serverless-openapi-documenter 0.0.108 → 0.0.109

package/README.md

@@ -928,7 +928,7 @@ The generator will interpret your settings for CORS and automatically add the re
 
 You can make use of the [OWASP Secure Headers](https://owasp.org/www-project-secure-headers/#x-permitted-cross-domain-policies) to generate response headers. These are a selection of response headers with default values that OWASP recommends returning with your response to help secure your application.
 
-The OWASP Secure Headers Project contains a set of recommended headers to return with recommended values, when generating the documentation, the generator will attempt to get the latest version of this document and apply the latest recommendations. If you do not allow outside connections, it will default to a version of recommendations from **2023-05-26 12:22:30 UTC**.
+The OWASP Secure Headers Project contains a set of recommended headers to return with recommended values, when generating the documentation, the generator will attempt to get the latest version of this document and apply the latest recommendations. If you do not allow outside connections, it will default to a version of recommendations from **2024-09-19 21:29:28 UTC**.
 
 Like CORS, if you have already set any of the OWASP Secure headers via `responseHeaders`, it will not overwrite them.
 
@@ -973,13 +973,14 @@ The full list of OWASP Secure Headers you can set are:
 - crossOriginOpenerPolicy - Cross-Origin-Opener-Policy,
 - crossOriginResourcePolicy - Cross-Origin-Resource-Policy,
 - permissionsPolicy - Permissions-Policy,
-- pragma - Pragma,
 - referrerPolicy - Referrer-Policy,
 - strictTransportSecurity - Strict-Transport-Security,
 - xContentTypeOptions - X-Content-Type-Options,
 - xFrameOptions - X-Frame-Options,
 - xPermittedCrossDomainPolicies - X-Permitted-Cross-Domain-Policies
 
+You should note that `Pragma` has been [deprecated by owasp](https://owasp.org/www-project-secure-headers/#pragma), this plugin will issue a warning when you are still using Pragma and might drop support.
+
 ###### Subset of OWASP Secure Headers with user defined values
 
 If you wish to override the OWASP Secure Headers, you can write your `methodResponse` like:

package/json/owasp.json

@@ -1,57 +1,53 @@
 {
-    "last_update_utc": "2023-05-26 12:22:30",
-    "headers": [
-      {
-        "name": "Cache-Control",
-        "value": "no-store, max-age=0"
-      },
-      {
-        "name": "Clear-Site-Data",
-        "value": "\"cache\",\"cookies\",\"storage\""
-      },
-      {
-        "name": "Content-Security-Policy",
-        "value": "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content"
-      },
-      {
-        "name": "Cross-Origin-Embedder-Policy",
-        "value": "require-corp"
-      },
-      {
-        "name": "Cross-Origin-Opener-Policy",
-        "value": "same-origin"
-      },
-      {
-        "name": "Cross-Origin-Resource-Policy",
-        "value": "same-origin"
-      },
-      {
-        "name": "Permissions-Policy",
-        "value": "accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),layout-animations=(self),legacy-image-formats=(self),magnetometer=(),microphone=(),midi=(),oversized-images=(self),payment=(),picture-in-picture=(),publickey-credentials-get=(),speaker-selection=(),sync-xhr=(self),unoptimized-images=(self),unsized-media=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=()"
-      },
-      {
-        "name": "Pragma",
-        "value": "no-cache"
-      },
-      {
-        "name": "Referrer-Policy",
-        "value": "no-referrer"
-      },
-      {
-        "name": "Strict-Transport-Security",
-        "value": "max-age=31536000 ; includeSubDomains"
-      },
-      {
-        "name": "X-Content-Type-Options",
-        "value": "nosniff"
-      },
-      {
-        "name": "X-Frame-Options",
-        "value": "deny"
-      },
-      {
-        "name": "X-Permitted-Cross-Domain-Policies",
-        "value": "none"
-      }
-    ]
-  }
+  "last_update_utc": "2024-09-19 21:29:28",
+  "headers": [
+    {
+      "name": "Cache-Control",
+      "value": "no-store, max-age=0"
+    },
+    {
+      "name": "Clear-Site-Data",
+      "value": "\"cache\",\"cookies\",\"storage\""
+    },
+    {
+      "name": "Content-Security-Policy",
+      "value": "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content"
+    },
+    {
+      "name": "Cross-Origin-Embedder-Policy",
+      "value": "require-corp"
+    },
+    {
+      "name": "Cross-Origin-Opener-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Cross-Origin-Resource-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Permissions-Policy",
+      "value": "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=()"
+    },
+    {
+      "name": "Referrer-Policy",
+      "value": "no-referrer"
+    },
+    {
+      "name": "Strict-Transport-Security",
+      "value": "max-age=31536000; includeSubDomains"
+    },
+    {
+      "name": "X-Content-Type-Options",
+      "value": "nosniff"
+    },
+    {
+      "name": "X-Frame-Options",
+      "value": "deny"
+    },
+    {
+      "name": "X-Permitted-Cross-Domain-Policies",
+      "value": "none"
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-openapi-documenter",
-  "version": "0.0.108",
+  "version": "0.0.109",
   "description": "Generate OpenAPI v3 documentation and Postman Collections from your Serverless Config",
   "main": "index.js",
   "keywords": [

package/src/definitionGenerator.js

@@ -553,6 +553,12 @@ class DefinitionGenerator {
             throw err;
           });
         } else {
+          if (Object.keys(response.owasp).includes("pragma")) {
+            this.logger.warn(
+              "Pragma has been deprecated by owasp (https://owasp.org/www-project-secure-headers/#pragma) and support for defaults will be dropped by this plugin."
+            );
+          }
+
           owaspHeaders = await this.createResponseHeaders(
             oWASP.getHeaders(response.owasp)
           ).catch((err) => {
@@ -603,7 +609,7 @@ class DefinitionGenerator {
       ).catch((err) => {
         throw err;
       });
-    } else if (this.currentEvent.cors) {
+    } else if (this.currentEvent?.cors) {
       const newHeaders = {};
       for (const key of Object.keys(this.DEFAULT_CORS_HEADERS)) {
         if (

package/src/owasp.js

@@ -47,11 +47,6 @@ class OWASP {
         description:
           "The HTTP Permissions-Policy header provides a mechanism to allow and deny the use of browser features in a document or within any [<iframe>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) elements in the document. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy)",
       },
-      Pragma: {
-        description:
-          "The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. This header serves for backwards compatibility with the HTTP/1.0 caches that do not have a [Cache-Control](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) HTTP/1.1 header. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma)",
-        deprecated: true,
-      },
       "Referrer-Policy": {
         description:
           "The Referrer-Policy [HTTP header](https://developer.mozilla.org/en-US/docs/Glossary/HTTP_header) controls how much [referrer information](https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns) (sent with the [Referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) header) should be included with requests. Aside from the HTTP header, you can [set this policy in HTML](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy)",
@@ -153,13 +148,44 @@ class OWASP {
   getHeaders(headerList) {
     const obj = {};
     for (const headerName of Object.keys(headerList)) {
-      const defaultHeader =
-        this.DEFAULT_OWASP_HEADERS[this.headerMap[headerName]];
-      Object.assign(obj, { [this.headerMap[headerName]]: defaultHeader });
+      if (headerName === "pragma") {
+        const pragma = {
+          Pragma: {
+            description:
+              "The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. This header serves for backwards compatibility with the HTTP/1.0 caches that do not have a [Cache-Control](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) HTTP/1.1 header. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma)",
+            deprecated: true,
+          },
+        };
+
+        if (typeof headerList["pragma"] !== "boolean") {
+          Object.assign(pragma["Pragma"], {
+            schema: {
+              type: "string",
+              default: headerList["pragma"].value,
+              example: headerList["pragma"].value,
+            },
+          });
+        } else {
+          Object.assign(pragma["Pragma"], {
+            schema: {
+              default: "no-cache",
+              type: "string",
+              example: "no-cache",
+            },
+          });
+        }
+
+        Object.assign(obj, pragma);
+      } else {
+        const defaultHeader =
+          this.DEFAULT_OWASP_HEADERS[this.headerMap[headerName]];
+
+        Object.assign(obj, { [this.headerMap[headerName]]: defaultHeader });
 
-      if (typeof headerList[headerName] !== "boolean") {
-        obj[this.headerMap[headerName]].schema.default =
-          headerList[headerName].value;
+        if (typeof headerList[headerName] !== "boolean") {
+          obj[this.headerMap[headerName]].schema.default =
+            headerList[headerName].value;
+        }
       }
     }
 

package/test/json/newOWASP.json

@@ -1,57 +1,53 @@
 {
-    "last_update_utc": "2023-05-26 12:22:30",
-    "headers": [
-      {
-        "name": "Cache-Control",
-        "value": "no-store, max-age=0"
-      },
-      {
-        "name": "Clear-Site-Data",
-        "value": "\"cache\",\"cookies\",\"storage\""
-      },
-      {
-        "name": "Content-Security-Policy",
-        "value": "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content"
-      },
-      {
-        "name": "Cross-Origin-Embedder-Policy",
-        "value": "credentialless"
-      },
-      {
-        "name": "Cross-Origin-Opener-Policy",
-        "value": "same-origin"
-      },
-      {
-        "name": "Cross-Origin-Resource-Policy",
-        "value": "same-origin"
-      },
-      {
-        "name": "Permissions-Policy",
-        "value": "accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),layout-animations=(self),legacy-image-formats=(self),magnetometer=(),microphone=(),midi=(),oversized-images=(self),payment=(),picture-in-picture=(),publickey-credentials-get=(),speaker-selection=(),sync-xhr=(self),unoptimized-images=(self),unsized-media=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=()"
-      },
-      {
-        "name": "Pragma",
-        "value": "no-cache"
-      },
-      {
-        "name": "Referrer-Policy",
-        "value": "no-referrer"
-      },
-      {
-        "name": "Strict-Transport-Security",
-        "value": "max-age=31536000 ; includeSubDomains"
-      },
-      {
-        "name": "X-Content-Type-Options",
-        "value": "nosniff"
-      },
-      {
-        "name": "X-Frame-Options",
-        "value": "deny"
-      },
-      {
-        "name": "X-Permitted-Cross-Domain-Policies",
-        "value": "none"
-      }
-    ]
-  }
+  "last_update_utc": "2024-09-19 21:29:28",
+  "headers": [
+    {
+      "name": "Cache-Control",
+      "value": "no-store, max-age=0"
+    },
+    {
+      "name": "Clear-Site-Data",
+      "value": "\"cache\",\"cookies\",\"storage\""
+    },
+    {
+      "name": "Content-Security-Policy",
+      "value": "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content"
+    },
+    {
+      "name": "Cross-Origin-Embedder-Policy",
+      "value": "require-corp"
+    },
+    {
+      "name": "Cross-Origin-Opener-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Cross-Origin-Resource-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Permissions-Policy",
+      "value": "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=()"
+    },
+    {
+      "name": "Referrer-Policy",
+      "value": "no-referrer"
+    },
+    {
+      "name": "Strict-Transport-Security",
+      "value": "max-age=31536000; includeSubDomains"
+    },
+    {
+      "name": "X-Content-Type-Options",
+      "value": "nosniff"
+    },
+    {
+      "name": "X-Frame-Options",
+      "value": "deny"
+    },
+    {
+      "name": "X-Permitted-Cross-Domain-Policies",
+      "value": "none"
+    }
+  ]
+}

package/test/unit/definitionGenerator.spec.js

@@ -10,6 +10,14 @@ const DefinitionGenerator = require("../../src/definitionGenerator");
 
 describe("DefinitionGenerator", () => {
   let mockServerless;
+  const logger = {
+    verbose: (str) => {
+      console.log(str);
+    },
+    warn: (str) => {
+      console.log(str);
+    },
+  };
   const v4 = new RegExp(
     /^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
   );
@@ -26,11 +34,7 @@ describe("DefinitionGenerator", () => {
 
   describe("constructor", () => {
     it("should return a definitionGenerator", function () {
-      const expected = new DefinitionGenerator(mockServerless, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      const expected = new DefinitionGenerator(mockServerless, logger);
       expect(expected).to.be.an.instanceOf(DefinitionGenerator);
     });
 
