-
Notifications
You must be signed in to change notification settings - Fork 252
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #143 from twitter/hpkp
Hpkp support (take 2)
- Loading branch information
Showing
7 changed files
with
229 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| ruby-1.9.3-p484 | ||
| 2.1.6 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| module SecureHeaders | ||
| class PublicKeyPinsBuildError < StandardError; end | ||
| class PublicKeyPins < Header | ||
| module Constants | ||
| HPKP_HEADER_NAME = "Public-Key-Pins" | ||
| ENV_KEY = 'secure_headers.public_key_pins' | ||
| HASH_ALGORITHMS = [:sha256] | ||
| DIRECTIVES = [:max_age] | ||
| end | ||
| class << self | ||
| def symbol_to_hyphen_case sym | ||
| sym.to_s.gsub('_', '-') | ||
| end | ||
| end | ||
| include Constants | ||
|
|
||
| def initialize(config=nil) | ||
| @config = validate_config(config) | ||
|
|
||
| @pins = @config.fetch(:pins, nil) | ||
| @report_uri = @config.fetch(:report_uri, nil) | ||
| @app_name = @config.fetch(:app_name, nil) | ||
| @enforce = !!@config.fetch(:enforce, nil) | ||
| @include_subdomains = !!@config.fetch(:include_subdomains, nil) | ||
| @tag_report_uri = !!@config.fetch(:tag_report_uri, nil) | ||
| end | ||
|
|
||
| def name | ||
| base = HPKP_HEADER_NAME | ||
| if !@enforce | ||
| base += "-Report-Only" | ||
| end | ||
| base | ||
| end | ||
|
|
||
| def value | ||
| header_value = [ | ||
| generic_directives, | ||
| pin_directives, | ||
| report_uri_directive, | ||
| subdomain_directive | ||
| ].compact.join('; ').strip | ||
| end | ||
|
|
||
| def validate_config(config) | ||
| raise PublicKeyPinsBuildError.new("config must be a hash.") unless config.is_a? Hash | ||
|
|
||
| if !config[:max_age] | ||
| raise PublicKeyPinsBuildError.new("max-age is a required directive.") | ||
| elsif config[:max_age].to_s !~ /\A\d+\z/ | ||
| raise PublicKeyPinsBuildError.new("max-age must be a number. | ||
| #{config[:max_age]} was supplied.") | ||
| elsif config[:pins] && config[:pins].length < 2 | ||
| raise PublicKeyPinsBuildError.new("A minimum of 2 pins are required.") | ||
| end | ||
|
|
||
| config | ||
| end | ||
|
|
||
| def pin_directives | ||
| return nil if @pins.nil? | ||
| @pins.collect do |pin| | ||
| pin.map do |token, hash| | ||
| "pin-#{token}=\"#{hash}\"" if HASH_ALGORITHMS.include?(token) | ||
| end | ||
| end.join('; ') | ||
| end | ||
|
|
||
| def generic_directives | ||
| DIRECTIVES.collect do |directive_name| | ||
| build_directive(directive_name) if @config[directive_name] | ||
| end.join('; ') | ||
| end | ||
|
|
||
| def build_directive(key) | ||
| "#{self.class.symbol_to_hyphen_case(key)}=#{@config[key]}" | ||
| end | ||
|
|
||
| def report_uri_directive | ||
| return nil if @report_uri.nil? | ||
|
|
||
| if @tag_report_uri | ||
| @report_uri = "#{@report_uri}?enforce=#{@enforce}" | ||
| @report_uri += "&app_name=#{@app_name}" if @app_name | ||
| end | ||
|
|
||
| "report-uri=\"#{@report_uri}\"" | ||
| end | ||
|
|
||
|
|
||
| def subdomain_directive | ||
| @include_subdomains ? 'includeSubDomains' : nil | ||
| end | ||
| end | ||
| end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| require 'spec_helper' | ||
|
|
||
| module SecureHeaders | ||
| describe PublicKeyPins do | ||
| specify{ expect(PublicKeyPins.new(:max_age => 1234).name).to eq("Public-Key-Pins-Report-Only") } | ||
| specify{ expect(PublicKeyPins.new(:max_age => 1234, :enforce => true).name).to eq("Public-Key-Pins") } | ||
|
|
||
| specify { expect(PublicKeyPins.new({:max_age => 1234}).value).to eq("max-age=1234")} | ||
| specify { expect(PublicKeyPins.new(:max_age => 1234).value).to eq("max-age=1234")} | ||
| specify { | ||
| config = {:max_age => 1234, :pins => [{:sha256 => 'base64encodedpin1'}, {:sha256 => 'base64encodedpin2'}]} | ||
| header_value = "max-age=1234; pin-sha256=\"base64encodedpin1\"; pin-sha256=\"base64encodedpin2\"" | ||
| expect(PublicKeyPins.new(config).value).to eq(header_value) | ||
| } | ||
|
|
||
| context "with an invalid configuration" do | ||
| it "raises an exception when max-age is not provided" do | ||
| expect { | ||
| PublicKeyPins.new(:foo => 'bar') | ||
| }.to raise_error(PublicKeyPinsBuildError) | ||
| end | ||
|
|
||
| it "raises an exception with an invalid max-age" do | ||
| expect { | ||
| PublicKeyPins.new(:max_age => 'abc123') | ||
| }.to raise_error(PublicKeyPinsBuildError) | ||
| end | ||
|
|
||
| it 'raises an exception with less than 2 pins' do | ||
| expect { | ||
| config = {:max_age => 1234, :pins => [{:sha256 => 'base64encodedpin'}]} | ||
| PublicKeyPins.new(config) | ||
| }.to raise_error(PublicKeyPinsBuildError) | ||
| end | ||
| end | ||
| end | ||
| end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters