Class: CSPMaker::ContentSecurityPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/csp_maker/csp.rb

Constant Summary collapse

HASH_SOURCE_ALGORITHM_PREFIXES = 
["sha256-", "sha384-", "sha512-"].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize {|_self| ... } ⇒ ContentSecurityPolicy

Returns a new instance of ContentSecurityPolicy.

Yields:

  • (_self)

Yield Parameters:



79
80
81
82
 
# File 'lib/csp_maker/csp.rb', line 79

def initialize
  @directives = {}
  yield self if block_given?
end

Instance Attribute Details

#directives ⇒ Object (readonly)

Returns the value of attribute directives.



77
78
79
 
# File 'lib/csp_maker/csp.rb', line 77

def directives
  @directives
end

Instance Method Details

#block_all_mixed_content(enabled = true) ⇒ Object

Specify whether to prevent the user agent from loading any assets over HTTP when the page uses HTTPS:

policy.block_all_mixed_content

Pass false to allow it again:

policy.block_all_mixed_content false


115
116
117
118
119
120
121
 
# File 'lib/csp_maker/csp.rb', line 115

def block_all_mixed_content(enabled = true)
  if enabled
    @directives["block-all-mixed-content"] = true
  else
    @directives.delete("block-all-mixed-content")
  end
end

#build(context = nil, nonce = nil, nonce_directives = nil) ⇒ Object 



210
211
212
213
 
# File 'lib/csp_maker/csp.rb', line 210

def build(context = nil, nonce = nil, nonce_directives = nil)
  nonce_directives ||= CSPMaker.nonce_directives || DEFAULT_NONCE_DIRECTIVES
  build_directives(context, nonce, nonce_directives).compact.join("; ")
end

#initialize_copy(other) ⇒ Object 



84
85
86
87
88
89
90
91
92
93
 
# File 'lib/csp_maker/csp.rb', line 84

def initialize_copy(other)
  @directives = other.directives.to_h do |directive, sources|
    if sources.is_a?(Array)
      copied_sources = sources.map { |source| source.is_a?(String) ? source.dup : source }
      [directive, copied_sources]
    else
      [directive, sources]
    end
  end
end

#nonce(nonce) ⇒ Object

Raises:



204
205
206
207
208
 
# File 'lib/csp_maker/csp.rb', line 204

def nonce(nonce)
  raise InvalidDirectiveError, "Nonce must be a non-empty string" unless nonce.is_a?(String) && nonce.length > 0

  "'nonce-#{nonce}'"
end

#plugin_types(*types) ⇒ Object

Restricts the set of plugins that can be embedded:

policy.plugin_types "application/x-shockwave-flash"

Leave empty to allow all plugins:

policy.plugin_types


131
132
133
134
135
136
137
 
# File 'lib/csp_maker/csp.rb', line 131

def plugin_types(*types)
  if types.first
    @directives["plugin-types"] = types
  else
    @directives.delete("plugin-types")
  end
end

#report_uri(uri) ⇒ Object

Enable the report-uri directive. Violation reports will be sent to the specified URI:

policy.report_uri "/csp-violation-report-endpoint"


144
145
146
 
# File 'lib/csp_maker/csp.rb', line 144

def report_uri(uri)
  @directives["report-uri"] = [uri]
end

#require_sri_for(*types) ⇒ Object

Specify asset types for which Subresource Integrity is required:

policy.require_sri_for :script, :style

Leave empty to not require Subresource Integrity:

policy.require_sri_for


157
158
159
160
161
162
163
 
# File 'lib/csp_maker/csp.rb', line 157

def require_sri_for(*types)
  if types.first
    @directives["require-sri-for"] = types
  else
    @directives.delete("require-sri-for")
  end
end

#sandbox(*values) ⇒ Object

Specify whether a sandbox should be enabled for the requested resource:

policy.sandbox

Values can be passed as arguments:

policy.sandbox "allow-scripts", "allow-modals"

Pass false to disable the sandbox:

policy.sandbox false


178
179
180
181
182
183
184
185
186
 
# File 'lib/csp_maker/csp.rb', line 178

def sandbox(*values)
  if values.empty?
    @directives["sandbox"] = true
  elsif values.first
    @directives["sandbox"] = values
  else
    @directives.delete("sandbox")
  end
end

#upgrade_insecure_requests(enabled = true) ⇒ Object

Specify whether user agents should treat any assets over HTTP as HTTPS:

policy.upgrade_insecure_requests

Pass false to disable it:

policy.upgrade_insecure_requests false


196
197
198
199
200
201
202
 
# File 'lib/csp_maker/csp.rb', line 196

def upgrade_insecure_requests(enabled = true)
  if enabled
    @directives["upgrade-insecure-requests"] = true
  else
    @directives.delete("upgrade-insecure-requests")
  end
end