@@ -39,11 +43,10 @@ describe("DefinitionGenerator", () => {
         JSON.stringify(mockServerless)
       );
       delete serverlessWithoutOpenAPIVersion.processedInput;
-      let expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      let expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
 
       Object.assign(serverlessWithoutOpenAPIVersion, { processedInput: {} });
@@ -57,55 +60,50 @@ describe("DefinitionGenerator", () => {
       serverlessWithoutOpenAPIVersion.processedInput = {
         options: {},
       };
-      expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
 
       serverlessWithoutOpenAPIVersion.processedInput.options = {
         test: "abc",
       };
 
-      expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
 
       serverlessWithoutOpenAPIVersion.processedInput.options = {
         openApiVersion: null,
       };
 
-      expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
 
       serverlessWithoutOpenAPIVersion.processedInput.options = {
         openApiVersion: undefined,
       };
 
-      expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
 
       serverlessWithoutOpenAPIVersion.processedInput.options = {
         openapiVersion: undefined,
       };
 
-      expected = new DefinitionGenerator(serverlessWithoutOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(
+        serverlessWithoutOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.0");
     });
 
@@ -115,20 +113,15 @@ describe("DefinitionGenerator", () => {
       );
       serverlessWithOpenAPIVersion.processedInput.options.openApiVersion =
         "3.0.2";
-      let expected = new DefinitionGenerator(serverlessWithOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      let expected = new DefinitionGenerator(
+        serverlessWithOpenAPIVersion,
+        logger
+      );
       expect(expected.version).to.be.equal("3.0.2");
 
       serverlessWithOpenAPIVersion.processedInput.options.openApiVersion =
         "3.0.1";
-      expected = new DefinitionGenerator(serverlessWithOpenAPIVersion, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      expected = new DefinitionGenerator(serverlessWithOpenAPIVersion, logger);
       expect(expected.version).to.be.equal("3.0.1");
     });
 
@@ -148,11 +141,7 @@ describe("DefinitionGenerator", () => {
           throw err;
         });
 
-      const expected = new DefinitionGenerator(mockServerless, {
-        verbose: (str) => {
-          console.log(str);
-        },
-      });
+      const expected = new DefinitionGenerator(mockServerless, logger);
 
       expect(expected.REDOCLY_RULES).to.have.property(
         "operation-2xx-response",
@@ -173,7 +162,10 @@ describe("DefinitionGenerator", () => {
 
   describe("createInfo", () => {
     it("should create openAPI info object correctly", function () {
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -183,7 +175,10 @@ describe("DefinitionGenerator", () => {
 
     it("should use the service name when documentation title has not been supplied", function () {
       delete mockServerless.service.custom.documentation.title;
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -195,7 +190,10 @@ describe("DefinitionGenerator", () => {
 
     it("should use the service name when documentation description has not been supplied", function () {
       delete mockServerless.service.custom.documentation.description;
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -205,7 +203,10 @@ describe("DefinitionGenerator", () => {
 
     it("should use an empty string when documentation description has not been supplied", function () {
       delete mockServerless.service.custom.documentation.description;
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -216,7 +217,10 @@ describe("DefinitionGenerator", () => {
     it("should generate a uuid for version when documentation version has not been supplied", function () {
       delete mockServerless.service.custom.documentation.version;
 
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -230,7 +234,10 @@ describe("DefinitionGenerator", () => {
         url: "http://example.com",
         email: "john@example.com",
       };
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -245,7 +252,10 @@ describe("DefinitionGenerator", () => {
         name: "John",
         email: "john@example.com",
       };
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -263,7 +273,10 @@ describe("DefinitionGenerator", () => {
         name: "Apache 2.0",
         url: "https://www.apache.org/licenses/LICENSE-2.0.html",
       };
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -277,7 +290,10 @@ describe("DefinitionGenerator", () => {
       mockServerless.service.custom.documentation.license = {
         url: "https://www.apache.org/licenses/LICENSE-2.0.html",
       };
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -289,7 +305,10 @@ describe("DefinitionGenerator", () => {
       mockServerless.service.custom.documentation.license = {
         name: "John",
       };
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -304,7 +323,10 @@ describe("DefinitionGenerator", () => {
 
     it("should assign specification extension fields when included", function () {
       mockServerless.service.custom.documentation["x-field"] = "john";
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -315,7 +337,10 @@ describe("DefinitionGenerator", () => {
 
     it("should ignore fields that do not conform to specifiction extension", function () {
       mockServerless.service.custom.documentation.otherField = "john";
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createInfo();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -337,7 +362,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         definitionGenerator.createSecuritySchemes(
           mockServerless.service.custom.documentation.securitySchemes
         );
@@ -369,7 +397,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -387,7 +418,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -407,7 +441,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         definitionGenerator.createSecuritySchemes(
           mockServerless.service.custom.documentation.securitySchemes
         );
@@ -432,7 +469,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -450,7 +490,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         definitionGenerator.createSecuritySchemes(
           mockServerless.service.custom.documentation.securitySchemes
         );
@@ -475,7 +518,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -503,7 +549,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         definitionGenerator.createSecuritySchemes(
           mockServerless.service.custom.documentation.securitySchemes
         );
@@ -557,7 +606,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -580,7 +632,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -604,7 +659,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -630,7 +688,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -653,7 +714,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -676,7 +740,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -696,7 +763,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -717,7 +787,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -737,7 +810,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -757,7 +833,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         expect(() => {
           definitionGenerator.createSecuritySchemes(
             mockServerless.service.custom.documentation.securitySchemes
@@ -788,7 +867,10 @@ describe("DefinitionGenerator", () => {
           },
         };
 
-        const definitionGenerator = new DefinitionGenerator(mockServerless);
+        const definitionGenerator = new DefinitionGenerator(
+          mockServerless,
+          logger
+        );
         definitionGenerator.createSecuritySchemes(
           mockServerless.service.custom.documentation.securitySchemes
         );
@@ -814,7 +896,10 @@ describe("DefinitionGenerator", () => {
     it("should add tags to the openAPI object correctly", function () {
       mockServerless.service.custom.documentation.tags = [{ name: "tag1" }];
 
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       definitionGenerator.createTags();
 
       expect(definitionGenerator.openAPI).to.be.an("object");
@@ -823,10 +908,41 @@ describe("DefinitionGenerator", () => {
     });
 
     it("should not add tags when they are not defined", function () {
-      const definitionGenerator = new DefinitionGenerator(mockServerless);
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
       expect(() => {
         definitionGenerator.createTags();
       }).to.throw();
     });
   });
+
+  describe(`createResponses`, async function () {
+    it(`handles creating headers with pragma as a default`, async function () {
+      const description = "this is a description";
+      const responseMock = {
+        methodResponses: [
+          {
+            responseBody: { description: description },
+            statusCode: 200,
+            owasp: { pragma: true },
+          },
+        ],
+      };
+
+      const definitionGenerator = new DefinitionGenerator(
+        mockServerless,
+        logger
+      );
+
+      const response = await definitionGenerator.createResponses(responseMock);
+
+      expect(response).to.be.an("object");
+      expect(response).to.have.property("200");
+      expect(response["200"]).to.have.property("description", description);
+      expect(response["200"].headers).to.be.an("object");
+      expect(response["200"].headers).to.have.property("Pragma");
+    });
+  });
 });

package/test/unit/owasp.spec.js

@@ -1,113 +1,120 @@
-'use strict'
+"use strict";
 
-const expect = require('chai').expect
-const nock = require('nock')
+const expect = require("chai").expect;
+const nock = require("nock");
 
-const owasp = require('../../src/owasp')
+const owasp = require("../../src/owasp");
 
-const owaspJSON = require('../../json/owasp.json')
-const newOWASPJSON = require('../json/newOWASP.json')
+const owaspJSON = require("../../json/owasp.json");
+const newOWASPJSON = require("../json/newOWASP.json");
 
 describe(`owasp`, function () {
-    describe(`getLatest`, function () {
-        it(`populates the defaults from the included OWASP release when the online version can not be reached`, async function() {
-            nock('https://owasp.org')
-                .get('/www-project-secure-headers/ci/headers_add.json')
-                .reply(404, {})
-
-            await owasp.getLatest()
-                .catch(err => {
-                    console.error(err)
-                    expect(err).to.be.undefined
-                })
-
-            expect(owasp.DEFAULT_OWASP_HEADERS['Permissions-Policy']).to.have.property('schema')
-            const permissionsPolicyDefault = owaspJSON.headers.filter(obj => obj.name === 'Permissions-Policy')
-            expect(owasp.DEFAULT_OWASP_HEADERS['Permissions-Policy'].schema.default).to.be.equal(permissionsPolicyDefault[0].value)
-            expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
-        });
-
-        it(`populates the defaults with information from a new OWASP release`, async function() {
-            nock('https://owasp.org')
-                .get('/www-project-secure-headers/ci/headers_add.json')
-                .reply(200, newOWASPJSON)
-
-            await owasp.getLatest()
-                .catch(err => {
-                    console.error(err)
-                    expect(err).to.be.undefined
-                })
-
-            expect(owasp.DEFAULT_OWASP_HEADERS['Cross-Origin-Embedder-Policy']).to.have.property('schema')
-            const newCrossOriginEmbedderPolicy = newOWASPJSON.headers.filter(obj => obj.name === 'Cross-Origin-Embedder-Policy')
-            expect(owasp.DEFAULT_OWASP_HEADERS['Cross-Origin-Embedder-Policy'].schema.default).to.be.equal(newCrossOriginEmbedderPolicy[0].value)
-            expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
-        });
-
-        it(`does not remove any defaults not contained in a new release`, async function() {
-            const newOWASPJSONMissing = JSON.parse(JSON.stringify(newOWASPJSON))
-
-            const headers = newOWASPJSONMissing.headers.filter(obj => obj.name !== 'Pragma')
-            newOWASPJSONMissing.headers = headers
-
-            nock('https://owasp.org')
-                .get('/www-project-secure-headers/ci/headers_add.json')
-                .reply(200, newOWASPJSONMissing)
-
-            await owasp.getLatest()
-                .catch(err => {
-                    console.error(err)
-                    expect(err).to.be.undefined
-                })
-
-            expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property('Pragma')
-            expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
-        });
-
-        it(`adds any properties contained in a new release`, async function() {
-            const newOWASPJSONAdded = JSON.parse(JSON.stringify(newOWASPJSON))
-            newOWASPJSONAdded.headers.push({name: 'x-added', value: 'true'})
-
-            nock('https://owasp.org')
-                .get('/www-project-secure-headers/ci/headers_add.json')
-                .reply(200, newOWASPJSONAdded)
-
-            await owasp.getLatest()
-                .catch(err => {
-                    console.error(err)
-                    expect(err).to.be.undefined
-                })
-
-            expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property('x-added')
-            expect(owasp.DEFAULT_OWASP_HEADERS['x-added']).to.have.property('schema')
-            expect(owasp.DEFAULT_OWASP_HEADERS['x-added'].schema.default).to.be.equal('true')
-            expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(14)
-        });
+  describe(`getLatest`, function () {
+    it(`populates the defaults from the included OWASP release when the online version can not be reached`, async function () {
+      nock("https://owasp.org")
+        .get("/www-project-secure-headers/ci/headers_add.json")
+        .reply(404, {});
+
+      await owasp.getLatest().catch((err) => {
+        console.error(err);
+        expect(err).to.be.undefined;
+      });
+
+      expect(
+        owasp.DEFAULT_OWASP_HEADERS["Permissions-Policy"]
+      ).to.have.property("schema");
+      const permissionsPolicyDefault = owaspJSON.headers.filter(
+        (obj) => obj.name === "Permissions-Policy"
+      );
+      expect(
+        owasp.DEFAULT_OWASP_HEADERS["Permissions-Policy"].schema.default
+      ).to.be.equal(permissionsPolicyDefault[0].value);
+      expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(12);
     });
 
-    describe(`getHeaders`, function () {
-        it(`brings back default headers from a list`, function() {
-            const headerOptions = {cacheControl: true, xFrameOptions: true}
-            const headers = owasp.getHeaders(headerOptions)
+    it(`populates the defaults with information from a new OWASP release`, async function () {
+      nock("https://owasp.org")
+        .get("/www-project-secure-headers/ci/headers_add.json")
+        .reply(200, newOWASPJSON);
+
+      await owasp.getLatest().catch((err) => {
+        console.error(err);
+        expect(err).to.be.undefined;
+      });
+
+      expect(
+        owasp.DEFAULT_OWASP_HEADERS["Cross-Origin-Embedder-Policy"]
+      ).to.have.property("schema");
+      const newCrossOriginEmbedderPolicy = newOWASPJSON.headers.filter(
+        (obj) => obj.name === "Cross-Origin-Embedder-Policy"
+      );
+      expect(
+        owasp.DEFAULT_OWASP_HEADERS["Cross-Origin-Embedder-Policy"].schema
+          .default
+      ).to.be.equal(newCrossOriginEmbedderPolicy[0].value);
+      expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(12);
+    });
+
+    it(`adds any properties contained in a new release`, async function () {
+      const newOWASPJSONAdded = JSON.parse(JSON.stringify(newOWASPJSON));
+      newOWASPJSONAdded.headers.push({ name: "x-added", value: "true" });
+
+      nock("https://owasp.org")
+        .get("/www-project-secure-headers/ci/headers_add.json")
+        .reply(200, newOWASPJSONAdded);
+
+      await owasp.getLatest().catch((err) => {
+        console.error(err);
+        expect(err).to.be.undefined;
+      });
+
+      expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property("x-added");
+      expect(owasp.DEFAULT_OWASP_HEADERS["x-added"]).to.have.property("schema");
+      expect(owasp.DEFAULT_OWASP_HEADERS["x-added"].schema.default).to.be.equal(
+        "true"
+      );
+      expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13);
+    });
+  });
+
+  describe(`getHeaders`, function () {
+    it(`brings back default headers from a list`, function () {
+      const headerOptions = { cacheControl: true, xFrameOptions: true };
+      const headers = owasp.getHeaders(headerOptions);
+
+      expect(Object.keys(headers).length).to.be.equal(2);
+    });
+
+    it(`brings back default headers from a list with new schema defaults when values are provided`, function () {
+      const headerOptions = {
+        referrerPolicy: {
+          value: "true",
+        },
+        crossOriginOpenerPolicy: {
+          value: "strict",
+        },
+      };
+
+      const headers = owasp.getHeaders(headerOptions);
 
-            expect(Object.keys(headers).length).to.be.equal(2)
-        });
+      expect(Object.keys(headers).length).to.be.equal(2);
+
+      expect(headers["Cross-Origin-Opener-Policy"].schema.default === "strict");
+    });
 
-        it(`brings back default headers from a list with new schema defaults when values are provided`, function() {
-            const headerOptions = {
-                referrerPolicy: {
-                    value: 'true'
-                },
-                crossOriginOpenerPolicy: {
-                    value: 'strict'
-                }
-            }
+    it(`handles pragma being deprecated`, function () {
+      const headerOptions = {
+        pragma: {
+          value: "true",
+        },
+      };
 
-            const headers = owasp.getHeaders(headerOptions)
+      const headers = owasp.getHeaders(headerOptions);
 
-            expect(Object.keys(headers).length).to.be.equal(2)
+      expect(Object.keys(headers).length).to.be.equal(1);
 
-            expect(headers['Cross-Origin-Opener-Policy'].schema.default === 'strict')
-        });
+      expect(headers["Pragma"]).to.have.property("schema");
+      expect(headers["Pragma"].schema).to.have.property("default", "true");
     });
+  });
 });