secure_headers 3.1.2 → 3.3.0

data/spec/lib/secure_headers/middleware_spec.rb

@@ -10,9 +10,25 @@ module SecureHeaders
 
     before(:each) do
       reset_config
+      Configuration.default
+    end
+
+    it "warns if the hpkp report-uri host is the same as the current host" do
+      report_host = "report-uri.io"
       Configuration.default do |config|
-        # use all default provided by the library
+        config.hpkp = {
+          max_age: 10000000,
+          pins: [
+            {sha256: 'b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c'},
+            {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
+          ],
+          report_uri: "https://#{report_host}/example-hpkp"
+        }
       end
+
+      expect(Kernel).to receive(:warn).with(Middleware::HPKP_SAME_HOST_WARNING)
+
+      middleware.call(Rack::MockRequest.env_for("https://#{report_host}", {}))
     end
 
     it "sets the headers" do
@@ -38,21 +54,56 @@ module SecureHeaders
       expect(env[CSP::HEADER_NAME]).to match("example.org")
     end
 
-    context "cookies should be flagged" do
-      it "flags cookies as secure" do
-        Configuration.default { |config| config.secure_cookies = true }
-        request = Rack::MockRequest.new(cookie_middleware)
-        response = request.get '/'
-        expect(response.headers['Set-Cookie']).to match(Middleware::SECURE_COOKIE_REGEXP)
+    context "secure_cookies" do
+      context "cookies should be flagged" do
+        it "flags cookies as secure" do
+          capture_warning do
+            Configuration.default { |config| config.secure_cookies = true }
+          end
+          request = Rack::Request.new("HTTPS" => "on")
+          _, env = cookie_middleware.call request.env
+          expect(env['Set-Cookie']).to eq("foo=bar; secure")
+        end
+      end
+
+      context "cookies should not be flagged" do
+        it "does not flags cookies as secure" do
+          capture_warning do
+            Configuration.default { |config| config.secure_cookies = false }
+          end
+          request = Rack::Request.new("HTTPS" => "on")
+          _, env = cookie_middleware.call request.env
+          expect(env['Set-Cookie']).to eq("foo=bar")
+        end
       end
     end
 
-    context "cookies should not be flagged" do
-      it "does not flags cookies as secure" do
-        Configuration.default { |config| config.secure_cookies = false }
-        request = Rack::MockRequest.new(cookie_middleware)
-        response = request.get '/'
-        expect(response.headers['Set-Cookie']).not_to match(Middleware::SECURE_COOKIE_REGEXP)
+    context "cookies" do
+      it "flags cookies from configuration" do
+        Configuration.default { |config| config.cookies = { secure: true, httponly: true } }
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+
+        expect(env['Set-Cookie']).to eq("foo=bar; secure; HttpOnly")
+      end
+
+      it "flags cookies with a combination of SameSite configurations" do
+        cookie_middleware = Middleware.new(lambda { |env| [200, env.merge("Set-Cookie" => ["_session=foobar", "_guest=true"]), "app"] })
+
+        Configuration.default { |config| config.cookies = { samesite: { lax: { except: ["_session"] }, strict: { only: ["_session"] } } } }
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+
+        expect(env['Set-Cookie']).to match("_session=foobar; SameSite=Strict")
+        expect(env['Set-Cookie']).to match("_guest=true; SameSite=Lax")
+      end
+
+      it "disables secure cookies for non-https requests" do
+        Configuration.default { |config| config.cookies = { secure: true } }
+
+        request = Rack::Request.new("HTTPS" => "off")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar")
       end
     end
   end

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -0,0 +1,125 @@
+require "spec_helper"
+require "erb"
+
+class Message < ERB
+  include SecureHeaders::ViewHelpers
+
+  def self.template
+<<-TEMPLATE
+<% hashed_javascript_tag(raise_error_on_unrecognized_hash = true) do %>
+  console.log(1)
+<% end %>
+
+<% hashed_style_tag do %>
+  body {
+    background-color: black;
+  }
+<% end %>
+
+<% nonced_javascript_tag do %>
+  body {
+    console.log(1)
+  }
+<% end %>
+
+<% nonced_style_tag do %>
+  body {
+    background-color: black;
+  }
+<% end %>
+<%= @name %>
+
+TEMPLATE
+  end
+
+  def initialize(request, options = {})
+    @virtual_path = "/asdfs/index"
+    @_request = request
+    @template = self.class.template
+    super(@template)
+  end
+
+  def capture(*args)
+    yield(*args)
+  end
+
+  def content_tag(type, content = nil, options = nil, &block)
+    content = if block_given?
+      capture(block)
+    end
+
+    if options.is_a?(Hash)
+      options = options.map {|k,v| " #{k}=#{v}"}
+    end
+    "<#{type}#{options}>#{content}</#{type}>"
+  end
+
+  def result
+    super(binding)
+  end
+
+  def request
+    @_request
+  end
+end
+
+module SecureHeaders
+  describe ViewHelpers do
+    let(:app) { lambda { |env| [200, env, "app"] } }
+    let(:middleware) { Middleware.new(app) }
+    let(:request) { Rack::Request.new("HTTP_USER_AGENT" => USER_AGENTS[:chrome]) }
+    let(:filename) { "app/views/asdfs/index.html.erb" }
+
+    before(:all) do
+      Configuration.default do |config|
+        config.csp[:script_src] = %w('self')
+        config.csp[:style_src] = %w('self')
+      end
+    end
+
+    after(:each) do
+      Configuration.instance_variable_set(:@script_hashes, nil)
+      Configuration.instance_variable_set(:@style_hashes, nil)
+    end
+
+    it "raises an error when using hashed content without precomputed hashes" do
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "raises an error when using hashed content with precomputed hashes, but none for the given file" do
+      Configuration.instance_variable_set(:@script_hashes, filename.reverse => ["'sha256-123'"])
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "raises an error when using previously unknown hashed content with precomputed hashes for a given file" do
+      Configuration.instance_variable_set(:@script_hashes, filename => ["'sha256-123'"])
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "adds known hash values to the corresponding headers when the helper is used" do
+      begin
+        allow(SecureRandom).to receive(:base64).and_return("abc123")
+
+        expected_hash = "sha256-3/URElR9+3lvLIouavYD/vhoICSNKilh15CzI/nKqg8="
+        Configuration.instance_variable_set(:@script_hashes, filename => ["'#{expected_hash}'"])
+        expected_style_hash = "sha256-7oYK96jHg36D6BM042er4OfBnyUDTG3pH1L8Zso3aGc="
+        Configuration.instance_variable_set(:@style_hashes, filename => ["'#{expected_style_hash}'"])
+
+        # render erb that calls out to helpers.
+        Message.new(request).result
+        _, env = middleware.call request.env
+
+        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'#{Regexp.escape(expected_hash)}'/)
+        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'nonce-abc123'/)
+        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'nonce-abc123'/)
+        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'#{Regexp.escape(expected_style_hash)}'/)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers_spec.rb

@@ -20,6 +20,13 @@ module SecureHeaders
       end.to raise_error(Configuration::NotYetConfiguredError)
     end
 
+    it "raises and ArgumentError when referencing an override that has not been set" do
+      expect do
+        Configuration.default
+        SecureHeaders.use_secure_headers_override(request, :missing)
+      end.to raise_error(ArgumentError)
+    end
+
     describe "#header_hash_for" do
       it "allows you to opt out of individual headers via API" do
         Configuration.default
@@ -305,6 +312,14 @@ module SecureHeaders
         end.to raise_error(XPCDPConfigError)
       end
 
+      it "validates your referrer_policy config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.referrer_policy = "lol"
+          end
+        end.to raise_error(ReferrerPolicyConfigError)
+      end
+
       it "validates your hpkp config upon configuration" do
         expect do
           Configuration.default do |config|
@@ -312,6 +327,14 @@ module SecureHeaders
           end
         end.to raise_error(PublicKeyPinsConfigError)
       end
+
+      it "validates your cookies config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.cookies = { secure: "lol" }
+          end
+        end.to raise_error(CookiesConfigError)
+      end
     end
   end
 end

data/spec/spec_helper.rb

@@ -11,6 +11,7 @@ require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
 
 USER_AGENTS = {
+  edge: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246",
   firefox: 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
   chrome: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
   ie: 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
@@ -30,6 +31,7 @@ def expect_default_values(hash)
   expect(hash[SecureHeaders::XXssProtection::HEADER_NAME]).to eq(SecureHeaders::XXssProtection::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XContentTypeOptions::HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XPermittedCrossDomainPolicies::HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::DEFAULT_VALUE)
+  expect(hash[SecureHeaders::ReferrerPolicy::HEADER_NAME]).to be_nil
 end
 
 module SecureHeaders
@@ -45,3 +47,15 @@ end
 def reset_config
   SecureHeaders::Configuration.clear_configurations
 end
+
+def capture_warning
+  begin
+    old_stderr = $stderr
+    $stderr = StringIO.new
+    yield
+    result = $stderr.string
+  ensure
+    $stderr = old_stderr
+  end
+  result
+end

data/upgrading-to-3-0.md

@@ -8,6 +8,7 @@ Changes
 | Global configuration             | `SecureHeaders::Configuration.configure` block             | `SecureHeaders::Configuration.default` block                                                                                                                                 |
 | All headers besides HPKP and CSP | Accept hashes as config values                           | Must be strings (validated during configuration)                                                                                                                                                            |
 | CSP directive values             | Accepted space delimited strings OR arrays of strings    | Must be arrays of strings                                                                                                                                                  |
+| CSP Nonce values in views             | `@content_security_policy_nonce`    | `content_security_policy_script_nonce` or `content_security_policy_style_nonce`
 | `self`/`none` source expressions     | could be `self` / `none` / `'self'` / `'none'`                   | Must be `'self'` or `'none'`                                                                                                                                                   |
 | `inline` / `eval` source expressions | could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'`                                                                                                                                   |
 | Per-action configuration         | override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111)  | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.1.2
+  version: 3.3.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-30 00:00:00.000000000 Z
+date: 2016-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -58,9 +58,12 @@ files:
 - Rakefile
 - lib/secure_headers.rb
 - lib/secure_headers/configuration.rb
+- lib/secure_headers/hash_helper.rb
 - lib/secure_headers/headers/content_security_policy.rb
+- lib/secure_headers/headers/cookie.rb
 - lib/secure_headers/headers/policy_management.rb
 - lib/secure_headers/headers/public_key_pins.rb
+- lib/secure_headers/headers/referrer_policy.rb
 - lib/secure_headers/headers/strict_transport_security.rb
 - lib/secure_headers/headers/x_content_type_options.rb
 - lib/secure_headers/headers/x_download_options.rb
@@ -69,12 +72,16 @@ files:
 - lib/secure_headers/headers/x_xss_protection.rb
 - lib/secure_headers/middleware.rb
 - lib/secure_headers/railtie.rb
+- lib/secure_headers/utils/cookies_config.rb
 - lib/secure_headers/view_helper.rb
+- lib/tasks/tasks.rake
 - secure_headers.gemspec
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
+- spec/lib/secure_headers/headers/referrer_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
@@ -82,6 +89,7 @@ files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
 - upgrading-to-3-0.md
@@ -113,8 +121,10 @@ summary: Add easily configured security headers to responses including content-s
 test_files:
 - spec/lib/secure_headers/configuration_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
+- spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
+- spec/lib/secure_headers/headers/referrer_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
 - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
 - spec/lib/secure_headers/headers/x_download_options_spec.rb
@@ -122,5 +132,6 @@ test_files:
 - spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb
 - spec/lib/secure_headers/headers/x_xss_protection_spec.rb
 - spec/lib/secure_headers/middleware_spec.rb
+- spec/lib/secure_headers/view_helpers_spec.rb
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb