secure_headers 2.2.3 → 2.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ff92ca9f6816c48cd276c4da21788c681401fded
-  data.tar.gz: e533e9fcfddaded93b6449612760c45fd4da75c8
+  metadata.gz: 8a0931db8855224044856cad01f2226dfb325c93
+  data.tar.gz: bc3520f802677b2c7967d9e7ae928c5d6ef4d2ca
 SHA512:
-  metadata.gz: 28d1e5956816ceea536220868c6c3df6c8cedfc190d3ad14be24a3cea8465a091668d35e77d6afb14feef5fe0504f65b71e8960e3740afa5af3e1eb7e239ac8d
-  data.tar.gz: 18f797ba06da2eb6f2ac7b269a55a642a26d143a48f9a4e58989605d9340fec40b9746e227efbadee8c93382f7cddc5202564adadb06d041eb8e0dc995559192
+  metadata.gz: 41b4ee3848c1261162c5a5e7f80931a1e7891a08ac0d1f49b5ebfae5ae819f0e8a5b3577499d4cd8d62eaf71d36218bb7bf97cd263d220a67a72e14c8a49dac6
+  data.tar.gz: acae6ac54a26a925e3fd74a2b24c50a00349cce8be8d9dca8d81ee1dbae68008defa925bb3a10f99996476687de0b632fca07cfc6d40bd7511dd8acc1cc7a0c1

data/.travis.yml

@@ -4,7 +4,6 @@ rvm:
   - "2.1"
   - "2.0.0"
   - "1.9.3"
-  - "1.8.7"
   - "jruby-19mode"
 
 sudo: false

data/README.md

@@ -49,7 +49,7 @@ This gem makes a few assumptions about how you will use some features.  For exam
   config.x_permitted_cross_domain_policies = 'none'
   config.csp = {
     :default_src => "https: self",
-    :enforce => proc {|controller| contoller.current_user.enforce_csp? },
+    :enforce => proc {|controller| controller.current_user.enforce_csp? },
     :frame_src => "https: http:.twimg.com http://itunes.apple.com",
     :img_src => "https:",
     :report_uri => '//example.com/uri-directive'
@@ -419,7 +419,7 @@ end
 
 * Node.js (express) [helmet](https://github.com/evilpacket/helmet) and [hood](https://github.com/seanmonstar/hood)
 * Node.js (hapi) [blankie](https://github.com/nlf/blankie)
-* J2EE Servlet >= 3.0 [highlines](https://github.com/sourceclear/headlines)
+* J2EE Servlet >= 3.0 [headlines](https://github.com/sourceclear/headlines)
 * ASP.NET - [NWebsec](https://github.com/NWebsec/NWebsec/wiki)
 * Python - [django-csp](https://github.com/mozilla/django-csp) + [commonware](https://github.com/jsocol/commonware/); [django-security](https://github.com/sdelements/django-security)
 * Go - [secureheader](https://github.com/kr/secureheader)

data/lib/secure_headers.rb

@@ -39,6 +39,9 @@ module SecureHeaders
     end
 
     def ensure_security_headers options = {}
+      if RUBY_VERSION == "1.8.7"
+        warn "[DEPRECATION] secure_headers ruby 1.8.7 support will dropped in the next release"
+      end
       self.secure_headers_options = options
       before_filter :prep_script_hash
       before_filter :set_hsts_header

data/lib/secure_headers/headers/content_security_policy.rb

@@ -2,6 +2,7 @@ require 'uri'
 require 'base64'
 require 'securerandom'
 require 'user_agent_parser'
+require 'json'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
@@ -166,6 +167,21 @@ module SecureHeaders
       end
     end
 
+    def to_json
+      build_value
+      @config.to_json.gsub(/(\w+)_src/, "\\1-src")
+    end
+
+    def self.from_json(*json_configs)
+      json_configs.inject({}) do |combined_config, one_config|
+        one_config = one_config.gsub(/(\w+)-src/, "\\1_src")
+        config = JSON.parse(one_config, :symbolize_names => true)
+        combined_config.merge(config) do |_, lhs, rhs|
+          lhs | rhs
+        end
+      end
+    end
+
     private
 
     def add_script_hashes

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.2.3"
+  VERSION = "2.2.4"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -56,6 +56,23 @@ module SecureHeaders
       end
     end
 
+    it "exports a policy to JSON" do
+      policy = ContentSecurityPolicy.new(default_opts)
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
+    it "imports JSON to build a policy" do
+      json1 = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"]})
+      json2 = %({"style-src":["'unsafe-inline'"],"img-src":["https:","data:"]})
+      json3 = %({"style-src":["https:","about:"]})
+      config = ContentSecurityPolicy.from_json(json1, json2, json3)
+      policy = ContentSecurityPolicy.new(config.merge(:disable_fill_missing => true))
+
+      expected = %({"default-src":["https:"],"script-src":["'unsafe-inline'","'unsafe-eval'","https:","data:"],"style-src":["'unsafe-inline'","https:","about:"],"img-src":["https:","data:"]})
+      expect(policy.to_json).to eq(expected)
+    end
+
     context "when using hash sources" do
       it "adds hashes and unsafe-inline to the script-src" do
         policy = ContentSecurityPolicy.new(default_opts.merge(:script_hashes => ['sha256-abc123']))

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.2.3
+  version: 2.2.4
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-08-14 00:00:00.000000000 Z
+date: 2015-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake