Contents

# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/agent/assess/rule/response/header_rule'
require 'contrast/utils/string_utils'

module Contrast
  module Agent
    module Assess
      module Rule
        module Response
          # This rule checks if the HTTP Headers include HSTS header and ensures that the max-age value
          # is set to a value greater than 0.
          class HSTSHeader < HeaderRule
            def rule_id
              'hsts-header-missing'
            end

            protected

            HEADER_KEYS = %w[Strict-Transport-Security].cs__freeze
            ACCEPTED_VALUES = [/max-age=(\.)?\d+(\.\d*)?/].cs__freeze
            DEFAULT_SAFE = true

            def evidence data
              # get only the value of the max-age property
              val = data&.split('=')&.last
              val = Contrast::Utils::ObjectShare::EMPTY_STRING if val.nil? || val == 'max-age'
              { DATA => val }
            end
          end
        end
      end
    end
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
contrast-agent-6.1.0	lib/contrast/agent/assess/rule/response/hsts_header_rule.rb
contrast-agent-6.0.0	lib/contrast/agent/assess/rule/response/hsts_header_rule.rb
contrast-agent-5.3.0	lib/contrast/agent/assess/rule/response/hsts_header_rule.rb
contrast-agent-5.2.0	lib/contrast/agent/assess/rule/response/hsts_header_rule.rb