secure_headers 3.0.3 → 3.2.0

data/spec/spec_helper.rb

@@ -3,9 +3,12 @@ require 'rspec'
 require 'rack'
 require 'pry-nav'
 
+require 'coveralls'
+Coveralls.wear!
+
 require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-ENV["RAILS_ENV"] = "test"
+
 
 USER_AGENTS = {
   firefox: 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
@@ -42,3 +45,15 @@ end
 def reset_config
   SecureHeaders::Configuration.clear_configurations
 end
+
+def capture_warning
+  begin
+    old_stderr = $stderr
+    $stderr = StringIO.new
+    yield
+    result = $stderr.string
+  ensure
+    $stderr = old_stderr
+  end
+  result
+end

data/upgrading-to-3-0.md

@@ -8,6 +8,7 @@ Changes
 | Global configuration             | `SecureHeaders::Configuration.configure` block             | `SecureHeaders::Configuration.default` block                                                                                                                                 |
 | All headers besides HPKP and CSP | Accept hashes as config values                           | Must be strings (validated during configuration)                                                                                                                                                            |
 | CSP directive values             | Accepted space delimited strings OR arrays of strings    | Must be arrays of strings                                                                                                                                                  |
+| CSP Nonce values in views             | `@content_security_policy_nonce`    | `content_security_policy_script_nonce` or `content_security_policy_style_nonce`
 | `self`/`none` source expressions     | could be `self` / `none` / `'self'` / `'none'`                   | Must be `'self'` or `'none'`                                                                                                                                                   |
 | `inline` / `eval` source expressions | could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'`                                                                                                                                   |
 | Per-action configuration         | override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111)  | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.0.3
+  version: 3.2.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-29 00:00:00.000000000 Z
+date: 2016-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -58,7 +58,10 @@ files:
 - Rakefile
 - lib/secure_headers.rb
 - lib/secure_headers/configuration.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/cookie.rb
+- lib/secure_headers/headers/policy_management.rb
 - lib/secure_headers/headers/public_key_pins.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
@@ -67,12 +70,15 @@ files:
 - lib/secure_headers/headers/x_permitted_cross_domain_policies.rb
 - lib/secure_headers/headers/x_xss_protection.rb
 - lib/secure_headers/middleware.rb
-- lib/secure_headers/padrino.rb
 - lib/secure_headers/railtie.rb
+- lib/secure_headers/utils/cookies_config.rb
 - lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
+- spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
@@ -81,9 +87,9 @@ files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
-- travis.sh
 - upgrading-to-3-0.md
 homepage: https://github.com/twitter/secureheaders
 licenses:
@@ -113,6 +119,8 @@ summary: Add easily configured security headers to responses including content-s
 test_files:
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
+- spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
@@ -121,5 +129,6 @@ test_files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb

data/lib/secure_headers/padrino.rb

@@ -1,13 +0,0 @@
-module SecureHeaders
-  module Padrino
-    class << self
-      ##
-      # Main class that register this extension.
-      #
-      def registered(app)
-        app.helpers SecureHeaders::InstanceMethods
-      end
-      alias_method :included, :registered
-    end
-  end
-end

data/travis.sh

@@ -1,10 +0,0 @@
-#! /bin/sh
-
-bundle install >> /dev/null &&
-bundle exec rspec --format progress spec &&
-cd fixtures/rails_3_2_12 &&
-bundle install >> /dev/null &&
-bundle exec rspec --format progress spec &&
-cd ../../fixtures/rails_3_2_12_no_init &&
-bundle install >> /dev/null &&
-bundle exec rspec spec