secure_headers 3.1.1 → 3.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e2df8c83dc908657d48aa5552696bade1374c288
-  data.tar.gz: 590bc0e2c9225ad3a330af1812babd6c129135d8
+  metadata.gz: 3ebe74bc751469bb4305dd36b59fe4881a87ec3d
+  data.tar.gz: 83fed6de7e4cab010cab6010caa0ba005ac43fc7
 SHA512:
-  metadata.gz: f6b8665ddd8e15bfd9f9e5fe2d330e9e7e9cc1386813883613e295e6d114c072f8bb1713871fde12e9feb8a3df8f691b39477a9db8daeb90f49013ecf44e7b8d
-  data.tar.gz: 713914b24728468981c723801891e07eeee044f63d7eca97106ef0c0d0376cc0ed4a00ae49177c14d83a5ef445c1cb0b7d6e43472446042f6ee33201f99c2001
+  metadata.gz: bd02880ba737a5a9489dd6e8209420259fec8d78330f5992e7b34f61ebe16677a93ff123dd3b417f6973bfcd85e03524b053bcd1487458492aa4c7b8a7a9bb40
+  data.tar.gz: 550c48cfd47e656e70dd3ab39ed6386b8d148231d55a553395da6076bc88bdaaa7fe1803695b093cf3e4fd49cb30bed0aff15a2455652efd00d7a27d9ce55636

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 3.1.2 Bug fix for regression
+
+See https://github.com/twitter/secureheaders/pull/239
+
+This meant that when header caches were regenerated upon calling `SecureHeaders.override(:name)` and using it with `use_secure_headers_override` would result in default values for anything other than CSP/HPKP.
+
 ## 3.1.1 Bug fix for regression
 
 See https://github.com/twitter/secureheaders/pull/235

data/lib/secure_headers/configuration.rb

@@ -121,6 +121,13 @@ module SecureHeaders
       copy.csp = self.class.send(:deep_copy_if_hash, @csp)
       copy.dynamic_csp = self.class.send(:deep_copy_if_hash, @dynamic_csp)
       copy.cached_headers = self.class.send(:deep_copy_if_hash, @cached_headers)
+      copy.x_content_type_options = @x_content_type_options
+      copy.hsts = @hsts
+      copy.x_frame_options = @x_frame_options
+      copy.x_xss_protection = @x_xss_protection
+      copy.x_download_options = @x_download_options
+      copy.x_permitted_cross_domain_policies = @x_permitted_cross_domain_policies
+      copy.hpkp = @hpkp
       copy
     end
 
@@ -133,6 +140,7 @@ module SecureHeaders
     end
 
     def update_x_frame_options(value)
+      @x_frame_options = value
       self.cached_headers[XFrameOptions::CONFIG_KEY] = XFrameOptions.make_header(value)
     end
 

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.1.1"
+  gem.version       = "3.1.2"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

data/spec/lib/secure_headers/configuration_spec.rb

@@ -41,6 +41,14 @@ module SecureHeaders
       end
     end
 
+    it "regenerates cached headers when building an override" do
+      Configuration.override(:test_override) do |config|
+        config.x_content_type_options = OPT_OUT
+      end
+
+      expect(Configuration.get.cached_headers).to_not eq(Configuration.get(:test_override).cached_headers)
+    end
+
     it "stores an override of the global config" do
       Configuration.override(:test_override) do |config|
         config.x_frame_options = "DENY"

data/spec/lib/secure_headers_spec.rb

@@ -21,7 +21,7 @@ module SecureHeaders
     end
 
     describe "#header_hash_for" do
-      it "allows you to opt out of individual headers" do
+      it "allows you to opt out of individual headers via API" do
         Configuration.default
         SecureHeaders.opt_out_of_header(request, CSP::CONFIG_KEY)
         SecureHeaders.opt_out_of_header(request, XContentTypeOptions::CONFIG_KEY)
@@ -31,6 +31,23 @@ module SecureHeaders
         expect(hash['X-Content-Type-Options']).to be_nil
       end
 
+      it "Carries options over when using overrides" do
+        Configuration.default do |config|
+          config.x_download_options = OPT_OUT
+          config.x_permitted_cross_domain_policies = OPT_OUT
+        end
+
+        Configuration.override(:api) do |config|
+          config.x_frame_options = OPT_OUT
+        end
+
+        SecureHeaders.use_secure_headers_override(request, :api)
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash['X-Download-Options']).to be_nil
+        expect(hash['X-Permitted-Cross-Domain-Policies']).to be_nil
+        expect(hash['X-Frame-Options']).to be_nil
+      end
+
       it "allows you to opt out entirely" do
         Configuration.default
         SecureHeaders.opt_out_of_all_protection(request)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.1.2
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-28 00:00:00.000000000 Z
+date: 2016-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake