|
3 | 3 | require 'securerandom' |
4 | 4 | require 'user_agent_parser' |
5 | 5 | require 'json' |
6 | | -require 'pry' |
7 | 6 |
|
8 | 7 | module SecureHeaders |
9 | 8 | class ContentSecurityPolicyBuildError < StandardError; end |
@@ -68,7 +67,6 @@ module Constants |
68 | 67 | ).freeze |
69 | 68 |
|
70 | 69 | ALL_DIRECTIVES = [DIRECTIVES_1_0 + DIRECTIVES_2_0 + DIRECTIVES_3_0 + DIRECTIVES_DRAFT].flatten.sort.uniq |
71 | | - ALL_CONFIGS = [:enforce, :app_name, :script_hash_middleware] + ALL_DIRECTIVES |
72 | 70 | CONFIG_KEY = :csp |
73 | 71 | end |
74 | 72 |
|
@@ -136,26 +134,26 @@ def initialize(config=nil, options={}) |
136 | 134 | @ssl_request = !!options.delete(:ssl) |
137 | 135 | @request_uri = options.delete(:request_uri) |
138 | 136 | @http_additions = config.delete(:http_additions) |
| 137 | + @disable_img_src_data_uri = !!config.delete(:disable_img_src_data_uri) |
| 138 | + @tag_report_uri = !!config.delete(:tag_report_uri) |
| 139 | + @script_hashes = config.delete(:script_hashes) || [] |
139 | 140 | @app_name = config.delete(:app_name) |
140 | 141 | @app_name = @app_name.call(@controller) if @app_name.respond_to?(:call) |
141 | 142 | @enforce = config.delete(:enforce) |
142 | 143 | @enforce = @enforce.call(@controller) if @enforce.respond_to?(:call) |
143 | 144 | @enforce = !!@enforce |
144 | | - @disable_img_src_data_uri = !!config.delete(:disable_img_src_data_uri) |
145 | | - @tag_report_uri = !!config.delete(:tag_report_uri) |
146 | | - @script_hashes = config.delete(:script_hashes) || [] |
147 | 145 |
|
148 | 146 | # Config values can be string, array, or lamdba values |
149 | 147 | @config = config.inject({}) do |hash, (key, value)| |
150 | 148 | config_val = value.respond_to?(:call) ? value.call(@controller) : value |
151 | | - if ContentSecurityPolicy::ALL_CONFIGS.include?(key.to_sym) # directives need to be normalized to arrays of strings |
| 149 | + if ALL_DIRECTIVES.include?(key.to_sym) # directives need to be normalized to arrays of strings |
152 | 150 | config_val = config_val.split if config_val.is_a? String |
153 | 151 | if config_val.is_a?(Array) |
154 | 152 | config_val = config_val.map do |val| |
155 | 153 | translate_dir_value(val) |
156 | 154 | end.flatten.uniq |
157 | 155 | end |
158 | | - else |
| 156 | + elsif key != :script_hash_middleware |
159 | 157 | raise ArgumentError.new("Unknown directive supplied: #{key}") |
160 | 158 | end |
161 | 159 |
|
@@ -219,7 +217,9 @@ def value |
219 | 217 | def to_json |
220 | 218 | build_value |
221 | 219 | @config.inject({}) do |hash, (key, value)| |
222 | | - hash[key.to_s.gsub(/(\w+)_(\w+)/, "\\1-\\2")] = value |
| 220 | + if ALL_DIRECTIVES.include?(key) |
| 221 | + hash[key.to_s.gsub(/(\w+)_(\w+)/, "\\1-\\2")] = value |
| 222 | + end |
223 | 223 | hash |
224 | 224 | end.to_json |
225 | 225 | end |
|
0 commit comments