From d594f189772250127053104086b2d3338749eff6 Mon Sep 17 00:00:00 2001 From: eleabrton Date: Thu, 27 May 2021 05:16:26 +0800 Subject: [PATCH] escape semicolons by replacing them with spaces See https://github.com/twitter/secure_headers/issues/418 --- lib/secure_headers/headers/content_security_policy.rb | 11 ++++++++--- .../headers/content_security_policy_spec.rb | 5 +++++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/lib/secure_headers/headers/content_security_policy.rb b/lib/secure_headers/headers/content_security_policy.rb index abac5c5..9f50623 100644 --- a/lib/secure_headers/headers/content_security_policy.rb +++ b/lib/secure_headers/headers/content_security_policy.rb @@ -103,10 +103,15 @@ def build_media_type_list_directive(directive) # Returns a string representing a directive. def build_source_list_directive(directive) source_list = @config.directive_value(directive) - if source_list != OPT_OUT && source_list && source_list.any? - normalized_source_list = minify_source_list(directive, source_list) - [symbol_to_hyphen_case(directive), normalized_source_list].join(" ") + minified_source_list = minify_source_list(directive, source_list).join(" ") + + if minified_source_list.include?(";") + Kernel.warn("#{directive} contains a ; in '#{minified_source_list}' which will raise an error in future versions. It has been replaced with a blank space.") + end + + escaped_source_list = minified_source_list.gsub(";", " ") + [symbol_to_hyphen_case(directive), escaped_source_list].join(" ").strip end end diff --git a/spec/lib/secure_headers/headers/content_security_policy_spec.rb b/spec/lib/secure_headers/headers/content_security_policy_spec.rb index fface8c..32b9b44 100644 --- a/spec/lib/secure_headers/headers/content_security_policy_spec.rb +++ b/spec/lib/secure_headers/headers/content_security_policy_spec.rb @@ -28,6 +28,11 @@ module SecureHeaders expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:") end + it "deprecates and escapes semicolons in directive source lists" do + expect(Kernel).to receive(:warn).with("frame_ancestors contains a ; in 'google.com;script-src *;.;' which will raise an error in future versions. It has been replaced with a blank space.") + expect(ContentSecurityPolicy.new(frame_ancestors: %w(https://google.com;script-src https://*;.;)).value).to eq("frame-ancestors google.com script-src * .") + end + it "discards 'none' values if any other source expressions are present" do csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none'))) expect(csp.value).not_to include("'none'")