Class: ContentSecurityPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/content-security-policy.rb,
lib/content-security-policy/errors.rb,
lib/content-security-policy/version.rb,
lib/content-security-policy/middleware.rb

Defined Under Namespace

Classes: IncorrectDirectivesError, NoDirectivesError

Constant Summary collapse

VERSION = 
'0.1.3'

Class Attribute Summary collapse

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(app, options = {}) ⇒ ContentSecurityPolicy

Initializes Content Security Policy middleware.

Examples:

use ContentSecurityPolicy, :directives => { 'default-src' => "'self'" }
use ContentSecurityPolicy, :directives => { 'default-src' => "'self'" }, :report_only => true

Parameters:

  • options (Hash) (defaults to: {}) —

    Options hash

Options Hash (options):

  • :report_only (Boolean) —

    Set to true if use in report-only mode

  • :directives (Hash) —

    Directives hash



20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/content-security-policy/middleware.rb', line 20

def initialize(app, options = {})
  @app = app
  @report_only = options[:report_only] || ContentSecurityPolicy.report_only
  @directives  = options[:directives]  || ContentSecurityPolicy.directives

  @directives or raise NoDirectivesError, 'No directives were passed.'

  # make sure directives with policy-uri don't contain any other directives
  if @directives['policy-uri'] && @directives.keys.length > 1
    raise IncorrectDirectivesError, 'You passed both policy-uri and other directives.'
  end
end

Class Attribute Details

.directives ⇒ Object (readonly) 



12
13
14
 
# File 'lib/content-security-policy.rb', line 12

def directives
  @directives
end

.report_only ⇒ Object 



9
10
11
 
# File 'lib/content-security-policy.rb', line 9

def report_only
  @report_only
end

Instance Attribute Details

#directives ⇒ Object (readonly) 



7
8
9
 
# File 'lib/content-security-policy/middleware.rb', line 7

def directives
  @directives
end

#report_only ⇒ Object (readonly) 



4
5
6
 
# File 'lib/content-security-policy/middleware.rb', line 4

def report_only
  @report_only
end

Class Method Details

.[]=(name, value) ⇒ Object

Sets directive.

Parameters:

  • name (String) —

    Directive name

  • value (String) —

    Directive value



40
41
42
 
# File 'lib/content-security-policy.rb', line 40

def []=(name, value)
  @directives[name] = value
end

.configure {|ContentSecurityPolicy| ... } ⇒ Object

Configures Content Security Policy directives.

Note that default-src directive should always be set.

Examples:

ContentSecurityPolicy.configure do |csp|
  csp.report_only = true
  csp['default-src'] = "'self'"
  csp['script-src']  = '*.example.com'
end
use ContentSecurityPolicy

Yields:



29
30
31
32
 
# File 'lib/content-security-policy.rb', line 29

def configure(&blk)
  @directives ||= {}
  blk.call(self)
end

Instance Method Details

#_call(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/content-security-policy/middleware.rb', line 43

def _call(env)
  status, headers, response = @app.call(env)

  # flatten directives
  directives = @directives.sort.map { |dir| "#{dir[0]} #{dir[1]}" }.join('; ')

  # prepare response headers names
  if @report_only
    resp_headers = %w(
      Content-Security-Policy-Report-Only
      X-Content-Security-Policy-Report-Only
      X-WebKit-CSP-Report-Only
    )
  else
    resp_headers = %w(
      Content-Security-Policy
      X-Content-Security-Policy
      X-WebKit-CSP
    )
  end

  # append response header
  resp_headers.each do |resp_header|
    headers[resp_header] = directives
  end

  [status, headers, response]
end

#call(env) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



36
37
38
 
# File 'lib/content-security-policy/middleware.rb', line 36

def call(env)
  dup._call(env)
end