secure_headers 3.0.3 → 3.2.0

data/lib/secure_headers/configuration.rb

@@ -1,8 +1,11 @@
+require 'yaml'
+
 module SecureHeaders
   class Configuration
     DEFAULT_CONFIG = :default
     NOOP_CONFIGURATION = "secure_headers_noop_config"
     class NotYetConfiguredError < StandardError; end
+    class IllegalPolicyModificationError < StandardError; end
     class << self
       # Public: Set the global default configuration.
       #
@@ -23,12 +26,12 @@ module SecureHeaders
       # if no value is supplied.
       #
       # Returns: the newly created config
-      def override(name, base = DEFAULT_CONFIG)
+      def override(name, base = DEFAULT_CONFIG, &block)
         unless get(base)
           raise NotYetConfiguredError, "#{base} policy not yet supplied"
         end
         override = @configurations[base].dup
-        yield(override)
+        override.instance_eval &block if block_given?
         add_configuration(name, override)
       end
 
@@ -43,18 +46,6 @@ module SecureHeaders
         @configurations[name]
       end
 
-      # Public: perform a basic deep dup. The shallow copy provided by dup/clone
-      # can lead to modifying parent objects.
-      def deep_copy(config)
-        config.each_with_object({}) do |(key, value), hash|
-          hash[key] = if value.is_a?(Array)
-            value.dup
-          else
-            value
-          end
-        end
-      end
-
       private
 
       # Private: add a valid configuration to the global set of named configs.
@@ -82,20 +73,51 @@ module SecureHeaders
           ALL_HEADER_CLASSES.each do |klass|
             config.send("#{klass::CONFIG_KEY}=", OPT_OUT)
           end
+          config.dynamic_csp = OPT_OUT
         end
 
         add_configuration(NOOP_CONFIGURATION, noop_config)
       end
+
+      # Public: perform a basic deep dup. The shallow copy provided by dup/clone
+      # can lead to modifying parent objects.
+      def deep_copy(config)
+        config.each_with_object({}) do |(key, value), hash|
+          hash[key] = if value.is_a?(Array)
+            value.dup
+          else
+            value
+          end
+        end
+      end
+
+      # Private: convenience method purely DRY things up. The value may not be a
+      # hash (e.g. OPT_OUT, nil)
+      def deep_copy_if_hash(value)
+        if value.is_a?(Hash)
+          deep_copy(value)
+        else
+          value
+        end
+      end
     end
 
-    attr_accessor :hsts, :x_frame_options, :x_content_type_options,
-      :x_xss_protection, :csp, :x_download_options, :x_permitted_cross_domain_policies,
-      :hpkp
-    attr_reader :cached_headers
+    attr_writer :hsts, :x_frame_options, :x_content_type_options,
+      :x_xss_protection, :x_download_options, :x_permitted_cross_domain_policies,
+      :hpkp, :dynamic_csp, :cookies
+
+    attr_reader :cached_headers, :csp, :dynamic_csp, :cookies
+
+    HASH_CONFIG_FILE = ENV["secure_headers_generated_hashes_file"] || "config/secure_headers_generated_hashes.yml"
+    if File.exists?(HASH_CONFIG_FILE)
+      config = YAML.safe_load(File.open(HASH_CONFIG_FILE))
+      @script_hashes = config["scripts"]
+      @style_hashes = config["styles"]
+    end
 
     def initialize(&block)
       self.hpkp = OPT_OUT
-      self.csp = self.class.deep_copy(CSP::DEFAULT_CONFIG)
+      self.csp = self.class.send(:deep_copy, CSP::DEFAULT_CONFIG)
       instance_eval &block if block_given?
     end
 
