secure_headers 2.4.1 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 333c51c1bbbed7415696fa0e8fd7e3147ddcf542
-  data.tar.gz: 798eae0a9dc303a0c72c946e74aa76a2f36e229c
+  metadata.gz: 36b98616c83ec1049b8f1bcc25671738da8d8bed
+  data.tar.gz: 730108ec10da36aeeb59049e88122a99987d1dcc
 SHA512:
-  metadata.gz: 80224aff2b4a8230de68b0338dd5ca4ef19c56b929fe59693d3f01395f7b4c3cab57170b389044dacd0745e43d07cf98951f13de48d646cc17cf8a40befe4d90
-  data.tar.gz: 7f663e76802e8c2282908eb2eefce7a040cf9f5c04da49b825bd147854879a900577f22f9a8e918a973d3019e840e95d08aec6eaeeb3836c6233fb0db0dd8982
+  metadata.gz: 854d9e8c9de09d5515dad3449726b4b2308b8a25b5dc702ed80da47fd3f94f983119531a4089877b215ee07dccfa8fec2766107891b018bcca376ec16ed95e8f
+  data.tar.gz: f0ec419ac593cdeb556dc852d6e2a3b8f5fcfe83c07b34ac8392fcb912004bbe1117ea9e473c068230a38c44c96a5e036dfde630ae5e7397203c9aed8babd741

data/.travis.yml

@@ -9,3 +9,4 @@ rvm:
 
 sudo: false
 cache: bundler
+before_install: gem update bundler

data/Gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec
 
 group :test do
+  gem "guard-rspec", platforms: [:ruby_19, :ruby_20, :ruby_21, :ruby_22]
   gem 'test-unit', '~> 3.0'
   gem 'rails', '3.2.22'
   gem 'sqlite3', :platforms => [:ruby, :mswin, :mingw]

data/Guardfile

@@ -0,0 +1,12 @@
+guard :rspec, cmd: "bundle exec rspec", all_on_start: true, all_after_pass: true do
+  require "guard/rspec/dsl"
+  dsl = Guard::RSpec::Dsl.new(self)
+
+  # RSpec files
+  rspec = dsl.rspec
+  watch(rspec.spec_helper) { rspec.spec_dir }
+  watch(rspec.spec_support) { rspec.spec_dir }
+  watch(rspec.spec_files)
+
+  watch(%r{^lib/(.+)\.rb$}) { |m| "spec/lib/#{m[1]}_spec.rb" }
+end

data/README.md

@@ -8,7 +8,7 @@ The gem will automatically apply several headers that are related to security.
 - X-Content-Type-Options - [Prevent content type sniffing](http://msdn.microsoft.com/en-us/library/ie/gg622941\(v=vs.85\).aspx)
 - X-Download-Options - [Prevent file downloads opening](http://msdn.microsoft.com/en-us/library/ie/jj542450(v=vs.85).aspx)
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
-- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinnning  Specification](https://tools.ietf.org/html/rfc7469)
+- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinning  Specification](https://tools.ietf.org/html/rfc7469)
 
 ## Usage
 

data/lib/secure_headers/headers/content_security_policy.rb

@@ -11,6 +11,7 @@ module SecureHeaders
       DEFAULT_CSP_HEADER = "default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: about: javascript:; img-src data:"
       HEADER_NAME = "Content-Security-Policy"
       ENV_KEY = 'secure_headers.content_security_policy'
+      USER_AGENT_PARSER = UserAgentParser::Parser.new
 
       DIRECTIVES_1_0 = [
         :default_src,
@@ -133,34 +134,42 @@ module SecureHeaders
       @ua = options[:ua]
       @ssl_request = !!options.delete(:ssl)
       @request_uri = options.delete(:request_uri)
-      @http_additions = config.delete(:http_additions)
-      @disable_img_src_data_uri = !!config.delete(:disable_img_src_data_uri)
-      @tag_report_uri = !!config.delete(:tag_report_uri)
-      @script_hashes = config.delete(:script_hashes) || []
-      @app_name = config.delete(:app_name)
-      @app_name = @app_name.call(@controller) if @app_name.respond_to?(:call)
-      @enforce = config.delete(:enforce)
-      @enforce = @enforce.call(@controller) if @enforce.respond_to?(:call)
-      @enforce = !!@enforce
 
       # Config values can be string, array, or lamdba values
       @config = config.inject({}) do |hash, (key, value)|
-        config_val = value.respond_to?(:call) ? value.call(@controller) : value
+        config_val = if value.respond_to?(:call)
+          warn "[DEPRECATION] secure_headers 3.x will not support procs as config values."
+          value.call(@controller)
+        else
+          value
+        end
+
         if ALL_DIRECTIVES.include?(key.to_sym) # directives need to be normalized to arrays of strings
-          config_val = config_val.split if config_val.is_a? String
+          if config_val.is_a? String
+            warn "[DEPRECATION] A String was supplied for directive #{key}. secure_headers 3.x will require all directives to be arrays of strings."
+            config_val = config_val.split
+          end
           if config_val.is_a?(Array)
             config_val = config_val.map do |val|
               translate_dir_value(val)
             end.flatten.uniq
           end
-        elsif key != :script_hash_middleware
-          raise ArgumentError.new("Unknown directive supplied: #{key}")
         end
 
         hash[key] = config_val
         hash
       end
 
+      @http_additions = @config.delete(:http_additions)
+      @disable_img_src_data_uri = !!@config.delete(:disable_img_src_data_uri)
+      @tag_report_uri = !!@config.delete(:tag_report_uri)
+      @script_hashes = @config.delete(:script_hashes) || []
+      @app_name = @config.delete(:app_name)
+      @app_name = @app_name.call(@controller) if @app_name.respond_to?(:call)
+      @enforce = @config.delete(:enforce)
+      @enforce = @enforce.call(@controller) if @enforce.respond_to?(:call)
+      @enforce = !!@enforce
+
       # normalize and tag the report-uri
       if @config[:report_uri]
         @config[:report_uri] = @config[:report_uri].map do |report_uri|
@@ -258,10 +267,10 @@ module SecureHeaders
 
     def translate_dir_value val
       if %w{inline eval}.include?(val)
-        warn "[DEPRECATION] using inline/eval may not be supported in the future. Instead use 'unsafe-inline'/'unsafe-eval' instead."
+        warn "[DEPRECATION] using inline/eval is not suppored in secure_headers 3.x. Instead use 'unsafe-inline'/'unsafe-eval' instead."
         val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
       elsif %{self none}.include?(val)
-        warn "[DEPRECATION] using self/none may not be supported in the future. Instead use 'self'/'none' instead."
+        warn "[DEPRECATION] using self/none is not suppored in secure_headers 3.x. Instead use 'self'/'none' instead."
         "'#{val}'"
       elsif val == 'nonce'
         if supports_nonces?
@@ -305,7 +314,7 @@ module SecureHeaders
     end
 
     def supported_directives
-      @supported_directives ||= case UserAgentParser.parse(@ua).family
+      @supported_directives ||= case USER_AGENT_PARSER.parse(@ua).family
       when "Chrome"
         CHROME_DIRECTIVES
       when "Safari"
@@ -318,7 +327,7 @@ module SecureHeaders
     end
 
     def supports_nonces?
-      parsed_ua = UserAgentParser.parse(@ua)
+      parsed_ua = USER_AGENT_PARSER.parse(@ua)
       ["Chrome", "Opera", "Firefox"].include?(parsed_ua.family)
     end
   end

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -41,6 +41,7 @@ module SecureHeaders
 
     def validate_config
       if @config.is_a? Hash
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for StrictTransportSecurity config"
         if !@config[:max_age]
           raise STSBuildError.new("No max-age was supplied.")
         elsif @config[:max_age].to_s !~ /\A\d+\z/

data/lib/secure_headers/headers/x_content_type_options.rb

@@ -25,6 +25,7 @@ module SecureHeaders
       when String
         @config
       else
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for XContentTypeOptions config"
         @config[:value]
       end
     end

data/lib/secure_headers/headers/x_download_options.rb

@@ -24,6 +24,7 @@ module SecureHeaders
       when String
         @config
       else
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for XDownloadOptions config"
         @config[:value]
       end
     end

data/lib/secure_headers/headers/x_frame_options.rb

@@ -25,6 +25,7 @@ module SecureHeaders
       when String
         @config
       else
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for XFrameOptions config"
         @config[:value]
       end
     end

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -25,6 +25,7 @@ module SecureHeaders
       when String
         @config
       else
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for XPermittedCrossDomainPolicies config"
         @config[:value]
       end
     end

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -25,6 +25,7 @@ module SecureHeaders
       when String
         @config
       else
+        warn "[DEPRECATION] secure_headers 3.0 will only accept string values for XXssProtection config"
         value = @config[:value].to_s
         value += "; mode=#{@config[:mode]}" if @config[:mode]
         value += "; report=#{@config[:report_uri]}" if @config[:report_uri]

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.4.1"
+  VERSION = "2.5.0"
 end

data/lib/secure_headers.rb

@@ -33,12 +33,18 @@ module SecureHeaders
         :x_xss_protection, :csp, :x_download_options, :script_hashes,
         :x_permitted_cross_domain_policies, :hpkp
 
-      def configure &block
+      # For preparation for the secure_headers 3.x change.
+      def default &block
         instance_eval &block
         if File.exists?(SCRIPT_HASH_CONFIG_FILE)
           ::SecureHeaders::Configuration.script_hashes = YAML.load(File.open(SCRIPT_HASH_CONFIG_FILE))
         end
       end
+
+      def configure &block
+        warn "[DEPRECATION] `configure` is removed in secure_headers 3.x. Instead use `default`."
+        default &block
+      end
     end
   end
 
@@ -52,21 +58,23 @@ module SecureHeaders
 
     def header_hash(options = nil)
       ALL_HEADER_CLASSES.inject({}) do |memo, klass|
-        config = if options.is_a?(Hash) && options[klass::Constants::CONFIG_KEY]
+        # must use !options[key].nil? because 'false' represents opting out, nil
+        # represents use global default.
+        config = if options.is_a?(Hash) && !options[klass::Constants::CONFIG_KEY].nil?
           options[klass::Constants::CONFIG_KEY]
         else
           ::SecureHeaders::Configuration.send(klass::Constants::CONFIG_KEY)
         end
 
         unless klass == SecureHeaders::PublicKeyPins && !config.is_a?(Hash)
-          header = get_a_header(klass::Constants::CONFIG_KEY, klass, config)
-          memo[header.name] = header.value
+          header = get_a_header(klass, config)
+          memo[header.name] = header.value if header
         end
         memo
       end
     end
 
-    def get_a_header(name, klass, options)
+    def get_a_header(klass, options)
       return if options == false
       klass.new(options)
     end
@@ -204,13 +212,14 @@ module SecureHeaders
     # we can't use ||= because I'm overloading false => disable, nil => default
     # both of which trigger the conditional assignment
     def secure_header_options_for(type, options)
+      warn "[DEPRECATION] secure_header_options_for will not be supported in secure_headers 3.x."
       options.nil? ? ::SecureHeaders::Configuration.send(type) : options
     end
 
     def set_a_header(name, klass, options=nil)
       options = secure_header_options_for(name, options)
       return if options == false
-      set_header(SecureHeaders::get_a_header(name, klass, options))
+      set_header(SecureHeaders::get_a_header(klass, options))
     end
 
     def set_header(name_or_header, value=nil)

data/secure_headers.gemspec

@@ -20,4 +20,5 @@ Gem::Specification.new do |gem|
   gem.require_paths = ["lib"]
   gem.add_development_dependency "rake"
   gem.add_dependency "user_agent_parser"
+  gem.post_install_message = "[DEPRECATION] Development has stopped on the 2.x line of secure_headers. It will be maintained, but new features will be added to the 3.x branch. A lot has changed in secure_headers 3.x. A migration guide can be found in the documentation: https://github.com/twitter/secureheaders/blob/master/upgrading-to-3-0.md."
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -142,6 +142,14 @@ module SecureHeaders
     end
 
