Module: SecureHeaders::ViewHelpers

Includes:
HashHelper
Defined in:
lib/secure_headers/view_helper.rb

Defined Under Namespace

Classes: UnexpectedHashedScriptException

Constant Summary collapse

SECURE_HEADERS_RAKE_TASK = 
"rake secure_headers:generate_hashes"

Instance Method Summary collapse

Methods included from HashHelper

#hash_source

Instance Method Details

#content_security_policy_nonce(type) ⇒ Object

Public: use the content security policy nonce for this request directly. Instructs secure_headers to append a nonce to style/script-src directives.

Returns a non-html-safe nonce value.



53
54
55
56
57
58
59
60
 
# File 'lib/secure_headers/view_helper.rb', line 53

def content_security_policy_nonce(type)
  case type
  when :script
    SecureHeaders.content_security_policy_script_nonce(@_request)
  when :style
    SecureHeaders.content_security_policy_style_nonce(@_request)
  end
end

#content_security_policy_script_nonce ⇒ Object 



62
63
64
 
# File 'lib/secure_headers/view_helper.rb', line 62

def content_security_policy_script_nonce
  content_security_policy_nonce(:script)
end

#content_security_policy_style_nonce ⇒ Object 



66
67
68
 
# File 'lib/secure_headers/view_helper.rb', line 66

def content_security_policy_style_nonce
  content_security_policy_nonce(:style)
end

#hashed_javascript_tag(raise_error_on_unrecognized_hash = nil, &block) ⇒ Object

Checks to see if the hashed code is expected and adds the hash source value to the current CSP.

By default, in development/test/etc. an exception will be raised.



75
76
77
78
79
80
81
82
83
 
# File 'lib/secure_headers/view_helper.rb', line 75

def hashed_javascript_tag(raise_error_on_unrecognized_hash = nil, &block)
  hashed_tag(
    :script,
    :script_src,
    Configuration.instance_variable_get(:@script_hashes),
    raise_error_on_unrecognized_hash,
    block
  )
end

#hashed_style_tag(raise_error_on_unrecognized_hash = nil, &block) ⇒ Object 



85
86
87
88
89
90
91
92
93
 
# File 'lib/secure_headers/view_helper.rb', line 85

def hashed_style_tag(raise_error_on_unrecognized_hash = nil, &block)
  hashed_tag(
    :style,
    :style_src,
    Configuration.instance_variable_get(:@style_hashes),
    raise_error_on_unrecognized_hash,
    block
  )
end

#nonced_javascript_include_tag(*args, &block) ⇒ Object

Public: create a script src tag using the content security policy nonce. Instructs secure_headers to append a nonce to script-src directive.

Returns an html-safe script tag with the nonce attribute.



37
38
39
 
# File 'lib/secure_headers/view_helper.rb', line 37

def nonced_javascript_include_tag(*args, &block)
  javascript_include_tag(*args, nonce: content_security_policy_nonce(:script), &block)
end

#nonced_javascript_pack_tag(*args, &block) ⇒ Object

Public: create a script Webpacker pack tag using the content security policy nonce. Instructs secure_headers to append a nonce to script-src directive.

Returns an html-safe script tag with the nonce attribute.



45
46
47
 
# File 'lib/secure_headers/view_helper.rb', line 45

def nonced_javascript_pack_tag(*args, &block)
  javascript_pack_tag(*args, nonce: content_security_policy_nonce(:script), &block)
end

#nonced_javascript_tag(content_or_options = {}, &block) ⇒ Object

Public: create a script tag using the content security policy nonce. Instructs secure_headers to append a nonce to script-src directive.

Returns an html-safe script tag with the nonce attribute.



29
30
31
 
# File 'lib/secure_headers/view_helper.rb', line 29

def nonced_javascript_tag(content_or_options = {}, &block)
  nonced_tag(:script, content_or_options, block)
end

#nonced_style_tag(content_or_options = {}, &block) ⇒ Object

Public: create a style tag using the content security policy nonce. Instructs secure_headers to append a nonce to style-src directive.

Returns an html-safe style tag with the nonce attribute.



13
14
15
 
# File 'lib/secure_headers/view_helper.rb', line 13

def nonced_style_tag(content_or_options = {}, &block)
  nonced_tag(:style, content_or_options, block)
end

#nonced_stylesheet_link_tag(*args, &block) ⇒ Object

Public: create a stylesheet link tag using the content security policy nonce. Instructs secure_headers to append a nonce to style-src directive.

Returns an html-safe link tag with the nonce attribute.



21
22
23
 
# File 'lib/secure_headers/view_helper.rb', line 21

def nonced_stylesheet_link_tag(*args, &block)
  stylesheet_link_tag(*args, nonce: content_security_policy_nonce(:style), &block)
end