Class: SecureHeaders::ContentSecurityPolicy

Inherits:
Header
  • Object
show all
Includes:
Constants
Defined in:
lib/secure_headers/headers/content_security_policy.rb,
lib/secure_headers/headers/content_security_policy/script_hash_middleware.rb

Defined Under Namespace

Modules: Constants Classes: ScriptHashMiddleware

Constant Summary

Constants included from Constants

Constants::ALL_DIRECTIVES, Constants::DEFAULT_CSP_HEADER, Constants::DIRECTIVES, Constants::ENV_KEY, Constants::HEADER_NAME, Constants::NON_DEFAULT_SOURCES, Constants::OTHER, Constants::SOURCE_DIRECTIVES

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(config = nil, options = {}) ⇒ ContentSecurityPolicy

options param contains :controller used for setting instance variables for nonces/hashes :ssl_request used to determine if http_additions should be used :ua the user agent (or just use Firefox/Chrome/MSIE/etc)

:report used to determine what :ssl_request, :ua, and :request_uri are set to



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 95

def initialize(config=nil, options={})
  return unless config

  if options[:request]
    options = options.merge(self.class.options_from_request(options[:request]))
  end

  @controller = options[:controller]
  @ua = options[:ua]
  @ssl_request = !!options.delete(:ssl)
  @request_uri = options.delete(:request_uri)

  # Config values can be string, array, or lamdba values
  @config = config.inject({}) do |hash, (key, value)|
    config_val = value.respond_to?(:call) ? value.call : value

    if SOURCE_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
      config_val = config_val.split if config_val.is_a? String
      if config_val.is_a?(Array)
        config_val = config_val.map do |val|
          translate_dir_value(val)
        end.flatten.uniq
      end
    end

    hash[key] = config_val
    hash
  end

  @http_additions = @config.delete(:http_additions)
  @app_name = @config.delete(:app_name)
  @report_uri = @config.delete(:report_uri)

  @disable_fill_missing = !!@config.delete(:disable_fill_missing)
  @enforce = !!@config.delete(:enforce)
  @tag_report_uri = !!@config.delete(:tag_report_uri)
  @script_hashes = @config.delete(:script_hashes) || []

  add_script_hashes if @script_hashes.any?
  fill_directives unless disable_fill_missing?
end

Instance Attribute Details

#disable_fill_missing ⇒ Object (readonly) Also known as: disable_fill_missing?

Returns the value of attribute disable_fill_missing.



44
45
46
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 44

def disable_fill_missing
  @disable_fill_missing
end

#ssl_request ⇒ Object (readonly) Also known as: ssl_request?

Returns the value of attribute ssl_request.



44
45
46
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 44

def ssl_request
  @ssl_request
end

Class Method Details

.add_to_env(request, controller, config) ⇒ Object 



57
58
59
60
61
62
63
64
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 57

def add_to_env(request, controller, config)
  set_nonce(controller)
  options = options_from_request(request).merge(:controller => controller)
  request.env[Constants::ENV_KEY] = {
    :config => config,
    :options => options,
  }
end

.generate_nonce ⇒ Object 



49
50
51
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 49

def generate_nonce
  SecureRandom.base64(32).chomp
end

.options_from_request(request) ⇒ Object 



66
67
68
69
70
71
72
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 66

def options_from_request(request)
  {
    :ssl => request.ssl?,
    :ua => request.env['HTTP_USER_AGENT'],
    :request_uri => request_uri_from_request(request),
  }
end

.request_uri_from_request(request) ⇒ Object 



74
75
76
77
78
79
80
81
82
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 74

def request_uri_from_request(request)
  if request.respond_to?(:original_url)
    # rails 3.1+
    request.original_url
  else
    # rails 2/3.0
    request.url
  end
end

.set_nonce(controller, nonce = generate_nonce) ⇒ Object 



53
54
55
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 53

def set_nonce(controller, nonce = generate_nonce)
  controller.instance_variable_set(:@content_security_policy_nonce, nonce)
end

.symbol_to_hyphen_case(sym) ⇒ Object 



84
85
86
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 84

def symbol_to_hyphen_case sym
  sym.to_s.gsub('_', '-')
end

Instance Method Details

#name ⇒ Object

Returns the name to use for the header. Either "Content-Security-Policy" or "Content-Security-Policy-Report-Only"



148
149
150
151
152
153
154
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 148

def name
  base = HEADER_NAME
  if !@enforce
    base += "-Report-Only"
  end
  base
end

#nonce ⇒ Object

Return or initialize the nonce value used for this header. If a reference to a controller is passed in the config, this method will check if a nonce has already been set and use it.



141
142
143
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 141

def nonce
  @nonce ||= @controller.instance_variable_get(:@content_security_policy_nonce) || self.class.generate_nonce
end

#value ⇒ Object

Return the value of the CSP header



158
159
160
161
162
163
164
165
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 158

def value
  return @config if @config.is_a?(String)
  if @config
    build_value
  else
    DEFAULT_CSP_HEADER
  end
end