secure_headers 3.6.5 → 4.0.0

data/lib/tasks/tasks.rake

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx unless defined? INLINE_SCRIPT_REGEX
 INLINE_STYLE_REGEX = /(<style[^>]*>)(.*?)<\/style>/mx unless defined? INLINE_STYLE_REGEX
 INLINE_HASH_SCRIPT_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx unless defined? INLINE_HASH_SCRIPT_HELPER_REGEX
@@ -73,7 +74,7 @@ namespace :secure_headers do
       end
     end
 
-    File.open(SecureHeaders::Configuration::HASH_CONFIG_FILE, 'w') do |file|
+    File.open(SecureHeaders::Configuration::HASH_CONFIG_FILE, "w") do |file|
       file.write(script_hashes.to_yaml)
     end
 

data/secure_headers.gemspec

@@ -1,10 +1,11 @@
 # -*- encoding: utf-8 -*-
+# frozen_string_literal: true
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.6.5"
+  gem.version       = "4.0.0"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
-  gem.description   = 'Manages application of security headers with many safe defaults.'
+  gem.description   = "Manages application of security headers with many safe defaults."
   gem.summary       = 'Add easily configured security headers to responses
     including content-security-policy, x-frame-options,
     strict-transport-security, etc.'
@@ -15,5 +16,14 @@ Gem::Specification.new do |gem|
   gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
   gem.require_paths = ["lib"]
   gem.add_development_dependency "rake"
-  gem.add_dependency "useragent"
+  gem.add_dependency "useragent", ">= 0.15.0"
+
+  # TODO: delete this after 4.1 is cut or a number of 4.0.x releases have occurred
+  gem.post_install_message = <<-POST_INSTALL
+
+**********
+:wave: secure_headers 4.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/upgrading-to-4-0.md
+**********
+
+  POST_INSTALL
 end

data/spec/lib/secure_headers/configuration_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe Configuration do
@@ -70,7 +71,7 @@ module SecureHeaders
 
     it "allows you to override an override" do
       Configuration.override(:override) do |config|
-        config.csp = { default_src: %w('self')}
+        config.csp = { default_src: %w('self'), script_src: %w('self')}
       end
 
       Configuration.override(:second_override, :override) do |config|
@@ -78,17 +79,17 @@ module SecureHeaders
       end
 
       original_override = Configuration.get(:override)
-      expect(original_override.csp.to_h).to eq(default_src: %w('self'))
+      expect(original_override.csp.to_h).to eq(default_src: %w('self'), script_src: %w('self'))
       override_config = Configuration.get(:second_override)
       expect(override_config.csp.to_h).to eq(default_src: %w('self'), script_src: %w('self' example.org))
     end
 
     it "deprecates the secure_cookies configuration" do
-      expect(Kernel).to receive(:warn).with(/\[DEPRECATION\]/)
-
-      Configuration.default do |config|
-        config.secure_cookies = true
-      end
+      expect {
+        Configuration.default do |config|
+          config.secure_cookies = true
+        end
+      }.to raise_error(ArgumentError)
     end
   end
 end

data/spec/lib/secure_headers/headers/clear_site_data_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe ClearSiteData do

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe ContentSecurityPolicy do
@@ -23,6 +24,10 @@ module SecureHeaders
     end
 
     describe "#value" do
+      it "uses a safe but non-breaking default value" do
+        expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:")
+      end
+
       it "discards 'none' values if any other source expressions are present" do
         csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none')))
         expect(csp.value).not_to include("'none'")
@@ -46,13 +51,18 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does not build directives with a value of OPT_OUT (and bypasses directive requirements)" do
+        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), script_src: OPT_OUT)
+        expect(csp.value).to eq("default-src example.org")
+      end
+
       it "does not remove schemes from report-uri values" do
         csp = ContentSecurityPolicy.new(default_src: %w(https:), report_uri: %w(https://example.org))
         expect(csp.value).to eq("default-src https:; report-uri https://example.org")
       end
 
       it "does not remove schemes when :preserve_schemes is true" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), :preserve_schemes => true)
+        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), preserve_schemes: true)
         expect(csp.value).to eq("default-src https://example.org")
       end
 
