Contents

# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/agent/assess/rule/response/framework/rails_support'
require 'contrast/agent/assess/rule/response/header_rule'
require 'contrast/utils/string_utils'

module Contrast
  module Agent
    module Assess
      module Rule
        module Response
          # These rules check the content of the HTTP Response to determine if the response contains the needed header
          class XXssProtection < HeaderRule
            include Framework::RailsSupport
            HEADER_KEYS = %w[X-XSS-Protection].cs__freeze
            ACCEPTED_VALUES = [/^1/].cs__freeze
            DEFAULT_SAFE = true

            def rule_id
              'xxssprotection-header-disabled'
            end

            protected

            def analyze_response? response
              !rails_seven? && super
            end
          end
        end
      end
    end
  end
end

Version data entries

5 entries across 5 versions & 1 rubygems

Version	Path
contrast-agent-6.11.0	lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb
contrast-agent-6.10.0	lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb
contrast-agent-6.9.0	lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb
contrast-agent-6.8.0	lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb
contrast-agent-6.7.0	lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb