secure_headers 2.5.3 → 3.0.0.pre

data/lib/tasks/tasks.rake

@@ -1,48 +0,0 @@
-INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx
-INLINE_HASH_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
-SCRIPT_HASH_CONFIG_FILE = 'config/script_hashes.yml'
-
-namespace :secure_headers do
-  include SecureHeaders::HashHelper
-
-  def is_erb?(filename)
-    filename =~ /\.erb\Z/
-  end
-
-  def generate_inline_script_hashes(filename)
-    file = File.read(filename)
-    hashes = []
-
-    [INLINE_SCRIPT_REGEX, INLINE_HASH_HELPER_REGEX].each do |regex|
-      file.gsub(regex) do # TODO don't use gsub
-        inline_script = Regexp.last_match.captures.last
-        if (filename =~ /\.mustache\Z/ && inline_script =~ /\{\{.*\}\}/) || (is_erb?(filename) && inline_script =~ /<%.*%>/)
-          puts "Looks like there's some dynamic content inside of a script tag :-/"
-          puts "That pretty much means the hash value will never match."
-          puts "Code: " + inline_script
-          puts "=" * 20
-        end
-
-        hashes << hash_source(inline_script)
-      end
-    end
-
-    hashes
-  end
-
-  task :generate_hashes do |t, args|
-    script_hashes = {}
-    Dir.glob("app/{views,templates}/**/*.{erb,mustache}") do |filename|
-      hashes = generate_inline_script_hashes(filename)
-      if hashes.any?
-        script_hashes[filename] = hashes
-      end
-    end
-
-    File.open(SCRIPT_HASH_CONFIG_FILE, 'w') do |file|
-      file.write(script_hashes.to_yaml)
-    end
-
-    puts "Script hashes from " + script_hashes.keys.size.to_s + " files added to #{SCRIPT_HASH_CONFIG_FILE}"
-  end
-end

data/spec/lib/secure_headers/headers/content_security_policy/script_hash_middleware_spec.rb

@@ -1,46 +0,0 @@
-require 'spec_helper'
-require 'secure_headers/headers/content_security_policy/script_hash_middleware'
-
-module SecureHeaders
-  describe ContentSecurityPolicy::ScriptHashMiddleware do
-
-    let(:app) { double(:call => [200, headers, '']) }
-    let(:env) { double }
-    let(:headers) { double }
-
-    let(:default_config) do
-      {
-        :default_src => 'https://*',
-        :report_uri => '/csp_report',
-        :script_src => "'unsafe-inline' 'unsafe-eval' https://* data:",
-        :style_src => "'unsafe-inline' https://* about:"
-      }
-    end
-
-    def should_assign_header name, value
-      expect(headers).to receive(:[]=).with(name, value)
-    end
-
-    def call_middleware(hashes = [])
-      options = {
-        :ua => USER_AGENTS[:chrome]
-      }
-      expect(env).to receive(:[]).with(HASHES_ENV_KEY).and_return(hashes)
-      expect(env).to receive(:[]).with(ENV_KEY).and_return(
-        :config => default_config,
-        :options => options
-      )
-      ContentSecurityPolicy::ScriptHashMiddleware.new(app).call(env)
-    end
-
-    it "adds hashes stored in env to the header" do
-      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*'sha256-/)
-      call_middleware(['sha256-abc123'])
-    end
-
-    it "leaves things alone when no hashes are saved to env" do
-      should_assign_header(HEADER_NAME + "-Report-Only", /script-src[^;]*(?!'sha256-)/)
-      call_middleware()
-    end
-  end
-end