secure_headers 3.0.3 → 4.0.0

data/spec/lib/secure_headers/configuration_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe Configuration do
@@ -29,18 +30,24 @@ module SecureHeaders
       expect_default_values(header_hash)
     end
 
-    it "copies all config values except for the cached headers when dup" do
+    it "copies config values when duping" do
       Configuration.override(:test_override, Configuration::NOOP_CONFIGURATION) do
         # do nothing, just copy it
       end
 
       config = Configuration.get(:test_override)
       noop = Configuration.get(Configuration::NOOP_CONFIGURATION)
-      [:hsts, :x_frame_options, :x_content_type_options, :x_xss_protection,
-        :x_download_options, :x_permitted_cross_domain_policies, :hpkp, :csp].each do |key|
+      [:csp, :csp_report_only, :cookies].each do |key|
+        expect(config.send(key)).to eq(noop.send(key))
+      end
+    end
 
-        expect(config.send(key)).to eq(noop.send(key)), "Value not copied: #{key}."
+    it "regenerates cached headers when building an override" do
+      Configuration.override(:test_override) do |config|
+        config.x_content_type_options = OPT_OUT
       end
+
+      expect(Configuration.get.cached_headers).to_not eq(Configuration.get(:test_override).cached_headers)
     end
 
     it "stores an override of the global config" do
@@ -59,12 +66,12 @@ module SecureHeaders
       default = Configuration.get
       override = Configuration.get(:override)
 
-      expect(override.csp).not_to eq(default.csp)
+      expect(override.csp.directive_value(:default_src)).not_to be(default.csp.directive_value(:default_src))
     end
 
     it "allows you to override an override" do
       Configuration.override(:override) do |config|
-        config.csp = { default_src: %w('self')}
+        config.csp = { default_src: %w('self'), script_src: %w('self')}
       end
 
       Configuration.override(:second_override, :override) do |config|
@@ -72,9 +79,17 @@ module SecureHeaders
       end
 
       original_override = Configuration.get(:override)
-      expect(original_override.csp).to eq(default_src: %w('self'))
+      expect(original_override.csp.to_h).to eq(default_src: %w('self'), script_src: %w('self'))
       override_config = Configuration.get(:second_override)
-      expect(override_config.csp).to eq(default_src: %w('self'), script_src: %w(example.org))
+      expect(override_config.csp.to_h).to eq(default_src: %w('self'), script_src: %w('self' example.org))
+    end
+
+    it "deprecates the secure_cookies configuration" do
+      expect {
+        Configuration.default do |config|
+          config.secure_cookies = true
+        end
+      }.to raise_error(ArgumentError)
     end
   end
 end

data/spec/lib/secure_headers/headers/clear_site_data_spec.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe ClearSiteData do
+    describe "make_header" do
+      it "returns nil with nil config" do
+        expect(described_class.make_header).to be_nil
+      end
+
+      it "returns nil with empty config" do
+        expect(described_class.make_header([])).to be_nil
+      end
+
+      it "returns nil with opt-out config" do
+        expect(described_class.make_header(OPT_OUT)).to be_nil
+      end
+
+      it "returns all types with `true` config" do
+        name, value = described_class.make_header(true)
+
+        expect(name).to eq(ClearSiteData::HEADER_NAME)
+        expect(value).to eq(
+          %("cache", "cookies", "storage", "executionContexts")
+        )
+      end
+
+      it "returns specified types" do
+        name, value = described_class.make_header(["foo", "bar"])
+
+        expect(name).to eq(ClearSiteData::HEADER_NAME)
+        expect(value).to eq(%("foo", "bar"))
+      end
+    end
+
+    describe "validate_config!" do
+      it "succeeds for `true` config" do
+        expect do
+          described_class.validate_config!(true)
+        end.not_to raise_error
+      end
+
+      it "succeeds for `nil` config" do
+        expect do
+          described_class.validate_config!(nil)
+        end.not_to raise_error
+      end
+
+      it "succeeds for opt-out config" do
+        expect do
+          described_class.validate_config!(OPT_OUT)
+        end.not_to raise_error
+      end
+
+      it "succeeds for empty config" do
+        expect do
+          described_class.validate_config!([])
+        end.not_to raise_error
+      end
+
+      it "succeeds for Array of Strings config" do
+        expect do
+          described_class.validate_config!(["foo"])
+        end.not_to raise_error
+      end
+
+      it "fails for Array of non-String config" do
+        expect do
+          described_class.validate_config!([1])
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
+      it "fails for other types of config" do
+        expect do
+          described_class.validate_config!(:cookies)
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+    end
+
+    describe "make_header_value" do
+      it "returns a string of quoted values that are comma separated" do
+        value = described_class.make_header_value(["foo", "bar"])
+        expect(value).to eq(%("foo", "bar"))
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe ContentSecurityPolicy do
@@ -14,192 +15,21 @@ module SecureHeaders
 
     describe "#name" do
       context "when in report-only mode" do
-        specify { expect(ContentSecurityPolicy.new(default_opts.merge(report_only: true)).name).to eq(ContentSecurityPolicy::HEADER_NAME + "-Report-Only") }
+        specify { expect(ContentSecurityPolicy.new(default_opts.merge(report_only: true)).name).to eq(ContentSecurityPolicyReportOnlyConfig::HEADER_NAME) }
       end
 
       context "when in enforce mode" do
-        specify { expect(ContentSecurityPolicy.new(default_opts).name).to eq(ContentSecurityPolicy::HEADER_NAME) }
+        specify { expect(ContentSecurityPolicy.new(default_opts).name).to eq(ContentSecurityPolicyConfig::HEADER_NAME) }
       end
     end
 
-    describe "#validate_config!" do
-      it "accepts all keys" do
-        # (pulled from README)
-        config = {
-          # "meta" values. these will shaped the header, but the values are not included in the header.
-          report_only:  true,     # default: false
-          preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
-
-          # directive values: these values will directly translate into source directives
-          default_src: %w(https: 'self'),
-          frame_src: %w('self' *.twimg.com itunes.apple.com),
-          connect_src: %w(wws:),
-          font_src: %w('self' data:),
-          img_src: %w(mycdn.com data:),
-          media_src: %w(utoob.com),
-          object_src: %w('self'),
-          script_src: %w('self'),
-          style_src: %w('unsafe-inline'),
-          base_uri: %w('self'),
-          child_src: %w('self'),
-          form_action: %w('self' github.com),
-          frame_ancestors: %w('none'),
-          plugin_types: %w(application/x-shockwave-flash),
-          block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
-          upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
-          report_uri: %w(https://example.com/uri-directive)
-        }
-
-        CSP.validate_config!(config)
-      end
-
-      it "requires a :default_src value" do
-        expect do
-          CSP.validate_config!(script_src: %('self'))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :report_only to be a truthy value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(report_only: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :preserve_schemes to be a truthy value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(preserve_schemes: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :block_all_mixed_content to be a boolean value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(block_all_mixed_content: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :upgrade_insecure_requests to be a boolean value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(upgrade_insecure_requests: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires all source lists to be an array of strings" do
-        expect do
-          CSP.validate_config!(default_src: "steve")
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "allows nil values" do
-        expect do
-          CSP.validate_config!(default_src: %w('self'), script_src: ["https:", nil])
-        end.to_not raise_error
-      end
-
-      it "rejects unknown directives / config" do
-        expect do
-          CSP.validate_config!(default_src: %w('self'), default_src_totally_mispelled: "steve")
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      # this is mostly to ensure people don't use the antiquated shorthands common in other configs
-      it "performs light validation on source lists" do
-        expect do
-          CSP.validate_config!(default_src: %w(self none inline eval))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-    end
-
-    describe "#combine_policies" do
-      it "combines the default-src value with the override if the directive was unconfigured" do
-        combined_config = CSP.combine_policies(Configuration.default.csp, script_src: %w(anothercdn.com))
-        csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.name).to eq(CSP::HEADER_NAME)
-        expect(csp.value).to eq("default-src https:; script-src https: anothercdn.com")
-      end
-
-      it "combines directives where the original value is nil and the hash is frozen" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }.freeze
-        end
-        report_uri = "https://report-uri.io/asdf"
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_uri: [report_uri])
-        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
-        expect(csp.value).to include("report-uri #{report_uri}")
-      end
-
-      it "does not combine the default-src value for directives that don't fall back to default sources" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }.freeze
-        end
-        non_default_source_additions = CSP::NON_DEFAULT_SOURCES.each_with_object({}) do |directive, hash|
-          hash[directive] = %w("http://example.org)
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, non_default_source_additions)
-
-        CSP::NON_DEFAULT_SOURCES.each do |directive|
-          expect(combined_config[directive]).to eq(%w("http://example.org))
-        end
-
-         ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox]).value
-      end
-
-      it "overrides the report_only flag" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_only: true)
-        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
-        expect(csp.name).to eq(CSP::REPORT_ONLY)
-      end
-
-      it "overrides the :block_all_mixed_content flag" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w(https:),
-            block_all_mixed_content: false
-          }
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, block_all_mixed_content: true)
-        csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.value).to eq("default-src https:; block-all-mixed-content")
-      end
-
-      it "raises an error if appending to a OPT_OUT policy" do
-        Configuration.default do |config|
-          config.csp = OPT_OUT
-        end
-        expect do
-          CSP.combine_policies(Configuration.get.csp, script_src: %w(anothercdn.com))
-        end.to raise_error(ContentSecurityPolicyConfigError)
+    describe "#value" do
+      it "uses a safe but non-breaking default value" do
+        expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:")
       end
-    end
 
-    describe "#idempotent_additions?" do
-      specify { expect(ContentSecurityPolicy.idempotent_additions?(OPT_OUT, script_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(c.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(a.com b.com c.com))).to be false }
-
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com a.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w())).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: nil)).to be true }
-    end
-
-    describe "#value" do
       it "discards 'none' values if any other source expressions are present" do
-        csp = ContentSecurityPolicy.new(default_opts.merge(frame_src: %w('self' 'none')))
+        csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none')))
         expect(csp.value).not_to include("'none'")
       end
 
