secure_headers 3.3.0 → 3.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c3acd5dfb3fc3a7c4037ef42b72765a4f1b34ede
-  data.tar.gz: 98f0ce842bac69bf7c5f4d3d4cc19e4281ebe00e
+  metadata.gz: 81af1b59ac5a5a838557fb48a3b605c5202bcd8f
+  data.tar.gz: 5b5ecdf10eea6b5a8e224e6b1606c554105775c6
 SHA512:
-  metadata.gz: 75d3b9033b09f0ac40675e8e8706185d9c0ca465a38f857228bf56857f5f44ba1eab5559b9c9f64f34ee398226ccd9dda5e26923f5325dcadd7be8ff0a957314
-  data.tar.gz: f6ffb2babf72009e60a4d4663ee6e933db8f8acb7159021e66a07168e1c6743df621309fb63e884f3257217d28951b196b2a192739860ce459f4fbabbab35622
+  metadata.gz: e3c87eb56ae112ae7048592fe082a70cf215603133b5f1385f57b5dbe080ab74c61eb4b093d3dc911a4f837e8d57a16a88a420a49195311ecd375d838ad4edd2
+  data.tar.gz: 2708e94fffbaa40e649c30925142fd16d8e79236f4cefdbcb64b58a4e08941100961f891d23754798d08c681309341717fd49597df281d601e3e3edf1b09a524

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 3.3.1 bugfix for boolean CSP directives
+
+[@stefansundin](https://github.com/twitter/secureheaders/pull/253) noticed that supplying `false` to "boolean" CSP directives (e.g. `upgrade-insecure-requests` and `block-all-mixed-content`) would still include the value.
+
 ## 3.3.0 referrer-policy support
 
 While not officially part of the spec and not implemented anywhere, support for the experimental [`referrer-policy` header](https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-header) was [preemptively added](https://github.com/twitter/secureheaders/pull/249).

data/README.md

@@ -48,7 +48,7 @@ SecureHeaders::Configuration.default do |config|
   config.referrer_policy = "origin-when-cross-origin"
   config.csp = {
     # "meta" values. these will shaped the header, but the values are not included in the header.
-    report_only:  true,     # default: false
+    report_only: true,      # default: false
     preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
 
     # directive values: these values will directly translate into source directives
@@ -66,7 +66,7 @@ SecureHeaders::Configuration.default do |config|
     form_action: %w('self' github.com),
     frame_ancestors: %w('none'),
     plugin_types: %w(application/x-shockwave-flash),
-    block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
+    block_all_mixed_content: true, # see http://www.w3.org/TR/mixed-content/
     upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
     report_uri: %w(https://report-uri.io/example-csp)
   }
@@ -85,7 +85,7 @@ end
 
 ### rails 2
 
-For rails 3+ applications, `secure_headers` has a `railtie` that should automatically include the middleware. For rails 2 applications, an explicit statement is required to use the middleware component.
+For rails 3+ applications, `secure_headers` has a `railtie` that should automatically include the middleware. For rails 2 or non-rails applications, an explicit statement is required to use the middleware component.
 
 ```ruby
 use SecureHeaders::Middleware
@@ -137,7 +137,7 @@ class MyController < ApplicationController
 end
 ```
 
-By default, a noop configuration is provided. No headers will be set when this default override is used.
+By default, a no-op configuration is provided. No headers will be set when this default override is used.
 
 ```ruby
 class MyController < ApplicationController
@@ -163,12 +163,12 @@ You can override the settings for a given action by producing a temporary overri
 class MyController < ApplicationController
   def index
     # Append value to the source list, override 'none' values
-    # Produces: default-src 'self'; script-src 'self' s3.amazaonaws.com; object-src 'self' youtube.com
-    append_content_security_policy_directives(script_src: %w(s3.amazaonaws.com), object_src: %w('self' youtube.com))
+    # Produces: default-src 'self'; script-src 'self' s3.amazonaws.com; object-src 'self' www.youtube.com
+    append_content_security_policy_directives(script_src: %w(s3.amazonaws.com), object_src: %w('self' www.youtube.com))
 
     # Overrides the previously set source list, override 'none' values
-    # Produces: default-src 'self'; script-src s3.amazaonaws.com; object-src 'self'
-    override_content_security_policy_directives(script_src: %w(s3.amazaonaws.com), object_src: %w('self'))
+    # Produces: default-src 'self'; script-src s3.amazonaws.com; object-src 'self'
+    override_content_security_policy_directives(script_src: %w(s3.amazonaws.com), object_src: %w('self'))
 
     # Global settings default to "sameorigin"
     override_x_frame_options("DENY")
@@ -207,7 +207,7 @@ You can use a view helper to automatically add nonces to script tags:
 
 ```erb
 <%= nonced_javascript_tag do %>
-console.log("hai");
+console.log("nonced!");
 <% end %>
 
 <%= nonced_style_tag do %>
@@ -324,14 +324,14 @@ Be aware that pinning error reporting is governed by the same rules as everythin
 
 ```ruby
 config.hpkp = {
-  max_age: 60.days.to_i,   # max_age is a required parameter
+  max_age: 60.days.to_i,    # max_age is a required parameter
   include_subdomains: true, # whether or not to apply pins to subdomains
   # Per the spec, SHA256 hashes are the only currently supported format.
   pins: [
     {sha256: 'b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c'},
     {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
   ],
-  report_only: true,            # defaults to false (report-only mode)
+  report_only: true,        # defaults to false (report-only mode)
   report_uri: 'https://report-uri.io/example-hpkp'
 }
 ```

data/lib/secure_headers/headers/content_security_policy.rb

@@ -53,7 +53,7 @@ module SecureHeaders
       directives.map do |directive_name|
         case DIRECTIVE_VALUE_TYPES[directive_name]
         when :boolean
-          symbol_to_hyphen_case(directive_name)
+          symbol_to_hyphen_case(directive_name) if @config[directive_name]
         when :string
           [symbol_to_hyphen_case(directive_name), @config[directive_name]].join(" ")
         else

data/lib/tasks/tasks.rake

@@ -54,6 +54,7 @@ namespace :secure_headers do
     hashes
   end
 
+  desc "Generate #{SecureHeaders::Configuration::HASH_CONFIG_FILE}"
   task :generate_hashes do |t, args|
     script_hashes = {
       "scripts" => {},

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.3.0"
+  gem.version       = "3.3.1"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -71,6 +71,16 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does add a boolean directive if the value is true" do
+        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: true)
+        expect(csp.value).to eq("default-src example.org; block-all-mixed-content; upgrade-insecure-requests")
+      end
+
+      it "does not add a boolean directive if the value is false" do
+        csp = ContentSecurityPolicy.new(default_src: ["https://example.org"], block_all_mixed_content: true, upgrade_insecure_requests: false)
+        expect(csp.value).to eq("default-src example.org; block-all-mixed-content")
+      end
+
       it "deduplicates any source expressions" do
         csp = ContentSecurityPolicy.new(default_src: %w(example.org example.org example.org))
         expect(csp.value).to eq("default-src example.org")

data/upgrading-to-3-0.md

@@ -13,6 +13,7 @@ Changes
 | `inline` / `eval` source expressions | could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'`                                                                                                                                   |
 | Per-action configuration         | override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111)  | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |
 | CSP/HPKP use `report_only` config that defaults to false | `enforce: false` |  `report_only: false` |
+| schemes in source expressions | Schemes were not stripped | Schemes are stripped by default to discourage mixed content. Setting `preserve_schemes: true` will revert to previous behavior |
 
 Migrating to 3.x from <= 2.x
 ==

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.3.1
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-29 00:00:00.000000000 Z
+date: 2016-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake