Class: ContentSecurityPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/content-security-policy.rb,
lib/content-security-policy/errors.rb,
lib/content-security-policy/version.rb,
lib/content-security-policy/middleware.rb

Defined Under Namespace

Classes: IncorrectDirectivesError, NoDirectivesError

Constant Summary collapse

VERSION = 
'0.1.3'

Class Attribute Summary collapse

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(app, options = {}) ⇒ ContentSecurityPolicy

Initializes Content Security Policy middleware.

Examples:

use ContentSecurityPolicy, :directives => { 'default-src' => "'self'" }
use ContentSecurityPolicy, :directives => { 'default-src' => "'self'" }, :report_only => true

Options Hash (options):

  • :report_only (Boolean) —

    Set to true if use in report-only mode

  • :directives (Hash) —

    Directives hash

Parameters:

  • (defaults to: {})

    Options hash



20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/content-security-policy/middleware.rb', line 20

def initialize(app, options = {})
  @app = app
  @report_only = options[:report_only] || ContentSecurityPolicy.report_only
  @directives  = options[:directives]  || ContentSecurityPolicy.directives

  @directives or raise NoDirectivesError, 'No directives were passed.'

  # make sure directives with policy-uri don't contain any other directives
  if @directives['policy-uri'] && @directives.keys.length > 1
    raise IncorrectDirectivesError, 'You passed both policy-uri and other directives.'
  end
end

Class Attribute Details

.directives ⇒ Object (readonly) 



12
13
14
 
# File 'lib/content-security-policy.rb', line 12

def directives
  @directives
end

.report_only ⇒ Object 



9
10
11
 
# File 'lib/content-security-policy.rb', line 9

def report_only
  @report_only
end

Instance Attribute Details

#directives ⇒ Object (readonly) 



7
8
9
 
# File 'lib/content-security-policy/middleware.rb', line 7

def directives
  @directives
end

#report_only ⇒ Object (readonly) 



4
5
6
 
# File 'lib/content-security-policy/middleware.rb', line 4

def report_only
  @report_only
end

Class Method Details

.[]=(name, value) ⇒ Object

Sets directive.

Parameters:

  • Directive name

  • Directive value



40
41
42
 
# File 'lib/content-security-policy.rb', line 40

def []=(name, value)
  @directives[name] = value
end

.configure {|ContentSecurityPolicy| ... } ⇒ Object

Configures Content Security Policy directives.

Note that default-src directive should always be set.

Examples:

ContentSecurityPolicy.configure do |csp|
  csp.report_only = true
  csp['default-src'] = "'self'"
  csp['script-src']  = '*.example.com'
end
use ContentSecurityPolicy

Yields:



29
30
31
32
 
# File 'lib/content-security-policy.rb', line 29

def configure(&blk)
  @directives ||= {}
  blk.call(self)
end

Instance Method Details

#_call(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

API:

  • private



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/content-security-policy/middleware.rb', line 43

def _call(env)
  status, headers, response = @app.call(env)

  # flatten directives
  directives = @directives.sort.map { |dir| "#{dir[0]} #{dir[1]}" }.join('; ')

  # prepare response headers names
  if @report_only
    resp_headers = %w(
      Content-Security-Policy-Report-Only
      X-Content-Security-Policy-Report-Only
      X-WebKit-CSP-Report-Only
    )
  else
    resp_headers = %w(
      Content-Security-Policy
      X-Content-Security-Policy
      X-WebKit-CSP
    )
  end

  # append response header
  resp_headers.each do |resp_header|
    headers[resp_header] = directives
  end

  [status, headers, response]
end

#call(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

API:

  • private



36
37
38
 
# File 'lib/content-security-policy/middleware.rb', line 36

def call(env)
  dup._call(env)
end