@@ -104,33 +126,45 @@ module SecureHeaders
     # Returns a deep-dup'd copy of this configuration.
     def dup
       copy = self.class.new
-      copy.hsts = hsts
-      copy.x_frame_options = x_frame_options
-      copy.x_content_type_options = x_content_type_options
-      copy.x_xss_protection = x_xss_protection
-      copy.x_download_options = x_download_options
-      copy.x_permitted_cross_domain_policies = x_permitted_cross_domain_policies
-      copy.csp = if csp.is_a?(Hash)
-        self.class.deep_copy(csp)
-      else
-        csp
+      copy.cookies = @cookies
+      copy.csp = self.class.send(:deep_copy_if_hash, @csp)
+      copy.dynamic_csp = self.class.send(:deep_copy_if_hash, @dynamic_csp)
+      copy.cached_headers = self.class.send(:deep_copy_if_hash, @cached_headers)
+      copy.x_content_type_options = @x_content_type_options
+      copy.hsts = @hsts
+      copy.x_frame_options = @x_frame_options
+      copy.x_xss_protection = @x_xss_protection
+      copy.x_download_options = @x_download_options
+      copy.x_permitted_cross_domain_policies = @x_permitted_cross_domain_policies
+      copy.hpkp = @hpkp
+      copy
+    end
+
+    def opt_out(header)
+      send("#{header}=", OPT_OUT)
+      if header == CSP::CONFIG_KEY
+        dynamic_csp = OPT_OUT
       end
+      self.cached_headers.delete(header)
+    end
+
+    def update_x_frame_options(value)
+      @x_frame_options = value
+      self.cached_headers[XFrameOptions::CONFIG_KEY] = XFrameOptions.make_header(value)
+    end
 
-      copy.hpkp = if hpkp.is_a?(Hash)
-        self.class.deep_copy(hpkp)
-      else
-        hpkp
+    # Public: generated cached headers for a specific user agent.
+    def rebuild_csp_header_cache!(user_agent)
+      self.cached_headers[CSP::CONFIG_KEY] = {}
+      unless current_csp == OPT_OUT
+        user_agent = UserAgent.parse(user_agent)
+        variation = CSP.ua_to_variation(user_agent)
+        self.cached_headers[CSP::CONFIG_KEY][variation] = CSP.make_header(current_csp, user_agent)
       end
-      copy
     end
 
-    # Public: Retrieve a config based on the CONFIG_KEY for a class
-    #
-    # Returns the value if available, and returns a dup of any hash values.
-    def fetch(key)
-      config = send(key)
-      config = self.class.deep_copy(config) if config.is_a?(Hash)
-      config
+    def current_csp
+      @dynamic_csp || @csp
     end
 
     # Public: validates all configurations values.
@@ -139,16 +173,38 @@ module SecureHeaders
     #
     # Returns nothing
     def validate_config!
-      StrictTransportSecurity.validate_config!(hsts)
-      ContentSecurityPolicy.validate_config!(csp)
-      XFrameOptions.validate_config!(x_frame_options)
-      XContentTypeOptions.validate_config!(x_content_type_options)
-      XXssProtection.validate_config!(x_xss_protection)
-      XDownloadOptions.validate_config!(x_download_options)
-      XPermittedCrossDomainPolicies.validate_config!(x_permitted_cross_domain_policies)
-      PublicKeyPins.validate_config!(hpkp)
+      StrictTransportSecurity.validate_config!(@hsts)
+      ContentSecurityPolicy.validate_config!(@csp)
+      XFrameOptions.validate_config!(@x_frame_options)
+      XContentTypeOptions.validate_config!(@x_content_type_options)
+      XXssProtection.validate_config!(@x_xss_protection)
+      XDownloadOptions.validate_config!(@x_download_options)
+      XPermittedCrossDomainPolicies.validate_config!(@x_permitted_cross_domain_policies)
+      PublicKeyPins.validate_config!(@hpkp)
+      Cookie.validate_config!(@cookies)
     end
 
+    def secure_cookies=(secure_cookies)
+      Kernel.warn "#{Kernel.caller.first}: [DEPRECATION] `#secure_cookies=` is deprecated. Please use `#cookies=` to configure secure cookies instead."
+      @cookies = (@cookies || {}).merge(secure: secure_cookies)
+    end
+
+    protected
+
+    def csp=(new_csp)
+      if self.dynamic_csp
+        raise IllegalPolicyModificationError, "You are attempting to modify CSP settings directly. Use dynamic_csp= instead."
+      end
+
+      @csp = new_csp
+    end
+
+    def cached_headers=(headers)
+      @cached_headers = headers
+    end
+
+    private
+
     # Public: Precompute the header names and values for this configuraiton.
     # Ensures that headers generated at configure time, not on demand.
     #
@@ -156,7 +212,7 @@ module SecureHeaders
     def cache_headers!
       # generate defaults for the "easy" headers
       headers = (ALL_HEADERS_BESIDES_CSP).each_with_object({}) do |klass, hash|
-        config = fetch(klass::CONFIG_KEY)
+        config = instance_variable_get("@#{klass::CONFIG_KEY}")
         unless config == OPT_OUT
           hash[klass::CONFIG_KEY] = klass.make_header(config).freeze
         end
@@ -165,7 +221,7 @@ module SecureHeaders
       generate_csp_headers(headers)
 
       headers.freeze
-      @cached_headers = headers
+      self.cached_headers = headers
     end
 
     # Private: adds CSP headers for each variation of CSP support.
@@ -175,11 +231,10 @@ module SecureHeaders
     #
     # Returns nothing
     def generate_csp_headers(headers)
-      unless csp == OPT_OUT
+      unless @csp == OPT_OUT
         headers[CSP::CONFIG_KEY] = {}
-
+        csp_config = self.current_csp
         CSP::VARIATIONS.each do |name, _|
-          csp_config = fetch(CSP::CONFIG_KEY)
           csp = CSP.make_header(csp_config, UserAgent.parse(name))
           headers[CSP::CONFIG_KEY][name] = csp.freeze
         end

data/lib/secure_headers/hash_helper.rb

@@ -0,0 +1,10 @@
+require 'base64'
+
+module SecureHeaders
+  module HashHelper
+    def hash_source(inline_script, digest = :SHA256)
+      base64_hashed_content = Base64.encode64(Digest.const_get(digest).digest(inline_script)).chomp
+      "'#{digest.to_s.downcase}-#{base64_hashed_content}'"
+    end
+  end
+end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,296 +1,9 @@
-require 'uri'
-require 'base64'
-require 'securerandom'
-require 'json'
+require_relative 'policy_management'
 
 module SecureHeaders
   class ContentSecurityPolicyConfigError < StandardError; end
   class ContentSecurityPolicy
-    MODERN_BROWSERS = %w(Chrome Opera Firefox)
-    DEFAULT_VALUE = "default-src https:".freeze
-    DEFAULT_CONFIG = { default_src: %w(https:) }.freeze
-    HEADER_NAME = "Content-Security-Policy".freeze
-    REPORT_ONLY = "Content-Security-Policy-Report-Only".freeze
-    HEADER_NAMES = [HEADER_NAME, REPORT_ONLY]
-    DATA_PROTOCOL = "data:".freeze
-    BLOB_PROTOCOL = "blob:".freeze
-    SELF = "'self'".freeze
-    NONE = "'none'".freeze
-    STAR = "*".freeze
-    UNSAFE_INLINE = "'unsafe-inline'".freeze
-    UNSAFE_EVAL = "'unsafe-eval'".freeze
-
-    # leftover deprecated values that will be in common use upon upgrading.
-    DEPRECATED_SOURCE_VALUES = [SELF, NONE, UNSAFE_EVAL, UNSAFE_INLINE, "inline", "eval"].map { |value| value.delete("'") }.freeze
-
-    DEFAULT_SRC = :default_src
-    CONNECT_SRC = :connect_src
-    FONT_SRC = :font_src
-    FRAME_SRC = :frame_src
-    IMG_SRC = :img_src
-    MEDIA_SRC = :media_src
-    OBJECT_SRC = :object_src
-    SANDBOX = :sandbox
-    SCRIPT_SRC = :script_src
-    STYLE_SRC = :style_src
-    REPORT_URI = :report_uri
-
-    DIRECTIVES_1_0 = [
-      DEFAULT_SRC,
-      CONNECT_SRC,
-      FONT_SRC,
-      FRAME_SRC,
-      IMG_SRC,
-      MEDIA_SRC,
-      OBJECT_SRC,
-      SANDBOX,
-      SCRIPT_SRC,
-      STYLE_SRC,
-      REPORT_URI
-    ].freeze
-
-    BASE_URI = :base_uri
-    CHILD_SRC = :child_src
-    FORM_ACTION = :form_action
-    FRAME_ANCESTORS = :frame_ancestors
-    PLUGIN_TYPES = :plugin_types
-
-    # These are directives that do not inherit the default-src value. This is
-    # useful when calling #combine_policies.
-    NON_DEFAULT_SOURCES = [
-      BASE_URI,
-      FORM_ACTION,
-      FRAME_ANCESTORS,
-      PLUGIN_TYPES,
-      REPORT_URI
-    ]
-
-    DIRECTIVES_2_0 = [
-      DIRECTIVES_1_0,
-      BASE_URI,
-      CHILD_SRC,
-      FORM_ACTION,
-      FRAME_ANCESTORS,
-      PLUGIN_TYPES
-    ].flatten.freeze
-
-    # All the directives currently under consideration for CSP level 3.
-    # https://w3c.github.io/webappsec/specs/CSP2/
-    MANIFEST_SRC = :manifest_src
-    REFLECTED_XSS = :reflected_xss
-    DIRECTIVES_3_0 = [
-      DIRECTIVES_2_0,
-      MANIFEST_SRC,
-      REFLECTED_XSS
-    ].flatten.freeze
-
-    # All the directives that are not currently in a formal spec, but have
-    # been implemented somewhere.
-    BLOCK_ALL_MIXED_CONTENT = :block_all_mixed_content
-    UPGRADE_INSECURE_REQUESTS = :upgrade_insecure_requests
-    DIRECTIVES_DRAFT = [
-      BLOCK_ALL_MIXED_CONTENT,
-      UPGRADE_INSECURE_REQUESTS
-    ].freeze
-
-    SAFARI_DIRECTIVES = DIRECTIVES_1_0
-
-    FIREFOX_UNSUPPORTED_DIRECTIVES = [
-      BLOCK_ALL_MIXED_CONTENT,
-      CHILD_SRC,
-      PLUGIN_TYPES
-    ].freeze
-
-    FIREFOX_DIRECTIVES = (
-      DIRECTIVES_2_0 + DIRECTIVES_DRAFT - FIREFOX_UNSUPPORTED_DIRECTIVES
-    ).freeze
-
-    CHROME_DIRECTIVES = (
-      DIRECTIVES_2_0 + DIRECTIVES_DRAFT
-    ).freeze
-
-    ALL_DIRECTIVES = [DIRECTIVES_1_0 + DIRECTIVES_2_0 + DIRECTIVES_3_0 + DIRECTIVES_DRAFT].flatten.uniq.sort
-
-    # Think of default-src and report-uri as the beginning and end respectively,
-    # everything else is in between.
-    BODY_DIRECTIVES = ALL_DIRECTIVES - [DEFAULT_SRC, REPORT_URI]
-
-    VARIATIONS = {
-      "Chrome" => CHROME_DIRECTIVES,
-      "Opera" => CHROME_DIRECTIVES,
-      "Firefox" => FIREFOX_DIRECTIVES,
-      "Safari" => SAFARI_DIRECTIVES,
-      "Other" => CHROME_DIRECTIVES
-    }.freeze
-
-    OTHER = "Other".freeze
-
-    DIRECTIVE_VALUE_TYPES = {
-      BASE_URI                  => :source_list,
-      BLOCK_ALL_MIXED_CONTENT   => :boolean,
-      CHILD_SRC                 => :source_list,
-      CONNECT_SRC               => :source_list,
-      DEFAULT_SRC               => :source_list,
-      FONT_SRC                  => :source_list,
-      FORM_ACTION               => :source_list,
-      FRAME_ANCESTORS           => :source_list,
-      FRAME_SRC                 => :source_list,
-      IMG_SRC                   => :source_list,
-      MANIFEST_SRC              => :source_list,
-      MEDIA_SRC                 => :source_list,
-      OBJECT_SRC                => :source_list,
-      PLUGIN_TYPES              => :source_list,
-      REFLECTED_XSS             => :string,
-      REPORT_URI                => :source_list,
-      SANDBOX                   => :string,
-      SCRIPT_SRC                => :source_list,
-      STYLE_SRC                 => :source_list,
-      UPGRADE_INSECURE_REQUESTS => :boolean
-    }.freeze
-
-    CONFIG_KEY = :csp
-    STAR_REGEXP = Regexp.new(Regexp.escape(STAR))
-    HTTP_SCHEME_REGEX = %r{\Ahttps?://}
-
-    WILDCARD_SOURCES = [
-      UNSAFE_EVAL,
-      UNSAFE_INLINE,
-      STAR,
-      DATA_PROTOCOL,
-      BLOB_PROTOCOL
-    ].freeze
-
-    META_CONFIGS = [
-      :report_only,
-      :preserve_schemes
-    ].freeze
-
-    class << self
-      # Public: generate a header name, value array that is user-agent-aware.
-      #
-      # Returns a default policy if no configuration is provided, or a
-      # header name and value based on the config.
-      def make_header(config, user_agent)
-        header = new(config, user_agent)
-        [header.name, header.value]
-      end
-
-      # Public: Validates each source expression.
-      #
-      # Does not validate the invididual values of the source expression (e.g.
-      # script_src => h*t*t*p: will not raise an exception)
-      def validate_config!(config)
-        return if config.nil? || config == OPT_OUT
-        raise ContentSecurityPolicyConfigError.new(":default_src is required") unless config[:default_src]
-        config.each do |key, value|
-          if META_CONFIGS.include?(key)
-            raise ContentSecurityPolicyConfigError.new("#{key} must be a boolean value") unless boolean?(value) || value.nil?
-          else
-            validate_directive!(key, value)
-          end
-        end
-      end
-
-      # Public: determine if merging +additions+ will cause a change to the
-      # actual value of the config.
-      #
-      # e.g. config = { script_src: %w(example.org google.com)} and
-      # additions = { script_src: %w(google.com)} then idempotent_additions? would return
-      # because google.com is already in the config.
-      def idempotent_additions?(config, additions)
-        return false if config == OPT_OUT
-        config.to_s == combine_policies(config, additions).to_s
-      end
-
-      # Public: combine the values from two different configs.
-      #
-      # original - the main config
-      # additions - values to be merged in
-      #
-      # raises an error if the original config is OPT_OUT
-      #
-      # 1. for non-source-list values (report_only, block_all_mixed_content, upgrade_insecure_requests),
-      # additions will overwrite the original value.
-      # 2. if a value in additions does not exist in the original config, the
-      # default-src value is included to match original behavior.
-      # 3. if a value in additions does exist in the original config, the two
-      # values are joined.
-      def combine_policies(original, additions)
-        if original == OPT_OUT
-          raise ContentSecurityPolicyConfigError.new("Attempted to override an opt-out CSP config.")
-        end
-
-        original = original.dup if original.frozen?
-
-        # in case we would be appending to an empty directive, fill it with the default-src value
-        additions.keys.each do |directive|
-          unless original[directive] || !source_list?(directive) || NON_DEFAULT_SOURCES.include?(directive)
-            original[directive] = original[:default_src]
-          end
-        end
-
-        # merge the two hashes. combine (instead of overwrite) the array values
-        # when each hash contains a value for a given key.
-        original.merge(additions) do |directive, lhs, rhs|
-          if source_list?(directive)
-            (lhs.to_a + rhs.to_a).compact.uniq
-          else
-            rhs
-          end
-        end.reject { |_, value| value.nil? || value == [] } # this mess prevents us from adding empty directives.
-      end
-
-      private
-
-      def source_list?(directive)
-        DIRECTIVE_VALUE_TYPES[directive] == :source_list
-      end
-
-      # Private: Validates that the configuration has a valid type, or that it is a valid
-      # source expression.
-      def validate_directive!(key, value)
-        case ContentSecurityPolicy::DIRECTIVE_VALUE_TYPES[key]
-        when :boolean
-          unless boolean?(value)
-            raise ContentSecurityPolicyConfigError.new("#{key} must be a boolean value")
-          end
-        when :string
-          unless value.is_a?(String)
-            raise ContentSecurityPolicyConfigError.new("#{key} Must be a string. Found #{config.class}: #{config} value")
-          end
-        else
-          validate_source_expression!(key, value)
-        end
-      end
-
-      # Private: validates that a source expression:
-      # 1. has a valid name
-      # 2. is an array of strings
-      # 3. does not contain any depreated, now invalid values (inline, eval, self, none)
-      #
-      # Does not validate the invididual values of the source expression (e.g.
-      # script_src => h*t*t*p: will not raise an exception)
-      def validate_source_expression!(key, value)
-        unless ContentSecurityPolicy::ALL_DIRECTIVES.include?(key)
-          raise ContentSecurityPolicyConfigError.new("Unknown directive #{key}")
-        end
-
-        unless value.is_a?(Array) && value.compact.all? { |v| v.is_a?(String) }
-          raise ContentSecurityPolicyConfigError.new("#{key} must be an array of strings")
-        end
-
-        value.each do |source_expression|
-          if ContentSecurityPolicy::DEPRECATED_SOURCE_VALUES.include?(source_expression)
-            raise ContentSecurityPolicyConfigError.new("#{key} contains an invalid keyword source (#{source_expression}). This value must be single quoted.")
-          end
-        end
-      end
-
-      def boolean?(value)
-        value.is_a?(TrueClass) || value.is_a?(FalseClass)
-      end
-    end
-
+    include PolicyManagement
 
