secure_headers 2.4.3 → 2.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2e4d6f82d6ed89fdcda1354e5ef6f802696bb192
-  data.tar.gz: ed1b4550998780641a7c09cdf5d13147ca42c7a6
+  metadata.gz: 72789dc25f6714e7bb64fc9b4255d1b0cbcb2ccf
+  data.tar.gz: 0a0e505e9f9ebed4807e3a8a52c160e630f4a1ae
 SHA512:
-  metadata.gz: 23c5adf02fd51a402a5daec6f46afb2c84022544f4572f67b65fdf1d9d4b08f3684d67cc9fd3031ec15530f988e1f52f19e63b6d712728c6dd44b366d8246519
-  data.tar.gz: ff8f0681465846609d2e1d9962eab1ac98ada78fb837f67a7981bfef549643ec2bdb4985927dabc20ae3f6eb6e79c9ea4a240a37d8ac631b4193870df0c1f268
+  metadata.gz: 96717b49d93a916952b139b50eec64df0f056ec59168c6abddb73b33893966d5309e8a956374ab55730a831288ca2c44dad3f49bef7f27ec6b2168be0881f778
+  data.tar.gz: 0615cef78d2724fd5cab650f9da4ee008443f1d2111e2065ffa4b04c43db2535c5d567687163e92f606d0c290b87a1a55df537e8c2328582b412f064be07f87e

data/README.md

@@ -8,7 +8,7 @@ The gem will automatically apply several headers that are related to security.
 - X-Content-Type-Options - [Prevent content type sniffing](http://msdn.microsoft.com/en-us/library/ie/gg622941\(v=vs.85\).aspx)
 - X-Download-Options - [Prevent file downloads opening](http://msdn.microsoft.com/en-us/library/ie/jj542450(v=vs.85).aspx)
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
-- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinnning  Specification](https://tools.ietf.org/html/rfc7469)
+- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinning  Specification](https://tools.ietf.org/html/rfc7469)
 
 ## Usage
 

data/lib/secure_headers.rb

@@ -52,21 +52,23 @@ module SecureHeaders
 
     def header_hash(options = nil)
       ALL_HEADER_CLASSES.inject({}) do |memo, klass|
-        config = if options.is_a?(Hash) && options[klass::Constants::CONFIG_KEY]
+        # must use !options[key].nil? because 'false' represents opting out, nil
+        # represents use global default.
+        config = if options.is_a?(Hash) && !options[klass::Constants::CONFIG_KEY].nil?
           options[klass::Constants::CONFIG_KEY]
         else
           ::SecureHeaders::Configuration.send(klass::Constants::CONFIG_KEY)
         end
 
         unless klass == SecureHeaders::PublicKeyPins && !config.is_a?(Hash)
-          header = get_a_header(klass::Constants::CONFIG_KEY, klass, config)
-          memo[header.name] = header.value
+          header = get_a_header(klass, config)
+          memo[header.name] = header.value if header
         end
         memo
       end
     end
 
-    def get_a_header(name, klass, options)
+    def get_a_header(klass, options)
       return if options == false
       klass.new(options)
     end
@@ -210,7 +212,7 @@ module SecureHeaders
     def set_a_header(name, klass, options=nil)
       options = secure_header_options_for(name, options)
       return if options == false
-      set_header(SecureHeaders::get_a_header(name, klass, options))
+      set_header(SecureHeaders::get_a_header(klass, options))
     end
 
     def set_header(name_or_header, value=nil)

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.4.3"
+  VERSION = "2.4.4"
 end

data/spec/lib/secure_headers_spec.rb

@@ -8,6 +8,7 @@ describe SecureHeaders do
   let(:request) {double(:ssl? => true, :url => 'https://example.com')}
 
   before(:each) do
+    reset_config
     stub_user_agent(nil)
     allow(headers).to receive(:[])
     allow(subject).to receive(:response).and_return(response)
@@ -171,6 +172,23 @@ describe SecureHeaders do
       expect_default_values(hash)
     end
 
+    it "allows opting out" do
+      hash = SecureHeaders::header_hash(:csp => false, :hpkp => false)
+      expect(hash['Content-Security-Policy-Report-Only']).to be_nil
+      expect(hash['Content-Security-Policy']).to be_nil
+    end
+
+    it "allows opting out with config" do
+      ::SecureHeaders::Configuration.configure do |config|
+        config.hsts = false
+        config.csp = false
+      end
+
+      hash = SecureHeaders::header_hash
+      expect(hash['Content-Security-Policy-Report-Only']).to be_nil
+      expect(hash['Content-Security-Policy']).to be_nil
+    end
+
     it "produces a hash with a mix of config values, override values, and default values" do
       ::SecureHeaders::Configuration.configure do |config|
         config.hsts = { :max_age => '123456'}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 2.4.3
+  version: 2.4.4
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-10-23 00:00:00.000000000 Z
+date: 2015-12-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake