secure_headers 6.1.2 → 6.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5656a8f0d18034c233413d98058f641e71161f35e2ce73052fb93e219b7ba270
-  data.tar.gz: b4b9bf8b7aa33386090ba4f965ea215a1512132192c407e45c0595af6649488c
+  metadata.gz: 6aed18c8a69d4ddb01e664faca9c6db1e4b4cb6fa26203b9f3c1f20ace3001bb
+  data.tar.gz: 1a347b7ffa5efd650131b9d9bacff110ba6b08b3cb9dc5a93b6c70de6f1d3359
 SHA512:
-  metadata.gz: 9c17adff27589d67d7c4d873600cac3eaa267ea91d8c12621493f0e58121ab71af6a5c0e4b6e9eb3fa23c624918577dd23c436746dd9426c430c31bcb3a78745
-  data.tar.gz: 3db4059a3798a985707575abfe50b8a6d16ecb0b3962d7ed1c52473098150979448c147109ea504533ef2737df47dd141753908200c566d31b95917c73151ab9
+  metadata.gz: a0ff8c0e7b81d8a1b543d54ff7cd4b4186521276242cff4614839f6d4abcf9313c66f0b935358d3f0f283052111000c84dbc7da40374563f9b82df8b39281d3a
+  data.tar.gz: d22831fc277d3ecbd7d9923d8ff3ad724c0fcdab88b75389edaaa2ec8c4b0653908ef756c2fc642d8328643dca6e0417769e2b323066bb357a1230c33c17df97

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 6.2.0
+
+Fixes semicolon injection issue reported by @mvgijssel see https://github.com/twitter/secure_headers/issues/418
+
 ## 6.1.2
 
 Adds the ability to specify `SameSite=none` with the same configurability as `Strict`/`Lax` in order to disable Chrome's soon-to-be-lax-by-default state.

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2013, 2014, 2015, 2016, 2017 Twitter, Inc.
+Copyright 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Twitter, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/README.md

@@ -132,9 +132,3 @@ However, I would consider these headers anyways depending on your load and bandw
 * Dropwizard [dropwizard-web-security](https://github.com/palantir/dropwizard-web-security)
 * Ember.js [ember-cli-content-security-policy](https://github.com/rwjblue/ember-cli-content-security-policy/)
 * PHP [secure-headers](https://github.com/BePsvPT/secure-headers)
-
-## License
-
-Copyright 2013-2014 Twitter, Inc and other contributors.
-
-Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

data/docs/cookies.md

@@ -25,7 +25,7 @@ Boolean-based configuration is intended to globally enable or disable a specific
 ```ruby
 config.cookies = {
   secure: true, # mark all cookies as Secure
-  httponly: OPT_OUT, # do not mark any cookies as HttpOnly
+  httponly: SecureHeaders::OPT_OUT, # do not mark any cookies as HttpOnly
 }
 ```
 
@@ -57,9 +57,9 @@ config.cookies = {
 ```ruby
 config.cookies = {
   samesite: {
-    strict: { only: ['_rails_session'] },
-    lax: { only: ['_guest'] },
-    none: { only: ['_tracking'] },
+    strict: { only: ['session_id_duplicate'] },
+    lax: { only: ['_guest', '_rails_session', 'device_id'] },
+    none: { only: ['_tracking', 'saml_cookie', 'session_id'] },
   }
 }
 ```

data/docs/upgrading-to-6-0.md

@@ -5,7 +5,7 @@ The original implementation of name overrides worked by making a copy of the def
 ```ruby
 class ApplicationController < ActionController::Base
   Configuration.default do |config|
-    config.x_frame_options = OPT_OUT
+    config.x_frame_options = SecureHeaders::OPT_OUT
   end
 
   SecureHeaders::Configuration.override(:dynamic_override) do |config|

data/lib/secure_headers/configuration.rb

@@ -126,7 +126,9 @@ module SecureHeaders
     # The list of attributes that must respond to a `make_header` method
     HEADERABLE_ATTRIBUTES = (CONFIG_ATTRIBUTES - [:cookies]).freeze
 
-    attr_accessor(*CONFIG_ATTRIBUTES_TO_HEADER_CLASSES.keys)
+    attr_writer(*(CONFIG_ATTRIBUTES_TO_HEADER_CLASSES.reject { |key| [:csp, :csp_report_only].include?(key) }.keys))
+
+    attr_reader(*(CONFIG_ATTRIBUTES_TO_HEADER_CLASSES.keys))
 
     @script_hashes = nil
     @style_hashes = nil

data/lib/secure_headers/headers/content_security_policy.rb

@@ -103,10 +103,15 @@ module SecureHeaders
     # Returns a string representing a directive.
     def build_source_list_directive(directive)
       source_list = @config.directive_value(directive)
-
       if source_list != OPT_OUT && source_list && source_list.any?
-        normalized_source_list = minify_source_list(directive, source_list)
-        [symbol_to_hyphen_case(directive), normalized_source_list].join(" ")
+        minified_source_list = minify_source_list(directive, source_list).join(" ")
+
+        if minified_source_list.include?(";")
+          Kernel.warn("#{directive} contains a ; in '#{minified_source_list}' which will raise an error in future versions. It has been replaced with a blank space.")
+        end
+
+        escaped_source_list = minified_source_list.gsub(";", " ")
+        [symbol_to_hyphen_case(directive), escaped_source_list].join(" ").strip
       end
     end
 

data/lib/secure_headers/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SecureHeaders
-  VERSION = "6.1.2"
+  VERSION = "6.2.0"
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -28,6 +28,11 @@ module SecureHeaders
         expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:")
       end
 
+      it "deprecates and escapes semicolons in directive source lists" do
+        expect(Kernel).to receive(:warn).with("frame_ancestors contains a ; in 'google.com;script-src *;.;' which will raise an error in future versions. It has been replaced with a blank space.")
+        expect(ContentSecurityPolicy.new(frame_ancestors: %w(https://google.com;script-src https://*;.;)).value).to eq("frame-ancestors google.com script-src * .")
+      end
+
       it "discards 'none' values if any other source expressions are present" do
         csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none')))
         expect(csp.value).not_to include("'none'")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 6.1.2
+  version: 6.2.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-08 00:00:00.000000000 Z
+date: 2020-01-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake