secure_headers 3.1.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7353ab86b76cba9baabc265f6321990163927fa0
-  data.tar.gz: 8081e9d2a284a26191899317d1947cde24d80d9f
+  metadata.gz: e2df8c83dc908657d48aa5552696bade1374c288
+  data.tar.gz: 590bc0e2c9225ad3a330af1812babd6c129135d8
 SHA512:
-  metadata.gz: 37fd3a8aca07d1ce46bd7cdaf89ddb057d41b94f2f41625287d9a3118d19300708fd33f9d5f029c341a9c80295848101f01558d3dfd370a7bba34c8862e710d6
-  data.tar.gz: 0d810d24a48f53a45bec5621291475059e521d0d4f640bf1430ad6c86ecf020fea8dd8eb220e600b71c32539d7cfbc1f87567066477deebdf660d8a0161e2f8a
+  metadata.gz: f6b8665ddd8e15bfd9f9e5fe2d330e9e7e9cc1386813883613e295e6d114c072f8bb1713871fde12e9feb8a3df8f691b39477a9db8daeb90f49013ecf44e7b8d
+  data.tar.gz: 713914b24728468981c723801891e07eeee044f63d7eca97106ef0c0d0376cc0ed4a00ae49177c14d83a5ef445c1cb0b7d6e43472446042f6ee33201f99c2001

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 3.1.1 Bug fix for regression
+
+See https://github.com/twitter/secureheaders/pull/235
+
+`idempotent_additions?` would return false when comparing `OPT_OUT` with `OPT_OUT`, causing `header_hash_for` to return a header cache with `{ nil => nil }` which cause the middleware to blow up when `{ nil => nil }` was merged into the rack header hash.
+
+This is a regression in 3.1.0 only.
+
+Now it returns true. I've added a test case to ensure that `header_hash_for` will never return such an element.
+
 ## 3.1.0 Adding secure cookie support
 
 New feature: marking all cookies as secure. Added by @jmera in https://github.com/twitter/secureheaders/pull/231. In the future, we'll probably add the ability to whitelist individual cookies that should not be marked secure. PRs welcome.

data/README.md

@@ -15,6 +15,8 @@ The gem will automatically apply several headers that are related to security.
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
 - Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinning Specification](https://tools.ietf.org/html/rfc7469)
 
+It can also mark all http cookies with the secure attribute (when configured to do so).
+
 `secure_headers` is a library with a global config, per request overrides, and rack middleware that enables you customize your application settings.
 
 ## Use
@@ -29,6 +31,7 @@ All `nil` values will fallback to their default values. `SecureHeaders::OPT_OUT`
 
 ```ruby
 SecureHeaders::Configuration.default do |config|
+  config.secure_cookies = true # mark all cookies as "secure"
   config.hsts = "max-age=#{20.years.to_i}; includeSubdomains; preload"
   config.x_frame_options = "DENY"
   config.x_content_type_options = "nosniff"

data/lib/secure_headers/configuration.rb

@@ -71,6 +71,7 @@ module SecureHeaders
           ALL_HEADER_CLASSES.each do |klass|
             config.send("#{klass::CONFIG_KEY}=", OPT_OUT)
           end
+          config.dynamic_csp = OPT_OUT
         end
 
         add_configuration(NOOP_CONFIGURATION, noop_config)

data/lib/secure_headers/headers/policy_management.rb

@@ -196,6 +196,7 @@ module SecureHeaders
       # additions = { script_src: %w(google.com)} then idempotent_additions? would return
       # because google.com is already in the config.
       def idempotent_additions?(config, additions)
+        return true if config == OPT_OUT && additions == OPT_OUT
         return false if config == OPT_OUT
         config == combine_policies(config, additions)
       end

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.1.0"
+  gem.version       = "3.1.1"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

data/spec/lib/secure_headers_spec.rb

@@ -38,6 +38,7 @@ module SecureHeaders
         ALL_HEADER_CLASSES.each do |klass|
           expect(hash[klass::CONFIG_KEY]).to be_nil
         end
+        expect(hash.count).to eq(0)
       end
 
       it "allows you to override X-Frame-Options settings" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Neil Matatall