secure_headers 3.5.0.pre → 3.6.2

data/spec/lib/secure_headers/headers/clear_site_data_spec.rb

@@ -0,0 +1,103 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe ClearSiteData do
+    describe "make_header" do
+      it "returns nil with nil config" do
+        expect(described_class.make_header).to be_nil
+      end
+
+      it "returns nil with empty config" do
+        expect(described_class.make_header([])).to be_nil
+      end
+
+      it "returns nil with opt-out config" do
+        expect(described_class.make_header(OPT_OUT)).to be_nil
+      end
+
+      it "returns all types with `true` config" do
+        name, value = described_class.make_header(true)
+
+        expect(name).to eq(ClearSiteData::HEADER_NAME)
+        expect(value).to eq(normalize_json(<<-HERE))
+          {
+            "types": [
+              "cache",
+              "cookies",
+              "storage",
+              "executionContexts"
+            ]
+          }
+        HERE
+      end
+
+      it "returns specified types" do
+        name, value = described_class.make_header(["foo", "bar"])
+
+        expect(name).to eq(ClearSiteData::HEADER_NAME)
+        expect(value).to eq(normalize_json(<<-HERE))
+          {
+            "types": [
+              "foo",
+              "bar"
+            ]
+          }
+        HERE
+      end
+    end
+
+    describe "validate_config!" do
+      it "succeeds for `true` config" do
+        expect do
+          described_class.validate_config!(true)
+        end.not_to raise_error
+      end
+
+      it "succeeds for `nil` config" do
+        expect do
+          described_class.validate_config!(nil)
+        end.not_to raise_error
+      end
+
+      it "succeeds for opt-out config" do
+        expect do
+          described_class.validate_config!(OPT_OUT)
+        end.not_to raise_error
+      end
+
+      it "succeeds for empty config" do
+        expect do
+          described_class.validate_config!([])
+        end.not_to raise_error
+      end
+
+      it "succeeds for Array of Strings config" do
+        expect do
+          described_class.validate_config!(["foo"])
+        end.not_to raise_error
+      end
+
+      it "fails for Array of non-String config" do
+        expect do
+          described_class.validate_config!([1])
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
+      it "fails for non-serializable config" do
+        expect do
+          described_class.validate_config!(["hi \255"])
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
+      it "fails for other types of config" do
+        expect do
+          described_class.validate_config!(:cookies)
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+    end
+
+    def normalize_json(json)
+      JSON.dump(JSON.parse(json))
+    end
+  end
+end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -107,6 +107,11 @@ module SecureHeaders
         expect(firefox_transitional).not_to match(/frame-src/)
       end
 
+      it "supports strict-dynamic" do
+        csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456}, USER_AGENTS[:chrome])
+        expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456'")
+      end
+
       context "browser sniffing" do
         let (:complex_opts) do
           (ContentSecurityPolicy::ALL_DIRECTIVES - [:frame_src]).each_with_object({}) do |directive, hash|
@@ -149,6 +154,18 @@ module SecureHeaders
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari6])
           expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
         end
+
+        it "adds 'unsafe-inline', filters  blocked-all-mixed-content, upgrade-insecure-requests, nonce sources, and hash sources for safari 10 and higher" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari10])
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types plugin-types.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; report-uri report-uri.com")
+        end
+
+        it "falls back to standard Firefox defaults when the useragent version is not present" do
+          ua = USER_AGENTS[:firefox].dup
+          allow(ua).to receive(:version).and_return(nil)
+          policy = ContentSecurityPolicy.new(complex_opts, ua)
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+        end
       end
     end
   end

data/spec/lib/secure_headers/headers/referrer_policy_spec.rb

@@ -18,6 +18,24 @@ module SecureHeaders
         end.not_to raise_error
       end
 
+      it "accepts 'same-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("same-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
       it "accepts 'origin'" do
         expect do
           ReferrerPolicy.validate_config!("origin")

data/spec/lib/secure_headers/middleware_spec.rb

@@ -105,6 +105,18 @@ module SecureHeaders
         _, env = cookie_middleware.call request.env
         expect(env['Set-Cookie']).to eq("foo=bar")
       end
+
+      it "sets the secure cookie flag correctly on interleaved http/https requests" do
+        Configuration.default { |config| config.cookies = { secure: true } }
+
+        request = Rack::Request.new("HTTPS" => "off")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar")
+
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar; secure")
+      end
     end
   end
 end

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -27,6 +27,16 @@ class Message < ERB
     background-color: black;
   }
 <% end %>
+
+<script nonce="<%= content_security_policy_script_nonce %>">
+  alert(1)
+</script>
+
+<style nonce="<%= content_security_policy_style_nonce %>">
+  body {
+    background-color: black;
+  }
+</style>
 <%= @name %>
 
 TEMPLATE

data/spec/lib/secure_headers_spec.rb

@@ -277,6 +277,20 @@ module SecureHeaders
           expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
         end
 
+        it "uses a nonce for safari 10+" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w(mycdn.com)
+            }
+          end
+
+          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari10]))
+          nonce = SecureHeaders.content_security_policy_script_nonce(safari_request)
+          hash = SecureHeaders.header_hash_for(safari_request)
+          expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'")
+        end
+
         it "supports the deprecated `report_only: true` format" do
           expect(Kernel).to receive(:warn).once
 
@@ -516,6 +530,14 @@ module SecureHeaders
         end.to raise_error(XContentTypeOptionsConfigError)
       end
 
+      it "validates your clear site data config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.clear_site_data = 1
+          end
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
       it "validates your x_xss config upon configuration" do
         expect do
           Configuration.default do |config|

data/spec/spec_helper.rb

@@ -21,7 +21,8 @@ USER_AGENTS = {
   ios6: "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
   safari5: "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
   safari5_1: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-  safari6: "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+  safari6: "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1",
+  safari10: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/602.2.11 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.11"
 }
 
 def expect_default_values(hash)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.5.0.pre
+  version: 3.6.2
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-09 00:00:00.000000000 Z
+date: 2017-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -58,9 +58,16 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- docs/HPKP.md
+- docs/cookies.md
+- docs/hashes.md
+- docs/named_overrides_and_appends.md
+- docs/per_action_configuration.md
+- docs/sinatra.md
 - lib/secure_headers.rb
 - lib/secure_headers/configuration.rb
 - lib/secure_headers/hash_helper.rb
+- lib/secure_headers/headers/clear_site_data.rb
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/content_security_policy_config.rb
 - lib/secure_headers/headers/cookie.rb
@@ -80,6 +87,7 @@ files:
 - lib/tasks/tasks.rake
 - secure_headers.gemspec
 - spec/lib/secure_headers/configuration_spec.rb
+- spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
@@ -111,18 +119,19 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,
   x-frame-options, strict-transport-security, etc.
 test_files:
 - spec/lib/secure_headers/configuration_spec.rb
+- spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb