Class: SecureHeaders::ContentSecurityPolicy

Inherits:
Object
  • Object
show all
Includes:
PolicyManagement
Defined in:
lib/secure_headers/headers/content_security_policy.rb

Constant Summary collapse

VERSION_46 =

constants to be used for version-specific UA sniffing

::UserAgent::Version.new("46")

Constants included from PolicyManagement

PolicyManagement::ALL_DIRECTIVES, PolicyManagement::BASE_URI, PolicyManagement::BLOB_PROTOCOL, PolicyManagement::BLOCK_ALL_MIXED_CONTENT, PolicyManagement::BODY_DIRECTIVES, PolicyManagement::CHILD_SRC, PolicyManagement::CHROME_DIRECTIVES, PolicyManagement::CONFIG_KEY, PolicyManagement::CONNECT_SRC, PolicyManagement::DATA_PROTOCOL, PolicyManagement::DEFAULT_CONFIG, PolicyManagement::DEFAULT_SRC, PolicyManagement::DEFAULT_VALUE, PolicyManagement::DEPRECATED_SOURCE_VALUES, PolicyManagement::DIRECTIVES_1_0, PolicyManagement::DIRECTIVES_2_0, PolicyManagement::DIRECTIVES_3_0, PolicyManagement::DIRECTIVES_DRAFT, PolicyManagement::DIRECTIVE_VALUE_TYPES, PolicyManagement::EDGE_DIRECTIVES, PolicyManagement::FETCH_SOURCES, PolicyManagement::FIREFOX_46_DEPRECATED_DIRECTIVES, PolicyManagement::FIREFOX_46_DIRECTIVES, PolicyManagement::FIREFOX_46_UNSUPPORTED_DIRECTIVES, PolicyManagement::FIREFOX_DIRECTIVES, PolicyManagement::FIREFOX_UNSUPPORTED_DIRECTIVES, PolicyManagement::FONT_SRC, PolicyManagement::FORM_ACTION, PolicyManagement::FRAME_ANCESTORS, PolicyManagement::FRAME_SRC, PolicyManagement::HEADER_NAME, PolicyManagement::HEADER_NAMES, PolicyManagement::HTTP_SCHEME_REGEX, PolicyManagement::IMG_SRC, PolicyManagement::MANIFEST_SRC, PolicyManagement::MEDIA_SRC, PolicyManagement::META_CONFIGS, PolicyManagement::MODERN_BROWSERS, PolicyManagement::NONE, PolicyManagement::NON_FETCH_SOURCES, PolicyManagement::OBJECT_SRC, PolicyManagement::OTHER, PolicyManagement::PLUGIN_TYPES, PolicyManagement::REFLECTED_XSS, PolicyManagement::REPORT_ONLY, PolicyManagement::REPORT_URI, PolicyManagement::SAFARI_DIRECTIVES, PolicyManagement::SANDBOX, PolicyManagement::SCRIPT_SRC, PolicyManagement::SELF, PolicyManagement::STAR, PolicyManagement::STAR_REGEXP, PolicyManagement::STYLE_SRC, PolicyManagement::UNSAFE_EVAL, PolicyManagement::UNSAFE_INLINE, PolicyManagement::UPGRADE_INSECURE_REQUESTS, PolicyManagement::VARIATIONS, PolicyManagement::WILDCARD_SOURCES

Instance Method Summary collapse

Methods included from PolicyManagement

included

Constructor Details

#initialize(config = nil, user_agent = OTHER) ⇒ ContentSecurityPolicy

Returns a new instance of ContentSecurityPolicy.



12
13
14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 12

def initialize(config = nil, user_agent = OTHER)
  @config = Configuration.send(:deep_copy, config || DEFAULT_CONFIG)
  @parsed_ua = if user_agent.is_a?(UserAgent::Browsers::Base)
    user_agent
  else
    UserAgent.parse(user_agent)
  end
  normalize_child_frame_src
  @report_only = @config[:report_only]
  @preserve_schemes = @config[:preserve_schemes]
  @script_nonce = @config[:script_nonce]
  @style_nonce = @config[:style_nonce]
end

Instance Method Details

#name ⇒ Object

Returns the name to use for the header. Either "Content-Security-Policy" or "Content-Security-Policy-Report-Only"



29
30
31
32
33
34
35
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 29

def name
  if @report_only
    REPORT_ONLY
  else
    HEADER_NAME
  end
end

#value ⇒ Object

Return the value of the CSP header



39
40
41
42
43
44
45
 
# File 'lib/secure_headers/headers/content_security_policy.rb', line 39

def value
  @value ||= if @config
    build_value
  else
    DEFAULT_VALUE
  end
end