :url => (request_uri || 'http://areallylongdomainexample.com') )
@@ -55,6 +56,23 @@ module SecureHeaders
       end
     end
 
+    it "exports a policy to JSON" do
+      policy = ContentSecurityPolicy.new(default_opts)
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
+    it "imports JSON to build a policy" do
+      json1 = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"]})
+      json2 = %({"style-src":["'unsafe-inline'"],"img-src":["https:","data:"]})
+      json3 = %({"style-src":["https:","about:"]})
+      config = ContentSecurityPolicy.from_json(json1, json2, json3)
+      policy = ContentSecurityPolicy.new(config)
+
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
     context "when using hash sources" do
       it "adds hashes and unsafe-inline to the script-src" do
         policy = ContentSecurityPolicy.new(default_opts.merge(:script_hashes => ['sha256-abc123']))
@@ -64,8 +82,7 @@ module SecureHeaders
 
     describe "#normalize_csp_options" do
       before(:each) do
-        default_opts.delete(:disable_fill_missing)
-        default_opts[:script_src] << ' self none'
+        default_opts[:script_src] <<  " 'self' 'none'"
         @opts = default_opts
       end
 
@@ -89,7 +106,7 @@ module SecureHeaders
 
         it "accepts procs for report-uris" do
           opts = {
-            :default_src => 'self',
+            :default_src => "'self'",
             :report_uri => proc { "http://lambda/result" }
           }
 
@@ -101,7 +118,6 @@ module SecureHeaders
           opts = {
             :default_src => proc { "http://lambda/result" },
             :enforce => proc { true },
-            :disable_fill_missing => proc { true }
           }
 
           csp = ContentSecurityPolicy.new(opts)
@@ -115,8 +131,7 @@ module SecureHeaders
 
           allow(controller).to receive(:current_user).and_return(user)
           opts = {
-            :disable_fill_missing => true,
-            :default_src => "self",
+            :default_src => "'self'",
             :enforce => lambda { |c| c.current_user.beta_testing? }
           }
           csp = ContentSecurityPolicy.new(opts, :controller => controller)
@@ -133,35 +148,26 @@ module SecureHeaders
         }.to raise_error(RuntimeError)
       end
 
-      context "CSP level 2 directives" do
-        let(:config) { {:default_src => 'self'} }
-        ::SecureHeaders::ContentSecurityPolicy::Constants::NON_DEFAULT_SOURCES.each do |non_default_source|
-          it "supports all level 2 directives" do
-            directive_name = ::SecureHeaders::ContentSecurityPolicy.send(:symbol_to_hyphen_case, non_default_source)
-            config.merge!({ non_default_source => "value" })
-            csp = ContentSecurityPolicy.new(config, :request => request_for(CHROME))
-            expect(csp.value).to match(/#{directive_name} value;/)
-          end
-        end
-      end
-
       context "auto-whitelists data: uris for img-src" do
         it "sets the value if no img-src specified" do
-          csp = ContentSecurityPolicy.new({:default_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
+          csp = ContentSecurityPolicy.new({:default_src => "'self'"}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
 
         it "appends the value if img-src is specified" do
-          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
+          csp = ContentSecurityPolicy.new({:default_src => "'self'", :img_src => "'self'"}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
-      end
 
-      it "fills in directives without values with default-src value" do
-        options = default_opts.merge(:disable_fill_missing => false)
-        csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-        value = "default-src https:; connect-src https:; font-src https:; frame-src https:; img-src https: data:; media-src https:; object-src https:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https: about:; report-uri /csp_report;"
-        expect(csp.value).to eq(value)
+        it "doesn't add a duplicate data uri if img-src specifies it already" do
+          csp = ContentSecurityPolicy.new({:default_src => "'self'", :img_src => "'self' data:"}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
+        end
+
+        it "allows the user to disable img-src data: uris auto-whitelisting" do
+          csp = ContentSecurityPolicy.new({:default_src => "'self'", :img_src => "'self'", :disable_img_src_data_uri => true}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self';")
+        end
       end
 
       it "sends the standard csp header if an unknown browser is supplied" do
@@ -184,18 +190,40 @@ module SecureHeaders
       end
 
       context "when using a nonce" do
-        it "adds a nonce and unsafe-inline to the script-src value" do
-          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce"), :request => request_for(CHROME))
+        it "adds a nonce and unsafe-inline to the script-src value when using chrome" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce"), :request => request_for(CHROME), :controller => controller)
+          expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
+        end
+
+        it "adds a nonce and unsafe-inline to the script-src value when using firefox" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce"), :request => request_for(FIREFOX), :controller => controller)
+          expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
+        end
+
+        it "adds a nonce and unsafe-inline to the script-src value when using opera" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce"), :request => request_for(OPERA), :controller => controller)
           expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
         end
 
+        it "does not add a nonce and unsafe-inline to the script-src value when using Safari" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce"), :request => request_for(SAFARI), :controller => controller)
+          expect(header.value).to include("script-src 'self' 'unsafe-inline'")
+          expect(header.value).not_to include("nonce")
+        end
+
+        it "does not add a nonce and unsafe-inline to the script-src value when using IE" do
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce"), :request => request_for(IE), :controller => controller)
+          expect(header.value).to include("script-src 'self' 'unsafe-inline'")
+          expect(header.value).not_to include("nonce")
+        end
+
         it "adds a nonce and unsafe-inline to the style-src value" do
-          header = ContentSecurityPolicy.new(default_opts.merge(:style_src => "self nonce"), :request => request_for(CHROME))
+          header = ContentSecurityPolicy.new(default_opts.merge(:style_src => "'self' nonce"), :request => request_for(CHROME), :controller => controller)
           expect(header.value).to include("style-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline'")
         end
 
         it "adds an identical nonce to the style and script-src directives" do
-          header = ContentSecurityPolicy.new(default_opts.merge(:style_src => "self nonce", :script_src => "self nonce"), :request => request_for(CHROME))
+          header = ContentSecurityPolicy.new(default_opts.merge(:style_src => "'self' nonce", :script_src => "'self' nonce"), :request => request_for(CHROME), :controller => controller)
           nonce = header.nonce
           value = header.value
           expect(value).to include("style-src 'self' 'nonce-#{nonce}' 'unsafe-inline'")
@@ -203,7 +231,7 @@ module SecureHeaders
         end
 
         it "does not add 'unsafe-inline' twice" do
-          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "self nonce inline"), :request => request_for(CHROME))
+          header = ContentSecurityPolicy.new(default_opts.merge(:script_src => "'self' nonce 'unsafe-inline'"), :request => request_for(CHROME), :controller => controller)
           expect(header.value).to include("script-src 'self' 'nonce-#{header.nonce}' 'unsafe-inline';")
         end
       end
@@ -251,7 +279,7 @@ module SecureHeaders
 
         describe ".add_to_env" do
           let(:controller) { double }
-          let(:config) { {:default_src => 'self'} }
+          let(:config) { {:default_src => "'self'"} }
           let(:options) { {:controller => controller} }
 
           it "adds metadata to env" do

data/spec/lib/secure_headers/headers/x_content_type_options_spec.rb

@@ -27,7 +27,7 @@ module SecureHeaders
         it "doesn't accept anything besides no-sniff" do
           expect {
             XContentTypeOptions.new("donkey")
-          }.to raise_error
+          }.to raise_error(XContentTypeOptionsBuildError)
         end
       end
     end

data/spec/lib/secure_headers/headers/x_download_options_spec.rb

@@ -25,7 +25,7 @@ module SecureHeaders
       it "doesn't accept anything besides noopen" do
         expect {
           XDownloadOptions.new("open")
-        }.to raise_error
+        }.to raise_error(XDOBuildError)
       end
     end
   end

data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb

@@ -57,7 +57,7 @@ module SecureHeaders
       it "doesn't accept invalid values" do
         expect {
           XPermittedCrossDomainPolicies.new("open")
-        }.to raise_error
+        }.to raise_error(XPCDPBuildError)
       end
     end
   end

data/spec/lib/secure_headers_spec.rb

@@ -1,10 +1,6 @@
 require 'spec_helper'
 
 describe SecureHeaders do
-  class DummyClass
-    include ::SecureHeaders
-  end
-
   subject {DummyClass.new}
   let(:headers) {double}
   let(:response) {double(:headers => headers)}
@@ -131,7 +127,7 @@ describe SecureHeaders do
 
     it "saves the options to the env when using script hashes" do
       opts = {
-        :default_src => 'self',
+        :default_src => "'self'",
         :script_hash_middleware => true
       }
       stub_user_agent(USER_AGENTS[:chrome])
@@ -159,6 +155,56 @@ describe SecureHeaders do
     end
   end
 
+  describe "SecureHeaders#header_hash" do
+    def expect_default_values(hash)
+      expect(hash[XFO_HEADER_NAME]).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
+      expect(hash[XDO_HEADER_NAME]).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
+      expect(hash[HSTS_HEADER_NAME]).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+      expect(hash[X_XSS_PROTECTION_HEADER_NAME]).to eq(SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
+      expect(hash[X_CONTENT_TYPE_OPTIONS_HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
+      expect(hash[XPCDP_HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::Constants::DEFAULT_VALUE)
+    end
+
+    it "produces a hash of headers given a hash as config" do
+      hash = SecureHeaders::header_hash(:csp => {:default_src => "'none'", :img_src => "data:", :disable_fill_missing => true})
+      expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'none'; img-src data:;")
+      expect_default_values(hash)
+    end
+
+    it "produces a hash with a mix of config values, override values, and default values" do
+      ::SecureHeaders::Configuration.configure do |config|
+        config.hsts = { :max_age => '123456'}
+        config.hpkp = {
+          :enforce => true,
+          :max_age => 1000000,
+          :include_subdomains => true,
+          :report_uri => '//example.com/uri-directive',
+          :pins => [
+            {:sha256 => 'abc'},
+            {:sha256 => '123'}
+          ]
+        }
+      end
+
+      hash = SecureHeaders::header_hash(:csp => {:default_src => "'none'", :img_src => "data:", :disable_fill_missing => true})
+      ::SecureHeaders::Configuration.configure do |config|
+        config.hsts = nil
+        config.hpkp = nil
+      end
+
+      expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'none'; img-src data:;")
+      expect(hash[XFO_HEADER_NAME]).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
+      expect(hash[HSTS_HEADER_NAME]).to eq("max-age=123456")
+      expect(hash[HPKP_HEADER_NAME]).to eq(%{max-age=1000000; pin-sha256="abc"; pin-sha256="123"; report-uri="//example.com/uri-directive"; includeSubDomains})
+    end
+
+    it "produces a hash of headers with default config" do
+      hash = SecureHeaders::header_hash
+      expect(hash['Content-Security-Policy-Report-Only']).to eq(SecureHeaders::ContentSecurityPolicy::Constants::DEFAULT_CSP_HEADER)
+      expect_default_values(hash)
+    end
+  end
+
   describe "#set_x_frame_options_header" do
     it "sets the X-Frame-Options header" do
       should_assign_header(XFO_HEADER_NAME, SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)

data/spec/spec_helper.rb

@@ -3,8 +3,11 @@ require 'rspec'
 
 require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-if defined?(Coveralls)
+begin
+  require 'coveralls'
   Coveralls.wear!
+rescue LoadError
+  # damn you 1.8.7
 end
 
 include ::SecureHeaders::PublicKeyPins::Constants
@@ -28,6 +31,10 @@ USER_AGENTS = {
   :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
 }
 
+class DummyClass
+  include ::SecureHeaders
+end
+
 def should_assign_header name, value
   expect(response.headers).to receive(:[]=).with(name, value)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-18 00:00:00.000000000 Z
+date: 2015-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: user_agent_parser
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Security related headers all in one gem.
 email:
 - neil.matatall@gmail.com
@@ -39,60 +53,60 @@ files:
 - LICENSE
 - README.md
 - Rakefile
-- fixtures/rails_3_2_12/.rspec
-- fixtures/rails_3_2_12/Gemfile
-- fixtures/rails_3_2_12/README.rdoc
-- fixtures/rails_3_2_12/Rakefile
-- fixtures/rails_3_2_12/app/controllers/application_controller.rb
-- fixtures/rails_3_2_12/app/controllers/other_things_controller.rb
-- fixtures/rails_3_2_12/app/controllers/things_controller.rb
-- fixtures/rails_3_2_12/app/models/.gitkeep
-- fixtures/rails_3_2_12/app/views/layouts/application.html.erb
-- fixtures/rails_3_2_12/app/views/other_things/index.html.erb
-- fixtures/rails_3_2_12/app/views/things/index.html.erb
-- fixtures/rails_3_2_12/config.ru
-- fixtures/rails_3_2_12/config/application.rb
-- fixtures/rails_3_2_12/config/boot.rb
-- fixtures/rails_3_2_12/config/environment.rb
-- fixtures/rails_3_2_12/config/environments/test.rb
-- fixtures/rails_3_2_12/config/initializers/secure_headers.rb
-- fixtures/rails_3_2_12/config/routes.rb
-- fixtures/rails_3_2_12/config/script_hashes.yml
-- fixtures/rails_3_2_12/lib/assets/.gitkeep
-- fixtures/rails_3_2_12/lib/tasks/.gitkeep
-- fixtures/rails_3_2_12/log/.gitkeep
-- fixtures/rails_3_2_12/spec/controllers/other_things_controller_spec.rb
-- fixtures/rails_3_2_12/spec/controllers/things_controller_spec.rb
-- fixtures/rails_3_2_12/spec/spec_helper.rb
-- fixtures/rails_3_2_12/vendor/assets/javascripts/.gitkeep
-- fixtures/rails_3_2_12/vendor/assets/stylesheets/.gitkeep
-- fixtures/rails_3_2_12/vendor/plugins/.gitkeep
-- fixtures/rails_3_2_12_no_init/.rspec
-- fixtures/rails_3_2_12_no_init/Gemfile
-- fixtures/rails_3_2_12_no_init/README.rdoc
-- fixtures/rails_3_2_12_no_init/Rakefile
-- fixtures/rails_3_2_12_no_init/app/controllers/application_controller.rb
-- fixtures/rails_3_2_12_no_init/app/controllers/other_things_controller.rb
-- fixtures/rails_3_2_12_no_init/app/controllers/things_controller.rb
-- fixtures/rails_3_2_12_no_init/app/models/.gitkeep
-- fixtures/rails_3_2_12_no_init/app/views/layouts/application.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/other_things/index.html.erb
-- fixtures/rails_3_2_12_no_init/app/views/things/index.html.erb
-- fixtures/rails_3_2_12_no_init/config.ru
-- fixtures/rails_3_2_12_no_init/config/application.rb
-- fixtures/rails_3_2_12_no_init/config/boot.rb
-- fixtures/rails_3_2_12_no_init/config/environment.rb
-- fixtures/rails_3_2_12_no_init/config/environments/test.rb
-- fixtures/rails_3_2_12_no_init/config/routes.rb
-- fixtures/rails_3_2_12_no_init/lib/assets/.gitkeep
-- fixtures/rails_3_2_12_no_init/lib/tasks/.gitkeep
-- fixtures/rails_3_2_12_no_init/log/.gitkeep
-- fixtures/rails_3_2_12_no_init/spec/controllers/other_things_controller_spec.rb
-- fixtures/rails_3_2_12_no_init/spec/controllers/things_controller_spec.rb
-- fixtures/rails_3_2_12_no_init/spec/spec_helper.rb
-- fixtures/rails_3_2_12_no_init/vendor/assets/javascripts/.gitkeep
-- fixtures/rails_3_2_12_no_init/vendor/assets/stylesheets/.gitkeep
-- fixtures/rails_3_2_12_no_init/vendor/plugins/.gitkeep
+- fixtures/rails_3_2_22/.rspec
+- fixtures/rails_3_2_22/Gemfile
+- fixtures/rails_3_2_22/README.rdoc
+- fixtures/rails_3_2_22/Rakefile
+- fixtures/rails_3_2_22/app/controllers/application_controller.rb
+- fixtures/rails_3_2_22/app/controllers/other_things_controller.rb
+- fixtures/rails_3_2_22/app/controllers/things_controller.rb
+- fixtures/rails_3_2_22/app/models/.gitkeep
+- fixtures/rails_3_2_22/app/views/layouts/application.html.erb
+- fixtures/rails_3_2_22/app/views/other_things/index.html.erb
+- fixtures/rails_3_2_22/app/views/things/index.html.erb
+- fixtures/rails_3_2_22/config.ru
+- fixtures/rails_3_2_22/config/application.rb
+- fixtures/rails_3_2_22/config/boot.rb
+- fixtures/rails_3_2_22/config/environment.rb
+- fixtures/rails_3_2_22/config/environments/test.rb
+- fixtures/rails_3_2_22/config/initializers/secure_headers.rb
+- fixtures/rails_3_2_22/config/routes.rb
+- fixtures/rails_3_2_22/config/script_hashes.yml
+- fixtures/rails_3_2_22/lib/assets/.gitkeep
+- fixtures/rails_3_2_22/lib/tasks/.gitkeep
+- fixtures/rails_3_2_22/log/.gitkeep
+- fixtures/rails_3_2_22/spec/controllers/other_things_controller_spec.rb
+- fixtures/rails_3_2_22/spec/controllers/things_controller_spec.rb
+- fixtures/rails_3_2_22/spec/spec_helper.rb
+- fixtures/rails_3_2_22/vendor/assets/javascripts/.gitkeep
+- fixtures/rails_3_2_22/vendor/assets/stylesheets/.gitkeep
+- fixtures/rails_3_2_22/vendor/plugins/.gitkeep
+- fixtures/rails_3_2_22_no_init/.rspec
+- fixtures/rails_3_2_22_no_init/Gemfile
+- fixtures/rails_3_2_22_no_init/README.rdoc
+- fixtures/rails_3_2_22_no_init/Rakefile
+- fixtures/rails_3_2_22_no_init/app/controllers/application_controller.rb
+- fixtures/rails_3_2_22_no_init/app/controllers/other_things_controller.rb
+- fixtures/rails_3_2_22_no_init/app/controllers/things_controller.rb
+- fixtures/rails_3_2_22_no_init/app/models/.gitkeep
+- fixtures/rails_3_2_22_no_init/app/views/layouts/application.html.erb
+- fixtures/rails_3_2_22_no_init/app/views/other_things/index.html.erb
+- fixtures/rails_3_2_22_no_init/app/views/things/index.html.erb
+- fixtures/rails_3_2_22_no_init/config.ru
+- fixtures/rails_3_2_22_no_init/config/application.rb
+- fixtures/rails_3_2_22_no_init/config/boot.rb
+- fixtures/rails_3_2_22_no_init/config/environment.rb
+- fixtures/rails_3_2_22_no_init/config/environments/test.rb
+- fixtures/rails_3_2_22_no_init/config/routes.rb
+- fixtures/rails_3_2_22_no_init/lib/assets/.gitkeep
+- fixtures/rails_3_2_22_no_init/lib/tasks/.gitkeep
+- fixtures/rails_3_2_22_no_init/log/.gitkeep
+- fixtures/rails_3_2_22_no_init/spec/controllers/other_things_controller_spec.rb
+- fixtures/rails_3_2_22_no_init/spec/controllers/things_controller_spec.rb
+- fixtures/rails_3_2_22_no_init/spec/spec_helper.rb
+- fixtures/rails_3_2_22_no_init/vendor/assets/javascripts/.gitkeep
+- fixtures/rails_3_2_22_no_init/vendor/assets/stylesheets/.gitkeep
+- fixtures/rails_3_2_22_no_init/vendor/plugins/.gitkeep
 - fixtures/rails_4_1_8/Gemfile
 - fixtures/rails_4_1_8/README.rdoc
 - fixtures/rails_4_1_8/Rakefile
@@ -156,8 +170,7 @@ homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
 metadata: {}
-post_install_message: 'Warning: lambda config values will be broken until you add
-  |controller|. e.g. :enforce => lambda { |controller| some_expression }'
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -173,7 +186,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.3
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,