secure_headers 3.0.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ed9f86aeaa22e01fb8d842a43ff1607cb8083b6a
-  data.tar.gz: b71a52f6790c7a0f78053695038cb925e2c4895a
+  metadata.gz: e2df8c83dc908657d48aa5552696bade1374c288
+  data.tar.gz: 590bc0e2c9225ad3a330af1812babd6c129135d8
 SHA512:
-  metadata.gz: 699085b909d21178a40e9f109687b3d9dd6dd21bb7250d81a33aca7b682627ad79f0c59941647b82f0492f2d25aae513ad825826d38760c579518b7c2d8ee508
-  data.tar.gz: 89d8d3c867306921bff9a7f5a09f2708a54eecdce5a57a83cd8c505253afbd46ae67d489beef5cb8f5eba678235110ae50e69f9e82c1391dd53c125ede53cb73
+  metadata.gz: f6b8665ddd8e15bfd9f9e5fe2d330e9e7e9cc1386813883613e295e6d114c072f8bb1713871fde12e9feb8a3df8f691b39477a9db8daeb90f49013ecf44e7b8d
+  data.tar.gz: 713914b24728468981c723801891e07eeee044f63d7eca97106ef0c0d0376cc0ed4a00ae49177c14d83a5ef445c1cb0b7d6e43472446042f6ee33201f99c2001

data/.gitignore

@@ -6,17 +6,8 @@
 .yardoc
 *.log
 Gemfile.lock
-InstalledFiles
 _yardoc
 coverage
-doc/
-lib/bundler/man
 pkg
 rdoc
 spec/reports
-test/tmp
-test/version_tmp
-*tmp
-*.sqlite3
-fixtures/rails_3_2_12_no_init/log
-fixtures/rails_3_2_12/log

data/.travis.yml

@@ -1,13 +1,21 @@
 language: ruby
 
 rvm:
-  - "2.2"
-  - "2.1"
-  - "2.0.0"
-  - "1.9.3"
-  - "jruby-19mode"
+  - ruby-head
+  - 2.2
+  - 2.1
+  - 2.0.0
+  - 1.9.3
+  - jruby-19mode
+  - jruby-head
+
+matrix:
+  allow_failures:
+    - rvm: jruby-head
+    - rvm: ruby-head
 
 before_install: gem update bundler
+bundler_args: --without guard -j 3
 
 sudo: false
 cache: bundler

data/CHANGELOG.md

@@ -1,3 +1,51 @@
+## 3.1.1 Bug fix for regression
+
+See https://github.com/twitter/secureheaders/pull/235
+
+`idempotent_additions?` would return false when comparing `OPT_OUT` with `OPT_OUT`, causing `header_hash_for` to return a header cache with `{ nil => nil }` which cause the middleware to blow up when `{ nil => nil }` was merged into the rack header hash.
+
+This is a regression in 3.1.0 only.
+
+Now it returns true. I've added a test case to ensure that `header_hash_for` will never return such an element.
+
+## 3.1.0 Adding secure cookie support
+
+New feature: marking all cookies as secure. Added by @jmera in https://github.com/twitter/secureheaders/pull/231. In the future, we'll probably add the ability to whitelist individual cookies that should not be marked secure. PRs welcome.
+
+Internal refactoring: In https://github.com/twitter/secureheaders/pull/232, we changed the way dynamic CSP is handled internally. The biggest benefit is that highly dynamic policies (which can happen with multiple `append/override` calls per request) are handled better:
+
+1. Only the CSP header cache is busted when using a dynamic policy. All other headers are preserved and don't need to be generated. Dynamic X-Frame-Options changes modify the cache directly.
+1. Idempotency checks for policy modifications are deferred until the end of the request lifecycle and only happen once, instead of per `append/override` call. The idempotency check itself is fairly expensive itself.
+1. CSP header string is produced at most once per request.
+
+## 3.0.3
+
+Bug fix for handling policy merges where appending a non-default source value (report-uri, plugin-types, frame-ancestors, base-uri, and form-action) would be combined with the default-src value. Appending a directive that doesn't exist in the current policy combines the new value with `default-src` to mimic the actual behavior of the addition. However, this does not make sense for non-default-src values (a.k.a. "fetch directives") and can lead to unexpected behavior like a `report-uri` value of `*`. Previously, this config:
+
+```
+{
+  default_src => %w(*)
+}
+```
+
+When appending:
+
+```
+{
+  report_uri => %w(https://report-uri.io/asdf)
+}
+```
+
+Would result in `default-src *; report-uri *` which doesn't make any sense at all.
+
+## 3.0.2
+
+Bug fix for handling CSP configs that supply a frozen hash. If a directive value is `nil`, then appending to a config with a frozen hash would cause an error since we're trying to modify a frozen hash. See https://github.com/twitter/secureheaders/pull/223.
+
+## 3.0.1
+
+Adds `upgrade-insecure-requests` support for requests from Firefox and Chrome (and Opera). See [the spec](https://www.w3.org/TR/upgrade-insecure-requests/) for details.
+
 ## 3.0.0
 
 secure_headers 3.0.0 is a near-complete, not-entirely-backward-compatible rewrite. Please see the [upgrade guide](https://github.com/twitter/secureheaders/blob/master/upgrading-to-3-0.md) for an in-depth explanation of the changes and the suggested upgrade path.

data/Gemfile

@@ -6,9 +6,12 @@ group :test do
   gem "tins", "~> 1.6.0" # 1.7 requires ruby 2.0
   gem "pry-nav"
   gem "rack"
+  gem "rspec"
+  gem "coveralls"
+end
+
+group :guard do
   gem "guard-rspec", platforms: [:ruby_19, :ruby_20, :ruby_21, :ruby_22]
-  gem "rspec", ">= 3.1"
   gem "growl"
   gem "rb-fsevent"
-  gem "coveralls", platforms: [:ruby_19, :ruby_20, :ruby_21, :ruby_22]
 end

data/README.md

@@ -15,6 +15,8 @@ The gem will automatically apply several headers that are related to security.
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
 - Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinning Specification](https://tools.ietf.org/html/rfc7469)
 
+It can also mark all http cookies with the secure attribute (when configured to do so).
+
 `secure_headers` is a library with a global config, per request overrides, and rack middleware that enables you customize your application settings.
 
 ## Use
@@ -29,7 +31,8 @@ All `nil` values will fallback to their default values. `SecureHeaders::OPT_OUT`
 
 ```ruby
 SecureHeaders::Configuration.default do |config|
-  config.hsts = "max-age=#{20.years.to_i}"
+  config.secure_cookies = true # mark all cookies as "secure"
+  config.hsts = "max-age=#{20.years.to_i}; includeSubdomains; preload"
   config.x_frame_options = "DENY"
   config.x_content_type_options = "nosniff"
   config.x_xss_protection = "1; mode=block"
@@ -56,13 +59,14 @@ SecureHeaders::Configuration.default do |config|
     frame_ancestors: %w('none'),
     plugin_types: %w(application/x-shockwave-flash),
     block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
-    report_uri: %w(https://example.com/uri-directive)
+    upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
+    report_uri: %w(https://report-uri.io/example-csp)
   }
   config.hpkp = {
     report_only: false,
     max_age: 60.days.to_i,
     include_subdomains: true,
-    report_uri: "https://example.com/uri-directive",
+    report_uri: "https://report-uri.io/example-hpkp",
     pins: [
       {sha256: "abc"},
       {sha256: "123"}
@@ -130,7 +134,7 @@ By default, a noop configuration is provided. No headers will be set when this d
 ```ruby
 class MyController < ApplicationController
   def index
-    SecureHeaders::opt_out_of_all_protection(request)
+    SecureHeaders.opt_out_of_all_protection(request)
   end
 end
 ```
@@ -174,7 +178,7 @@ When manipulating content security policy, there are a few things to consider. T
 
 #### Append to the policy with a directive other than `default_src`
 
-The value of `default_src` is joined with the addition. Note the `https:` is carried over from the `default-src` config. If you do not want this, use `override_content_security_policy_directives` instead. To illustrate:
+The value of `default_src` is joined with the addition if the it is a [fetch directive](https://w3c.github.io/webappsec-csp/#directives-fetch). Note the `https:` is carried over from the `default-src` config. If you do not want this, use `override_content_security_policy_directives` instead. To illustrate:
 
