secure_headers 3.7.0 → 4.0.0.alpha01

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 4.0.0.alpha01
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-25 00:00:00.000000000 Z
+date: 2017-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.15.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.15.0
 description: Manages application of security headers with many safe defaults.
 email:
 - neil.matatall@gmail.com
@@ -49,6 +49,7 @@ files:
 - ".github/PULL_REQUEST_TEMPLATE.md"
 - ".gitignore"
 - ".rspec"
+- ".rubocop.yml"
 - ".ruby-gemset"
 - ".ruby-version"
 - ".travis.yml"
@@ -73,7 +74,6 @@ files:
 - lib/secure_headers/headers/content_security_policy.rb
 - lib/secure_headers/headers/content_security_policy_config.rb
 - lib/secure_headers/headers/cookie.rb
-- lib/secure_headers/headers/expect_certificate_transparency.rb
 - lib/secure_headers/headers/policy_management.rb
 - lib/secure_headers/headers/public_key_pins.rb
 - lib/secure_headers/headers/referrer_policy.rb
@@ -93,7 +93,6 @@ files:
 - spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
-- spec/lib/secure_headers/headers/expect_certificate_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/referrer_policy_spec.rb
@@ -108,11 +107,17 @@ files:
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
 - upgrading-to-3-0.md
+- upgrading-to-4-0.md
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
 metadata: {}
-post_install_message: 
+post_install_message: |2+
+
+  **********
+  :wave: secure_headers 4.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/upgrading-to-4-0.md
+  **********
+
 rdoc_options: []
 require_paths:
 - lib
@@ -123,12 +128,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,
@@ -138,7 +143,6 @@ test_files:
 - spec/lib/secure_headers/headers/clear_site_data_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/cookie_spec.rb
-- spec/lib/secure_headers/headers/expect_certificate_spec.rb
 - spec/lib/secure_headers/headers/policy_management_spec.rb
 - spec/lib/secure_headers/headers/public_key_pins_spec.rb
 - spec/lib/secure_headers/headers/referrer_policy_spec.rb

data/lib/secure_headers/headers/expect_certificate_transparency.rb

@@ -1,70 +0,0 @@
-# frozen_string_literal: true
-module SecureHeaders
-  class ExpectCertificateTransparencyConfigError < StandardError; end
-
-  class ExpectCertificateTransparency
-    HEADER_NAME = "Expect-CT".freeze
-    CONFIG_KEY  = :expect_certificate_transparency
-    INVALID_CONFIGURATION_ERROR = "config must be a hash.".freeze
-    INVALID_ENFORCE_VALUE_ERROR = "enforce must be a boolean".freeze
-    REQUIRED_MAX_AGE_ERROR      = "max-age is a required directive.".freeze
-    INVALID_MAX_AGE_ERROR       = "max-age must be a number.".freeze
-
-    class << self
-      # Public: Generate a Expect-CT header.
-      #
-      # Returns nil if not configured, returns header name and value if
-      # configured.
-      def make_header(config)
-        return if config.nil?
-
-        header = new(config)
-        [HEADER_NAME, header.value]
-      end
-
-      def validate_config!(config)
-        return if config.nil? || config == OPT_OUT
-        raise ExpectCertificateTransparencyConfigError.new(INVALID_CONFIGURATION_ERROR) unless config.is_a? Hash
-
-        unless [true, false, nil].include?(config[:enforce])
-          raise ExpectCertificateTransparencyConfigError.new(INVALID_ENFORCE_VALUE_ERROR)
-        end
-
-        if !config[:max_age]
-          raise ExpectCertificateTransparencyConfigError.new(REQUIRED_MAX_AGE_ERROR)
-        elsif config[:max_age].to_s !~ /\A\d+\z/
-          raise ExpectCertificateTransparencyConfigError.new(INVALID_MAX_AGE_ERROR)
-        end
-      end
-    end
-
-    def initialize(config)
-      @enforced   = config.fetch(:enforce, nil)
-      @max_age    = config.fetch(:max_age, nil)
-      @report_uri = config.fetch(:report_uri, nil)
-    end
-
-    def value
-      header_value = [
-        enforced_directive,
-        max_age_directive,
-        report_uri_directive
-      ].compact.join("; ").strip
-    end
-
-    def enforced_directive
-      # Unfortunately `if @enforced` isn't enough here in case someone
-      # passes in a random string so let's be specific with it to prevent
-      # accidental enforcement.
-      "enforce" if @enforced == true
-    end
-
-    def max_age_directive
-      "max-age=#{@max_age}" if @max_age
-    end
-
-    def report_uri_directive
-      "report-uri=\"#{@report_uri}\"" if @report_uri
-    end
-  end
-end

data/spec/lib/secure_headers/headers/expect_certificate_spec.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-require "spec_helper"
-
-module SecureHeaders
-  describe ExpectCertificateTransparency do
-    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: true).value).to eq("enforce; max-age=1234") }
-    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: false).value).to eq("max-age=1234") }
-    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, enforce: "yolocopter").value).to eq("max-age=1234") }
-    specify { expect(ExpectCertificateTransparency.new(max_age: 1234, report_uri: "https://report-uri.io/expect-ct").value).to eq("max-age=1234; report-uri=\"https://report-uri.io/expect-ct\"") }
-    specify do
-      config = { enforce: true, max_age: 1234, report_uri: "https://report-uri.io/expect-ct" }
-      header_value = "enforce; max-age=1234; report-uri=\"https://report-uri.io/expect-ct\""
-      expect(ExpectCertificateTransparency.new(config).value).to eq(header_value)
-    end
-
-    context "with an invalid configuration" do
-      it "raises an exception when configuration isn't a hash" do
-        expect do
-          ExpectCertificateTransparency.validate_config!(%w(a))
-        end.to raise_error(ExpectCertificateTransparencyConfigError)
-      end
-
-      it "raises an exception when max-age is not provided" do
-        expect do
-          ExpectCertificateTransparency.validate_config!(foo: "bar")
-        end.to raise_error(ExpectCertificateTransparencyConfigError)
-      end
-
-      it "raises an exception with an invalid max-age" do
-        expect do
-          ExpectCertificateTransparency.validate_config!(max_age: "abc123")
-        end.to raise_error(ExpectCertificateTransparencyConfigError)
-      end
-
-      it "raises an exception with an invalid enforce value" do
-        expect do
-          ExpectCertificateTransparency.validate_config!(enforce: "brokenstring")
-        end.to raise_error(ExpectCertificateTransparencyConfigError)
-      end
-    end
-  end
-end