kotovalexarian-likes-github/sinatra
1
0
Fork 0
mirror of https://github.com/sinatra/sinatra synced 2023-03-27 23:18:01 -04:00
Code Releases Activity

use upper case for frame options, fixes #25

Browse source
This commit is contained in:
Konstantin Haase 2012-12-10 16:48:21 +01:00
parent 13f0d4dac3
commit 4c74529929
2 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
rack-protection/lib/rack/protection/frame_options.rb
View file

@ -18,8 +18,13 @@ module Rack
# to allow embedding from the same origin (default).
class FrameOptions < XSSHeader
default_options :frame_options => :sameorigin
def header
{ 'X-Frame-Options' => options[:frame_options].to_s }
@header ||= begin
frame_options = options[:frame_options]
frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
{ 'X-Frame-Options' => frame_options.to_str }
end
end
end
end

15
rack-protection/spec/frame_options_spec.rb
View file

@ -4,7 +4,7 @@ describe Rack::Protection::FrameOptions do
it_behaves_like "any rack application"
it 'should set the X-Frame-Options' do
get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "sameorigin"
get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "SAMEORIGIN"
end
it 'should not set the X-Frame-Options for other content types' do
@ -18,7 +18,18 @@ describe Rack::Protection::FrameOptions do
run DummyApp
end
get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "deny"
get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "DENY"
end
it 'should allow changing the protection mode to a string' do
# I have no clue what other modes are available
mock_app do
use Rack::Protection::FrameOptions, :frame_options => "ALLOW-FROM foo"
run DummyApp
end
get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "ALLOW-FROM foo"
end
it 'should not override the header if already set' do