 ```ruby
 ::SecureHeaders::Configuration.default do |config|
@@ -191,7 +195,7 @@ Code  | Result
 
 #### Nonce
 
-script/style-nonce can be used to whitelist inline content. To do this, call the SecureHeaders::content_security_policy_nonce then set the nonce attributes on the various tags.
+script/style-nonce can be used to whitelist inline content. To do this, call the `SecureHeaders.content_security_policy_nonce` then set the nonce attributes on the various tags.
 
 Setting a nonce will also set 'unsafe-inline' for browsers that don't support nonces for backwards compatibility. 'unsafe-inline' is ignored if a nonce is present in a directive in compliant browsers.
 
@@ -254,7 +258,7 @@ config.hpkp = {
     {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
   ],
   report_only: true,            # defaults to false (report-only mode)
-  report_uri: '//example.com/uri-directive',
+  report_uri: 'https://report-uri.io/example-hpkp',
   app_name: 'example',
   tag_report_uri: true
 }
@@ -280,49 +284,12 @@ class Donkey < Sinatra::Application
   set :root, APP_ROOT
 
   get '/' do
-    SecureHeaders.override_x_frame_options(SecureHeaders::OPT_OUT)
+    SecureHeaders.override_x_frame_options(request, SecureHeaders::OPT_OUT)
     haml :index
   end
 end
 ```
 
-### Using with Padrino
-
-You can use SecureHeaders for Padrino applications as well:
-
-In your `Gemfile`:
-
-```ruby
-  gem "secure_headers", require: 'secure_headers'
-```
-
-then in your `app.rb` file you can:
-
-```ruby
-Padrino.use(SecureHeaders::Middleware)
-require 'secure_headers/padrino'
-
-module Web
-  class App < Padrino::Application
-    register SecureHeaders::Padrino
-
-    get '/' do
-      render 'index'
-    end
-  end
-end
-```
-
-and in `config/boot.rb`:
-
-```ruby
-def before_load
-  SecureHeaders::Configuration.default do |config|
-    ...
-  end
-end
-```
-
 ## Similar libraries
 
 * Rack [rack-secure_headers](https://github.com/frodsan/rack-secure_headers)
@@ -333,6 +300,8 @@ end
 * Python - [django-csp](https://github.com/mozilla/django-csp) + [commonware](https://github.com/jsocol/commonware/); [django-security](https://github.com/sdelements/django-security)
 * Go - [secureheader](https://github.com/kr/secureheader)
 * Elixir [secure_headers](https://github.com/anotherhale/secure_headers)
+* Dropwizard [dropwizard-web-security](https://github.com/palantir/dropwizard-web-security)
+* Ember.js [ember-cli-content-security-policy](https://github.com/rwjblue/ember-cli-content-security-policy/)
 
 ## License
 

data/lib/secure_headers/configuration.rb

@@ -3,6 +3,7 @@ module SecureHeaders
     DEFAULT_CONFIG = :default
     NOOP_CONFIGURATION = "secure_headers_noop_config"
     class NotYetConfiguredError < StandardError; end
+    class IllegalPolicyModificationError < StandardError; end
     class << self
       # Public: Set the global default configuration.
       #
@@ -23,12 +24,12 @@ module SecureHeaders
       # if no value is supplied.
       #
       # Returns: the newly created config
-      def override(name, base = DEFAULT_CONFIG)
+      def override(name, base = DEFAULT_CONFIG, &block)
         unless get(base)
           raise NotYetConfiguredError, "#{base} policy not yet supplied"
         end
         override = @configurations[base].dup
-        yield(override)
+        override.instance_eval &block if block_given?
         add_configuration(name, override)
       end
 
@@ -43,18 +44,6 @@ module SecureHeaders
         @configurations[name]
       end
 
-      # Public: perform a basic deep dup. The shallow copy provided by dup/clone
-      # can lead to modifying parent objects.
-      def deep_copy(config)
-        config.each_with_object({}) do |(key, value), hash|
-          hash[key] = if value.is_a?(Array)
-            value.dup
-          else
-            value
-          end
-        end
-      end
-
       private
 
       # Private: add a valid configuration to the global set of named configs.
@@ -82,20 +71,44 @@ module SecureHeaders
           ALL_HEADER_CLASSES.each do |klass|
             config.send("#{klass::CONFIG_KEY}=", OPT_OUT)
           end
+          config.dynamic_csp = OPT_OUT
         end
 
         add_configuration(NOOP_CONFIGURATION, noop_config)
       end
+
+      # Public: perform a basic deep dup. The shallow copy provided by dup/clone
+      # can lead to modifying parent objects.
+      def deep_copy(config)
+        config.each_with_object({}) do |(key, value), hash|
+          hash[key] = if value.is_a?(Array)
+            value.dup
+          else
+            value
+          end
+        end
+      end
+
+      # Private: convenience method purely DRY things up. The value may not be a
+      # hash (e.g. OPT_OUT, nil)
+      def deep_copy_if_hash(value)
+        if value.is_a?(Hash)
+          deep_copy(value)
+        else
+          value
+        end
+      end
     end
 
-    attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-      :x_xss_protection, :csp, :x_download_options, :x_permitted_cross_domain_policies,
-      :hpkp
-    attr_reader :cached_headers
+    attr_writer :hsts, :x_frame_options, :x_content_type_options,
+      :x_xss_protection, :x_download_options, :x_permitted_cross_domain_policies,
+      :hpkp, :dynamic_csp, :secure_cookies
+
+    attr_reader :cached_headers, :csp, :dynamic_csp, :secure_cookies
 
     def initialize(&block)
       self.hpkp = OPT_OUT
-      self.csp = self.class.deep_copy(CSP::DEFAULT_CONFIG)
+      self.csp = self.class.send(:deep_copy, CSP::DEFAULT_CONFIG)
       instance_eval &block if block_given?
     end
 
@@ -104,33 +117,37 @@ module SecureHeaders
     # Returns a deep-dup'd copy of this configuration.
     def dup
       copy = self.class.new
-      copy.hsts = hsts
-      copy.x_frame_options = x_frame_options
-      copy.x_content_type_options = x_content_type_options
-      copy.x_xss_protection = x_xss_protection
-      copy.x_download_options = x_download_options
-      copy.x_permitted_cross_domain_policies = x_permitted_cross_domain_policies
-      copy.csp = if csp.is_a?(Hash)
-        self.class.deep_copy(csp)
-      else
-        csp
+      copy.secure_cookies = @secure_cookies
+      copy.csp = self.class.send(:deep_copy_if_hash, @csp)
+      copy.dynamic_csp = self.class.send(:deep_copy_if_hash, @dynamic_csp)
+      copy.cached_headers = self.class.send(:deep_copy_if_hash, @cached_headers)
+      copy
+    end
+
+    def opt_out(header)
+      send("#{header}=", OPT_OUT)
+      if header == CSP::CONFIG_KEY
+        dynamic_csp = OPT_OUT
       end
+      self.cached_headers.delete(header)
+    end
+
+    def update_x_frame_options(value)
+      self.cached_headers[XFrameOptions::CONFIG_KEY] = XFrameOptions.make_header(value)
+    end
 
-      copy.hpkp = if hpkp.is_a?(Hash)
-        self.class.deep_copy(hpkp)
-      else
-        hpkp
+    # Public: generated cached headers for a specific user agent.
+    def rebuild_csp_header_cache!(user_agent)
+      self.cached_headers[CSP::CONFIG_KEY] = {}
+      unless current_csp == OPT_OUT
+        user_agent = UserAgent.parse(user_agent)
+        variation = CSP.ua_to_variation(user_agent)
+        self.cached_headers[CSP::CONFIG_KEY][variation] = CSP.make_header(current_csp, user_agent)
       end
-      copy
     end
 
-    # Public: Retrieve a config based on the CONFIG_KEY for a class
-    #
-    # Returns the value if available, and returns a dup of any hash values.
-    def fetch(key)
-      config = send(key)
-      config = self.class.deep_copy(config) if config.is_a?(Hash)
-      config
+    def current_csp
+      @dynamic_csp || @csp
     end
 
     # Public: validates all configurations values.
@@ -139,16 +156,32 @@ module SecureHeaders
     #
     # Returns nothing
     def validate_config!
-      StrictTransportSecurity.validate_config!(hsts)
-      ContentSecurityPolicy.validate_config!(csp)
-      XFrameOptions.validate_config!(x_frame_options)
-      XContentTypeOptions.validate_config!(x_content_type_options)
-      XXssProtection.validate_config!(x_xss_protection)
-      XDownloadOptions.validate_config!(x_download_options)
-      XPermittedCrossDomainPolicies.validate_config!(x_permitted_cross_domain_policies)
-      PublicKeyPins.validate_config!(hpkp)
+      StrictTransportSecurity.validate_config!(@hsts)
+      ContentSecurityPolicy.validate_config!(@csp)
+      XFrameOptions.validate_config!(@x_frame_options)
+      XContentTypeOptions.validate_config!(@x_content_type_options)
+      XXssProtection.validate_config!(@x_xss_protection)
+      XDownloadOptions.validate_config!(@x_download_options)
+      XPermittedCrossDomainPolicies.validate_config!(@x_permitted_cross_domain_policies)
+      PublicKeyPins.validate_config!(@hpkp)
     end
 
+    protected
+
+    def csp=(new_csp)
+      if self.dynamic_csp
+        raise IllegalPolicyModificationError, "You are attempting to modify CSP settings directly. Use dynamic_csp= isntead."
+      end
+
+      @csp = new_csp
+    end
+
+    def cached_headers=(headers)
+      @cached_headers = headers
+    end
+
+    private
+
     # Public: Precompute the header names and values for this configuraiton.
     # Ensures that headers generated at configure time, not on demand.
     #
@@ -156,7 +189,7 @@ module SecureHeaders
     def cache_headers!
       # generate defaults for the "easy" headers
       headers = (ALL_HEADERS_BESIDES_CSP).each_with_object({}) do |klass, hash|
-        config = fetch(klass::CONFIG_KEY)
+        config = instance_variable_get("@#{klass::CONFIG_KEY}")
         unless config == OPT_OUT
           hash[klass::CONFIG_KEY] = klass.make_header(config).freeze
         end
@@ -165,7 +198,7 @@ module SecureHeaders
       generate_csp_headers(headers)
 
       headers.freeze
-      @cached_headers = headers
+      self.cached_headers = headers
     end
 
     # Private: adds CSP headers for each variation of CSP support.
@@ -175,11 +208,10 @@ module SecureHeaders
     #
     # Returns nothing
     def generate_csp_headers(headers)
-      unless csp == OPT_OUT
+      unless @csp == OPT_OUT
         headers[CSP::CONFIG_KEY] = {}
-
+        csp_config = self.current_csp
         CSP::VARIATIONS.each do |name, _|
-          csp_config = fetch(CSP::CONFIG_KEY)
           csp = CSP.make_header(csp_config, UserAgent.parse(name))
           headers[CSP::CONFIG_KEY][name] = csp.freeze
         end