secure_headers 0.2.1 → 0.3.0

data/HISTORY.md

@@ -1,3 +1,17 @@
+0.3.0
+=======
+- Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
+
+0.2.3
+=======
+
+- Fix error in report-uri logic for Firefox forwarding.
+
+0.2.2
+=======
+
+- Stop applying chrome-extension: to Firefox directives.
+
 0.2.1
 =======
 

data/README.md

@@ -59,8 +59,7 @@ This gem makes a few assumptions about how you will use some features.  For exam
   config.x_xss_protection = {:value => '1', :mode => false}
   config.csp = {
     :default_src => "https://* inline eval",
-    # ALWAYS supply a full URL for report URIs
-    :report_uri => 'https://example.com/uri-directive',
+    :report_uri => '//example.com/uri-directive',
     :img_src => "https://* data:",
     :frame_src => "https://* http://*.twimg.com http://itunes.apple.com"
   }
@@ -107,12 +106,12 @@ and [Mozilla CSP specification](https://wiki.mozilla.org/Security/CSP/Specificat
   # default_src is required!
   :default_src     => nil,      # sets the default-src/allow+options directives
 
-  # Where reports are sent. Use full URLs.
-  :report_uri  => 'https://mylogaggregator.example.com',
+  # Where reports are sent. Use protocol relative URLs if you are posting to the same domain (TLD+1). Use paths if you are posting to the application serving the header
+  :report_uri  => '//mysite.example.com',
 
   # Send reports that cannot be sent across host here. These requests are sent
   # the server, not the browser. If no value is supplied, it will default to
-  # the value in report_uri.
+  # the value in report_uri. Use this if you cannot use relative protocols mentioned above due to host mismatches.
   :forward_endpoint => 'https://internal.mylogaggregator.example.com'
 
   # these directives all take 'none', 'self', or a globbed pattern
@@ -239,8 +238,7 @@ require 'secure_headers'
   config.x_xss_protection = {:value => '1', :mode => false}
   config.csp = {
     :default_src => "https://* inline eval",
-    # ALWAYS supply a full URL for report URIs
-    :report_uri => 'https://example.com/uri-directive',
+    :report_uri => '//example.com/uri-directive',
     :img_src => "https://* data:",
     :frame_src => "https://* http://*.twimg.com http://itunes.apple.com"
   }
@@ -281,8 +279,7 @@ module Web
       config.x_xss_protection       = {:value   => '1', :mode => false}
       config.csp                    = {
         :default_src => "https://* inline eval",
-        # ALWAYS supply a full URL for report URIs
-        :report_uri => 'https://example.com/uri-directive',
+        :report_uri => '//example.com/uri-directive',
         :img_src => "https://* data:",
         :frame_src => "https://* http://*.twimg.com http://itunes.apple.com"
       }

data/lib/secure_headers/headers/content_security_policy/browser_strategy.rb

@@ -63,7 +63,11 @@ module SecureHeaders
       end
 
       def normalize_reporting_endpoint?
-        false
+        # noop except for Firefox for now
+      end
+
+      def add_missing_extension_values
+        # noop except for chrome for now
       end
     end
   end

data/lib/secure_headers/headers/content_security_policy/webkit_browser_strategy.rb

@@ -4,6 +4,15 @@ module SecureHeaders
       def base_name
         SecureHeaders::ContentSecurityPolicy::WEBKIT_CSP_HEADER_NAME
       end
+
+      def add_missing_extension_values
+        directives.each do |directive|
+          next unless config[directive]
+          if !config[directive].include?('chrome-extension:')
+            config[directive] << 'chrome-extension:'
+          end
+        end
+      end
     end
   end
 end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -97,13 +97,13 @@ module SecureHeaders
 
     def build_value
       fill_directives unless disable_fill_missing?
-      add_missing_chrome_extension_values unless disable_chrome_extension?
+      browser_strategy.add_missing_extension_values unless disable_chrome_extension?
       append_http_additions unless ssl_request?
 
       header_value = [
         build_impl_specific_directives,
         generic_directives(@config),
-        report_uri_directive(@report_uri)
+        report_uri_directive
       ].join
 
       #store the value for next time
@@ -125,15 +125,6 @@ module SecureHeaders
       @config
     end
 
-    def add_missing_chrome_extension_values
-      directives.each do |directive|
-        next unless @config[directive]
-        if !@config[directive].include?('chrome-extension:')
-          @config[directive] << 'chrome-extension:'
-        end
-      end
-    end
-
     def append_http_additions
       return unless http_additions
 
@@ -183,8 +174,6 @@ module SecureHeaders
 
       if forward_endpoint
         @report_uri = FF_CSP_ENDPOINT
-      else
-        @report_uri = nil
       end
     end
 
@@ -205,8 +194,18 @@ module SecureHeaders
       uri.host == origin.host && origin.port == uri.port && origin.scheme == uri.scheme
     end
 
-    def report_uri_directive(report_uri)
-      report_uri ? "report-uri #{report_uri};" : ''
+    def report_uri_directive
+      return '' if @report_uri.nil?
+
+      if @report_uri.start_with?('//')
+        @report_uri = if @ssl_request
+                        "https:" + @report_uri
+                      else
+                        "http:" + @report_uri
+                      end
+      end
+
+      "report-uri #{@report_uri};"
     end
 
     def generic_directives(config)

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -10,7 +10,7 @@ module SecureHeaders
         :default_src => 'https://*',
         :report_uri => '/csp_report',
         :script_src => 'inline eval https://* data:',
-        :style_src => "inline https://* chrome-extension: about:"
+        :style_src => "inline https://* about:"
       }
     end
 
@@ -186,6 +186,33 @@ module SecureHeaders
         csp = ContentSecurityPolicy.new(opts, :request => request_for(CHROME))
         csp.report_uri.should == 'https://example.com/csp'
       end
+
+      context "when using a protocol-relative value for report-uri" do
+        let(:opts) {
+          {
+            :default_src => 'self',
+            :report_uri => '//example.com/csp'
+          }
+        }
+
+        it "uses the current protocol" do
+          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX, '/', :ssl => true))
+          csp.value.should =~ %r{report-uri https://example.com/csp;}
+
+          csp = ContentSecurityPolicy.new(opts, :request => request_for(FIREFOX))
+          csp.value.should =~ %r{report-uri http://example.com/csp;}
+        end
+
+        it "uses the pre-configured https protocol" do
+          csp = ContentSecurityPolicy.new(opts, :ua => "Firefox", :ssl => true)
+          csp.value.should =~ %r{report-uri https://example.com/csp;}
+        end
+
+        it "uses the pre-configured http protocol" do
+          csp = ContentSecurityPolicy.new(opts, :ua => "Firefox", :ssl => false)
+          csp.value.should =~ %r{report-uri http://example.com/csp;}
+        end
+      end
     end
 
     describe "#value" do
@@ -212,7 +239,7 @@ module SecureHeaders
       it "fills in directives without values with default-src value" do
         options = default_opts.merge(:disable_fill_missing => false)
         csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-        value = "default-src https://*; connect-src https://*; font-src https://*; frame-src https://*; img-src https://* data:; media-src https://*; object-src https://*; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* chrome-extension: about:; report-uri /csp_report;"
+        value = "default-src https://*; connect-src https://*; font-src https://*; frame-src https://*; img-src https://* data:; media-src https://*; object-src https://*; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"
         csp.value.should == value
       end
 
@@ -224,7 +251,12 @@ module SecureHeaders
       context "X-Content-Security-Policy" do
         it "builds a csp header for firefox" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(FIREFOX))
-          csp.value.should == "allow https://*; options inline-script eval-script; img-src data:; script-src https://* data:; style-src https://* chrome-extension: about:; report-uri /csp_report;"
+          csp.value.should == "allow https://*; options inline-script eval-script; img-src data:; script-src https://* data:; style-src https://* about:; report-uri /csp_report;"
+        end
+
+        it "does not append chrome-extension to directives" do
+          csp = ContentSecurityPolicy.new(default_opts.merge(:disable_chrome_extension => false), :request => request_for(FIREFOX))
+          csp.value.should_not match "chrome-extension:"
         end
 
         it "copies connect-src values to xhr_src values" do
@@ -253,7 +285,7 @@ module SecureHeaders
       context "X-Webkit-CSP" do
         it "builds a csp header for chrome" do
           csp = ContentSecurityPolicy.new(default_opts, :request => request_for(CHROME))
-          csp.value.should == "default-src https://*; img-src data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* chrome-extension: about:; report-uri /csp_report;"
+          csp.value.should == "default-src https://*; img-src data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"
         end
 
         it "ignores :forward_endpoint settings" do
@@ -311,7 +343,7 @@ module SecureHeaders
 
         it "adds directive values for headers on http" do
           csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
-          csp.value.should == "default-src https://*; frame-src http://*; img-src http://* data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* chrome-extension: about:; report-uri /csp_report;"
+          csp.value.should == "default-src https://*; frame-src http://*; img-src http://* data:; script-src 'unsafe-inline' 'unsafe-eval' https://* data:; style-src 'unsafe-inline' https://* about:; report-uri /csp_report;"
         end
 
         it "does not add the directive values if requesting https" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-21 00:00:00.000000000 Z
+date: 2013-03-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: brwsr