mirror of
https://github.com/postalserver/postal.git
synced 2026-10-18 10:17:22 +00:00
Adam Cooke
5eeed7c023
Upgrades Rails from 7.1.6 to 7.2.3.2, Ruby from 3.4.6 to 3.4.10, and brings the rest of the bundle up to date. Two things were broken by Rails 7.2 and are fixed here: * MigrationWaiter called `ActiveRecord::Base.connection.migration_context`, which moved to the connection pool in 7.2. This raised NoMethodError on boot for any deployment with `migration_waiter.enabled` set, and had no test covering it. * `config.action_dispatch.show_exceptions = false` was deprecated in 7.1 and removed in 7.2. Now `:none`. `json` is pinned to < 3. Active Support 7.2 passes `quirks_mode:` to both `JSON.generate` and `JSON.parse`, and json 3.0 removed that option, so an unpinned json resolves to 3.x and makes every `to_json` raise - webhook payloads included. Nothing else in the bundle constrains it. The pin can go when we reach Rails 8.1, which no longer passes the option. `dynamic_form` is dropped. It is unmaintained and from 1.3.1 requires Ruby < 3.4, so it could never be updated again. Ten views used it, so `error_messages_for` now lives in ErrorMessagesHelper and `f.error_messages` in a form builder extension. The rendered markup is unchanged apart from a heading and description the stylesheet had always hidden; the rules that hid them are removed too. `execjs` is unpinned. The `< 2.8` constraint dated from the Rails 6.0 upgrade and asset output is byte-identical without it. Notable gem majors: puma 8, haml 7, secure_headers 7, sentry 7, jwt 3, prometheus-client 5, highline 3, omniauth-rails_csrf_protection 2, rspec-rails 8, shoulda-matchers 8, rubocop 1.91. secure_headers 7 changes X-XSS-Protection from "1; mode=block" to "0", which is the correct modern default and matches Rails' own. `config.load_defaults` deliberately stays at 7.0. The pending 7.1 and 7.2 options are listed, commented out, in new_framework_defaults_7_1.rb and _7_2.rb so they can be adopted in stages - several change the signed cookie and cache formats and need a staged deploy. The vestigial new_framework_defaults_7_0.rb is removed, as `load_defaults 7.0` already applies all of it. Adds tests for the areas this touched, which were mostly uncovered: MigrationWaiter, the serialized columns that gate a defaults bump, JSON encoding, HAML template compilation for all 103 templates, page rendering, form error rendering and security headers. The assets Gemfile group now includes :test so the view layer can be exercised at all.
87 lines
2.7 KiB
Ruby
87 lines
2.7 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "rails_helper"
|
|
|
|
# The security headers come from the secure_headers gem plus Rails' own
|
|
# defaults, and both have changed them across major versions. Nothing else in
|
|
# the suite looks at response headers, so pin them here.
|
|
RSpec.describe "security headers", type: :request do
|
|
before do
|
|
host! Postal::Config.postal.web_hostname
|
|
get "/login"
|
|
end
|
|
|
|
it "responds successfully" do
|
|
expect(response).to have_http_status(:ok)
|
|
end
|
|
|
|
it "sets X-Frame-Options to sameorigin" do
|
|
expect(response.headers["x-frame-options"]).to eq "sameorigin"
|
|
end
|
|
|
|
it "sets X-Content-Type-Options to nosniff" do
|
|
expect(response.headers["x-content-type-options"]).to eq "nosniff"
|
|
end
|
|
|
|
it "disables the legacy XSS auditor rather than enabling it" do
|
|
# secure_headers 7 changed this from "1; mode=block". `0` is correct: the
|
|
# legacy auditor is deprecated and blocking mode was itself exploitable.
|
|
expect(response.headers["x-xss-protection"]).to eq "0"
|
|
end
|
|
|
|
it "sets X-Permitted-Cross-Domain-Policies to none" do
|
|
expect(response.headers["x-permitted-cross-domain-policies"]).to eq "none"
|
|
end
|
|
|
|
describe "the content security policy" do
|
|
let(:csp) { response.headers["content-security-policy"] }
|
|
|
|
it "is present" do
|
|
expect(csp).to be_present
|
|
end
|
|
|
|
it "restricts script-src to self" do
|
|
expect(csp).to include "script-src 'self'"
|
|
end
|
|
|
|
it "restricts connect-src to self" do
|
|
expect(csp).to include "connect-src 'self'"
|
|
end
|
|
|
|
it "forbids object-src" do
|
|
expect(csp).to include "object-src 'none'"
|
|
end
|
|
end
|
|
|
|
describe "cookies" do
|
|
# Rack 3 returns set-cookie as a String for one cookie and an Array for
|
|
# several, so normalise before looking for a particular cookie.
|
|
def cookie_named(name)
|
|
Array(response.headers["set-cookie"]).flat_map { |v| v.split("\n") }.find { |c| c.start_with?("#{name}=") }
|
|
end
|
|
|
|
it "marks the browser id cookie httponly and samesite lax" do
|
|
expect(cookie_named("browser_id")).to include "httponly"
|
|
expect(cookie_named("browser_id")).to include "samesite=lax"
|
|
end
|
|
|
|
context "once logged in" do
|
|
let(:user) { create(:user) }
|
|
|
|
before do
|
|
post "/login", params: { email_address: user.email_address, password: "passw0rd" }
|
|
end
|
|
|
|
it "marks the authie session cookie httponly and samesite lax" do
|
|
expect(cookie_named("user_session")).to include "httponly"
|
|
expect(cookie_named("user_session")).to include "samesite=lax"
|
|
end
|
|
|
|
it "marks the rails session cookie httponly and samesite lax" do
|
|
expect(cookie_named("_postal_session")).to include "httponly"
|
|
expect(cookie_named("_postal_session")).to include "samesite=lax"
|
|
end
|
|
end
|
|
end
|
|
end
|