Add a class level dup method

Author: ptoomey3

lib/secure_headers/configuration.rb

@@ -62,6 +62,10 @@ def named_append(name, &block)
         @appends[name] = block
       end
 
+      def dup
+        default_config.dup
+      end
+
       private
 
       # Public: perform a basic deep dup. The shallow copy provided by dup/clone

spec/lib/secure_headers/configuration_spec.rb

@@ -16,6 +16,16 @@ module SecureHeaders
       expect(Configuration.overrides(Configuration::NOOP_OVERRIDE)).to_not be_nil
     end
 
+    it "dup results in a copy of the default config" do
+      Configuration.default
+      original_configuration = Configuration.send(:default_config)
+      configuration = Configuration.dup
+      expect(original_configuration).not_to be(configuration)
+      Configuration::CONFIG_ATTRIBUTES.each do |attr|
+        expect(original_configuration.send(attr)).to eq(configuration.send(attr))
+      end
+    end
+
     it "stores an override" do
       Configuration.override(:test_override) do |config|
         config.x_frame_options = "DENY"
@@ -41,7 +51,7 @@ module SecureHeaders
         config.cookies = OPT_OUT
       end
 
-      config = Configuration.send(:default_config)
+      config = Configuration.dup
       expect(config.cookies).to eq(OPT_OUT)
     end
 
@@ -50,7 +60,7 @@ module SecureHeaders
         config.cookies = {httponly: true, secure: true, samesite: {lax: false}}
       end
 
-      config = Configuration.send(:default_config)
+      config = Configuration.dup
       expect(config.cookies).to eq({httponly: true, secure: true, samesite: {lax: false}})
     end
   end

spec/lib/secure_headers/headers/policy_management_spec.rb

@@ -172,7 +172,7 @@ module SecureHeaders
             script_src: %w('self'),
           }
         end
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         combined_config = ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, style_src: %w(anothercdn.com))
         csp = ContentSecurityPolicy.new(combined_config)
         expect(csp.name).to eq(ContentSecurityPolicyConfig::HEADER_NAME)
@@ -188,7 +188,7 @@ module SecureHeaders
           }.freeze
         end
         report_uri = "https://report-uri.io/asdf"
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         combined_config = ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, report_uri: [report_uri])
         csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
         expect(csp.value).to include("report-uri #{report_uri}")
@@ -205,7 +205,7 @@ module SecureHeaders
         non_default_source_additions = ContentSecurityPolicy::NON_FETCH_SOURCES.each_with_object({}) do |directive, hash|
           hash[directive] = %w("http://example.org)
         end
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         combined_config = ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, non_default_source_additions)
 
         ContentSecurityPolicy::NON_FETCH_SOURCES.each do |directive|
@@ -221,7 +221,7 @@ module SecureHeaders
             report_only: false
           }
         end
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         combined_config = ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, report_only: true)
         csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
         expect(csp.name).to eq(ContentSecurityPolicyReportOnlyConfig::HEADER_NAME)
@@ -235,7 +235,7 @@ module SecureHeaders
             block_all_mixed_content: false
           }
         end
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         combined_config = ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, block_all_mixed_content: true)
         csp = ContentSecurityPolicy.new(combined_config)
         expect(csp.value).to eq("default-src https:; block-all-mixed-content; script-src 'self'")
@@ -245,7 +245,7 @@ module SecureHeaders
         Configuration.default do |config|
           config.csp = OPT_OUT
         end
-        default_policy = Configuration.send(:default_config)
+        default_policy = Configuration.dup
         expect do
           ContentSecurityPolicy.combine_policies(default_policy.csp.to_h, script_src: %w(anothercdn.com))
         end.to raise_error(ContentSecurityPolicyConfigError)