secure_headers 3.0.3 → 4.0.0

data/spec/lib/secure_headers/headers/cookie_spec.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe Cookie do
+    let(:raw_cookie) { "_session=thisisatest" }
+
+    it "does not tamper with cookies when using OPT_OUT is used" do
+      cookie = Cookie.new(raw_cookie, OPT_OUT)
+      expect(cookie.to_s).to eq(raw_cookie)
+    end
+
+    it "applies httponly, secure, and samesite by default" do
+      cookie = Cookie.new(raw_cookie, nil)
+      expect(cookie.to_s).to eq("_session=thisisatest; secure; HttpOnly; SameSite=Lax")
+    end
+
+    it "preserves existing attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true, httponly: OPT_OUT, samesite: OPT_OUT)
+      expect(cookie.to_s).to eq("_session=thisisatest; secure")
+    end
+
+    it "prevents duplicate flagging of attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true, httponly: OPT_OUT)
+      expect(cookie.to_s.scan(/secure/i).count).to eq(1)
+    end
+
+    context "Secure cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as Secure" do
+          cookie = Cookie.new(raw_cookie, secure: true, httponly: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as Secure when whitelisted" do
+          cookie = Cookie.new(raw_cookie, secure: { only: ["_session"]}, httponly: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+
+        it "does not flag cookies as Secure when excluded" do
+          cookie = Cookie.new(raw_cookie, secure: { except: ["_session"] }, httponly: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "HttpOnly cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as HttpOnly" do
+          cookie = Cookie.new(raw_cookie, httponly: true, secure: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as HttpOnly when whitelisted" do
+          cookie = Cookie.new(raw_cookie, httponly: { only: ["_session"]}, secure: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+
+        it "does not flag cookies as HttpOnly when excluded" do
+          cookie = Cookie.new(raw_cookie, httponly: { except: ["_session"] }, secure: OPT_OUT, samesite: OPT_OUT)
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "SameSite cookies" do
+      it "flags SameSite=Lax" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "flags SameSite=Lax when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true}, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "does not flag cookies as SameSite=Lax when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "does not flag cookies as SameSite=Strict when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] }}, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, {samesite: { strict: true}, secure: OPT_OUT, httponly: OPT_OUT})
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "flags properly when both lax and strict are configured" do
+        raw_cookie = "_session=thisisatest"
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] }, lax: { only: ["_additional_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "ignores configuration if the cookie is already flagged" do
+        raw_cookie = "_session=thisisatest; SameSite=Strict"
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true }, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq(raw_cookie)
+      end
+
+      it "samesite: true sets all cookies to samesite=lax" do
+        raw_cookie = "_session=thisisatest"
+        cookie = Cookie.new(raw_cookie, samesite: true, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+    end
+  end
+
+  context "with an invalid configuration" do
+    it "raises an exception when not configured with a Hash" do
+      expect do
+        Cookie.validate_config!("configuration")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when configured without a boolean(true or OPT_OUT)/Hash" do
+      expect do
+        Cookie.validate_config!(secure: "true")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when configured with false" do
+      expect do
+        Cookie.validate_config!(secure: false)
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided" do
+      expect do
+        Cookie.validate_config!(secure: { only: [], except: [] })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite is not configured with a Hash" do
+      expect do
+        Cookie.validate_config!(samesite: true)
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: true})
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"], except: ["_anythingelse"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"] }, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { except: ["_anything"] }, strict: { except: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+  end
+end

data/spec/lib/secure_headers/headers/expect_certificate_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe ExpectCertificateTransparency do
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: true).value).to eq("enforce; max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: false).value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: "yolocopter").value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, report_uri: "https://report-uri.io/expect-ct").value).to eq("max-age=1234; report-uri=\"https://report-uri.io/expect-ct\"") }
+    specify do
+      config = { enforce: true, max_age: 1234, report_uri: "https://report-uri.io/expect-ct" }
+      header_value = "enforce; max-age=1234; report-uri=\"https://report-uri.io/expect-ct\""
+      expect(ExpectCertificateTransparency.new(config).value).to eq(header_value)
+    end
+
+    context "with an invalid configuration" do
+      it "raises an exception when configuration isn't a hash" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(%w(a))
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception when max-age is not provided" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(foo: "bar")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid max-age" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(max_age: "abc123")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid enforce value" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(enforce: "brokenstring")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/policy_management_spec.rb

@@ -0,0 +1,228 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe PolicyManagement do
+    let (:default_opts) do
+      {
+        default_src: %w(https:),
+        img_src: %w(https: data:),
+        script_src: %w('unsafe-inline' 'unsafe-eval' https: data:),
+        style_src: %w('unsafe-inline' https: about:),
+        report_uri: %w(/csp_report)
+      }
+    end
+
+    describe "#validate_config!" do
+      it "accepts all keys" do
+        # (pulled from README)
+        config = {
+          # "meta" values. these will shape the header, but the values are not included in the header.
+          report_only:  true,     # default: false
+          preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
+
+          # directive values: these values will directly translate into source directives
+          default_src: %w(https: 'self'),
+          frame_src: %w('self' *.twimg.com itunes.apple.com),
+          child_src: %w('self' *.twimg.com itunes.apple.com),
+          connect_src: %w(wss:),
+          font_src: %w('self' data:),
+          img_src: %w(mycdn.com data:),
+          manifest_src: %w(manifest.com),
+          media_src: %w(utoob.com),
+          object_src: %w('self'),
+          script_src: %w('self'),
+          style_src: %w('unsafe-inline'),
+          base_uri: %w('self'),
+          form_action: %w('self' github.com),
+          frame_ancestors: %w('none'),
+          plugin_types: %w(application/x-shockwave-flash),
+          block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
+          upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
+          report_uri: %w(https://example.com/uri-directive)
+        }
+
+        ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(config))
+      end
+
+      it "requires a :default_src value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(script_src: %w('self')))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires a :script_src value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self')))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts OPT_OUT as a script-src value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), script_src: OPT_OUT))
+        end.to_not raise_error
+      end
+
+      it "requires :report_only to be a truthy value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(report_only: "steve")))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :preserve_schemes to be a truthy value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(preserve_schemes: "steve")))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :block_all_mixed_content to be a boolean value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(block_all_mixed_content: "steve")))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :upgrade_insecure_requests to be a boolean value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(upgrade_insecure_requests: "steve")))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires all source lists to be an array of strings" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "allows nil values" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), script_src: ["https:", nil]))
+        end.to_not raise_error
+      end
+
+      it "rejects unknown directives / config" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), default_src_totally_mispelled: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      # this is mostly to ensure people don't use the antiquated shorthands common in other configs
+      it "performs light validation on source lists" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w(self none inline eval), script_src: %w('self')))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "rejects anything not of the form allow-* as a sandbox value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["steve"])))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts anything of the form allow-* as a sandbox value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["allow-foo"])))
+        end.to_not raise_error
+      end
+
+      it "accepts true as a sandbox policy" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: true)))
+        end.to_not raise_error
+      end
+
+      it "rejects anything not of the form type/subtype as a plugin-type value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["steve"])))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts anything of the form type/subtype as a plugin-type value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["application/pdf"])))
+        end.to_not raise_error
+      end
+    end
+
+    describe "#combine_policies" do
+      it "combines the default-src value with the override if the directive was unconfigured" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w(https:),
+            script_src: %w('self'),
+          }
+        end
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, style_src: %w(anothercdn.com))
+        csp = ContentSecurityPolicy.new(combined_config)
+        expect(csp.name).to eq(ContentSecurityPolicyConfig::HEADER_NAME)
+        expect(csp.value).to eq("default-src https:; script-src 'self'; style-src https: anothercdn.com")
+      end
+
+      it "combines directives where the original value is nil and the hash is frozen" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            script_src: %w('self'),
+            report_only: false
+          }.freeze
+        end
+        report_uri = "https://report-uri.io/asdf"
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, report_uri: [report_uri])
+        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
+        expect(csp.value).to include("report-uri #{report_uri}")
+      end
+
+      it "does not combine the default-src value for directives that don't fall back to default sources" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            script_src: %w('self'),
+            report_only: false
+          }.freeze
+        end
+        non_default_source_additions = ContentSecurityPolicy::NON_FETCH_SOURCES.each_with_object({}) do |directive, hash|
+          hash[directive] = %w("http://example.org)
+        end
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, non_default_source_additions)
+
+        ContentSecurityPolicy::NON_FETCH_SOURCES.each do |directive|
+          expect(combined_config[directive]).to eq(%w("http://example.org))
+        end
+      end
+
+      it "overrides the report_only flag" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            script_src: %w('self'),
+            report_only: false
+          }
+        end
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, report_only: true)
+        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
+        expect(csp.name).to eq(ContentSecurityPolicyReportOnlyConfig::HEADER_NAME)
+      end
+
+      it "overrides the :block_all_mixed_content flag" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w(https:),
+            script_src: %w('self'),
+            block_all_mixed_content: false
+          }
+        end
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, block_all_mixed_content: true)
+        csp = ContentSecurityPolicy.new(combined_config)
+        expect(csp.value).to eq("default-src https:; block-all-mixed-content; script-src 'self'")
+      end
+
+      it "raises an error if appending to a OPT_OUT policy" do
+        Configuration.default do |config|
+          config.csp = OPT_OUT
+        end
+        expect do
+          ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, script_src: %w(anothercdn.com))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/public_key_pins_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe PublicKeyPins do
@@ -8,7 +9,7 @@ module SecureHeaders
     specify { expect(PublicKeyPins.new(max_age: 1234).value).to eq("max-age=1234") }
     specify { expect(PublicKeyPins.new(max_age: 1234).value).to eq("max-age=1234") }
     specify do
-      config = { max_age: 1234, pins: [{ sha256: 'base64encodedpin1' }, { sha256: 'base64encodedpin2' }] }
+      config = { max_age: 1234, pins: [{ sha256: "base64encodedpin1" }, { sha256: "base64encodedpin2" }] }
       header_value = "max-age=1234; pin-sha256=\"base64encodedpin1\"; pin-sha256=\"base64encodedpin2\""
       expect(PublicKeyPins.new(config).value).to eq(header_value)
     end
@@ -16,19 +17,19 @@ module SecureHeaders
     context "with an invalid configuration" do
       it "raises an exception when max-age is not provided" do
         expect do
-          PublicKeyPins.validate_config!(foo: 'bar')
+          PublicKeyPins.validate_config!(foo: "bar")
         end.to raise_error(PublicKeyPinsConfigError)
       end
 
