secure_headers 3.2.0 → 4.0.0

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,33 +1,46 @@
-require_relative 'policy_management'
+# frozen_string_literal: true
+require_relative "policy_management"
+require_relative "content_security_policy_config"
+require "useragent"
 
 module SecureHeaders
-  class ContentSecurityPolicyConfigError < StandardError; end
   class ContentSecurityPolicy
     include PolicyManagement
 
+    # constants to be used for version-specific UA sniffing
+    VERSION_46 = ::UserAgent::Version.new("46")
+    VERSION_10 = ::UserAgent::Version.new("10")
+    FALLBACK_VERSION = ::UserAgent::Version.new("0")
+
     def initialize(config = nil, user_agent = OTHER)
-      config = Configuration.deep_copy(DEFAULT_CONFIG) unless config
-      @config = config
+      @config = if config.is_a?(Hash)
+        if config[:report_only]
+          ContentSecurityPolicyReportOnlyConfig.new(config || DEFAULT_CONFIG)
+        else
+          ContentSecurityPolicyConfig.new(config || DEFAULT_CONFIG)
+        end
+      elsif config.nil?
+        ContentSecurityPolicyConfig.new(DEFAULT_CONFIG)
+      else
+        config
+      end
+
       @parsed_ua = if user_agent.is_a?(UserAgent::Browsers::Base)
         user_agent
       else
         UserAgent.parse(user_agent)
       end
-      @report_only = @config[:report_only]
-      @preserve_schemes = @config[:preserve_schemes]
-      @script_nonce = @config[:script_nonce]
-      @style_nonce = @config[:style_nonce]
+      @frame_src = normalize_child_frame_src
+      @preserve_schemes = @config.preserve_schemes
+      @script_nonce = @config.script_nonce
+      @style_nonce = @config.style_nonce
     end
 
     ##
     # Returns the name to use for the header. Either "Content-Security-Policy" or
     # "Content-Security-Policy-Report-Only"
     def name
-      if @report_only
-        REPORT_ONLY
-      else
-        HEADER_NAME
-      end
+      @config.class.const_get(:HEADER_NAME)
     end
 
     ##
@@ -42,6 +55,14 @@ module SecureHeaders
 
     private
 
+    def normalize_child_frame_src
+      if @config.frame_src && @config.child_src && @config.frame_src != @config.child_src
+        raise ArgumentError, "#{Kernel.caller.first}: both :child_src and :frame_src supplied and do not match. This can lead to inconsistent behavior across browsers."
+      end
+
+      @config.frame_src || @config.child_src
+    end
+
     # Private: converts the config object into a string representing a policy.
     # Places default-src at the first directive and report-uri as the last. All
     # others are presented in alphabetical order.
@@ -53,44 +74,90 @@ module SecureHeaders
       directives.map do |directive_name|
         case DIRECTIVE_VALUE_TYPES[directive_name]
         when :boolean
-          symbol_to_hyphen_case(directive_name)
-        when :string
-          [symbol_to_hyphen_case(directive_name), @config[directive_name]].join(" ")
-        else
-          build_directive(directive_name)
+          symbol_to_hyphen_case(directive_name) if @config.directive_value(directive_name)
+        when :sandbox_list
+          build_sandbox_list_directive(directive_name)
+        when :media_type_list
+          build_media_type_list_directive(directive_name)
+        when :source_list
+          build_source_list_directive(directive_name)
         end
       end.compact.join("; ")
     end
 
+    def build_sandbox_list_directive(directive)
+      return unless sandbox_list = @config.directive_value(directive)
+      max_strict_policy = case sandbox_list
+      when Array
+        sandbox_list.empty?
+      when true
+        true
+      else
+        false
+      end
+
+      # A maximally strict sandbox policy is just the `sandbox` directive,
+      # whith no configuraiton values.
+      if max_strict_policy
+        symbol_to_hyphen_case(directive)
+      elsif sandbox_list && sandbox_list.any?
+        [
+          symbol_to_hyphen_case(directive),
+          sandbox_list.uniq
+        ].join(" ")
+      end
+    end
+
+    def build_media_type_list_directive(directive)
+      return unless media_type_list = @config.directive_value(directive)
+      if media_type_list && media_type_list.any?
+        [
+          symbol_to_hyphen_case(directive),
+          media_type_list.uniq
+        ].join(" ")
+      end
+    end
+
     # Private: builds a string that represents one directive in a minified form.
     #
     # directive_name - a symbol representing the various ALL_DIRECTIVES
     #
     # Returns a string representing a directive.
-    def build_directive(directive)
-      return if @config[directive].nil?
-
-      source_list = @config[directive].compact
-      return if source_list.empty?
+    def build_source_list_directive(directive)
+      source_list = case directive
+      when :child_src
+        if supported_directives.include?(:child_src)
+          @frame_src
+        end
+      when :frame_src
+        unless supported_directives.include?(:child_src)
+          @frame_src
+        end
+      else
+        @config.directive_value(directive)
+      end
 
-      normalized_source_list = minify_source_list(directive, source_list)
-      [symbol_to_hyphen_case(directive), normalized_source_list].join(" ")
+      if source_list != OPT_OUT && source_list && source_list.any?
+        normalized_source_list = minify_source_list(directive, source_list)
+        [symbol_to_hyphen_case(directive), normalized_source_list].join(" ")
+      end
     end
 
     # If a directive contains *, all other values are omitted.
     # If a directive contains 'none' but has other values, 'none' is ommitted.
     # Schemes are stripped (see http://www.w3.org/TR/CSP2/#match-source-expression)
     def minify_source_list(directive, source_list)
+      source_list = source_list.compact
       if source_list.include?(STAR)
         keep_wildcard_sources(source_list)
       else
-        populate_nonces!(directive, source_list)
-        reject_all_values_if_none!(source_list)
+        source_list = populate_nonces(directive, source_list)
+        source_list = reject_all_values_if_none(source_list)
 
         unless directive == REPORT_URI || @preserve_schemes
-          strip_source_schemes!(source_list)
+          source_list = strip_source_schemes(source_list)
         end
-        dedup_source_list(source_list).join(" ")
+        dedup_source_list(source_list)
       end
     end
 
@@ -100,8 +167,12 @@ module SecureHeaders
     end
 
     # Discard any 'none' values if more directives are supplied since none may override values.
-    def reject_all_values_if_none!(source_list)
-      source_list.reject! { |value| value == NONE } if source_list.length > 1
+    def reject_all_values_if_none(source_list)
+      if source_list.length > 1
+        source_list.reject { |value| value == NONE }
+      else
+        source_list
+      end
     end
 
     # Removes duplicates and sources that already match an existing wild card.
@@ -123,12 +194,14 @@ module SecureHeaders
 
     # Private: append a nonce to the script/style directories if script_nonce
     # or style_nonce are provided.
-    def populate_nonces!(directive, source_list)
+    def populate_nonces(directive, source_list)
       case directive
       when SCRIPT_SRC
         append_nonce(source_list, @script_nonce)
       when STYLE_SRC
         append_nonce(source_list, @style_nonce)
+      else
+        source_list
       end
     end
 
@@ -145,34 +218,50 @@ module SecureHeaders
           source_list << UNSAFE_INLINE
         end
       end
+
+      source_list
     end
 
     # Private: return the list of directives that are supported by the user agent,
     # starting with default-src and ending with report-uri.
     def directives
-      [DEFAULT_SRC,
+      [
+        DEFAULT_SRC,
         BODY_DIRECTIVES.select { |key| supported_directives.include?(key) },
-        REPORT_URI].flatten.select { |directive| @config.key?(directive) }
+        REPORT_URI
+      ].flatten
     end
 
     # Private: Remove scheme from source expressions.
-    def strip_source_schemes!(source_list)
-      source_list.map! { |source_expression| source_expression.sub(HTTP_SCHEME_REGEX, "") }
+    def strip_source_schemes(source_list)
+      source_list.map { |source_expression| source_expression.sub(HTTP_SCHEME_REGEX, "") }
     end
 
     # Private: determine which directives are supported for the given user agent.
     #
+    # Add UA-sniffing special casing here.
+    #
     # Returns an array of symbols representing the directives.
     def supported_directives
-      @supported_directives ||= VARIATIONS[@parsed_ua.browser] || VARIATIONS[OTHER]
+      @supported_directives ||= if VARIATIONS[@parsed_ua.browser]
+        if @parsed_ua.browser == "Firefox" && ((@parsed_ua.version || FALLBACK_VERSION) >= VERSION_46)
+          VARIATIONS["FirefoxTransitional"]
+        elsif @parsed_ua.browser == "Safari" && ((@parsed_ua.version || FALLBACK_VERSION) >= VERSION_10)
+          VARIATIONS["SafariTransitional"]
+        else
+          VARIATIONS[@parsed_ua.browser]
+        end
+      else
+        VARIATIONS[OTHER]
+      end
     end
 
     def nonces_supported?
-      @nonces_supported ||= MODERN_BROWSERS.include?(@parsed_ua.browser)
+      @nonces_supported ||= self.class.nonces_supported?(@parsed_ua)
     end
 
     def symbol_to_hyphen_case(sym)
-      sym.to_s.tr('_', '-')
+      sym.to_s.tr("_", "-")
     end
   end
 end

data/lib/secure_headers/headers/content_security_policy_config.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+module SecureHeaders
+  module DynamicConfig
+    def self.included(base)
+      base.send(:attr_writer, :modified)
+      base.send(:attr_reader, *base.attrs)
+      base.attrs.each do |attr|
+        base.send(:define_method, "#{attr}=") do |value|
+          if self.class.attrs.include?(attr)
+            write_attribute(attr, value)
+          else
+            raise ContentSecurityPolicyConfigError, "Unknown config directive: #{attr}=#{value}"
+          end
+        end
+      end
+    end
+
+    def initialize(hash)
+      @base_uri = nil
+      @block_all_mixed_content = nil
+      @child_src = nil
+      @connect_src = nil
+      @default_src = nil
+      @font_src = nil
+      @form_action = nil
+      @frame_ancestors = nil
+      @frame_src = nil
+      @img_src = nil
+      @manifest_src = nil
+      @media_src = nil
+      @object_src = nil
+      @plugin_types = nil
+      @preserve_schemes = nil
+      @report_only = nil
+      @report_uri = nil
+      @sandbox = nil
+      @script_nonce = nil
+      @script_src = nil
+      @style_nonce = nil
+      @style_src = nil
+      @upgrade_insecure_requests = nil
+
+      from_hash(hash)
+      @modified = false
+    end
+
+    def update_directive(directive, value)
+      self.send("#{directive}=", value)
+    end
+
+    def directive_value(directive)
+      if self.class.attrs.include?(directive)
+        self.send(directive)
+      end
+    end
+
+    def modified?
+      @modified
+    end
+
+    def merge(new_hash)
+      ContentSecurityPolicy.combine_policies(self.to_h, new_hash)
+    end
+
+    def merge!(new_hash)
+      from_hash(new_hash)
+    end
+
+    def append(new_hash)
+      from_hash(ContentSecurityPolicy.combine_policies(self.to_h, new_hash))
+    end
+
+    def to_h
+      self.class.attrs.each_with_object({}) do |key, hash|
+        value = self.send(key)
+        hash[key] = value unless value.nil?
+      end
+    end
+
+    def dup
+      self.class.new(self.to_h)
+    end
+
+    def opt_out?
+      false
+    end
+
+    def ==(o)
+      self.class == o.class && self.to_h == o.to_h
+    end
+
+    alias_method :[], :directive_value
+    alias_method :[]=, :update_directive
+
+    private
+    def from_hash(hash)
+      hash.each_pair do |k, v|
+        next if v.nil?
+
+        if self.class.attrs.include?(k)
+          write_attribute(k, v)
+        else
+          raise ContentSecurityPolicyConfigError, "Unknown config directive: #{k}=#{v}"
+        end
+      end
+    end
+
+    def write_attribute(attr, value)
+      value = value.dup if PolicyManagement::DIRECTIVE_VALUE_TYPES[attr] == :source_list
+      attr_variable = "@#{attr}"
+      prev_value = self.instance_variable_get(attr_variable)
+      self.instance_variable_set(attr_variable, value)
+      if prev_value != value
+        @modified = true
+      end
+    end
+  end
+
+  class ContentSecurityPolicyConfigError < StandardError; end
+  class ContentSecurityPolicyConfig
+    CONFIG_KEY = :csp
+    HEADER_NAME = "Content-Security-Policy".freeze
+
+    ATTRS = PolicyManagement::ALL_DIRECTIVES + PolicyManagement::META_CONFIGS + PolicyManagement::NONCES
+    def self.attrs
+      ATTRS
+    end
+
+    include DynamicConfig
+
+    # based on what was suggested in https://github.com/rails/rails/pull/24961/files
+    DEFAULT = {
+      default_src: %w('self' https:),
+      font_src: %w('self' https: data:),
+      img_src: %w('self' https: data:),
+      object_src: %w('none'),
+      script_src: %w(https:),
+      style_src: %w('self' https: 'unsafe-inline')
+    }
+
+    def report_only?
+      false
+    end
+
+    def make_report_only
+      ContentSecurityPolicyReportOnlyConfig.new(self.to_h)
+    end
+  end
+
+  class ContentSecurityPolicyReportOnlyConfig < ContentSecurityPolicyConfig
+    CONFIG_KEY = :csp_report_only
+    HEADER_NAME = "Content-Security-Policy-Report-Only".freeze
+
+    def report_only?
+      true
+    end
+
+    def make_report_only
+      self
+    end
+  end
+end

data/lib/secure_headers/headers/cookie.rb

@@ -1,5 +1,7 @@
-require 'cgi'
-require 'secure_headers/utils/cookies_config'
+# frozen_string_literal: true
+require "cgi"
+require "secure_headers/utils/cookies_config"
+
 
 module SecureHeaders
   class CookiesConfigError < StandardError; end
@@ -13,8 +15,18 @@ module SecureHeaders
 
     attr_reader :raw_cookie, :config
 
+    COOKIE_DEFAULTS = {
+      httponly: true,
+      secure: true,
+      samesite: { lax: true },
+    }.freeze
+
     def initialize(cookie, config)
       @raw_cookie = cookie
+      unless config == OPT_OUT
+        config ||= {}
+        config = COOKIE_DEFAULTS.merge(config)
+      end
       @config = config
       @attributes = {
         httponly: nil,
@@ -56,6 +68,7 @@ module SecureHeaders
     end
 
     def flag_cookie?(attribute)
+      return false if config == OPT_OUT
       case config[attribute]
       when TrueClass
         true
@@ -85,6 +98,7 @@ module SecureHeaders
     end
 
     def flag_samesite?
+      return false if config == OPT_OUT || config[:samesite] == OPT_OUT
       flag_samesite_lax? || flag_samesite_strict?
     end
 
@@ -99,6 +113,10 @@ module SecureHeaders
     def flag_samesite_enforcement?(mode)
       return unless config[:samesite]
 
+      if config[:samesite].is_a?(TrueClass) && mode == :lax
+        return true
+      end
+
       case config[:samesite][mode]
       when Hash
         conditionally_flag?(config[:samesite][mode])
@@ -113,7 +131,7 @@ module SecureHeaders
       return unless cookie
 
       cookie.split(/[;,]\s?/).each do |pairs|
-        name, values = pairs.split('=',2)
+        name, values = pairs.split("=", 2)
         name = CGI.unescape(name)
 
         attribute = name.downcase.to_sym

data/lib/secure_headers/headers/expect_certificate_transparency.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+module SecureHeaders
+  class ExpectCertificateTransparencyConfigError < StandardError; end
+
+  class ExpectCertificateTransparency
+    HEADER_NAME = "Expect-CT".freeze
+    CONFIG_KEY  = :expect_certificate_transparency
+    INVALID_CONFIGURATION_ERROR = "config must be a hash.".freeze
+    INVALID_ENFORCE_VALUE_ERROR = "enforce must be a boolean".freeze
+    REQUIRED_MAX_AGE_ERROR      = "max-age is a required directive.".freeze
+    INVALID_MAX_AGE_ERROR       = "max-age must be a number.".freeze
+
+    class << self
+      # Public: Generate a Expect-CT header.
+      #
+      # Returns nil if not configured, returns header name and value if
+      # configured.
+      def make_header(config)
+        return if config.nil?
+
+        header = new(config)
+        [HEADER_NAME, header.value]
+      end
+
+      def validate_config!(config)
+        return if config.nil? || config == OPT_OUT
+        raise ExpectCertificateTransparencyConfigError.new(INVALID_CONFIGURATION_ERROR) unless config.is_a? Hash
+
+        unless [true, false, nil].include?(config[:enforce])
+          raise ExpectCertificateTransparencyConfigError.new(INVALID_ENFORCE_VALUE_ERROR)
+        end
+
+        if !config[:max_age]
+          raise ExpectCertificateTransparencyConfigError.new(REQUIRED_MAX_AGE_ERROR)
+        elsif config[:max_age].to_s !~ /\A\d+\z/
+          raise ExpectCertificateTransparencyConfigError.new(INVALID_MAX_AGE_ERROR)
+        end
+      end
+    end
+
+    def initialize(config)
+      @enforced   = config.fetch(:enforce, nil)
+      @max_age    = config.fetch(:max_age, nil)
+      @report_uri = config.fetch(:report_uri, nil)
+    end
+
+    def value
+      [
+        enforced_directive,
+        max_age_directive,
+        report_uri_directive
+      ].compact.join("; ").strip
+    end
+
+    def enforced_directive
+      # Unfortunately `if @enforced` isn't enough here in case someone
+      # passes in a random string so let's be specific with it to prevent
+      # accidental enforcement.
+      "enforce" if @enforced == true
+    end
+
+    def max_age_directive
+      "max-age=#{@max_age}" if @max_age
+    end
+
+    def report_uri_directive
+      "report-uri=\"#{@report_uri}\"" if @report_uri
+    end
+  end
+end