Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
secureheaders builds the Content-Security-Policy value by stitching every configured directive together with ; separators. Three directive builders (buildsandboxlistdirective, buildmediatypelistdirective, buildreporttodirective) interpolate caller-supplied strings into that value without scrubbing ;, \r, or \n. When an application forwards untrusted input into SecureHeaders.overridecontentsecuritypolicydirectives (or append…) for :sandbox, :plugintypes, or :reportto, an attacker can embed a literal ; and inject an arbitrary CSP directive into the header value. Because :sandbox and :plugintypes both sort alphabetically before :scriptsrc in BODYDIRECTIVES, the injected script-src lands earlier in the header and wins under the CSP first-occurrence rule, defeating the application's real script-src. End result: an 'unsafe-inline' policy is forced for inline <script despite the configured strict CSP, giving full XSS reachability anywhere reflected or stored content meets one of…
Recommended action: Upgrade to 7.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secureheaders are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPTOUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Duplicate script-src directives detected. All but the first instance will be ignored. See https://www.w3.org/TR/CSP3/#parse-serialized-policy Note: In this case, the user agent SHOULD notify developers that a duplicate directive was…
Recommended action: Upgrade to 6.2.0, 5.1.0 or 3.8.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. e.g. would result in CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial: Patches This has been fixed in 6.3.0, 5.2.0, and 3.9.0 Workarounds References https://github.com/twitter/secureheaders/security/advisories/GHSA-xq52-rv6w-397c The effect of multiple policies For more information If you have any questions or comments about this advisory: Open an issue in this repo DM us at @ndm on twitter
Recommended action: Upgrade to 6.3.0, 5.2.0 or 3.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.