secure_headers 3.2.0 → 3.8.0

data/spec/lib/secure_headers/headers/cookie_spec.rb

@@ -62,29 +62,21 @@ module SecureHeaders
     end
 
     context "SameSite cookies" do
-      it "flags SameSite=Lax" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } })
-        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
-      end
-
-      it "flags SameSite=Lax when configured with a boolean" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: true})
-        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
-      end
-
-      it "does not flag cookies as SameSite=Lax when excluded" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } })
-        expect(cookie.to_s).to eq("_session=thisisatest")
-      end
+      %w(None Lax Strict).each do |flag|
+        it "flags SameSite=#{flag}" do
+          cookie = Cookie.new(raw_cookie, samesite: { flag.downcase.to_sym => { only: ["_session"] } })
+          expect(cookie.to_s).to eq("_session=thisisatest; SameSite=#{flag}")
+        end
 
-      it "flags SameSite=Strict" do
-        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } })
-        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
-      end
+        it "flags SameSite=#{flag} when configured with a boolean" do
+          cookie = Cookie.new(raw_cookie, samesite: { flag.downcase.to_sym => true })
+          expect(cookie.to_s).to eq("_session=thisisatest; SameSite=#{flag}")
+        end
 
-      it "does not flag cookies as SameSite=Strict when excluded" do
-        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] } })
-        expect(cookie.to_s).to eq("_session=thisisatest")
+        it "does not flag cookies as SameSite=#{flag} when excluded" do
+          cookie = Cookie.new(raw_cookie, samesite: { flag.downcase.to_sym => { except: ["_session"] } })
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
       end
 
       it "flags SameSite=Strict when configured with a boolean" do
@@ -131,10 +123,15 @@ module SecureHeaders
       end.to raise_error(CookiesConfigError)
     end
 
-    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
-      expect do
-        Cookie.validate_config!(samesite: { lax: true, strict: true})
-      end.to raise_error(CookiesConfigError)
+    cookie_options = %w(none lax strict).map(&:to_sym)
+    cookie_options.each do |flag|
+      (cookie_options - [flag]).each do |other_flag|
+        it "raises an exception when SameSite #{flag} and #{other_flag} enforcement modes are configured with booleans" do
+          expect do
+            Cookie.validate_config!(samesite: { flag => true, other_flag => true})
+          end.to raise_error(CookiesConfigError)
+        end
+      end
     end
 
     it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do

data/spec/lib/secure_headers/headers/expect_certificate_transparency_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe ExpectCertificateTransparency do
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: true).value).to eq("enforce, max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: false).value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: "yolocopter").value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, report_uri: "https://report-uri.io/expect-ct").value).to eq("max-age=1234, report-uri=\"https://report-uri.io/expect-ct\"") }
+    specify do
+      config = { enforce: true, max_age: 1234, report_uri: "https://report-uri.io/expect-ct" }
+      header_value = "enforce, max-age=1234, report-uri=\"https://report-uri.io/expect-ct\""
+      expect(ExpectCertificateTransparency.new(config).value).to eq(header_value)
+    end
+
+    context "with an invalid configuration" do
+      it "raises an exception when configuration isn't a hash" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(%w(a))
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception when max-age is not provided" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(foo: "bar")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid max-age" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(max_age: "abc123")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid enforce value" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(enforce: "brokenstring")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/policy_management_spec.rb

@@ -23,15 +23,17 @@ module SecureHeaders
           # directive values: these values will directly translate into source directives
           default_src: %w(https: 'self'),
           frame_src: %w('self' *.twimg.com itunes.apple.com),
-          connect_src: %w(wws:),
+          child_src: %w('self' *.twimg.com itunes.apple.com),
+          connect_src: %w(wss:),
           font_src: %w('self' data:),
           img_src: %w(mycdn.com data:),
+          manifest_src: %w(manifest.com),
           media_src: %w(utoob.com),
           object_src: %w('self'),
           script_src: %w('self'),
           style_src: %w('unsafe-inline'),
+          worker_src: %w(worker.com),
           base_uri: %w('self'),
-          child_src: %w('self'),
           form_action: %w('self' github.com),
           frame_ancestors: %w('none'),
           plugin_types: %w(application/x-shockwave-flash),
@@ -40,70 +42,105 @@ module SecureHeaders
           report_uri: %w(https://example.com/uri-directive)
         }
 
-        CSP.validate_config!(config)
+        ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(config))
       end
 
       it "requires a :default_src value" do
         expect do
-          CSP.validate_config!(script_src: %('self'))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(script_src: %('self')))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "requires :report_only to be a truthy value" do
         expect do
-          CSP.validate_config!(default_opts.merge(report_only: "steve"))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(report_only: "steve")))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "requires :preserve_schemes to be a truthy value" do
         expect do
-          CSP.validate_config!(default_opts.merge(preserve_schemes: "steve"))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(preserve_schemes: "steve")))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "requires :block_all_mixed_content to be a boolean value" do
         expect do
-          CSP.validate_config!(default_opts.merge(block_all_mixed_content: "steve"))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(block_all_mixed_content: "steve")))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "requires :upgrade_insecure_requests to be a boolean value" do
         expect do
-          CSP.validate_config!(default_opts.merge(upgrade_insecure_requests: "steve"))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(upgrade_insecure_requests: "steve")))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "requires all source lists to be an array of strings" do
         expect do
-          CSP.validate_config!(default_src: "steve")
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: "steve"))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       it "allows nil values" do
         expect do
-          CSP.validate_config!(default_src: %w('self'), script_src: ["https:", nil])
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), script_src: ["https:", nil]))
         end.to_not raise_error
       end
 
       it "rejects unknown directives / config" do
         expect do
-          CSP.validate_config!(default_src: %w('self'), default_src_totally_mispelled: "steve")
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), default_src_totally_mispelled: "steve"))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
       # this is mostly to ensure people don't use the antiquated shorthands common in other configs
       it "performs light validation on source lists" do
         expect do
-          CSP.validate_config!(default_src: %w(self none inline eval))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w(self none inline eval)))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
+
+      it "rejects anything not of the form allow-* as a sandbox value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["steve"])))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts anything of the form allow-* as a sandbox value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["allow-foo"])))
+        end.to_not raise_error
+      end
+
+      it "accepts true as a sandbox policy" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: true)))
+        end.to_not raise_error
+      end
+
+      it "rejects anything not of the form type/subtype as a plugin-type value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["steve"])))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts anything of the form type/subtype as a plugin-type value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["application/pdf"])))
+        end.to_not raise_error
+      end
     end
 
     describe "#combine_policies" do
       it "combines the default-src value with the override if the directive was unconfigured" do
-        combined_config = CSP.combine_policies(Configuration.default.csp, script_src: %w(anothercdn.com))
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w(https:)
+          }
+        end
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, script_src: %w(anothercdn.com))
         csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.name).to eq(CSP::HEADER_NAME)
+        expect(csp.name).to eq(ContentSecurityPolicyConfig::HEADER_NAME)
         expect(csp.value).to eq("default-src https:; script-src https: anothercdn.com")
       end
 
@@ -115,7 +152,7 @@ module SecureHeaders
           }.freeze
         end
         report_uri = "https://report-uri.io/asdf"
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_uri: [report_uri])
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, report_uri: [report_uri])
         csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
         expect(csp.value).to include("report-uri #{report_uri}")
       end
@@ -127,12 +164,12 @@ module SecureHeaders
             report_only: false
           }.freeze
         end
-        non_default_source_additions = CSP::NON_FETCH_SOURCES.each_with_object({}) do |directive, hash|
+        non_default_source_additions = ContentSecurityPolicy::NON_FETCH_SOURCES.each_with_object({}) do |directive, hash|
           hash[directive] = %w("http://example.org)
         end
-        combined_config = CSP.combine_policies(Configuration.get.csp, non_default_source_additions)
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, non_default_source_additions)
 
-        CSP::NON_FETCH_SOURCES.each do |directive|
+        ContentSecurityPolicy::NON_FETCH_SOURCES.each do |directive|
           expect(combined_config[directive]).to eq(%w("http://example.org))
         end
 
@@ -146,9 +183,9 @@ module SecureHeaders
             report_only: false
           }
         end
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_only: true)
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, report_only: true)
         csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
-        expect(csp.name).to eq(CSP::REPORT_ONLY)
+        expect(csp.name).to eq(ContentSecurityPolicyReportOnlyConfig::HEADER_NAME)
       end
 
       it "overrides the :block_all_mixed_content flag" do
@@ -158,7 +195,7 @@ module SecureHeaders
             block_all_mixed_content: false
           }
         end
-        combined_config = CSP.combine_policies(Configuration.get.csp, block_all_mixed_content: true)
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, block_all_mixed_content: true)
         csp = ContentSecurityPolicy.new(combined_config)
         expect(csp.value).to eq("default-src https:; block-all-mixed-content")
       end
@@ -168,23 +205,9 @@ module SecureHeaders
           config.csp = OPT_OUT
         end
         expect do
-          CSP.combine_policies(Configuration.get.csp, script_src: %w(anothercdn.com))
+          ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, script_src: %w(anothercdn.com))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
     end
-
-    describe "#idempotent_additions?" do
-      specify { expect(ContentSecurityPolicy.idempotent_additions?(OPT_OUT, script_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(c.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(a.com b.com c.com))).to be false }
-
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com a.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w())).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: nil)).to be true }
-    end
   end
 end

data/spec/lib/secure_headers/headers/referrer_policy_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe ReferrerPolicy do
+    specify { expect(ReferrerPolicy.make_header).to eq([ReferrerPolicy::HEADER_NAME, "origin-when-cross-origin"]) }
+    specify { expect(ReferrerPolicy.make_header('no-referrer')).to eq([ReferrerPolicy::HEADER_NAME, "no-referrer"]) }
+
+    context "valid configuration values" do
+      it "accepts 'no-referrer'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer")
+        end.not_to raise_error
+      end
+
+      it "accepts 'no-referrer-when-downgrade'" do
+        expect do
+          ReferrerPolicy.validate_config!("no-referrer-when-downgrade")
+        end.not_to raise_error
+      end
+
+      it "accepts 'same-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("same-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'unsafe-url'" do
+        expect do
+          ReferrerPolicy.validate_config!("unsafe-url")
+        end.not_to raise_error
+      end
+
+      it "accepts nil" do
+        expect do
+          ReferrerPolicy.validate_config!(nil)
+        end.not_to raise_error
+      end
+    end
+
+    context 'invlaid configuration values' do
+      it "doesn't accept invalid values" do
+        expect do
+          ReferrerPolicy.validate_config!("open")
+        end.to raise_error(ReferrerPolicyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/middleware_spec.rb

@@ -13,6 +13,24 @@ module SecureHeaders
       Configuration.default
     end
 
+    it "warns if the hpkp report-uri host is the same as the current host" do
+      report_host = "report-uri.io"
+      Configuration.default do |config|
+        config.hpkp = {
+          max_age: 10000000,
+          pins: [
+            {sha256: 'b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c'},
+            {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
+          ],
+          report_uri: "https://#{report_host}/example-hpkp"
+        }
+      end
+
+      expect(Kernel).to receive(:warn).with(Middleware::HPKP_SAME_HOST_WARNING)
+
+      middleware.call(Rack::MockRequest.env_for("https://#{report_host}", {}))
+    end
+
     it "sets the headers" do
       _, env = middleware.call(Rack::MockRequest.env_for("https://looocalhost", {}))
       expect_default_values(env)
@@ -33,7 +51,7 @@ module SecureHeaders
       SecureHeaders.use_secure_headers_override(request, "my_custom_config")
       expect(request.env[SECURE_HEADERS_CONFIG]).to be(Configuration.get("my_custom_config"))
       _, env = middleware.call request.env
-      expect(env[CSP::HEADER_NAME]).to match("example.org")
+      expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match("example.org")
     end
 
     context "secure_cookies" do
@@ -87,6 +105,18 @@ module SecureHeaders
         _, env = cookie_middleware.call request.env
         expect(env['Set-Cookie']).to eq("foo=bar")
       end
+
+      it "sets the secure cookie flag correctly on interleaved http/https requests" do
+        Configuration.default { |config| config.cookies = { secure: true } }
+
+        request = Rack::Request.new("HTTPS" => "off")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar")
+
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar; secure")
+      end
     end
   end
 end

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -27,7 +27,16 @@ class Message < ERB
     background-color: black;
   }
 <% end %>
-<%= @name %>
+
+<script nonce="<%= content_security_policy_script_nonce %>">
+  alert(1)
+</script>
+
+<style nonce="<%= content_security_policy_style_nonce %>">
+  body {
+    background-color: black;
+  }
+</style>
 
 TEMPLATE
   end
@@ -72,8 +81,11 @@ module SecureHeaders
 
     before(:all) do
       Configuration.default do |config|
-        config.csp[:script_src] = %w('self')
-        config.csp[:style_src] = %w('self')
+        config.csp = {
+          :default_src => %w('self'),
+          :script_src => %w('self'),
+          :style_src => %w('self')
+        }
       end
     end
 
@@ -115,10 +127,10 @@ module SecureHeaders
         Message.new(request).result
         _, env = middleware.call request.env
 
-        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'#{Regexp.escape(expected_hash)}'/)
-        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'nonce-abc123'/)
-        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'nonce-abc123'/)
-        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'#{Regexp.escape(expected_style_hash)}'/)
+        expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/script-src[^;]*'#{Regexp.escape(expected_hash)}'/)
+        expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/script-src[^;]*'nonce-abc123'/)
+        expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/style-src[^;]*'nonce-abc123'/)
+        expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/style-src[^;]*'#{Regexp.escape(expected_style_hash)}'/)
       end
     end
   end