secure_headers 3.0.0.rc1 → 3.0.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of secure_headers might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +205 -0
- data/secure_headers.gemspec +1 -1
- metadata +5 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ed9f86aeaa22e01fb8d842a43ff1607cb8083b6a
|
|
4
|
+
data.tar.gz: b71a52f6790c7a0f78053695038cb925e2c4895a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 699085b909d21178a40e9f109687b3d9dd6dd21bb7250d81a33aca7b682627ad79f0c59941647b82f0492f2d25aae513ad825826d38760c579518b7c2d8ee508
|
|
7
|
+
data.tar.gz: 89d8d3c867306921bff9a7f5a09f2708a54eecdce5a57a83cd8c505253afbd46ae67d489beef5cb8f5eba678235110ae50e69f9e82c1391dd53c125ede53cb73
|
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,205 @@
|
|
|
1
|
+
## 3.0.0
|
|
2
|
+
|
|
3
|
+
secure_headers 3.0.0 is a near-complete, not-entirely-backward-compatible rewrite. Please see the [upgrade guide](https://github.com/twitter/secureheaders/blob/master/upgrading-to-3-0.md) for an in-depth explanation of the changes and the suggested upgrade path.
|
|
4
|
+
|
|
5
|
+
## 2.5.1 - 2016-02-16 18:11:11 UTC - Remove noisy deprecation warning
|
|
6
|
+
|
|
7
|
+
See https://github.com/twitter/secureheaders/issues/203 and https://github.com/twitter/secureheaders/commit/cfad0e52285353b88e46fe384e7cd60bf2a01735
|
|
8
|
+
|
|
9
|
+
>> Upon upgrading to secure_headers 2.5.0, I get a flood of these deprecations when running my tests:
|
|
10
|
+
> [DEPRECATION] secure_header_options_for will not be supported in secure_headers
|
|
11
|
+
|
|
12
|
+
/cc @bquorning
|
|
13
|
+
|
|
14
|
+
## 2.5.0 - 2016-01-06 22:11:02 UTC - 2.x deprecation warning release
|
|
15
|
+
|
|
16
|
+
This release contains deprecation warnings for those wishing to upgrade to the 3.x series. With this release, fixing all deprecation warnings will make your configuration compatible when you decide to upgrade to the soon-to-be-released 3.x series (currently in pre-release stage).
|
|
17
|
+
|
|
18
|
+
No changes to functionality should be observed unless you were using procs as CSP config values.
|
|
19
|
+
|
|
20
|
+
## 2.4.4 - 2015-12-03 23:29:42 UTC - Bug fix release
|
|
21
|
+
|
|
22
|
+
If you use the `header_hash` method for setting your headers in middleware and you opted out of a header (via setting the value to `false`), you would run into an exception as described in https://github.com/twitter/secureheaders/pull/193
|
|
23
|
+
|
|
24
|
+
```
|
|
25
|
+
NoMethodError:
|
|
26
|
+
undefined method `name' for nil:NilClass
|
|
27
|
+
# ./lib/secure_headers.rb:63:in `block in header_hash'
|
|
28
|
+
# ./lib/secure_headers.rb:54:in `each'
|
|
29
|
+
# ./lib/secure_headers.rb:54:in `inject'
|
|
30
|
+
# ./lib/secure_headers.rb:54:in `header_hash'
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
|
|
34
|
+
## 2.4.3 - 2015-10-23 18:35:43 UTC - Performance improvement
|
|
35
|
+
|
|
36
|
+
@igrep reported an anti-patter in use regarding [UserAgentParser](https://github.com/ua-parser/uap-ruby). This caused UserAgentParser to reload it's entire configuration set *twice** per request. Moving this to a cached constant prevents the constant reinstantiation and will improve performance.
|
|
37
|
+
|
|
38
|
+
https://github.com/twitter/secureheaders/issues/187
|
|
39
|
+
|
|
40
|
+
## 2.4.2 - 2015-10-20 20:22:08 UTC - Bug fix release
|
|
41
|
+
|
|
42
|
+
A nasty regression meant that many CSP configuration values were "reset" after the first request, one of these being the "enforce" flag. See https://github.com/twitter/secureheaders/pull/184 for the full list of fields that were affected. Thanks to @spdawson for reporting this https://github.com/twitter/secureheaders/issues/183
|
|
43
|
+
|
|
44
|
+
## 2.4.1 - 2015-10-14 22:57:41 UTC - More UA sniffing
|
|
45
|
+
|
|
46
|
+
This release may change the output of headers based on per browser support. Unsupported directives will be omitted based on the user agent per request. See https://github.com/twitter/secureheaders/pull/179
|
|
47
|
+
|
|
48
|
+
p.s. this will likely be the last non-bugfix release for the 2.x line. 3.x will be a major change. Sneak preview: https://github.com/twitter/secureheaders/pull/181
|
|
49
|
+
|
|
50
|
+
## 2.4.0 - 2015-10-01 23:05:38 UTC - Some internal changes affecting behavior, but not functionality
|
|
51
|
+
|
|
52
|
+
If you leveraged `secure_headers` automatic filling of empty directives, the header value will change but it should not affect how the browser applies the policy. The content of CSP reports may change if you do not update your policy.
|
|
53
|
+
|
|
54
|
+
before
|
|
55
|
+
===
|
|
56
|
+
|
|
57
|
+
```ruby
|
|
58
|
+
config.csp = {
|
|
59
|
+
:default_src => "'self'"
|
|
60
|
+
}
|
|
61
|
+
```
|
|
62
|
+
would produce `default-src 'self'; connect-src 'self'; frame-src 'self' ... etc.`
|
|
63
|
+
|
|
64
|
+
after
|
|
65
|
+
===
|
|
66
|
+
|
|
67
|
+
```ruby
|
|
68
|
+
config.csp = {
|
|
69
|
+
:default_src => "'self'"
|
|
70
|
+
}
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
will produce `default-src 'self'`
|
|
74
|
+
|
|
75
|
+
The reason for this is that a `default-src` violation was basically impossible to handle. Chrome sends an `effective-directive` which helps indicate what kind of violation occurred even if it fell back to `default-src`. This is part of the [CSP Level 2 spec](http://www.w3.org/TR/CSP2/#violation-report-effective-directive) so hopefully other browsers will implement this soon.
|
|
76
|
+
|
|
77
|
+
Workaround
|
|
78
|
+
===
|
|
79
|
+
|
|
80
|
+
Just set the values yourself, but really a `default-src` of anything other than `'none'` implies the policy can be tightened dramatically. "ZOMG don't you work for github and doesn't github send a `default-src` of `*`???" Yes, this is true. I disagree with this but at the same time, github defines every single known directive that a browser supports so `default-src` will only apply if a new directive is introduced, and we'd rather fail open. For now.
|
|
81
|
+
|
|
82
|
+
```ruby
|
|
83
|
+
config.csp = {
|
|
84
|
+
:default_src => "'self'",
|
|
85
|
+
:connect_src => "'self'",
|
|
86
|
+
:frame_src => "'self'"
|
|
87
|
+
... etc.
|
|
88
|
+
}
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
Besides, relying on `default-src` is often not what you want and encourages an overly permissive policy. I've seen it. Seriously. `default-src 'unsafe-inline' 'unsafe-eval' https: http:;` That's terrible.
|
|
92
|
+
|
|
93
|
+
|
|
94
|
+
## 2.3.0 - 2015-09-30 19:43:09 UTC - Add header_hash feature for use in middleware.
|
|
95
|
+
|
|
96
|
+
See https://github.com/twitter/secureheaders/issues/167 and https://github.com/twitter/secureheaders/pull/168
|
|
97
|
+
|
|
98
|
+
tl;dr is that there is a class method `SecureHeaders::header_hash` that will return a hash of header name => value pairs useful for merging with the rack header hash in middleware.
|
|
99
|
+
|
|
100
|
+
## 2.2.4 - 2015-08-26 23:31:37 UTC - Print deprecation warning for 1.8.7 users
|
|
101
|
+
|
|
102
|
+
As discussed in https://github.com/twitter/secureheaders/issues/154
|
|
103
|
+
|
|
104
|
+
## 2.2.3 - 2015-08-14 20:26:12 UTC - Adds ability to opt-out of automatically adding data: sources to img-src
|
|
105
|
+
|
|
106
|
+
See https://github.com/twitter/secureheaders/pull/161
|
|
107
|
+
|
|
108
|
+
## 2.2.2 - 2015-07-02 21:18:38 UTC - Another option for config granularity.
|
|
109
|
+
|
|
110
|
+
See https://github.com/twitter/secureheaders/pull/147
|
|
111
|
+
|
|
112
|
+
Allows you to override a controller method that returns a config in the context of the executing action.
|
|
113
|
+
|
|
114
|
+
## 2.2.1 - 2015-06-24 21:01:57 UTC - When using nonces, do not include the nonce for safari / IE
|
|
115
|
+
|
|
116
|
+
See https://github.com/twitter/secureheaders/pull/150
|
|
117
|
+
|
|
118
|
+
Safari will generate a warning that it doesn't support nonces. Safari will fall back to the `unsafe-inline`. Things will still work, but an ugly message is printed to the console.
|
|
119
|
+
|
|
120
|
+
This opts out safari and IE users from the inline script protection. I haven't verified any IE behavior yet, so I'm just assuming it doesn't work.
|
|
121
|
+
|
|
122
|
+
## 2.2.0 - 2015-06-18 22:01:23 UTC - Pass controller reference to callable config value expressions.
|
|
123
|
+
|
|
124
|
+
https://github.com/twitter/secureheaders/pull/148
|
|
125
|
+
|
|
126
|
+
Facilitates better per-request config:
|
|
127
|
+
|
|
128
|
+
`:enforce => lambda { |controller| controller.current_user.beta_testing? }`
|
|
129
|
+
|
|
130
|
+
**NOTE** if you used `lambda` config values, this will raise an exception until you add the controller reference:
|
|
131
|
+
|
|
132
|
+
bad:
|
|
133
|
+
|
|
134
|
+
`lambda { true }`
|
|
135
|
+
|
|
136
|
+
good:
|
|
137
|
+
|
|
138
|
+
`lambda { |controller| true }`
|
|
139
|
+
`proc { true }`
|
|
140
|
+
`proc { |controller| true }`
|
|
141
|
+
|
|
142
|
+
## v2.1.0 - 2015-05-07 18:34:56 UTC - Add hpkp support
|
|
143
|
+
|
|
144
|
+
Includes https://github.com/twitter/secureheaders/pull/143 (which is really just https://github.com/twitter/secureheaders/pull/132) from @thirstscolr
|
|
145
|
+
|
|
146
|
+
|
|
147
|
+
## v2.0.2 - 2015-05-05 03:09:44 UTC - Add report_uri constant value
|
|
148
|
+
|
|
149
|
+
Just a small change that adds a constant that was missing as reported in https://github.com/twitter/secureheaders/issues/141
|
|
150
|
+
|
|
151
|
+
## v2.0.1 - 2015-03-20 18:46:47 UTC - View Helpers Fixed
|
|
152
|
+
|
|
153
|
+
Fixes an issue where view helpers (for nonces, hashes, etc) weren't available in views.
|
|
154
|
+
|
|
155
|
+
## 2.0.0 - 2015-01-23 20:23:56 UTC - 2.0
|
|
156
|
+
|
|
157
|
+
This release contains support for more csp level 2 features such as the new directives, the script hash integration, and more.
|
|
158
|
+
|
|
159
|
+
It also sets a new header by default: `X-Permitted-Cross-Domain-Policies`
|
|
160
|
+
|
|
161
|
+
Support for hpkp is not included in this release as the implementations are still very unstable.
|
|
162
|
+
|
|
163
|
+
:rocket:
|
|
164
|
+
|
|
165
|
+
## v.2.0.0.pre2 - 2014-12-06 01:55:42 UTC - Adds X-Permitted-Cross-Domain-Policies support by default
|
|
166
|
+
|
|
167
|
+
The only change between this and the first pre release is that the X-Permitted-Cross-Domain-Policies support is included.
|
|
168
|
+
|
|
169
|
+
## v1.4.0 - 2014-12-06 01:54:48 UTC - Deprecate features in preparation for 2.0
|
|
170
|
+
|
|
171
|
+
This removes the forwarder and "experimental" feature. The forwarder wasn't well maintained and created a lot of headaches. Also, it was using an outdated certificate pack for compatibility. That's bad. The experimental feature wasn't really used and it complicated the codebase a lot. It's also a questionably useful API that is very confusing.
|
|
172
|
+
|
|
173
|
+
## v2.0.0.pre - 2014-11-14 00:54:07 UTC - 2.0.0.pre - CSP level 2 support
|
|
174
|
+
|
|
175
|
+
This release is intended to be ready for CSP level 2. Mainly, this means there is direct support for hash/nonce of inline content and includes many new directives (which do not inherit from default-src)
|
|
176
|
+
|
|
177
|
+
## v1.3.4 - 2014-10-13 22:05:44 UTC -
|
|
178
|
+
|
|
179
|
+
* Adds X-Download-Options support
|
|
180
|
+
* Adds support for X-XSS-Protection reporting
|
|
181
|
+
* Defers loading of rails engine for faster boot times
|
|
182
|
+
|
|
183
|
+
## v1.3.3 - 2014-08-15 02:30:24 UTC - hsts preload confirmation value support
|
|
184
|
+
|
|
185
|
+
@agl just made a new option for HSTS representing confirmation that a site wants to be included in a browser's preload list (https://hstspreload.appspot.com).
|
|
186
|
+
|
|
187
|
+
This just adds a new 'preload' option to the HSTS settings to specify that option.
|
|
188
|
+
|
|
189
|
+
## v1.3.2 - 2014-08-14 00:01:32 UTC - Add app tagging support
|
|
190
|
+
|
|
191
|
+
Tagging Requests
|
|
192
|
+
|
|
193
|
+
It's often valuable to send extra information in the report uri that is not available in the reports themselves. Namely, "was the policy enforced" and "where did the report come from"
|
|
194
|
+
```ruby
|
|
195
|
+
{
|
|
196
|
+
:tag_report_uri => true,
|
|
197
|
+
:enforce => true,
|
|
198
|
+
:app_name => 'twitter',
|
|
199
|
+
:report_uri => 'csp_reports'
|
|
200
|
+
}
|
|
201
|
+
```
|
|
202
|
+
Results in
|
|
203
|
+
```
|
|
204
|
+
report-uri csp_reports?enforce=true&app_name=twitter
|
|
205
|
+
```
|
data/secure_headers.gemspec
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# -*- encoding: utf-8 -*-
|
|
2
2
|
Gem::Specification.new do |gem|
|
|
3
3
|
gem.name = "secure_headers"
|
|
4
|
-
gem.version = "3.0.0
|
|
4
|
+
gem.version = "3.0.0"
|
|
5
5
|
gem.authors = ["Neil Matatall"]
|
|
6
6
|
gem.email = ["neil.matatall@gmail.com"]
|
|
7
7
|
gem.description = 'Security related headers all in one gem.'
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: secure_headers
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.0.0
|
|
4
|
+
version: 3.0.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Neil Matatall
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-02-
|
|
11
|
+
date: 2016-02-18 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: rake
|
|
@@ -50,6 +50,7 @@ files:
|
|
|
50
50
|
- ".ruby-gemset"
|
|
51
51
|
- ".ruby-version"
|
|
52
52
|
- ".travis.yml"
|
|
53
|
+
- CHANGELOG.md
|
|
53
54
|
- Gemfile
|
|
54
55
|
- Guardfile
|
|
55
56
|
- LICENSE
|
|
@@ -99,9 +100,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
99
100
|
version: '0'
|
|
100
101
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
101
102
|
requirements:
|
|
102
|
-
- - "
|
|
103
|
+
- - ">="
|
|
103
104
|
- !ruby/object:Gem::Version
|
|
104
|
-
version:
|
|
105
|
+
version: '0'
|
|
105
106
|
requirements: []
|
|
106
107
|
rubyforge_project:
|
|
107
108
|
rubygems_version: 2.4.5.1
|