secure_headers 6.3.4 → 7.3.0

data/docs/upgrading-to-3-0.md

@@ -1,42 +0,0 @@
-`secure_headers` 3.0 is a near-complete rewrite. It includes breaking changes and removes a lot of features that were either leftover from the days when the CSP standard was not fully adopted or were just downright confusing.
-
-Changes
-==
-
-| What                                                     | < = 2.x                                                                                                                                                                                         | >= 3.0                                                                                                                                                                       |
-| ----------------------------------                       | ----------------------------------------------------------                                                                                                                                      | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Global configuration                                     | `SecureHeaders::Configuration.configure` block                                                                                                                                                  | `SecureHeaders::Configuration.default` block                                                                                                                                 |
-| All headers besides HPKP and CSP                         | Accept hashes as config values                                                                                                                                                                  | Must be strings (validated during configuration)                                                                                                                             |
-| CSP directive values                                     | Accepted space delimited strings OR arrays of strings                                                                                                                                           | Must be arrays of strings                                                                                                                                                    |
-| CSP Nonce values in views                                | `@content_security_policy_nonce`                                                                                                                                                                | `content_security_policy_nonce(:script)` or `content_security_policy_nonce(:style)`                                                                                              |
-| nonce is no longer a source expression                   | `config.csp = "'self' 'nonce'"`                                                                                                                                                                 | Remove `'nonce'` from source expression and use [nonce helpers](https://github.com/twitter/secureheaders#nonce).                                                             |
-| `self`/`none` source expressions                         | Could be `self` / `none` / `'self'` / `'none'`                                                                                                                                                  | Must be `'self'` or `'none'`                                                                                                                                                 |
-| `inline` / `eval` source expressions                     | Could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'`                                                                                                                                | Must be `'unsafe-eval'` or `'unsafe-inline'`                                                                                                                                 |
-| Per-action configuration                                 | Override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111) | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration)   |
-| CSP/HPKP use `report_only` config that defaults to false | `enforce: false`                                                                                                                                                                                | `report_only: false`                                                                                                                                                         |
-| Schemes in source expressions                            | Schemes were not stripped                                                                                                                                                                       | Schemes are stripped by default to discourage mixed content. Setting `preserve_schemes: true` will revert to previous behavior                                               |
-| Opting out of default configuration                      | `skip_before_filter :set_x_download_options_header` or `config.x_download_options = false`                                                                                                      | Within default block: `config.x_download_options = SecureHeaders::OPT_OUT`                                                                                                   |
-
-Migrating to 3.x from <= 2.x
-==
-
-1. Convert all headers except for CSP/HPKP using hashes to string values. The values are validated at runtime and will provide guidance on misconfigured headers.
-1. Convert all instances of `self`/`none`/`eval`/`inline` to the corresponding values in the above table.
-1. Convert all CSP space-delimited directives to an array of strings.
-1. Convert all `enforce: true|false` to `report_only: true|false`. 
-1. Remove `ensure_security_headers` from controllers (3.x uses a middleware instead).
-
-Everything is terrible, why should I upgrade?
-==
-
-`secure_headers` <= 2.x built every header per request using a series of automatically included `before_filters`. This is horribly inefficient because:
-
-1. `before_filters` are slow and adding 8 per request isn't great
-1. We are rebuilding strings that may never change for every request
-1. Errors in the request may mean that the headers never get set in the first place
-
-`secure_headers` 3.x sets headers in rack middleware that runs once per request and uses configuration values passed via `request.env`. This is much more efficient and somewhat guarantees that headers will always be set. **The values for the headers are cached and reused per request**.
-
-Also, there is a more flexible API for customizing content security policies / X-Frame-Options. In practice, none of the other headers need granular controls. One way of customizing headers per request is to use the helper methods. The only downside of this technique is that headers will be computed from scratch.
-
-See the [README](README.md) for more information.

data/docs/upgrading-to-4-0.md

@@ -1,35 +0,0 @@
-## script_src must be set
-
-Not setting a `script_src` value means your policy falls back to whatever `default_src` (also required) is set to. This can be very dangerous and indicates the policy is too loose.
-
-However, sometimes you really don't need a `script-src` e.g. API responses (`default-src 'none'`) so you can set `script_src: SecureHeaders::OPT_OUT` to work around this.
-
-## Default Content Security Policy
-
-The default CSP has changed to be more universal without sacrificing too much security.
-
-* Flash/Java disabled by default
-* `img-src` allows data: images and favicons (among others)
-* `style-src` allows inline CSS by default (most find it impossible/impractical to remove inline content today)
-* `form-action` (not governed by `default-src`, practically treated as `*`) is set to `'self'`
-
-Previously, the default CSP was:
-
-`Content-Security-Policy: default-src 'self'`
-
-The new default policy is:
-
-`default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:`
-
-## CSP configuration
-
-* Setting `report_only: true` in a CSP config will raise an error. Instead, set `csp_report_only`.
-* Setting `frame_src` and `child_src` when values don't match will raise an error. Just use `frame_src`.
-
-## config.secure_cookies removed
-
-Use `config.cookies` instead.
-
-## Supported ruby versions
-
-We've dropped support for ruby versions <= 2.2. Sorry.

data/docs/upgrading-to-5-0.md

@@ -1,15 +0,0 @@
-## All cookies default to secure/httponly/SameSite=Lax
-
-By default, *all* cookies will be marked as `SameSite=lax`,`secure`, and `httponly`. To opt-out, supply `SecureHeaders::OPT_OUT` as the value for `SecureHeaders.cookies` or the individual configs. Setting these values to `false` will raise an error.
-
-```ruby
-# specific opt outs
-config.cookies = {
-  secure: SecureHeaders::OPT_OUT,
-  httponly: SecureHeaders::OPT_OUT,
-  samesite: SecureHeaders::OPT_OUT,
-}
-
-# nuclear option, just make things work again
-config.cookies = SecureHeaders::OPT_OUT
-```

data/docs/upgrading-to-6-0.md

@@ -1,50 +0,0 @@
-## Named overrides are now dynamically applied
-
-The original implementation of name overrides worked by making a copy of the default policy, applying the overrides, and storing the result for later use. But, this lead to unexpected results if named overrides were combined with a dynamic policy change. If a change was made to the default configuration during a request, followed by a named override, the dynamic changes would be lost. To keep things consistent named overrides have been rewritten to work the same as named appends in that they always operate on the configuration for the current request. As an example:
-
-```ruby
-class ApplicationController < ActionController::Base
-  Configuration.default do |config|
-    config.x_frame_options = SecureHeaders::OPT_OUT
-  end
-
-  SecureHeaders::Configuration.override(:dynamic_override) do |config|
-    config.x_content_type_options = "nosniff"
-  end
-end
-
-class FooController < ApplicationController
-  def bar
-    # Dynamically update the default config for this request
-    override_x_frame_options("DENY")
-    append_content_security_policy_directives(frame_src: "3rdpartyprovider.com")
-
-    # Override everything, discard modifications above
-    use_secure_headers_override(:dynamic_override)
-  end
-end
-```
-
-Prior to 6.0.0, the response would NOT include a `X-Frame-Options` header since the named override would be a copy of the default configuration, but with `X-Content-Type-Options` set to `nosniff`. As of 6.0.0, the above code results in both `X-Frame-Options` set to `DENY` AND `X-Content-Type-Options` set to `nosniff`.
-
-## `ContentSecurityPolicyConfig#merge` and `ContentSecurityPolicyReportOnlyConfig#merge` work more like `Hash#merge`
-
-These classes are typically not directly instantiated by users of SecureHeaders. But, if you access `config.csp` you end up accessing one of these objects. Prior to 6.0.0, `#merge` worked more like `#append` in that it would combine policies (i.e. if both policies contained the same key the values would be combined rather than overwritten). This was not consistent with `#merge!`, which worked more like Ruby's `Hash#merge!` (overwriting duplicate keys). As of 6.0.0, `#merge` works the same as `#merge!`, but returns a new object instead of mutating `self`.
-
-## `Configuration#get` has been removed
-
-This method is not typically directly called by users of SecureHeaders. Given that named overrides are no longer statically stored, fetching them no longer makes sense.
-
-## Configuration headers are no longer cached
-
-Prior to 6.0.0 SecureHeaders pre-built and cached the headers that corresponded to the default configuration. The same was also done for named overrides. However, now that named overrides are applied dynamically, those can no longer be cached. As a result, caching has been removed in the name of simplicity. Some micro-benchmarks indicate this shouldn't be a performance problem and will help to eliminate a class of bugs entirely.
-
-## Calling the default configuration more than once will result in an Exception
-
-Prior to 6.0.0 you could conceivably, though unlikely, have `Configure#default` called more than once. Because configurations are dynamic, configuring more than once could result in unexpected behavior. So, as of 6.0.0 we raise `AlreadyConfiguredError` if the default configuration is setup more than once.
-
-## All user agent sniffing has been removed
-
-The policy configured is the policy that is delivered in terms of which directives are sent. We still dedup, strip schemes, and look for other optimizations but we will not e.g. conditionally send `frame-src` / `child-src` or apply `nonce`s / `unsafe-inline`.
-
-The primary reason for these per-browser customization was to reduce console warnings. This has lead to many bugs and results in confusing behavior. Also, console logs are incredibly noisy today and increasingly warn you about perfectly valid things (like sending `X-Frame-Options` and `frame-ancestors` together).

data/spec/lib/secure_headers/configuration_spec.rb

@@ -1,121 +0,0 @@
-# frozen_string_literal: true
-require "spec_helper"
-
-module SecureHeaders
-  describe Configuration do
-    before(:each) do
-      reset_config
-    end
-
-    it "has a default config" do
-      expect(Configuration.default).to_not be_nil
-    end
-
-    it "has an 'noop' override" do
-      Configuration.default
-      expect(Configuration.overrides(Configuration::NOOP_OVERRIDE)).to_not be_nil
-    end
-
-    it "dup results in a copy of the default config" do
-      Configuration.default
-      original_configuration = Configuration.send(:default_config)
-      configuration = Configuration.dup
-      expect(original_configuration).not_to be(configuration)
-      Configuration::CONFIG_ATTRIBUTES.each do |attr|
-        expect(original_configuration.send(attr)).to eq(configuration.send(attr))
-      end
-    end
-
-    it "stores an override" do
-      Configuration.override(:test_override) do |config|
-        config.x_frame_options = "DENY"
-      end
-
-      expect(Configuration.overrides(:test_override)).to_not be_nil
-    end
-
-    describe "#override" do
-      it "raises on configuring an existing override" do
-        set_override = Proc.new {
-          Configuration.override(:test_override) do |config|
-            config.x_frame_options = "DENY"
-          end
-        }
-
-        set_override.call
-
-        expect { set_override.call }
-          .to raise_error(Configuration::AlreadyConfiguredError, "Configuration already exists")
-      end
-
-      it "raises when a named append with the given name exists" do
-        Configuration.named_append(:test_override) do |config|
-          config.x_frame_options = "DENY"
-        end
-
-        expect do
-          Configuration.override(:test_override) do |config|
-            config.x_frame_options = "SAMEORIGIN"
-          end
-        end.to raise_error(Configuration::AlreadyConfiguredError, "Configuration already exists")
-      end
-    end
-
-    describe "#named_append" do
-      it "raises on configuring an existing append" do
-        set_override = Proc.new {
-          Configuration.named_append(:test_override) do |config|
-            config.x_frame_options = "DENY"
-          end
-        }
-
-        set_override.call
-
-        expect { set_override.call }
-          .to raise_error(Configuration::AlreadyConfiguredError, "Configuration already exists")
-      end
-
-      it "raises when an override with the given name exists" do
-        Configuration.override(:test_override) do |config|
-          config.x_frame_options = "DENY"
-        end
-
-        expect do
-          Configuration.named_append(:test_override) do |config|
-            config.x_frame_options = "SAMEORIGIN"
-          end
-        end.to raise_error(Configuration::AlreadyConfiguredError, "Configuration already exists")
-      end
-    end
-
-    it "deprecates the secure_cookies configuration" do
-      expect {
-        Configuration.default do |config|
-          config.secure_cookies = true
-        end
-      }.to raise_error(ArgumentError)
-    end
-
-    it "gives cookies a default config" do
-      expect(Configuration.default.cookies).to eq({httponly: true, secure: true, samesite: {lax: true}})
-    end
-
-    it "allows OPT_OUT" do
-      Configuration.default do |config|
-        config.cookies = OPT_OUT
-      end
-
-      config = Configuration.dup
-      expect(config.cookies).to eq(OPT_OUT)
-    end
-
-    it "allows me to be explicit too" do
-      Configuration.default do |config|
-        config.cookies = {httponly: true, secure: true, samesite: {lax: false}}
-      end
-
-      config = Configuration.dup
-      expect(config.cookies).to eq({httponly: true, secure: true, samesite: {lax: false}})
-    end
-  end
-end

data/spec/lib/secure_headers/headers/clear_site_data_spec.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-require "spec_helper"
-
-module SecureHeaders
-  describe ClearSiteData do
-    describe "make_header" do
-      it "returns nil with nil config" do
-        expect(described_class.make_header).to be_nil
-      end
-
-      it "returns nil with empty config" do
-        expect(described_class.make_header([])).to be_nil
-      end
-
-      it "returns nil with opt-out config" do
-        expect(described_class.make_header(OPT_OUT)).to be_nil
-      end
-
-      it "returns all types with `true` config" do
-        name, value = described_class.make_header(true)
-
-        expect(name).to eq(ClearSiteData::HEADER_NAME)
-        expect(value).to eq(
-          %("cache", "cookies", "storage", "executionContexts")
-        )
-      end
-
-      it "returns specified types" do
-        name, value = described_class.make_header(["foo", "bar"])
-
-        expect(name).to eq(ClearSiteData::HEADER_NAME)
-        expect(value).to eq(%("foo", "bar"))
-      end
-    end
-
-    describe "validate_config!" do
-      it "succeeds for `true` config" do
-        expect do
-          described_class.validate_config!(true)
-        end.not_to raise_error
-      end
-
-      it "succeeds for `nil` config" do
-        expect do
-          described_class.validate_config!(nil)
-        end.not_to raise_error
-      end
-
-      it "succeeds for opt-out config" do
-        expect do
-          described_class.validate_config!(OPT_OUT)
-        end.not_to raise_error
-      end
-
-      it "succeeds for empty config" do
-        expect do
-          described_class.validate_config!([])
-        end.not_to raise_error
-      end
-
-      it "succeeds for Array of Strings config" do
-        expect do
-          described_class.validate_config!(["foo"])
-        end.not_to raise_error
-      end
-
-      it "fails for Array of non-String config" do
-        expect do
-          described_class.validate_config!([1])
-        end.to raise_error(ClearSiteDataConfigError)
-      end
-
-      it "fails for other types of config" do
-        expect do
-          described_class.validate_config!(:cookies)
-        end.to raise_error(ClearSiteDataConfigError)
-      end
-    end
-
-    describe "make_header_value" do
-      it "returns a string of quoted values that are comma separated" do
-        value = described_class.make_header_value(["foo", "bar"])
-        expect(value).to eq(%("foo", "bar"))
-      end
-    end
-  end
-end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -1,190 +0,0 @@
-# frozen_string_literal: true
-require "spec_helper"
-
-module SecureHeaders
-  describe ContentSecurityPolicy do
-    let (:default_opts) do
-      {
-        default_src: %w(https:),
-        img_src: %w(https: data:),
-        script_src: %w('unsafe-inline' 'unsafe-eval' https: data:),
-        style_src: %w('unsafe-inline' https: about:),
-        report_uri: %w(/csp_report)
-      }
-    end
-
-    describe "#name" do
-      context "when in report-only mode" do
-        specify { expect(ContentSecurityPolicy.new(default_opts.merge(report_only: true)).name).to eq(ContentSecurityPolicyReportOnlyConfig::HEADER_NAME) }
-      end
-
-      context "when in enforce mode" do
-        specify { expect(ContentSecurityPolicy.new(default_opts).name).to eq(ContentSecurityPolicyConfig::HEADER_NAME) }
-      end
-    end
-
-    describe "#value" do
-      it "uses a safe but non-breaking default value" do
-        expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:")
-      end
-
-      it "deprecates and escapes semicolons in directive source lists" do
-        expect(Kernel).to receive(:warn).with(%(frame_ancestors contains a ; in "google.com;script-src *;.;" which will raise an error in future versions. It has been replaced with a blank space.))
-        expect(ContentSecurityPolicy.new(frame_ancestors: %w(https://google.com;script-src https://*;.;)).value).to eq("frame-ancestors google.com script-src * .")
-      end
-
-      it "deprecates and escapes semicolons in directive source lists" do
-        expect(Kernel).to receive(:warn).with(%(frame_ancestors contains a \n in "\\nfoo.com\\nhacked" which will raise an error in future versions. It has been replaced with a blank space.))
-        expect(ContentSecurityPolicy.new(frame_ancestors: ["\nfoo.com\nhacked"]).value).to eq("frame-ancestors  foo.com hacked")
-      end
-
-      it "discards 'none' values if any other source expressions are present" do
-        csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none')))
-        expect(csp.value).not_to include("'none'")
-      end
-
-      it "discards source expressions (besides unsafe-* and non-host source values) when * is present" do
-        csp = ContentSecurityPolicy.new(default_src: %w(* 'unsafe-inline' 'unsafe-eval' http: https: example.org data: blob:))
-        expect(csp.value).to eq("default-src * 'unsafe-inline' 'unsafe-eval' data: blob:")
-      end
-
-      it "minifies source expressions based on overlapping wildcards" do
-        config = {
-          default_src: %w(a.example.org b.example.org *.example.org https://*.example.org)
-        }
-        csp = ContentSecurityPolicy.new(config)
-        expect(csp.value).to eq("default-src *.example.org")
-      end
-
-      it "removes http/s schemes from hosts" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org))
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does not build directives with a value of OPT_OUT (and bypasses directive requirements)" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), script_src: OPT_OUT)
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does not remove schemes from report-uri values" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https:), report_uri: %w(https://example.org))
-        expect(csp.value).to eq("default-src https:; report-uri https://example.org")
-      end
-
-      it "does not remove schemes when :preserve_schemes is true" do
-        csp = ContentSecurityPolicy.new(default_src: %w(https://example.org), preserve_schemes: true)
-        expect(csp.value).to eq("default-src https://example.org")
-      end
-
-      it "removes nil from source lists" do
-        csp = ContentSecurityPolicy.new(default_src: ["https://example.org", nil])
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does not add a directive if the value is an empty array (or all nil)" do
-        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], script_src: [nil])
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does not add a directive if the value is nil" do
-        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], script_src: nil)
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does add a boolean directive if the value is true" do
-        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: true)
-        expect(csp.value).to eq("default-src example.org; block-all-mixed-content; upgrade-insecure-requests")
-      end
-
-      it "does not add a boolean directive if the value is false" do
-        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: false)
-        expect(csp.value).to eq("default-src example.org; block-all-mixed-content")
-      end
-
-      it "deduplicates any source expressions" do
-        csp = ContentSecurityPolicy.new(default_src: %w(example.org example.org example.org))
-        expect(csp.value).to eq("default-src example.org")
-      end
-
-      it "does not deduplicate non-matching schema source expressions" do
-        csp = ContentSecurityPolicy.new(default_src: %w(*.example.org wss://example.example.org))
-        expect(csp.value).to eq("default-src *.example.org wss://example.example.org")
-      end
-
-      it "creates maximally strict sandbox policy when passed no sandbox token values" do
-        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: [])
-        expect(csp.value).to eq("default-src example.org; sandbox")
-      end
-
-      it "creates maximally strict sandbox policy when passed true" do
-        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: true)
-        expect(csp.value).to eq("default-src example.org; sandbox")
-      end
-
-      it "creates sandbox policy when passed valid sandbox token values" do
-        csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: %w(allow-forms allow-scripts))
-        expect(csp.value).to eq("default-src example.org; sandbox allow-forms allow-scripts")
-      end
-
-      it "does not emit a warning when using frame-src" do
-        expect(Kernel).to_not receive(:warn)
-        ContentSecurityPolicy.new(default_src: %w('self'), frame_src: %w('self')).value
-      end
-
-      it "allows script as a require-sri-src" do
-        csp = ContentSecurityPolicy.new(default_src: %w('self'), require_sri_for: %w(script))
-        expect(csp.value).to eq("default-src 'self'; require-sri-for script")
-      end
-
-      it "allows style as a require-sri-src" do
-        csp = ContentSecurityPolicy.new(default_src: %w('self'), require_sri_for: %w(style))
-        expect(csp.value).to eq("default-src 'self'; require-sri-for style")
-      end
-
-      it "allows script and style as a require-sri-src" do
-        csp = ContentSecurityPolicy.new(default_src: %w('self'), require_sri_for: %w(script style))
-        expect(csp.value).to eq("default-src 'self'; require-sri-for script style")
-      end
-
-      it "includes prefetch-src" do
-        csp = ContentSecurityPolicy.new(default_src: %w('self'), prefetch_src: %w(foo.com))
-        expect(csp.value).to eq("default-src 'self'; prefetch-src foo.com")
-      end
-
-      it "includes navigate-to" do
-        csp = ContentSecurityPolicy.new(default_src: %w('self'), navigate_to: %w(foo.com))
-        expect(csp.value).to eq("default-src 'self'; navigate-to foo.com")
-      end
-
-      it "supports strict-dynamic" do
-        csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456})
-        expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456' 'unsafe-inline'")
-      end
-
-      it "supports strict-dynamic and opting out of the appended 'unsafe-inline'" do
-        csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456, disable_nonce_backwards_compatibility: true })
-        expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456'")
-      end
-
-      it "supports script-src-elem directive" do
-        csp = ContentSecurityPolicy.new({script_src: %w('self'), script_src_elem: %w('self')})
-        expect(csp.value).to eq("script-src 'self'; script-src-elem 'self'")
-      end
-
-      it "supports script-src-attr directive" do
-        csp = ContentSecurityPolicy.new({script_src: %w('self'), script_src_attr: %w('self')})
-        expect(csp.value).to eq("script-src 'self'; script-src-attr 'self'")
-      end
-
-      it "supports style-src-elem directive" do
-        csp = ContentSecurityPolicy.new({style_src: %w('self'), style_src_elem: %w('self')})
-        expect(csp.value).to eq("style-src 'self'; style-src-elem 'self'")
-      end
-
-      it "supports style-src-attr directive" do
-        csp = ContentSecurityPolicy.new({style_src: %w('self'), style_src_attr: %w('self')})
-        expect(csp.value).to eq("style-src 'self'; style-src-attr 'self'")
-      end
-    end
-  end
-end