secure_headers 3.5.0 → 3.6.2

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -107,6 +107,11 @@ module SecureHeaders
         expect(firefox_transitional).not_to match(/frame-src/)
       end
 
+      it "supports strict-dynamic" do
+        csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456}, USER_AGENTS[:chrome])
+        expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456'")
+      end
+
       context "browser sniffing" do
         let (:complex_opts) do
           (ContentSecurityPolicy::ALL_DIRECTIVES - [:frame_src]).each_with_object({}) do |directive, hash|
@@ -149,6 +154,18 @@ module SecureHeaders
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari6])
           expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
         end
+
+        it "adds 'unsafe-inline', filters  blocked-all-mixed-content, upgrade-insecure-requests, nonce sources, and hash sources for safari 10 and higher" do
+          policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari10])
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types plugin-types.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; report-uri report-uri.com")
+        end
+
+        it "falls back to standard Firefox defaults when the useragent version is not present" do
+          ua = USER_AGENTS[:firefox].dup
+          allow(ua).to receive(:version).and_return(nil)
+          policy = ContentSecurityPolicy.new(complex_opts, ua)
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+        end
       end
     end
   end

data/spec/lib/secure_headers/headers/referrer_policy_spec.rb

@@ -18,6 +18,24 @@ module SecureHeaders
         end.not_to raise_error
       end
 
+      it "accepts 'same-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("same-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin")
+        end.not_to raise_error
+      end
+
+      it "accepts 'strict-origin-when-cross-origin'" do
+        expect do
+          ReferrerPolicy.validate_config!("strict-origin-when-cross-origin")
+        end.not_to raise_error
+      end
+
       it "accepts 'origin'" do
         expect do
           ReferrerPolicy.validate_config!("origin")

data/spec/lib/secure_headers_spec.rb

@@ -530,6 +530,14 @@ module SecureHeaders
         end.to raise_error(XContentTypeOptionsConfigError)
       end
 
+      it "validates your clear site data config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.clear_site_data = 1
+          end
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
       it "validates your x_xss config upon configuration" do
         expect do
           Configuration.default do |config|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.5.0
+  version: 3.6.2
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-10-12 00:00:00.000000000 Z
+date: 2017-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -58,9 +58,16 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- docs/HPKP.md
+- docs/cookies.md
+- docs/hashes.md
+- docs/named_overrides_and_appends.md
+- docs/per_action_configuration.md
+- docs/sinatra.md
 - lib/secure_headers.rb
 - lib/secure_headers/configuration.rb
 - lib/secure_headers/hash_helper.rb
+- lib/secure_headers/headers/clear_site_data.rb
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/content_security_policy_config.rb
 - lib/secure_headers/headers/cookie.rb
@@ -80,6 +87,7 @@ files:
 - lib/tasks/tasks.rake
 - secure_headers.gemspec
 - spec/lib/secure_headers/configuration_spec.rb
+- spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
@@ -116,13 +124,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,
   x-frame-options, strict-transport-security, etc.
 test_files:
 - spec/lib/secure_headers/configuration_spec.rb
+- spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb