Class: SecureHeaders::ContentSecurityPolicy::BrowserStrategy

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Defined in:
lib/secure_headers/headers/content_security_policy/browser_strategy.rb

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(content_security_policy) ⇒ BrowserStrategy

Returns a new instance of BrowserStrategy.



27
28
29
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 27

def initialize(content_security_policy)
  @content_security_policy = content_security_policy
end

Class Method Details

.build(content_security_policy) ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 10

def self.build(content_security_policy)
  browser = content_security_policy.browser
  klass = if browser.ie?
    IeBrowserStrategy
  elsif browser.firefox?
    if browser.version.to_i >= 23
      StandardBrowserStrategy
    else
      FirefoxBrowserStrategy
    end
  else
    StandardBrowserStrategy
  end

  klass.new content_security_policy
end

Instance Method Details

#add_missing_extension_values ⇒ Object 



73
74
75
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 73

def add_missing_extension_values
  # noop except for chrome for now
end

#base_name ⇒ Object 



31
32
33
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 31

def base_name
  SecureHeaders::ContentSecurityPolicy::STANDARD_HEADER_NAME
end

#build_impl_specific_directives(default) ⇒ Object 



61
62
63
64
65
66
67
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 61

def build_impl_specific_directives(default)
  if default.any?
    "default-src #{default.join(" ")}; "
  else
    ""
  end
end

#csp_header ⇒ Object 



43
44
45
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 43

def csp_header
  SecureHeaders::ContentSecurityPolicy::WEBKIT_CSP_HEADER
end

#directives ⇒ Object 



47
48
49
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 47

def directives
  SecureHeaders::ContentSecurityPolicy::WEBKIT_DIRECTIVES
end

#filter_unsupported_directives(config) ⇒ Object 



51
52
53
54
55
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 51

def filter_unsupported_directives(config)
  config = config.dup
  config.delete(:frame_ancestors)
  config
end

#name ⇒ Object 



35
36
37
38
39
40
41
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 35

def name
  base = base_name
  if !enforce || experimental
    base += "-Report-Only"
  end
  base
end

#normalize_reporting_endpoint? ⇒ Boolean

Returns:

  • (Boolean) 


69
70
71
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 69

def normalize_reporting_endpoint?
  # noop except for Firefox for now
end

#translate_inline_or_eval(val) ⇒ Object 



57
58
59
 
# File 'lib/secure_headers/headers/content_security_policy/browser_strategy.rb', line 57

def translate_inline_or_eval val
  val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
end