secure_headers 3.1.0 → 3.2.0

data/spec/lib/secure_headers_spec.rb

@@ -21,7 +21,7 @@ module SecureHeaders
     end
 
     describe "#header_hash_for" do
-      it "allows you to opt out of individual headers" do
+      it "allows you to opt out of individual headers via API" do
         Configuration.default
         SecureHeaders.opt_out_of_header(request, CSP::CONFIG_KEY)
         SecureHeaders.opt_out_of_header(request, XContentTypeOptions::CONFIG_KEY)
@@ -31,6 +31,23 @@ module SecureHeaders
         expect(hash['X-Content-Type-Options']).to be_nil
       end
 
+      it "Carries options over when using overrides" do
+        Configuration.default do |config|
+          config.x_download_options = OPT_OUT
+          config.x_permitted_cross_domain_policies = OPT_OUT
+        end
+
+        Configuration.override(:api) do |config|
+          config.x_frame_options = OPT_OUT
+        end
+
+        SecureHeaders.use_secure_headers_override(request, :api)
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash['X-Download-Options']).to be_nil
+        expect(hash['X-Permitted-Cross-Domain-Policies']).to be_nil
+        expect(hash['X-Frame-Options']).to be_nil
+      end
+
       it "allows you to opt out entirely" do
         Configuration.default
         SecureHeaders.opt_out_of_all_protection(request)
@@ -38,6 +55,7 @@ module SecureHeaders
         ALL_HEADER_CLASSES.each do |klass|
           expect(hash[klass::CONFIG_KEY]).to be_nil
         end
+        expect(hash.count).to eq(0)
       end
 
       it "allows you to override X-Frame-Options settings" do

data/spec/spec_helper.rb

@@ -45,3 +45,15 @@ end
 def reset_config
   SecureHeaders::Configuration.clear_configurations
 end
+
+def capture_warning
+  begin
+    old_stderr = $stderr
+    $stderr = StringIO.new
+    yield
+    result = $stderr.string
+  ensure
+    $stderr = old_stderr
+  end
+  result
+end

data/upgrading-to-3-0.md

@@ -8,6 +8,7 @@ Changes
 | Global configuration             | `SecureHeaders::Configuration.configure` block             | `SecureHeaders::Configuration.default` block                                                                                                                                 |
 | All headers besides HPKP and CSP | Accept hashes as config values                           | Must be strings (validated during configuration)                                                                                                                                                            |
 | CSP directive values             | Accepted space delimited strings OR arrays of strings    | Must be arrays of strings                                                                                                                                                  |
+| CSP Nonce values in views             | `@content_security_policy_nonce`    | `content_security_policy_script_nonce` or `content_security_policy_style_nonce`
 | `self`/`none` source expressions     | could be `self` / `none` / `'self'` / `'none'`                   | Must be `'self'` or `'none'`                                                                                                                                                   |
 | `inline` / `eval` source expressions | could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'`                                                                                                                                   |
 | Per-action configuration         | override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111)  | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-28 00:00:00.000000000 Z
+date: 2016-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -58,7 +58,9 @@ files:
 - Rakefile
 - lib/secure_headers.rb
 - lib/secure_headers/configuration.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/cookie.rb
 - lib/secure_headers/headers/policy_management.rb
 - lib/secure_headers/headers/public_key_pins.rb
 - lib/secure_headers/headers/strict_transport_security.rb
@@ -69,10 +71,13 @@ files:
 - lib/secure_headers/headers/x_xss_protection.rb
 - lib/secure_headers/middleware.rb
 - lib/secure_headers/railtie.rb
+- lib/secure_headers/utils/cookies_config.rb
 - lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
@@ -82,6 +87,7 @@ files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
 - upgrading-to-3-0.md
@@ -113,6 +119,7 @@ summary: Add easily configured security headers to responses including content-s
 test_files:
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
@@ -122,5 +129,6 @@ test_files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb