Skip to content

Commit 9fca5a9

Browse files
KyFaStKyFaSt
committed
alphabetize and rubocop lint
1 parent 7270ba0 commit 9fca5a9

File tree

5 files changed

+34
-36
lines changed

5 files changed

+34
-36
lines changed

‎lib/secure_headers.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ def raise_on_unknown_target(target)
209209

210210
def config_and_target(request, target)
211211
config = config_for(request)
212-
target = guess_target(config) unless target
212+
target ||= guess_target(config)
213213
raise_on_unknown_target(target)
214214
[config, target]
215215
end

‎lib/secure_headers/headers/policy_management.rb‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -131,11 +131,11 @@ def self.included(base)
131131
NAVIGATE_TO => :source_list,
132132
OBJECT_SRC => :source_list,
133133
PLUGIN_TYPES => :media_type_list,
134+
PREFETCH_SRC => :source_list,
135+
REPORT_TO => :report_to_endpoint,
136+
REPORT_URI => :source_list,
134137
REQUIRE_SRI_FOR => :require_sri_for_list,
135138
REQUIRE_TRUSTED_TYPES_FOR => :require_trusted_types_for_list,
136-
REPORT_URI => :source_list,
137-
REPORT_TO => :report_to_endpoint,
138-
PREFETCH_SRC => :source_list,
139139
SANDBOX => :sandbox_list,
140140
SCRIPT_SRC => :source_list,
141141
SCRIPT_SRC_ELEM => :source_list,
@@ -161,8 +161,8 @@ def self.included(base)
161161
FORM_ACTION,
162162
FRAME_ANCESTORS,
163163
NAVIGATE_TO,
164-
REPORT_URI,
165164
REPORT_TO,
165+
REPORT_URI,
166166
]
167167

168168
FETCH_SOURCES = ALL_DIRECTIVES - NON_FETCH_SOURCES - NON_SOURCE_LIST_SOURCES

‎spec/lib/secure_headers/headers/content_security_policy_spec.rb‎

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
module SecureHeaders
55
describe ContentSecurityPolicy do
6-
let (:default_opts) do
6+
let(:default_opts) do
77
{
88
default_src: %w(https:),
99
img_src: %w(https: data:),
@@ -167,75 +167,74 @@ module SecureHeaders
167167
end
168168

169169
it "supports strict-dynamic" do
170-
csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456})
170+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456 })
171171
expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456' 'unsafe-inline'")
172172
end
173173

174174
it "supports strict-dynamic and opting out of the appended 'unsafe-inline'" do
175-
csp = ContentSecurityPolicy.new({default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456, disable_nonce_backwards_compatibility: true })
175+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), script_src: [ContentSecurityPolicy::STRICT_DYNAMIC], script_nonce: 123456, disable_nonce_backwards_compatibility: true })
176176
expect(csp.value).to eq("default-src 'self'; script-src 'strict-dynamic' 'nonce-123456'")
177177
end
178178

179179
it "supports script-src-elem directive" do
180-
csp = ContentSecurityPolicy.new({script_src: %w('self'), script_src_elem: %w('self')})
180+
csp = ContentSecurityPolicy.new({ script_src: %w('self'), script_src_elem: %w('self') })
181181
expect(csp.value).to eq("script-src 'self'; script-src-elem 'self'")
182182
end
183183

184184
it "supports script-src-attr directive" do
185-
csp = ContentSecurityPolicy.new({script_src: %w('self'), script_src_attr: %w('self')})
185+
csp = ContentSecurityPolicy.new({ script_src: %w('self'), script_src_attr: %w('self') })
186186
expect(csp.value).to eq("script-src 'self'; script-src-attr 'self'")
187187
end
188188

189189
it "supports style-src-elem directive" do
190-
csp = ContentSecurityPolicy.new({style_src: %w('self'), style_src_elem: %w('self')})
190+
csp = ContentSecurityPolicy.new({ style_src: %w('self'), style_src_elem: %w('self') })
191191
expect(csp.value).to eq("style-src 'self'; style-src-elem 'self'")
192192
end
193193

194194
it "supports style-src-attr directive" do
195-
csp = ContentSecurityPolicy.new({style_src: %w('self'), style_src_attr: %w('self')})
195+
csp = ContentSecurityPolicy.new({ style_src: %w('self'), style_src_attr: %w('self') })
196196
expect(csp.value).to eq("style-src 'self'; style-src-attr 'self'")
197197
end
198198

199199
it "supports trusted-types directive" do
200-
csp = ContentSecurityPolicy.new({trusted_types: %w(blahblahpolicy)})
200+
csp = ContentSecurityPolicy.new({ trusted_types: %w(blahblahpolicy) })
201201
expect(csp.value).to eq("trusted-types blahblahpolicy")
202202
end
203203

204204
it "supports trusted-types directive with 'none'" do
205-
csp = ContentSecurityPolicy.new({trusted_types: %w('none')})
205+
csp = ContentSecurityPolicy.new({ trusted_types: %w('none') })
206206
expect(csp.value).to eq("trusted-types 'none'")
207207
end
208208

209209
it "allows duplicate policy names in trusted-types directive" do
210-
csp = ContentSecurityPolicy.new({trusted_types: %w(blahblahpolicy 'allow-duplicates')})
210+
csp = ContentSecurityPolicy.new({ trusted_types: %w(blahblahpolicy 'allow-duplicates') })
211211
expect(csp.value).to eq("trusted-types blahblahpolicy 'allow-duplicates'")
212212
end
213213

214214
it "supports report-to directive with endpoint name" do
215-
csp = ContentSecurityPolicy.new({default_src: %w('self'), report_to: "csp-endpoint"})
215+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), report_to: "csp-endpoint" })
216216
expect(csp.value).to eq("default-src 'self'; report-to csp-endpoint")
217217
end
218218

219219
it "includes report-to before report-uri in alphabetical order" do
220-
csp = ContentSecurityPolicy.new({default_src: %w('self'), report_uri: %w(/csp_report), report_to: "csp-endpoint"})
220+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), report_uri: %w(/csp_report), report_to: "csp-endpoint" })
221221
expect(csp.value).to eq("default-src 'self'; report-to csp-endpoint; report-uri /csp_report")
222222
end
223223

224224
it "does not add report-to if the endpoint name is empty" do
225-
csp = ContentSecurityPolicy.new({default_src: %w('self'), report_to: ""})
225+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), report_to: "" })
226226
expect(csp.value).to eq("default-src 'self'")
227227
end
228228

229229
it "does not add report-to if not provided" do
230-
csp = ContentSecurityPolicy.new({default_src: %w('self')})
230+
csp = ContentSecurityPolicy.new({ default_src: %w('self') })
231231
expect(csp.value).not_to include("report-to")
232232
end
233233

234234
it "supports report-to without report-uri" do
235-
csp = ContentSecurityPolicy.new({default_src: %w('self'), report_to: "reporting-endpoint-name"})
235+
csp = ContentSecurityPolicy.new({ default_src: %w('self'), report_to: "reporting-endpoint-name" })
236236
expect(csp.value).to eq("default-src 'self'; report-to reporting-endpoint-name")
237237
end
238238
end
239239
end
240240
end
241-

‎spec/lib/secure_headers/headers/policy_management_spec.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ module SecureHeaders
88
Configuration.default
99
end
1010

11-
let (:default_opts) do
11+
let(:default_opts) do
1212
{
1313
default_src: %w(https:),
1414
img_src: %w(https: data:),

‎spec/lib/secure_headers_spec.rb‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ module SecureHeaders
5454
describe "#header_hash_for" do
5555
it "allows you to opt out of individual headers via API" do
5656
Configuration.default do |config|
57-
config.csp = { default_src: %w('self'), script_src: %w('self')}
57+
config.csp = { default_src: %w('self'), script_src: %w('self') }
5858
config.csp_report_only = config.csp
5959
end
6060
SecureHeaders.opt_out_of_header(request, :csp)
@@ -174,11 +174,11 @@ module SecureHeaders
174174
end
175175

176176
Configuration.named_append(:moar_default_sources) do |request|
177-
{ default_src: %w(https:), style_src: %w('self')}
177+
{ default_src: %w(https:), style_src: %w('self') }
178178
end
179179

180180
Configuration.named_append(:how_about_a_script_src_too) do |request|
181-
{ script_src: %w('unsafe-inline')}
181+
{ script_src: %w('unsafe-inline') }
182182
end
183183

184184
SecureHeaders.use_content_security_policy_named_append(request, :moar_default_sources)
@@ -318,7 +318,7 @@ module SecureHeaders
318318
default_src: %w('self'),
319319
script_src: %w('self')
320320
}
321-
config.csp_report_only = config.csp.merge({script_src: %w(foo.com)})
321+
config.csp_report_only = config.csp.merge({ script_src: %w(foo.com) })
322322
end
323323

324324
hash = SecureHeaders.header_hash_for(request)
@@ -342,42 +342,42 @@ module SecureHeaders
342342
end
343343

344344
it "allows appending to the enforced policy" do
345-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
345+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :enforced)
346346
hash = SecureHeaders.header_hash_for(request)
347347
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
348348
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src 'self'")
349349
end
350350

351351
it "allows appending to the report only policy" do
352-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
352+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :report_only)
353353
hash = SecureHeaders.header_hash_for(request)
354354
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src 'self'")
355355
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
356356
end
357357

358358
it "allows appending to both policies" do
359-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
359+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :both)
360360
hash = SecureHeaders.header_hash_for(request)
361361
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
362362
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
363363
end
364364

365365
it "allows overriding the enforced policy" do
366-
SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
366+
SecureHeaders.override_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :enforced)
367367
hash = SecureHeaders.header_hash_for(request)
368368
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src anothercdn.com")
369369
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src 'self'")
370370
end
371371

372372
it "allows overriding the report only policy" do
373-
SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
373+
SecureHeaders.override_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :report_only)
374374
hash = SecureHeaders.header_hash_for(request)
375375
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src 'self'")
376376
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src anothercdn.com")
377377
end
378378

379379
it "allows overriding both policies" do
380-
SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
380+
SecureHeaders.override_content_security_policy_directives(request, { script_src: %w(anothercdn.com) }, :both)
381381
hash = SecureHeaders.header_hash_for(request)
382382
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src anothercdn.com")
383383
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src anothercdn.com")
@@ -392,7 +392,7 @@ module SecureHeaders
392392
script_src: %w('self')
393393
}
394394
end
395-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
395+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) })
396396

397397
hash = SecureHeaders.header_hash_for(request)
398398
expect(hash["content-security-policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
@@ -408,7 +408,7 @@ module SecureHeaders
408408
script_src: %w('self')
409409
}
410410
end
411-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
411+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) })
412412

413413
hash = SecureHeaders.header_hash_for(request)
414414
expect(hash["content-security-policy-report-only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
@@ -427,7 +427,7 @@ module SecureHeaders
427427
script_src: %w('self')
428428
}
429429
end
430-
SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
430+
SecureHeaders.append_content_security_policy_directives(request, { script_src: %w(anothercdn.com) })
431431

432432
hash = SecureHeaders.header_hash_for(request)
433433
expect(hash["content-security-policy"]).to eq("default-src enforced.com; script-src 'self' anothercdn.com")
@@ -670,4 +670,3 @@ module SecureHeaders
670670
end
671671
end
672672
end
673-

0 commit comments

Comments
 (0)