Contents

class SiteInspector
  class Endpoint
    # Utility parser for HSTS headers.
    # RFC: http://tools.ietf.org/html/rfc6797
    class Hsts < Check
      def valid?
        return false unless header
        pairs.none? { |key, value| "#{key}#{value}" =~ /[\s\'\"]/ }
      end

      def max_age
        pairs[:"max-age"].to_i
      end

      def include_subdomains?
        pairs.keys.include? :includesubdomains
      end

      def preload?
        pairs.keys.include? :preload
      end

      def enabled?
        return false unless max_age
        max_age > 0
      end

      # Google's minimum max-age for automatic preloading
      def preload_ready?
        include_subdomains? && preload? && max_age >= 10_886_400
      end

      def to_h
        {
          valid:              valid?,
          max_age:            max_age,
          include_subdomains: include_subdomains?,
          preload:            preload?,
          enabled:            enabled?,
          preload_ready:      preload_ready?
        }
      end

      private

      def headers
        endpoint.headers
      end

      def header
        @header ||= headers['strict-transport-security']
      end

      def directives
        @directives ||= header ? header.split(/\s*;\s*/) : []
      end

      def pairs
        @pairs ||= begin
          pairs = {}
          directives.each do |directive|
            key, value = directive.downcase.split('=')

            if value =~ /\".*\"/
              value = value.sub(/^\"/, '')
              value = value.sub(/\"$/, '')
            end

            pairs[key.to_sym] = value
          end

          pairs
        end
      end
    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
site-inspector-3.1.1	lib/site-inspector/checks/hsts.rb