secure_headers 2.2.2 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 288faa28dbfd3d98051878c6a14de550cad278c8
-  data.tar.gz: 8a0fb29d2d522ecbfefba832c85fd3a5db5de750
+  metadata.gz: ff92ca9f6816c48cd276c4da21788c681401fded
+  data.tar.gz: e533e9fcfddaded93b6449612760c45fd4da75c8
 SHA512:
-  metadata.gz: 5cd42475a992e0491c9e503f0c1a236e61ea1e17d7fd972c5178bc58aa2ff5f7e9dab92a0f008e6c61c25478f23317f5c420807db97589ae1c00a85c6c7c5555
-  data.tar.gz: 09c1c571b5c1efd70ea02206403d84b5d85498b323b255f7901f6daf8196f6c922cdae4eea2d73b8c1e74be98b3efce9db53670c477009367b55aeb4be3fa5cf
+  metadata.gz: 28d1e5956816ceea536220868c6c3df6c8cedfc190d3ad14be24a3cea8465a091668d35e77d6afb14feef5fe0504f65b71e8960e3740afa5af3e1eb7e239ac8d
+  data.tar.gz: 18f797ba06da2eb6f2ac7b269a55a642a26d143a48f9a4e58989605d9340fec40b9746e227efbadee8c93382f7cddc5202564adadb06d041eb8e0dc995559192

data/Gemfile

@@ -10,6 +10,6 @@ group :test do
   gem 'rspec', '>= 3.1'
   gem 'growl'
   gem 'rb-fsevent'
-  gem 'coveralls', :platforms => [:ruby_19, :ruby_20, :ruby_21, :ruby_21]
+  gem 'coveralls', :platforms => [:ruby_19, :ruby_20, :ruby_21]
   gem 'i18n', '< 0.7.0', :platforms => [:ruby_18]
 end

data/README.md

@@ -418,9 +418,10 @@ end
 ## Similar libraries
 
 * Node.js (express) [helmet](https://github.com/evilpacket/helmet) and [hood](https://github.com/seanmonstar/hood)
+* Node.js (hapi) [blankie](https://github.com/nlf/blankie)
 * J2EE Servlet >= 3.0 [highlines](https://github.com/sourceclear/headlines)
 * ASP.NET - [NWebsec](https://github.com/NWebsec/NWebsec/wiki)
-* Python - [django-csp](https://github.com/mozilla/django-csp/) + [commonware](https://github.com/jsocol/commonware/)
+* Python - [django-csp](https://github.com/mozilla/django-csp) + [commonware](https://github.com/jsocol/commonware/); [django-security](https://github.com/sdelements/django-security)
 * Go - [secureheader](https://github.com/kr/secureheader)
 
 ## Authors

data/lib/secure_headers/headers/content_security_policy.rb

@@ -128,6 +128,7 @@ module SecureHeaders
 
       @disable_fill_missing = !!@config.delete(:disable_fill_missing)
       @enforce = !!@config.delete(:enforce)
+      @disable_img_src_data_uri = !!@config.delete(:disable_img_src_data_uri)
       @tag_report_uri = !!@config.delete(:tag_report_uri)
       @script_hashes = @config.delete(:script_hashes) || []
 
@@ -238,10 +239,11 @@ module SecureHeaders
 
     def generic_directives
       header_value = ''
+      data_uri = @disable_img_src_data_uri ? [] : ["data:"]
       if @config[:img_src]
-        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
+        @config[:img_src] = @config[:img_src] + data_uri unless @config[:img_src].include?('data:')
       else
-        @config[:img_src] = @config[:default_src] + ['data:']
+        @config[:img_src] = @config[:default_src] + data_uri
       end
 
       DIRECTIVES.each do |directive_name|

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.2.2"
+  VERSION = "2.2.3"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -156,6 +156,16 @@ module SecureHeaders
           csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_fill_missing => true}, :request => request_for(CHROME))
           expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
         end
+
+        it "doesn't add a duplicate data uri if img-src specifies it already" do
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self data:', :disable_fill_missing => true}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self' data:;")
+        end
+
+        it "allows the user to disable img-src data: uris auto-whitelisting" do
+          csp = ContentSecurityPolicy.new({:default_src => 'self', :img_src => 'self', :disable_img_src_data_uri => true, :disable_fill_missing => true}, :request => request_for(CHROME))
+          expect(csp.value).to eq("default-src 'self'; img-src 'self';")
+        end
       end
 
       it "fills in directives without values with default-src value" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.2.2
+  version: 2.2.3
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-02 00:00:00.000000000 Z
+date: 2015-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -186,7 +186,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.3
+rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,