Class: CamaleonCms::MediaSecurityHeaders

Inherits:
Object
  • Object
show all
Defined in:
lib/camaleon_cms/media_security_headers.rb

Constant Summary collapse

SVG_PATH_PATTERN =

Case-insensitive: an evil.SVG is stored and served verbatim (get_file_format downcases the extension), so a case-sensitive match left uppercase-extension SVGs served inline without the protective headers.

%r{\A/media/.*\.svg\z}i

Instance Method Summary collapse

Constructor Details

#initialize(app) ⇒ MediaSecurityHeaders

Returns a new instance of MediaSecurityHeaders.



10
11
12
 
# File 'lib/camaleon_cms/media_security_headers.rb', line 10

def initialize(app)
  @app = app
end

Instance Method Details

#call(env) ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/camaleon_cms/media_security_headers.rb', line 14

def call(env)
  status, headers, body = @app.call(env)

  if env['REQUEST_METHOD'] == 'GET' && env['PATH_INFO']&.match?(SVG_PATH_PATTERN)
    # Lowercase header keys: the Rack 3 SPEC requires them and Falcon/Rack::Lint reject
    # mixed case (Puma tolerated it, which hid this).
    headers['x-content-type-options'] = 'nosniff'
    headers['content-security-policy'] = "script-src 'none'"
  end

  [status, headers, body]
end