secure_headers 5.0.3 → 5.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fd26137e6127e709c13eadb6b16969d87ff354d2
-  data.tar.gz: 3cfc345eec36d83dc0186c4b0a41f61145e432df
+  metadata.gz: d30a295775010a197058029cc447bdf51ad1f93e
+  data.tar.gz: 79a4928de6fe2508ebdfed92cfe36ba1d70cdce8
 SHA512:
-  metadata.gz: 9353e1023fa74152d817162f800e13570c58541b79fc16705b0f143876300838cde65af0c7d06a9286c39a69a33ba42d04c8ef0fad60824e7efcf2a33baf460b
-  data.tar.gz: b0e99964050e7a31ae32069832dcb32eac00f536dae6301e4e7504970db2d64a243549fa1cf53b50f5246913043c39f78dd347f695651b54a3d1bb1aa30b9daa
+  metadata.gz: 206573552433a49370adf984f538091ac3bd4c2e6ee0ba521f949762e145259725a3938ab2ec5124b5556fdd1502388ac8dd7e8d5fcc947c9f96e3ed78947cfa
+  data.tar.gz: c53aab77376ad2d8fac21c2d684cc02dcf14322cd51591d7048f0865315a60b6266ce7f066651040b8d626adf311101e31b2b1690ce1e3b18190ea42f90f24ac

data/.ruby-version

@@ -1 +1 @@
-2.4.1
+2.4.2

data/.travis.yml

@@ -2,9 +2,9 @@ language: ruby
 
 rvm:
   - ruby-head
-  - 2.4.1
-  - 2.3.4
-  - 2.2
+  - 2.4.2
+  - 2.3.5
+  - 2.2.8
   - jruby-head
 
 env:

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 5.0.4
+
+- Adds support for `nonced_stylesheet_pack_tag` #373 (@paulfri)
+
 ## 5.0.3
 
 - Add nonced versions of Rails link/include tags #372 (@steveh)

data/Gemfile

@@ -5,14 +5,14 @@ gemspec
 
 group :test do
   gem "coveralls"
-  gem "json", "~> 1"
+  gem "json"
   gem "pry-nav"
-  gem "rack", "~> 1"
+  gem "rack"
   gem "rspec"
-  gem "rubocop", "~> 0.47.0"
+  gem "rubocop"
   gem "rubocop-github"
-  gem "term-ansicolor", "< 1.4"
-  gem "tins", "~> 1.6.0" # 1.7 requires ruby 2.0
+  gem "term-ansicolor"
+  gem "tins"
 end
 
 group :guard do

data/docs/per_action_configuration.md

@@ -72,6 +72,8 @@ body {
 <%= nonced_javascript_pack_tag "pack.js" %>
 
 <%= nonced_stylesheet_link_tag "link.css" %>
+
+<%= nonced_stylesheet_pack_tag "pack.css" %>
 ```
 
 becomes:
@@ -136,4 +138,4 @@ end
 class SessionsController < ApplicationController
   after_action  :clear_browser_cache, only: :destroy
 end
-```
+```

data/lib/secure_headers/configuration.rb

@@ -308,7 +308,7 @@ module SecureHeaders
     def generate_csp_headers_for_config(headers, header_key, csp_config)
       unless csp_config.opt_out?
         headers[header_key] = {}
-        ContentSecurityPolicy::VARIATIONS.each do |name, _|
+        ContentSecurityPolicy::VARIATIONS.each_key do |name|
           csp = ContentSecurityPolicy.make_header(csp_config, UserAgent.parse(name))
           headers[header_key][name] = csp.freeze
         end

data/lib/secure_headers/view_helper.rb

@@ -19,7 +19,9 @@ module SecureHeaders
     #
     # Returns an html-safe link tag with the nonce attribute.
     def nonced_stylesheet_link_tag(*args, &block)
-      stylesheet_link_tag(*args, nonce: content_security_policy_nonce(:style), &block)
+      opts = extract_options(args).merge(nonce: content_security_policy_nonce(:style))
+
+      stylesheet_link_tag(*args, opts, &block)
     end
 
     # Public: create a script tag using the content security policy nonce.
@@ -35,7 +37,9 @@ module SecureHeaders
     #
     # Returns an html-safe script tag with the nonce attribute.
     def nonced_javascript_include_tag(*args, &block)
-      javascript_include_tag(*args, nonce: content_security_policy_nonce(:script), &block)
+      opts = extract_options(args).merge(nonce: content_security_policy_nonce(:script))
+
+      javascript_include_tag(*args, opts, &block)
     end
 
     # Public: create a script Webpacker pack tag using the content security policy nonce.
@@ -43,7 +47,19 @@ module SecureHeaders
     #
     # Returns an html-safe script tag with the nonce attribute.
     def nonced_javascript_pack_tag(*args, &block)
-      javascript_pack_tag(*args, nonce: content_security_policy_nonce(:script), &block)
+      opts = extract_options(args).merge(nonce: content_security_policy_nonce(:script))
+
+      javascript_pack_tag(*args, opts, &block)
+    end
+
+    # Public: create a stylesheet Webpacker link tag using the content security policy nonce.
+    # Instructs secure_headers to append a nonce to style-src directive.
+    #
+    # Returns an html-safe link tag with the nonce attribute.
+    def nonced_stylesheet_pack_tag(*args, &block)
+      opts = extract_options(args).merge(nonce: content_security_policy_nonce(:style))
+
+      stylesheet_pack_tag(*args, opts, &block)
     end
 
     # Public: use the content security policy nonce for this request directly.
@@ -138,6 +154,14 @@ module SecureHeaders
       end
       content_tag type, content, options.merge(nonce: content_security_policy_nonce(type))
     end
+
+    def extract_options(args)
+      if args.last.is_a? Hash
+        args.pop
+      else
+        {}
+      end
+    end
   end
 end
 

data/secure_headers.gemspec

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "5.0.3"
+  gem.version       = "5.0.4"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = "Manages application of security headers with many safe defaults."
@@ -22,7 +22,7 @@ Gem::Specification.new do |gem|
   gem.post_install_message = <<-POST_INSTALL
 
 **********
-:wave: secure_headers 5.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-4-0.md https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-4-0.md
+:wave: secure_headers 5.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-5-0.md
 **********
 
   POST_INSTALL

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -39,11 +39,13 @@ class Message < ERB
   }
 </style>
 
-<%= nonced_javascript_include_tag "include.js" %>
+<%= nonced_javascript_include_tag "include.js", defer: true %>
 
-<%= nonced_javascript_pack_tag "pack.js" %>
+<%= nonced_javascript_pack_tag "pack.js", "otherpack.js", defer: true %>
 
-<%= nonced_stylesheet_link_tag "link.css" %>
+<%= nonced_stylesheet_link_tag "link.css", media: :all %>
+
+<%= nonced_stylesheet_pack_tag "pack.css", "otherpack.css", media: :all %>
 
 TEMPLATE
   end
@@ -70,16 +72,22 @@ TEMPLATE
     "<#{type}#{options}>#{content}</#{type}>"
   end
 
-  def javascript_include_tag(source, options = {})
-    content_tag(:script, nil, options.merge(src: source))
+  def javascript_include_tag(*sources, **options)
+    sources.map do |source|
+      content_tag(:script, nil, options.merge(src: source))
+    end
   end
 
   alias_method :javascript_pack_tag, :javascript_include_tag
 
-  def stylesheet_link_tag(source, options = {})
-    content_tag(:link, nil, options.merge(href: source, rel: "stylesheet", media: "screen"))
+  def stylesheet_link_tag(*sources, **options)
+    sources.map do |source|
+      content_tag(:link, nil, options.merge(href: source, rel: "stylesheet", media: "screen"))
+    end
   end
 
+  alias_method :stylesheet_pack_tag, :stylesheet_link_tag
+
   def result
     super(binding)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 5.0.3
+  version: 5.0.4
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-20 00:00:00.000000000 Z
+date: 2017-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -117,7 +117,7 @@ metadata: {}
 post_install_message: |2+
 
   **********
-  :wave: secure_headers 5.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-4-0.md https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-4-0.md
+  :wave: secure_headers 5.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/docs/upgrading-to-5-0.md
   **********
 
 rdoc_options: []
@@ -135,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.11
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,