secure_headers 3.6.0 → 3.7.0

data/spec/lib/secure_headers_spec.rb

@@ -105,7 +105,7 @@ module SecureHeaders
       end
 
       it "produces a UA-specific CSP when overriding (and busting the cache)" do
-        config = Configuration.default do |config|
+        Configuration.default do |config|
           config.csp = {
             default_src: %w('self'),
             child_src: %w('self')
@@ -173,6 +173,33 @@ module SecureHeaders
           expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline' anothercdn.com")
         end
 
+        it "appends child-src to frame-src" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              frame_src: %w(frame_src.com)
+            }
+          end
+
+          SecureHeaders.append_content_security_policy_directives(chrome_request, child_src: %w(child_src.com))
+          hash = SecureHeaders.header_hash_for(chrome_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; child-src frame_src.com child_src.com")
+        end
+
+        it "appends frame-src to child-src" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              child_src: %w(child_src.com)
+            }
+          end
+
+          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari6]))
+          SecureHeaders.append_content_security_policy_directives(safari_request, frame_src: %w(frame_src.com))
+          hash = SecureHeaders.header_hash_for(safari_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; frame-src child_src.com frame_src.com")
+        end
+
         it "supports named appends" do
           Configuration.default do |config|
             config.csp = {
@@ -204,7 +231,7 @@ module SecureHeaders
 
           SecureHeaders.content_security_policy_script_nonce(request) # should add the value to the header
           hash = SecureHeaders.header_hash_for(chrome_request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match /\Adefault-src 'self'; script-src 'self' 'nonce-.*'\z/
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'nonce-.*'\z/)
         end
 
         it "appends a hash to a missing script-src value" do
@@ -216,7 +243,7 @@ module SecureHeaders
 
           SecureHeaders.append_content_security_policy_directives(request, script_src: %w('sha256-abc123'))
           hash = SecureHeaders.header_hash_for(chrome_request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match /\Adefault-src 'self'; script-src 'self' 'sha256-abc123'\z/
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'sha256-abc123'\z/)
         end
 
         it "overrides individual directives" do
@@ -252,7 +279,7 @@ module SecureHeaders
           end
 
           safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari5]))
-          nonce = SecureHeaders.content_security_policy_script_nonce(safari_request)
+          SecureHeaders.content_security_policy_script_nonce(safari_request)
           hash = SecureHeaders.header_hash_for(safari_request)
           expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline'; style-src 'self'")
         end

data/spec/spec_helper.rb

@@ -34,6 +34,7 @@ def expect_default_values(hash)
   expect(hash[SecureHeaders::XContentTypeOptions::HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XPermittedCrossDomainPolicies::HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::DEFAULT_VALUE)
   expect(hash[SecureHeaders::ReferrerPolicy::HEADER_NAME]).to be_nil
+  expect(hash[SecureHeaders::ExpectCertificateTransparency::HEADER_NAME]).to be_nil
 end
 
 module SecureHeaders

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.7.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-05 00:00:00.000000000 Z
+date: 2017-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -38,7 +38,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Security related headers all in one gem.
+description: Manages application of security headers with many safe defaults.
 email:
 - neil.matatall@gmail.com
 executables: []
@@ -53,6 +53,8 @@ files:
 - ".ruby-version"
 - ".travis.yml"
 - CHANGELOG.md
+- CODE_OF_CONDUCT.md
+- CONTRIBUTING.md
 - Gemfile
 - Guardfile
 - LICENSE
@@ -71,6 +73,7 @@ files:
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/content_security_policy_config.rb
 - lib/secure_headers/headers/cookie.rb
+- lib/secure_headers/headers/expect_certificate_transparency.rb
 - lib/secure_headers/headers/policy_management.rb
 - lib/secure_headers/headers/public_key_pins.rb
 - lib/secure_headers/headers/referrer_policy.rb
@@ -90,6 +93,7 @@ files:
 - spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
+- spec/lib/secure_headers/headers/expect_certificate_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/referrer_policy_spec.rb
@@ -124,7 +128,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,
@@ -134,6 +138,7 @@ test_files:
 - spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
+- spec/lib/secure_headers/headers/expect_certificate_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/referrer_policy_spec.rb