@@ -86,25 +96,30 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "creates maximally strict sandbox policy when passed no sandbox token values" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: [])
+        expect(csp.value).to eq("default-src example.org; sandbox")
+      end
+
+      it "creates maximally strict sandbox policy when passed true" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: true)
+        expect(csp.value).to eq("default-src example.org; sandbox")
+      end
+
+      it "creates sandbox policy when passed valid sandbox token values" do
+        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: %w(allow-forms allow-scripts))
+        expect(csp.value).to eq("default-src example.org; sandbox allow-forms allow-scripts")
+      end
+
       it "does not emit a warning when using frame-src" do
         expect(Kernel).to_not receive(:warn)
         ContentSecurityPolicy.new(default_src: %w('self'), frame_src: %w('self')).value
       end
 
-      it "emits a warning when child-src and frame-src are supplied but are not equal" do
-        expect(Kernel).to receive(:warn).with(/both :child_src and :frame_src supplied and do not match./)
-        ContentSecurityPolicy.new(default_src: %w('self'), child_src: %w(child-src.com), frame_src: %w(frame-src,com)).value
-      end
-
-      it "will still set inconsistent child/frame-src values to be less surprising" do
-        expect(Kernel).to receive(:warn).at_least(:once)
-        firefox = ContentSecurityPolicy.new({default_src: %w('self'), child_src: %w(child-src.com), frame_src: %w(frame-src,com)}, USER_AGENTS[:firefox]).value
-        firefox_transitional = ContentSecurityPolicy.new({default_src: %w('self'), child_src: %w(child-src.com), frame_src: %w(frame-src,com)}, USER_AGENTS[:firefox46]).value
-        expect(firefox).not_to eq(firefox_transitional)
-        expect(firefox).to match(/frame-src/)
-        expect(firefox).not_to match(/child-src/)
-        expect(firefox_transitional).to match(/child-src/)
-        expect(firefox_transitional).not_to match(/frame-src/)
+      it "raises an error when child-src and frame-src are supplied but are not equal" do
+        expect {
+          ContentSecurityPolicy.new(default_src: %w('self'), child_src: %w(child-src.com), frame_src: %w(frame-src,com)).value
+        }.to raise_error(ArgumentError)
       end
 
       it "supports strict-dynamic" do
@@ -119,52 +134,53 @@ module SecureHeaders
           end.merge({
             block_all_mixed_content: true,
             upgrade_insecure_requests: true,
-            reflected_xss: "block",
             script_src: %w(script-src.com),
-            script_nonce: 123456
+            script_nonce: 123456,
+            sandbox: %w(allow-forms),
+            plugin_types: %w(application/pdf)
           })
         end
 
         it "does not filter any directives for Chrome" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:chrome])
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types plugin-types.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "does not filter any directives for Opera" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:opera])
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types plugin-types.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; block-all-mixed-content; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "filters blocked-all-mixed-content, child-src, and plugin-types for firefox" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:firefox])
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "filters blocked-all-mixed-content, frame-src, and plugin-types for firefox 46 and higher" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:firefox46])
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
 
         it "child-src value is copied to frame-src, adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for Edge" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:edge])
-          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
         end
 
         it "child-src value is copied to frame-src, adds 'unsafe-inline', filters base-uri, blocked-all-mixed-content, upgrade-insecure-requests, child-src, form-action, frame-ancestors, nonce sources, hash sources, and plugin-types for safari" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari6])
-          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; connect-src connect-src.com; font-src font-src.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'unsafe-inline'; style-src style-src.com; report-uri report-uri.com")
         end
 
         it "adds 'unsafe-inline', filters  blocked-all-mixed-content, upgrade-insecure-requests, nonce sources, and hash sources for safari 10 and higher" do
           policy = ContentSecurityPolicy.new(complex_opts, USER_AGENTS[:safari10])
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types plugin-types.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; child-src child-src.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; plugin-types application/pdf; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; report-uri report-uri.com")
         end
 
         it "falls back to standard Firefox defaults when the useragent version is not present" do
           ua = USER_AGENTS[:firefox].dup
           allow(ua).to receive(:version).and_return(nil)
           policy = ContentSecurityPolicy.new(complex_opts, ua)
-          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; media-src media-src.com; object-src object-src.com; sandbox sandbox.com; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
+          expect(policy.value).to eq("default-src default-src.com; base-uri base-uri.com; connect-src connect-src.com; font-src font-src.com; form-action form-action.com; frame-ancestors frame-ancestors.com; frame-src child-src.com; img-src img-src.com; manifest-src manifest-src.com; media-src media-src.com; object-src object-src.com; sandbox allow-forms; script-src script-src.com 'nonce-123456'; style-src style-src.com; upgrade-insecure-requests; report-uri report-uri.com")
         end
       end
     end

data/spec/lib/secure_headers/headers/cookie_spec.rb

@@ -1,40 +1,46 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe Cookie do
     let(:raw_cookie) { "_session=thisisatest" }
 
-    it "does not tamper with cookies when unconfigured" do
-      cookie = Cookie.new(raw_cookie, {})
+    it "does not tamper with cookies when using OPT_OUT is used" do
+      cookie = Cookie.new(raw_cookie, OPT_OUT)
       expect(cookie.to_s).to eq(raw_cookie)
     end
 
+    it "applies httponly, secure, and samesite by default" do
+      cookie = Cookie.new(raw_cookie, nil)
+      expect(cookie.to_s).to eq("_session=thisisatest; secure; HttpOnly; SameSite=Lax")
+    end
+
     it "preserves existing attributes" do
-      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true, httponly: OPT_OUT, samesite: OPT_OUT)
       expect(cookie.to_s).to eq("_session=thisisatest; secure")
     end
 
     it "prevents duplicate flagging of attributes" do
-      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true, httponly: OPT_OUT)
       expect(cookie.to_s.scan(/secure/i).count).to eq(1)
     end
 
     context "Secure cookies" do
       context "when configured with a boolean" do
         it "flags cookies as Secure" do
-          cookie = Cookie.new(raw_cookie, secure: true)
+          cookie = Cookie.new(raw_cookie, secure: true, httponly: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest; secure")
         end
       end
 
       context "when configured with a Hash" do
         it "flags cookies as Secure when whitelisted" do
-          cookie = Cookie.new(raw_cookie, secure: { only: ["_session"]})
+          cookie = Cookie.new(raw_cookie, secure: { only: ["_session"]}, httponly: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest; secure")
         end
 
         it "does not flag cookies as Secure when excluded" do
-          cookie = Cookie.new(raw_cookie, secure: { except: ["_session"] })
+          cookie = Cookie.new(raw_cookie, secure: { except: ["_session"] }, httponly: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest")
         end
       end
@@ -43,19 +49,19 @@ module SecureHeaders
     context "HttpOnly cookies" do
       context "when configured with a boolean" do
         it "flags cookies as HttpOnly" do
-          cookie = Cookie.new(raw_cookie, httponly: true)
+          cookie = Cookie.new(raw_cookie, httponly: true, secure: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
         end
       end
 
       context "when configured with a Hash" do
         it "flags cookies as HttpOnly when whitelisted" do
-          cookie = Cookie.new(raw_cookie, httponly: { only: ["_session"]})
+          cookie = Cookie.new(raw_cookie, httponly: { only: ["_session"]}, secure: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
         end
 
         it "does not flag cookies as HttpOnly when excluded" do
-          cookie = Cookie.new(raw_cookie, httponly: { except: ["_session"] })
+          cookie = Cookie.new(raw_cookie, httponly: { except: ["_session"] }, secure: OPT_OUT, samesite: OPT_OUT)
           expect(cookie.to_s).to eq("_session=thisisatest")
         end
       end
@@ -63,46 +69,52 @@ module SecureHeaders
 
     context "SameSite cookies" do
       it "flags SameSite=Lax" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } })
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
       end
 
       it "flags SameSite=Lax when configured with a boolean" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: true})
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true}, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
       end
 
       it "does not flag cookies as SameSite=Lax when excluded" do
-        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } })
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest")
       end
 
       it "flags SameSite=Strict" do
-        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } })
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
       end
 
       it "does not flag cookies as SameSite=Strict when excluded" do
-        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] } })
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] }}, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest")
       end
 
       it "flags SameSite=Strict when configured with a boolean" do
-        cookie = Cookie.new(raw_cookie, samesite: { strict: true})
+        cookie = Cookie.new(raw_cookie, {samesite: { strict: true}, secure: OPT_OUT, httponly: OPT_OUT})
         expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
       end
 
       it "flags properly when both lax and strict are configured" do
         raw_cookie = "_session=thisisatest"
-        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] }, lax: { only: ["_additional_session"] } })
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] }, lax: { only: ["_additional_session"] } }, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
       end
 
       it "ignores configuration if the cookie is already flagged" do
         raw_cookie = "_session=thisisatest; SameSite=Strict"
-        cookie = Cookie.new(raw_cookie, samesite: { lax: true })
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true }, secure: OPT_OUT, httponly: OPT_OUT)
         expect(cookie.to_s).to eq(raw_cookie)
       end
+
+      it "samesite: true sets all cookies to samesite=lax" do
+        raw_cookie = "_session=thisisatest"
+        cookie = Cookie.new(raw_cookie, samesite: true, secure: OPT_OUT, httponly: OPT_OUT)
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
     end
   end
 
@@ -113,12 +125,18 @@ module SecureHeaders
       end.to raise_error(CookiesConfigError)
     end
 
-    it "raises an exception when configured without a boolean/Hash" do
+    it "raises an exception when configured without a boolean(true or OPT_OUT)/Hash" do
       expect do
         Cookie.validate_config!(secure: "true")
       end.to raise_error(CookiesConfigError)
     end
 
+    it "raises an exception when configured with false" do
+      expect do
+        Cookie.validate_config!(secure: false)
+      end.to raise_error(CookiesConfigError)
+    end
+
     it "raises an exception when both only and except filters are provided" do
       expect do
         Cookie.validate_config!(secure: { only: [], except: [] })

data/spec/lib/secure_headers/headers/expect_certificate_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+require "spec_helper"
+
+module SecureHeaders
+  describe ExpectCertificateTransparency do
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: true).value).to eq("enforce; max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: false).value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: "yolocopter").value).to eq("max-age=1234") }
+    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, report_uri: "https://report-uri.io/expect-ct").value).to eq("max-age=1234; report-uri=\"https://report-uri.io/expect-ct\"") }
+    specify do
+      config = { enforce: true, max_age: 1234, report_uri: "https://report-uri.io/expect-ct" }
+      header_value = "enforce; max-age=1234; report-uri=\"https://report-uri.io/expect-ct\""
+      expect(ExpectCertificateTransparency.new(config).value).to eq(header_value)
+    end
+
+    context "with an invalid configuration" do
+      it "raises an exception when configuration isn't a hash" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(%w(a))
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception when max-age is not provided" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(foo: "bar")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid max-age" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(max_age: "abc123")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+
+      it "raises an exception with an invalid enforce value" do
+        expect do
+          ExpectCertificateTransparency.validate_config!(enforce: "brokenstring")
+        end.to raise_error(ExpectCertificateTransparencyConfigError)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers/headers/policy_management_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe PolicyManagement do
@@ -16,7 +17,7 @@ module SecureHeaders
       it "accepts all keys" do
         # (pulled from README)
         config = {
-          # "meta" values. these will shaped the header, but the values are not included in the header.
+          # "meta" values. these will shape the header, but the values are not included in the header.
           report_only:  true,     # default: false
           preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
 
@@ -27,6 +28,7 @@ module SecureHeaders
           connect_src: %w(wss:),
           font_src: %w('self' data:),
           img_src: %w(mycdn.com data:),
+          manifest_src: %w(manifest.com),
           media_src: %w(utoob.com),
           object_src: %w('self'),
           script_src: %w('self'),
@@ -45,10 +47,22 @@ module SecureHeaders
 
       it "requires a :default_src value" do
         expect do
-          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(script_src: %('self')))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(script_src: %w('self')))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
 
+      it "requires a :script_src value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self')))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts OPT_OUT as a script-src value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w('self'), script_src: OPT_OUT))
+        end.to_not raise_error
+      end
+
       it "requires :report_only to be a truthy value" do
         expect do
           ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(report_only: "steve")))
@@ -94,28 +108,60 @@ module SecureHeaders
       # this is mostly to ensure people don't use the antiquated shorthands common in other configs
       it "performs light validation on source lists" do
         expect do
-          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w(self none inline eval)))
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_src: %w(self none inline eval), script_src: %w('self')))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "rejects anything not of the form allow-* as a sandbox value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["steve"])))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "accepts anything of the form allow-* as a sandbox value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: ["allow-foo"])))
+        end.to_not raise_error
+      end
+
+      it "accepts true as a sandbox policy" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(sandbox: true)))
+        end.to_not raise_error
+      end
+
+      it "rejects anything not of the form type/subtype as a plugin-type value" do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["steve"])))
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
+
+      it "accepts anything of the form type/subtype as a plugin-type value " do
+        expect do
+          ContentSecurityPolicy.validate_config!(ContentSecurityPolicyConfig.new(default_opts.merge(plugin_types: ["application/pdf"])))
+        end.to_not raise_error
+      end
     end
 
     describe "#combine_policies" do
       it "combines the default-src value with the override if the directive was unconfigured" do
         Configuration.default do |config|
           config.csp = {
-            default_src: %w(https:)
+            default_src: %w(https:),
+            script_src: %w('self'),
           }
         end
-        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, script_src: %w(anothercdn.com))
+        combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, style_src: %w(anothercdn.com))
         csp = ContentSecurityPolicy.new(combined_config)
         expect(csp.name).to eq(ContentSecurityPolicyConfig::HEADER_NAME)
-        expect(csp.value).to eq("default-src https:; script-src https: anothercdn.com")
+        expect(csp.value).to eq("default-src https:; script-src 'self'; style-src https: anothercdn.com")
       end
 
       it "combines directives where the original value is nil and the hash is frozen" do
         Configuration.default do |config|
           config.csp = {
             default_src: %w('self'),
+            script_src: %w('self'),
             report_only: false
           }.freeze
         end
@@ -129,6 +175,7 @@ module SecureHeaders
         Configuration.default do |config|
           config.csp = {
             default_src: %w('self'),
+            script_src: %w('self'),
             report_only: false
           }.freeze
         end
@@ -140,14 +187,13 @@ module SecureHeaders
         ContentSecurityPolicy::NON_FETCH_SOURCES.each do |directive|
           expect(combined_config[directive]).to eq(%w("http://example.org))
         end
-
-         ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox]).value
       end
 
       it "overrides the report_only flag" do
         Configuration.default do |config|
           config.csp = {
             default_src: %w('self'),
+            script_src: %w('self'),
             report_only: false
           }
         end
@@ -160,12 +206,13 @@ module SecureHeaders
         Configuration.default do |config|
           config.csp = {
             default_src: %w(https:),
+            script_src: %w('self'),
             block_all_mixed_content: false
           }
         end
         combined_config = ContentSecurityPolicy.combine_policies(Configuration.get.csp.to_h, block_all_mixed_content: true)
         csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.value).to eq("default-src https:; block-all-mixed-content")
+        expect(csp.value).to eq("default-src https:; block-all-mixed-content; script-src 'self'")
       end
 
       it "raises an error if appending to a OPT_OUT policy" do

data/spec/lib/secure_headers/headers/public_key_pins_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe PublicKeyPins do
@@ -8,7 +9,7 @@ module SecureHeaders
     specify { expect(PublicKeyPins.new(max_age: 1234).value).to eq("max-age=1234") }
     specify { expect(PublicKeyPins.new(max_age: 1234).value).to eq("max-age=1234") }
     specify do
-      config = { max_age: 1234, pins: [{ sha256: 'base64encodedpin1' }, { sha256: 'base64encodedpin2' }] }
+      config = { max_age: 1234, pins: [{ sha256: "base64encodedpin1" }, { sha256: "base64encodedpin2" }] }
       header_value = "max-age=1234; pin-sha256=\"base64encodedpin1\"; pin-sha256=\"base64encodedpin2\""
       expect(PublicKeyPins.new(config).value).to eq(header_value)
     end
@@ -16,19 +17,19 @@ module SecureHeaders
     context "with an invalid configuration" do
       it "raises an exception when max-age is not provided" do
         expect do
-          PublicKeyPins.validate_config!(foo: 'bar')
+          PublicKeyPins.validate_config!(foo: "bar")
         end.to raise_error(PublicKeyPinsConfigError)
       end
 
       it "raises an exception with an invalid max-age" do
         expect do
-          PublicKeyPins.validate_config!(max_age: 'abc123')
+          PublicKeyPins.validate_config!(max_age: "abc123")
         end.to raise_error(PublicKeyPinsConfigError)
       end
 
-      it 'raises an exception with less than 2 pins' do
+      it "raises an exception with less than 2 pins" do
         expect do
-          config = { max_age: 1234, pins: [{ sha256: 'base64encodedpin' }] }
+          config = { max_age: 1234, pins: [{ sha256: "base64encodedpin" }] }
           PublicKeyPins.validate_config!(config)
         end.to raise_error(PublicKeyPinsConfigError)
       end