     def initialize(config = nil, user_agent = OTHER)
       config = Configuration.deep_copy(DEFAULT_CONFIG) unless config
@@ -350,36 +63,45 @@ module SecureHeaders
     end
 
     # Private: builds a string that represents one directive in a minified form.
-    # If a directive contains *, all other values are omitted.
-    # If a directive contains 'none' but has other values, 'none' is ommitted.
-    # Schemes are stripped (see http://www.w3.org/TR/CSP2/#match-source-expression)
     #
     # directive_name - a symbol representing the various ALL_DIRECTIVES
     #
     # Returns a string representing a directive.
-    def build_directive(directive_name)
-      return if @config[directive_name].nil?
+    def build_directive(directive)
+      return if @config[directive].nil?
 
-      source_list = @config[directive_name].compact
+      source_list = @config[directive].compact
       return if source_list.empty?
 
-      value = if source_list.include?(STAR)
-        # Discard trailing entries (excluding unsafe-*) since * accomplishes the same.
-        source_list.select { |value| WILDCARD_SOURCES.include?(value) }
-      else
-        populate_nonces(directive_name, source_list)
+      normalized_source_list = minify_source_list(directive, source_list)
+      [symbol_to_hyphen_case(directive), normalized_source_list].join(" ")
+    end
 
-        # Discard any 'none' values if more directives are supplied since none may override values.
-        source_list.reject! { |value| value == NONE } if source_list.length > 1
+    # If a directive contains *, all other values are omitted.
+    # If a directive contains 'none' but has other values, 'none' is ommitted.
+    # Schemes are stripped (see http://www.w3.org/TR/CSP2/#match-source-expression)
+    def minify_source_list(directive, source_list)
+      if source_list.include?(STAR)
+        keep_wildcard_sources(source_list)
+      else
+        populate_nonces!(directive, source_list)
+        reject_all_values_if_none!(source_list)
 
-        # remove schemes and dedup source expressions
-        unless directive_name == REPORT_URI || @preserve_schemes
-          source_list = strip_source_schemes(source_list)
+        unless directive == REPORT_URI || @preserve_schemes
+          strip_source_schemes!(source_list)
         end
         dedup_source_list(source_list).join(" ")
       end
+    end
+
+    # Discard trailing entries (excluding unsafe-*) since * accomplishes the same.
+    def keep_wildcard_sources(source_list)
+      source_list.select { |value| WILDCARD_SOURCES.include?(value) }
+    end
 
-      [symbol_to_hyphen_case(directive_name), value].join(" ")
+    # Discard any 'none' values if more directives are supplied since none may override values.
+    def reject_all_values_if_none!(source_list)
+      source_list.reject! { |value| value == NONE } if source_list.length > 1
     end
 
     # Removes duplicates and sources that already match an existing wild card.
@@ -401,7 +123,7 @@ module SecureHeaders
 
     # Private: append a nonce to the script/style directories if script_nonce
     # or style_nonce are provided.
-    def populate_nonces(directive, source_list)
+    def populate_nonces!(directive, source_list)
       case directive
       when SCRIPT_SRC
         append_nonce(source_list, @script_nonce)
@@ -434,8 +156,8 @@ module SecureHeaders
     end
 
     # Private: Remove scheme from source expressions.
-    def strip_source_schemes(source_list)
-      source_list.map { |source_expression| source_expression.sub(HTTP_SCHEME_REGEX, "") }
+    def strip_source_schemes!(source_list)
+      source_list.map! { |source_expression| source_expression.sub(HTTP_SCHEME_REGEX, "") }
     end
 
     # Private: determine which directives are supported for the given user agent.