     describe "#value" do
+      it "does not mutate shared state" do
+        opts = default_opts.merge(enforce: true)
+        policy = ContentSecurityPolicy.new(opts, :request => request_for(CHROME))
+        expect(policy.name).to eq("Content-Security-Policy")
+        policy = ContentSecurityPolicy.new(opts, :request => request_for(CHROME))
+        expect(policy.name).to eq("Content-Security-Policy")
+      end
+
       context "browser sniffing" do
         let(:complex_opts) do
           ALL_DIRECTIVES.inject({}) { |memo, directive| memo[directive] = "'self'"; memo }.merge(:block_all_mixed_content => '')

data/spec/lib/secure_headers/headers/x_content_type_options_spec.rb

@@ -1,3 +1,5 @@
+require 'spec_helper'
+
 module SecureHeaders
   describe XContentTypeOptions do
     specify{ expect(XContentTypeOptions.new.name).to eq("X-Content-Type-Options") }

data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb

@@ -1,3 +1,5 @@
+require 'spec_helper'
+
 module SecureHeaders
   describe XXssProtection do
     specify { expect(XXssProtection.new.name).to eq(X_XSS_PROTECTION_HEADER_NAME)}

data/spec/lib/secure_headers_spec.rb

@@ -8,6 +8,7 @@ describe SecureHeaders do
   let(:request) {double(:ssl? => true, :url => 'https://example.com')}
 
   before(:each) do
+    reset_config
     stub_user_agent(nil)
     allow(headers).to receive(:[])
     allow(subject).to receive(:response).and_return(response)
@@ -19,7 +20,7 @@ describe SecureHeaders do
   end
 
   def reset_config
-    ::SecureHeaders::Configuration.configure do |config|
+    ::SecureHeaders::Configuration.default do |config|
       config.hpkp = nil
       config.hsts = nil
       config.x_frame_options = nil
@@ -138,7 +139,7 @@ describe SecureHeaders do
 
     context "when disabled by configuration settings" do
       it "does not set any headers when disabled" do
-        ::SecureHeaders::Configuration.configure do |config|
+        ::SecureHeaders::Configuration.default do |config|
           config.hsts = false
           config.hpkp = false
           config.x_frame_options = false
@@ -171,8 +172,25 @@ describe SecureHeaders do
       expect_default_values(hash)
     end
 
+    it "allows opting out" do
+      hash = SecureHeaders::header_hash(:csp => false, :hpkp => false)
+      expect(hash['Content-Security-Policy-Report-Only']).to be_nil
+      expect(hash['Content-Security-Policy']).to be_nil
+    end
+
+    it "allows opting out with config" do
+      ::SecureHeaders::Configuration.default do |config|
+        config.hsts = false
+        config.csp = false
+      end
+
+      hash = SecureHeaders::header_hash
+      expect(hash['Content-Security-Policy-Report-Only']).to be_nil
+      expect(hash['Content-Security-Policy']).to be_nil
+    end
+
     it "produces a hash with a mix of config values, override values, and default values" do
-      ::SecureHeaders::Configuration.configure do |config|
+      ::SecureHeaders::Configuration.default do |config|
         config.hsts = { :max_age => '123456'}
         config.hpkp = {
           :enforce => true,
@@ -187,7 +205,7 @@ describe SecureHeaders do
       end
 
       hash = SecureHeaders::header_hash(:csp => {:default_src => "'none'", :img_src => "data:"})
-      ::SecureHeaders::Configuration.configure do |config|
+      ::SecureHeaders::Configuration.default do |config|
         config.hsts = nil
         config.hpkp = nil
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.4.1
+  version: 2.5.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-10-14 00:00:00.000000000 Z
+date: 2016-01-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -50,6 +50,7 @@ files:
 - ".ruby-version"
 - ".travis.yml"
 - Gemfile
+- Guardfile
 - LICENSE
 - README.md
 - Rakefile
@@ -170,7 +171,10 @@ homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
 metadata: {}
-post_install_message: 
+post_install_message: "[DEPRECATION] Development has stopped on the 2.x line of secure_headers.
+  It will be maintained, but new features will be added to the 3.x branch. A lot has
+  changed in secure_headers 3.x. A migration guide can be found in the documentation:
+  https://github.com/twitter/secureheaders/blob/master/upgrading-to-3-0.md."
 rdoc_options: []
 require_paths:
 - lib