Contents

# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/agent/assess/rule/response/base_rule'
require 'contrast/utils/string_utils'

module Contrast
  module Agent
    module Assess
      module Rule
        module Response
          # These rules check that the HTTP Headers include CSP header types
          class CspHeaderMissing < BaseRule
            def rule_id
              'csp-header-missing'
            end

            protected

            CSP_HEADERS = %w[CONTENT_SECURITY_POLICY X_CONTENT_SECURITY_POLICY X_WEBKIT_CSP].cs__freeze

            DATA = 'data'.cs__freeze

            # Rules discern which responses they can/should analyze.
            #
            # @param response [Contrast::Agent::Response] the response of the application
            def analyze_response? response
              super && headers?(response)
            end

            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
            #
            # @param response [Contrast::Agent::Response] the response of the application
            # @return [Contrast::Utils::ObjectShare::EMPTY_STRING, nil] if CSP Header is not found
            def violated? response
              response_headers = response.headers
              return if CSP_HEADERS.any? { |header_key| response_headers[header_key]&.length&.positive? }

              { DATA => Contrast::Utils::ObjectShare::EMPTY_STRING }
            end
          end
        end
      end
    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
contrast-agent-5.1.0	lib/contrast/agent/assess/rule/response/csp_header_missing_rule.rb