secure_headers 0.4.2 → 0.4.3

data/HISTORY.md

@@ -1,6 +1,11 @@
 0.4.3
 ======
 
+Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
+
+0.4.2
+======
+
 - Stupid bug where Fixnums couldn't be used for config values
 - Doc updates
 

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

data/lib/secure_headers.rb

@@ -114,7 +114,7 @@ module SecureHeaders
 
     def broken_implementation?(browser)
       #IOS 5 sometimes refuses to load external resources even when whitelisted with CSP
-      return browser.ios5?
+      return browser.ios5? || (browser.safari? && browser.version == 5)
     end
   end
 end

data/spec/lib/secure_headers_spec.rb

@@ -24,7 +24,10 @@ describe SecureHeaders do
     :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
     :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
     :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3"
+    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
   }
 
   def should_assign_header name, value
@@ -81,8 +84,8 @@ describe SecureHeaders do
           5
         when :opera
           4
-        when :ios5
-          3 # csp is disabled for ios5
+        when :ios5, :safari5
+          3 # csp breaks these browsers
         else
           4
         end

metadata

@@ -1,62 +1,55 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: secure_headers
-version: !ruby/object:Gem::Version 
-  hash: 11
+version: !ruby/object:Gem::Version
+  version: 0.4.3
   prerelease: 
-  segments: 
-  - 0
-  - 4
-  - 2
-  version: 0.4.2
 platform: ruby
-authors: 
+authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2013-05-05 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2013-05-07 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: brwsr
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 17
-        segments: 
-        - 1
-        - 1
-        - 1
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 1.1.1
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: rake
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
+  version_requirements: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.1.1
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
   type: :development
-  version_requirements: *id002
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Add easily configured browser headers to responses.
-email: 
+email:
 - neil.matatall@gmail.com
 executables: []
-
 extensions: []
-
 extra_rdoc_files: []
-
-files: 
+files:
 - .gitignore
 - .rvmrc
 - .travis.yml
@@ -177,39 +170,32 @@ files:
 - spec/spec_helper.rb
 - travis.sh
 homepage: https://github.com/twitter/secureheaders
-licenses: 
+licenses:
 - Apache Public License 2.0
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
+required_ruby_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
 rubyforge_project: 
 rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
-summary: Add easily configured browser headers to responses including content security policy, x-frame-options, strict-transport-security and more.
-test_files: 
+summary: Add easily configured browser headers to responses including content security
+  policy, x-frame-options, strict-transport-security and more.
+test_files:
 - spec/controllers/content_security_policy_controller_spec.rb
 - spec/lib/secure_headers/headers/content_security_policy_spec.rb
 - spec/lib/secure_headers/headers/strict_transport_security_spec.rb