secure_headers 3.6.0 → 3.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7585a939ce1ded2d2226ba1d1503a5f0dca3eb49
-  data.tar.gz: 3762611d81eb31f24cdfd04a609d7aaed5a62182
+  metadata.gz: 4c6f04730011514076422fb3c43c8173c286c452
+  data.tar.gz: d78013640315208504a1187efabcf23fdabd750b
 SHA512:
-  metadata.gz: 4ba111dea43dd24b25567ff18e98fb1de8ad5f5a04566a9390e9a20e9c405571038960bd3dca417d225f58deea82214e27d8381448c887607db2883cd71b6dda
-  data.tar.gz: 7dd6cf414c1e3ed0814b5095730cd98ee77259c3560dc7a9371754dbbbff837f44a7cc93d664f85d7317fb6f633f0b2a5d8145f7d7fac5833a5dfc83fa0b4a72
+  metadata.gz: 8ed1d507c2136e42138301e6ae6df82eb36f1271c4ebabda99d15adbb65cefab104a9f7bfe8057ec9c839bc69325da033694b5a8b2d7de75aabd07ffc3fd6933
+  data.tar.gz: aee29edfd5ce45c1e16239292cde0fd771699d71c623c938f7e3d34d56f4266c5a2e8cdb063b94c2629917c22508d96c3cd393d52df9e6e7f8807f7263cdf65b

data/.ruby-version

@@ -1 +1 @@
-2.2.5
+2.3.3

data/.travis.yml

@@ -2,6 +2,7 @@ language: ruby
 
 rvm:
   - ruby-head
+  - 2.3.3
   - 2.2
   - 2.1
   - 2.0.0

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 3.6.1
+
+Improved memory use via minor improvements clever hacks that are sadly needed.
+Thanks @carlosantoniodasilva!
+
 ## 3.6.0
 
 Add support for the clear-site-data header

data/README.md

@@ -62,7 +62,8 @@ SecureHeaders::Configuration.default do |config|
       lax: true # mark all cookies as SameSite=lax
     }
   }
-  config.hsts = "max-age=#{20.years.to_i}; includeSubdomains; preload"
+  # Add "; preload" and submit the site to hstspreload.org for best protection.
+  config.hsts = "max-age=#{20.years.to_i}; includeSubdomains"
   config.x_frame_options = "DENY"
   config.x_content_type_options = "nosniff"
   config.x_xss_protection = "1; mode=block"
@@ -156,6 +157,7 @@ end
 * Elixir [secure_headers](https://github.com/anotherhale/secure_headers)
 * Dropwizard [dropwizard-web-security](https://github.com/palantir/dropwizard-web-security)
 * Ember.js [ember-cli-content-security-policy](https://github.com/rwjblue/ember-cli-content-security-policy/)
+* PHP [secure-headers](https://github.com/BePsvPT/secure-headers)
 
 ## License
 

data/lib/secure_headers.rb

@@ -177,7 +177,7 @@ module SecureHeaders
 
       header_classes_for(request).each_with_object({}) do |klass, hash|
         if header = headers[klass::CONFIG_KEY]
-          header_name, value = if [ContentSecurityPolicyConfig, ContentSecurityPolicyReportOnlyConfig].include?(klass)
+          header_name, value = if klass == ContentSecurityPolicyConfig || klass == ContentSecurityPolicyReportOnlyConfig
             csp_header_for_ua(header, user_agent)
           else
             header

data/lib/secure_headers/configuration.rb

@@ -262,7 +262,7 @@ module SecureHeaders
       end
     end
 
-    # Public: Precompute the header names and values for this configuraiton.
+    # Public: Precompute the header names and values for this configuration.
     # Ensures that headers generated at configure time, not on demand.
     #
     # Returns the cached headers

data/lib/secure_headers/headers/content_security_policy_config.rb

@@ -6,12 +6,7 @@ module SecureHeaders
       base.attrs.each do |attr|
         base.send(:define_method, "#{attr}=") do |value|
           if self.class.attrs.include?(attr)
-            value = value.dup if PolicyManagement::DIRECTIVE_VALUE_TYPES[attr] == :source_list
-            prev_value = self.instance_variable_get("@#{attr}")
-            self.instance_variable_set("@#{attr}", value)
-            if prev_value != self.instance_variable_get("@#{attr}")
-              @modified = true
-            end
+            write_attribute(attr, value)
           else
             raise ContentSecurityPolicyConfigError, "Unknown config directive: #{attr}=#{value}"
           end
@@ -52,8 +47,9 @@ module SecureHeaders
 
     def to_h
       self.class.attrs.each_with_object({}) do |key, hash|
-        hash[key] = self.send(key)
-      end.reject { |_, v| v.nil? }
+        value = self.send(key)
+        hash[key] = value unless value.nil?
+      end
     end
 
     def dup
@@ -73,14 +69,26 @@ module SecureHeaders
 
     private
     def from_hash(hash)
-      hash.keys.reject { |k| hash[k].nil? }.map do |k|
+      hash.each_pair do |k, v|
+        next if v.nil?
+
         if self.class.attrs.include?(k)
-          self.send("#{k}=", hash[k])
+          write_attribute(k, v)
         else
-          raise ContentSecurityPolicyConfigError, "Unknown config directive: #{k}=#{hash[k]}"
+          raise ContentSecurityPolicyConfigError, "Unknown config directive: #{k}=#{v}"
         end
       end
     end
+
+    def write_attribute(attr, value)
+      value = value.dup if PolicyManagement::DIRECTIVE_VALUE_TYPES[attr] == :source_list
+      attr_variable = "@#{attr}"
+      prev_value = self.instance_variable_get(attr_variable)
+      self.instance_variable_set(attr_variable, value)
+      if prev_value != value
+        @modified = true
+      end
+    end
   end
 
   class ContentSecurityPolicyConfigError < StandardError; end
@@ -88,8 +96,9 @@ module SecureHeaders
     CONFIG_KEY = :csp
     HEADER_NAME = "Content-Security-Policy".freeze
 
+    ATTRS = PolicyManagement::ALL_DIRECTIVES + PolicyManagement::META_CONFIGS + PolicyManagement::NONCES
     def self.attrs
-      PolicyManagement::ALL_DIRECTIVES + PolicyManagement::META_CONFIGS + PolicyManagement::NONCES
+      ATTRS
     end
 
     include DynamicConfig

data/lib/secure_headers/headers/policy_management.rb

@@ -109,7 +109,7 @@ module SecureHeaders
       DIRECTIVES_2_0 + DIRECTIVES_DRAFT
     ).freeze
 
-    ALL_DIRECTIVES = [DIRECTIVES_1_0 + DIRECTIVES_2_0 + DIRECTIVES_3_0 + DIRECTIVES_DRAFT].flatten.uniq.sort
+    ALL_DIRECTIVES = (DIRECTIVES_1_0 + DIRECTIVES_2_0 + DIRECTIVES_3_0 + DIRECTIVES_DRAFT).uniq.sort
 
     # Think of default-src and report-uri as the beginning and end respectively,
     # everything else is in between.
@@ -271,7 +271,7 @@ module SecureHeaders
       # copy the default-src value to the original config. This modifies the original hash.
       def populate_fetch_source_with_default!(original, additions)
         # in case we would be appending to an empty directive, fill it with the default-src value
-        additions.keys.each do |directive|
+        additions.each_key do |directive|
           if !original[directive] && ((source_list?(directive) && FETCH_SOURCES.include?(directive)) || nonce_added?(original, additions))
             if nonce_added?(original, additions)
               inferred_directive = directive.to_s.gsub(/_nonce/, "_src").to_sym

data/lib/secure_headers/headers/referrer_policy.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class ReferrerPolicyConfigError < StandardError; end
   class ReferrerPolicy
-    HEADER_NAME = "Referrer-Policy"
+    HEADER_NAME = "Referrer-Policy".freeze
     DEFAULT_VALUE = "origin-when-cross-origin"
     VALID_POLICIES = %w(
       no-referrer

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -2,7 +2,7 @@ module SecureHeaders
   class STSConfigError < StandardError; end
 
   class StrictTransportSecurity
-    HEADER_NAME = 'Strict-Transport-Security'
+    HEADER_NAME = 'Strict-Transport-Security'.freeze
     HSTS_MAX_AGE = "631138519"
     DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
     VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i

data/lib/secure_headers/headers/x_content_type_options.rb

@@ -2,7 +2,7 @@ module SecureHeaders
   class XContentTypeOptionsConfigError < StandardError; end
 
   class XContentTypeOptions
-    HEADER_NAME = "X-Content-Type-Options"
+    HEADER_NAME = "X-Content-Type-Options".freeze
     DEFAULT_VALUE = "nosniff"
     CONFIG_KEY = :x_content_type_options
 

data/lib/secure_headers/headers/x_download_options.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class XDOConfigError < StandardError; end
   class XDownloadOptions
-    HEADER_NAME = "X-Download-Options"
+    HEADER_NAME = "X-Download-Options".freeze
     DEFAULT_VALUE = 'noopen'
     CONFIG_KEY = :x_download_options
 

data/lib/secure_headers/headers/x_frame_options.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class XFOConfigError < StandardError; end
   class XFrameOptions
-    HEADER_NAME = "X-Frame-Options"
+    HEADER_NAME = "X-Frame-Options".freeze
     CONFIG_KEY = :x_frame_options
     SAMEORIGIN = "sameorigin"
     DENY = "deny"

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class XPCDPConfigError < StandardError; end
   class XPermittedCrossDomainPolicies
-    HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
+    HEADER_NAME = "X-Permitted-Cross-Domain-Policies".freeze
     DEFAULT_VALUE = 'none'
     VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
     CONFIG_KEY = :x_permitted_cross_domain_policies

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -1,7 +1,7 @@
 module SecureHeaders
   class XXssProtectionConfigError < StandardError; end
   class XXssProtection
-    HEADER_NAME = 'X-XSS-Protection'
+    HEADER_NAME = 'X-XSS-Protection'.freeze
     DEFAULT_VALUE = "1; mode=block"
     VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
     CONFIG_KEY = :x_xss_protection

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.6.0"
+  gem.version       = "3.6.1"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.6.1
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-05 00:00:00.000000000 Z
+date: 2017-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -124,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,