secure_headers 5.0.2 → 5.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e421f2b5968b737c264d985109c40f477a84c44c
-  data.tar.gz: 7839fcc26e1db7ddda587f063a6f2f0db052ffa2
+  metadata.gz: fd26137e6127e709c13eadb6b16969d87ff354d2
+  data.tar.gz: 3cfc345eec36d83dc0186c4b0a41f61145e432df
 SHA512:
-  metadata.gz: cd41e5df0da65b0f5304d58f73eec970315dd316598d7049fc59de87b16b97e281032c55df7b96490423e93bf24457e30b87196f2a000d127194a1c1878d4032
-  data.tar.gz: 4465312cd5cc22f2f74f77a4572c3585a9ecd1461ea2cfcbb3fd9dc1f506c06e22aff4efdd92b2eb8f90cd8c88b9eeacf34126c86444398f6d2ecfba04903e72
+  metadata.gz: 9353e1023fa74152d817162f800e13570c58541b79fc16705b0f143876300838cde65af0c7d06a9286c39a69a33ba42d04c8ef0fad60824e7efcf2a33baf460b
+  data.tar.gz: b0e99964050e7a31ae32069832dcb32eac00f536dae6301e4e7504970db2d64a243549fa1cf53b50f5246913043c39f78dd347f695651b54a3d1bb1aa30b9daa

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 5.0.3
+
+- Add nonced versions of Rails link/include tags #372 (@steveh)
+
 ## 5.0.2
 
 - Updates `Referrer-Policy` header to support multiple policy values

data/docs/per_action_configuration.md

@@ -66,6 +66,12 @@ body {
   background-color: black;
 }
 <% end %>
+
+<%= nonced_javascript_include_tag "include.js" %>
+
+<%= nonced_javascript_pack_tag "pack.js" %>
+
+<%= nonced_stylesheet_link_tag "link.css" %>
 ```
 
 becomes:

data/lib/secure_headers/view_helper.rb

@@ -7,21 +7,45 @@ module SecureHeaders
     class UnexpectedHashedScriptException < StandardError; end
 
     # Public: create a style tag using the content security policy nonce.
-    # Instructs secure_headers to append a nonce to style/script-src directives.
+    # Instructs secure_headers to append a nonce to style-src directive.
     #
     # Returns an html-safe style tag with the nonce attribute.
     def nonced_style_tag(content_or_options = {}, &block)
       nonced_tag(:style, content_or_options, block)
     end
 
+    # Public: create a stylesheet link tag using the content security policy nonce.
+    # Instructs secure_headers to append a nonce to style-src directive.
+    #
+    # Returns an html-safe link tag with the nonce attribute.
+    def nonced_stylesheet_link_tag(*args, &block)
+      stylesheet_link_tag(*args, nonce: content_security_policy_nonce(:style), &block)
+    end
+
     # Public: create a script tag using the content security policy nonce.
-    # Instructs secure_headers to append a nonce to style/script-src directives.
+    # Instructs secure_headers to append a nonce to script-src directive.
     #
     # Returns an html-safe script tag with the nonce attribute.
     def nonced_javascript_tag(content_or_options = {}, &block)
       nonced_tag(:script, content_or_options, block)
     end
 
+    # Public: create a script src tag using the content security policy nonce.
+    # Instructs secure_headers to append a nonce to script-src directive.
+    #
+    # Returns an html-safe script tag with the nonce attribute.
+    def nonced_javascript_include_tag(*args, &block)
+      javascript_include_tag(*args, nonce: content_security_policy_nonce(:script), &block)
+    end
+
+    # Public: create a script Webpacker pack tag using the content security policy nonce.
+    # Instructs secure_headers to append a nonce to script-src directive.
+    #
+    # Returns an html-safe script tag with the nonce attribute.
+    def nonced_javascript_pack_tag(*args, &block)
+      javascript_pack_tag(*args, nonce: content_security_policy_nonce(:script), &block)
+    end
+
     # Public: use the content security policy nonce for this request directly.
     # Instructs secure_headers to append a nonce to style/script-src directives.
     #

data/secure_headers.gemspec

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "5.0.2"
+  gem.version       = "5.0.3"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = "Manages application of security headers with many safe defaults."

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -39,6 +39,12 @@ class Message < ERB
   }
 </style>
 
+<%= nonced_javascript_include_tag "include.js" %>
+
+<%= nonced_javascript_pack_tag "pack.js" %>
+
+<%= nonced_stylesheet_link_tag "link.css" %>
+
 TEMPLATE
   end
 
@@ -64,6 +70,16 @@ TEMPLATE
     "<#{type}#{options}>#{content}</#{type}>"
   end
 
+  def javascript_include_tag(source, options = {})
+    content_tag(:script, nil, options.merge(src: source))
+  end
+
+  alias_method :javascript_pack_tag, :javascript_include_tag
+
+  def stylesheet_link_tag(source, options = {})
+    content_tag(:link, nil, options.merge(href: source, rel: "stylesheet", media: "screen"))
+  end
+
   def result
     super(binding)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 5.0.2
+  version: 5.0.3
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-14 00:00:00.000000000 Z
+date: 2017-11-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake