site-inspector 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e04e629831f1d1a1c2c9f786563936f18d3f5da4
-  data.tar.gz: 26ac4b5b19f7470c34bfdbf91f0d42bac5f3ff54
+  metadata.gz: 7ba79a277c6611844c2628263b41f8953274bd7a
+  data.tar.gz: bf7e16d237c56018c62977ea0c4aed2df751b83b
 SHA512:
-  metadata.gz: f390ec91acae9a038ef72fe7b4806203528d3ec2a4117cbcb4f0bc97f49aad8d3655cad6db12e8f2a010df3f5dd10f5502ca150eff6d6f140e61fa1846b007e2
-  data.tar.gz: 4e9dcbaca581276008830e4f5836622f9a88cb0d74a06ec1bffebc46f0821fdb2cb57755ce97f59699575aa3e1d134b581fc410d8a6cf0ea095e72ae4d1dd1e3
+  metadata.gz: ff18940993447863687a4c0fb5815f753f8cc6d176df67d005f46d30758cfac4e446c099e058544faf6e792a1c378f9c36526e66212c97910039f109a022b9b2
+  data.tar.gz: f756567dc72bff09822b3d9da45d85d9143ff8eeb5bc86a60ca091da29a286a4ce6d06c35154bfc02010154da0950d5255dc9865917abcbdd6a00847639e83ee

data/lib/site-inspector/headers.rb

@@ -1,34 +1,67 @@
 class SiteInspector
+
+  # the ? versions could maybe just be dropped
+  def has_cookies?
+    !!has_cookies
+  end
+
+  def strict_transport_security?
+    !!strict_transport_security
+  end
+
+  def content_security_policy?
+    !!content_security_policy
+  end
+
+  def click_jacking_protection?
+    !!click_jacking_protection
+  end
+
+  # return the found header value
+
+  def has_cookies
+    header_from("Set-Cookie")
+  end
+
+  def strict_transport_security
+    header_from("Strict-Transport-Security")
+  end
+
+  def content_security_policy
+    header_from("Content-Security-Policy")
+  end
+
+  def click_jacking_protection
+    header_from("X-Frame-Options")
+  end
+
   def server
-    response && response.headers["Server"]
+    header_from("Server")
   end
 
-  def xss_protection?
-    response && response.headers["X-XSS-Protection"] == "1; mode=block"
+  def xss_protection
+    header_from("X-XSS-Protection")
   end
 
-  def has_cookies?
-    response && response.headers.include?("Set-Cookie")
+  # more specific checks than presence of headers
+  def xss_protection?
+    xss_protection == "1; mode=block"
   end
 
   def secure_cookies?
     return nil if !response || !has_cookies?
-    cookie = response.headers["Set-Cookie"]
+    cookie = header_from("Set-Cookie")
     cookie = cookie.first if cookie.is_a?(Array)
     marked_secure = !!(cookie.downcase =~ /secure/)
-    marked_http_only = !!(cookie.downcase =~ /HttpOnly/)
+    marked_http_only = !!(cookie.downcase =~ /httponly/)
     marked_secure and marked_http_only
   end
 
-  def strict_transport_security?
-    response && response.headers.include?("Strict-Transport-Security")
-  end
+  # helper function: case-insensitive sweep for header, return value
+  def header_from(header)
+    return nil unless response
 
-  def content_security_policy?
-    response && response.headers.include?("Content-Security-Policy")
-  end
-
-  def click_jacking_protection?
-    response && response.headers.include?("X-Frame-Options")
+    the_header = response.headers.keys.find {|h| h.downcase =~ /^#{header.downcase}/}
+    response.headers[the_header]
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: site-inspector
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Ben Balter