       it "raises an exception with an invalid max-age" do
         expect do
-          PublicKeyPins.validate_config!(max_age: 'abc123')
+          PublicKeyPins.validate_config!(max_age: "abc123")
         end.to raise_error(PublicKeyPinsConfigError)
       end
 
-      it 'raises an exception with less than 2 pins' do
+      it "raises an exception with less than 2 pins" do
         expect do
-          config = { max_age: 1234, pins: [{ sha256: 'base64encodedpin' }] }
+          config = { max_age: 1234, pins: [{ sha256: "base64encodedpin" }] }
           PublicKeyPins.validate_config!(config)
         end.to raise_error(PublicKeyPinsConfigError)
       end

data/spec/lib/secure_headers/headers/referrer_policy_spec.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe ReferrerPolicy do
+    specify { expect(ReferrerPolicy.make_header).to eq([ReferrerPolicy::HEADER_NAME, "origin-when-cross-origin"]) }
+    specify { expect(ReferrerPolicy.make_header("no-referrer")).to eq([ReferrerPolicy::HEADER_NAME, "no-referrer"]) }
+
+    context "valid configuration values" do
+      it "accepts 'no-referrer'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer")
+        end.not_to raise_error
+      end
+
+      it "accepts 'no-referrer-when-downgrade'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer-when-downgrade")
+        end.not_to raise_error
+      end
+
+      it "accepts 'same-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("same-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'unsafe-url'" do
+        expect do
+          ReferrerPolicy.validate_config!("unsafe-url")
+        end.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect do
+          ReferrerPolicy.validate_config!(nil)
+        end.not_to raise_error
+      end
+    end
+
+    context "invlaid configuration values" do
+      it "doesn't accept invalid values" do
+        expect do
+          ReferrerPolicy.validate_config!("open")
+        end.to raise_error(ReferrerPolicyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/strict_transport_security_spec.rb

@@ -1,28 +1,29 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe StrictTransportSecurity do
     describe "#value" do
       specify { expect(StrictTransportSecurity.make_header).to eq([StrictTransportSecurity::HEADER_NAME, StrictTransportSecurity::DEFAULT_VALUE]) }
-      specify { expect(StrictTransportSecurity.make_header("max-age=1234")).to eq([StrictTransportSecurity::HEADER_NAME, "max-age=1234"]) }
+      specify { expect(StrictTransportSecurity.make_header("max-age=1234; includeSubdomains; preload")).to eq([StrictTransportSecurity::HEADER_NAME, "max-age=1234; includeSubdomains; preload"]) }
 
       context "with an invalid configuration" do
         context "with a string argument" do
           it "raises an exception with an invalid max-age" do
             expect do
-              StrictTransportSecurity.validate_config!('max-age=abc123')
+              StrictTransportSecurity.validate_config!("max-age=abc123")
             end.to raise_error(STSConfigError)
           end
 
           it "raises an exception if max-age is not supplied" do
             expect do
-              StrictTransportSecurity.validate_config!('includeSubdomains')
+              StrictTransportSecurity.validate_config!("includeSubdomains")
             end.to raise_error(STSConfigError)
           end
 
           it "raises an exception with an invalid format" do
             expect do
-              StrictTransportSecurity.validate_config!('max-age=123includeSubdomains')
+              StrictTransportSecurity.validate_config!("max-age=123includeSubdomains")
             end.to raise_error(STSConfigError)
           end
         end

data/spec/lib/secure_headers/headers/x_content_type_options_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe XContentTypeOptions do

data/spec/lib/secure_headers/headers/x_download_options_spec.rb

@@ -1,9 +1,10 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe XDownloadOptions do
     specify { expect(XDownloadOptions.make_header).to eq([XDownloadOptions::HEADER_NAME, XDownloadOptions::DEFAULT_VALUE]) }
-    specify { expect(XDownloadOptions.make_header('noopen')).to eq([XDownloadOptions::HEADER_NAME, 'noopen']) }
+    specify { expect(XDownloadOptions.make_header("noopen")).to eq([XDownloadOptions::HEADER_NAME, "noopen"]) }
 
     context "invalid configuration values" do
       it "accepts noopen" do

data/spec/lib/secure_headers/headers/x_frame_options_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe XFrameOptions do

data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb

@@ -1,9 +1,10 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe XPermittedCrossDomainPolicies do
     specify { expect(XPermittedCrossDomainPolicies.make_header).to eq([XPermittedCrossDomainPolicies::HEADER_NAME, "none"]) }
-    specify { expect(XPermittedCrossDomainPolicies.make_header('master-only')).to eq([XPermittedCrossDomainPolicies::HEADER_NAME, 'master-only']) }
+    specify { expect(XPermittedCrossDomainPolicies.make_header("master-only")).to eq([XPermittedCrossDomainPolicies::HEADER_NAME, "master-only"]) }
 
     context "valid configuration values" do
       it "accepts 'all'" do
@@ -36,7 +37,7 @@ module SecureHeaders
       end
     end
 
-    context 'invlaid configuration values' do
+    context "invlaid configuration values" do
       it "doesn't accept invalid values" do
         expect do
           XPermittedCrossDomainPolicies.validate_config!("open")