@@ -221,13 +51,18 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does not build directives with a value of OPT_OUT (and bypasses directive requirements)" do
+        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), script_src: OPT_OUT)
+        expect(csp.value).to eq("default-src example.org")
+      end
+
       it "does not remove schemes from report-uri values" do
         csp = ContentSecurityPolicy.new(default_src: %w(https:), report_uri: %w(https://example.org))
         expect(csp.value).to eq("default-src https:; report-uri https://example.org")
       end
 
       it "does not remove schemes when :preserve_schemes is true" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), :preserve_schemes => true)
+        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), preserve_schemes: true)
         expect(csp.value).to eq("default-src https://example.org")
       end
 
@@ -246,42 +81,106 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does add a boolean directive if the value is true" do
+        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: true)
+        expect(csp.value).to eq("default-src example.org; block-all-mixed-content; upgrade-insecure-requests")
+      end
+
+      it "does not add a boolean directive if the value is false" do
+        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: false)
+        expect(csp.value).to eq("default-src example.org; block-all-mixed-content")
+      end
+
       it "deduplicates any source expressions" do
         csp = ContentSecurityPolicy.new(default_src: %w(example.org example.org example.org))
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "creates maximally strict sandbox policy when passed no sandbox token values" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: [])
+        expect(csp.value).to eq("default-src example.org; sandbox")
+      end
+
+      it "creates maximally strict sandbox policy when passed true" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: true)
+        expect(csp.value).to eq("default-src example.org; sandbox")
+      end
+
+      it "creates sandbox policy when passed valid sandbox token values" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: %w(allow-forms allow-scripts))
+        expect(csp.value).to eq("default-src example.org; sandbox allow-forms allow-scripts")
+      end
+
+      it "does not emit a warning when using frame-src" do
+        expect(Kernel).to_not receive(:warn)
+        ContentSecurityPolicy.new(default_src: %w('self'), frame_src: %w('self')).value
+      end
+
+      it "raises an error when child-src and frame-src are supplied but are not equal" do
+        expect {
+          ContentSecurityPolicy.new(default_src: %w('self'), child_src: %w(child-src.com), frame_src: %w(frame-src,com)).value
+        }.to raise_error(ArgumentError)
+      end
+
+      it "supports strict-dynamic" do
+        csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456}, USER_AGENTS[:chrome])
+        expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456'")
+      end
+
       context "browser sniffing" do
         let (:complex_opts) do
-          ContentSecurityPolicy::ALL_DIRECTIVES.each_with_object({}) do |directive, hash|
-            hash[directive] = %w('self')
+          (ContentSecurityPolicy::ALL_DIRECTIVES - [:frame_src]).each_with_object({}) do |directive, hash|
+            hash[directive] = ["#{directive.to_s.gsub("_", "-")}.com"]
           end.merge({
             block_all_mixed_content: true,
             upgrade_insecure_requests: true,
-            reflected_xss: "block",
-            script_src: %w('self'),
-            script_nonce: 123456
+            script_src: %w(script-src.com),
+            script_nonce: 123456,
+            sandbox: %w(allow-forms),
+            plugin_types: %w(application/pdf)
           })
         end
 
         it "does not filter any directives for Chrome" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:chrome])
-          expect(policy.value).to eq("default-src 'self'; base-uri 'self'; block-all-mixed-content; child-src 'self'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; plugin-types 'self'; sandbox 'self'; script-src 'self' 'nonce-123456'; style-src 'self'; upgrade-insecure-requests; report-uri 'self'")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "does not filter any directives for Opera" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:opera])
-          expect(policy.value).to eq("default-src 'self'; base-uri 'self'; block-all-mixed-content; child-src 'self'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; plugin-types 'self'; sandbox 'self'; script-src 'self' 'nonce-123456'; style-src 'self'; upgrade-insecure-requests; report-uri 'self'")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "filters blocked-all-mixed-content, child-src, and plugin-types for firefox" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:firefox])
-          expect(policy.value).to eq("default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; sandbox 'self'; script-src 'self' 'nonce-123456'; style-src 'self'; upgrade-insecure-requests; report-uri 'self'")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+        end
+
+        it "filters blocked-all-mixed-content, frame-src, and plugin-types for firefox 46 and higher" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:firefox46])
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+        end
+
+        it "child-src value is copied to frame-src, adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for Edge" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:edge])
+          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
         end
 
-        it "adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for safari" do
+        it "child-src value is copied to frame-src, adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for safari" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari6])
-          expect(policy.value).to eq("default-src 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; sandbox 'self'; script-src 'self' 'unsafe-inline'; style-src 'self'; report-uri 'self'")
+          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
+        end
+
+        it "adds 'unsafe-inline', filters  blocked-all-mixed-content, upgrade-insecure-requests, nonce sources, and hash sources for safari 10 and higher" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari10])
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; report-uri report-uri.com")
+        end
+
+        it "falls back to standard Firefox defaults when the useragent version is not present" do
+          ua = USER_AGENTS[:firefox].dup
+          allow(ua).to receive(:version).and_return(nil)
+          policy = ContentSecurityPolicy.new(complex_opts, ua)
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
       end
     end