db-init should only import basic.plan. Fixed #276.
Merge pull request #277 from yeukhon/db-init

db-init should only import basic.plan. Fixed #276.
CSP plugin should accept blob and data. Fixed #254.
Merge pull request #278 from yeukhon/csp

CSP plugin should accept blob and data. Fixed #254.
Fixed test_malformed_csp to test 'self' typo. Fixed #280.

After #254 is fixed, the regex for source expression has been updated
and improved to accept valid hostnames like localhost. This means
even img-src is considered valid if they are not directive (if they
fall under source list).
Merge pull request #281 from yeukhon/csp

Fixed test_malformed_csp to test 'self' typo. Fixed #280.
Fixed #279. Rewrite CSPPlugin.

What has changed?

+ tests are completly rewritten.
+ CSPPlugin is completely rewritten to support 1.0 syntax.
+ Compare to the previous CSSPlugin, CSP and XCSP presence check is always required.

The orginal rewrite expected more issues to raise, but I have given up that idea, Instead,
only relevant and basic syntax checks are done. Issues/summaries like how many directives
inherit from default-src are not available (although they were implemented I backed out those
codes during squash). Also, this plugin currently only checks the syntax of the CSP header; so
XCSP, CSP-RO and XCSP-RO are not verified. An experimental CSPPlugin (but separate) should
be developed. Until then this plugin can remain simple like this.
Merge pull request #282 from yeukhon/issue#279

Fixed #279. Rewrite CSPPlugin.
Working on #284. Updated test_alive.py

+ Update test_alive.py with the new test driver.

We will add the new driver to the base test class once all tests have been converted.

+ timeout is commented out

This is because minion.curly does not handle code 28 (operation timeout error).
This will be a separate issue to handle.
Working on #284. Updated test_xframe.py

+ Update test_xframe.py with the new test driver.

We will add the new driver to the base test class once all tests have been converted.
Working on #284. Update test_hsts.py to use new driver.

+ Replace stunnel with Flask SSL invokcation.

This snippet (http://flask.pocoo.org/snippets/111/)
can be used to start Flask with TLS. A new directory called https_data
has been added to replace stunnel-data. The new direcorty contains
a testing certificate and a testing private key. There is a REAMDE
with instruction to generate the cert and key.

Unfortunately, because we self-signed the cert, we need to disable SSL/TLS
cert verification in pycurl. But I don't want to enable that until I have
spoken to Stefan about this. For now, we know the code works because the plugin
hasn't changed a bit. We will leave it commented out. I really hope we don't
need to assert mozillalabs.com or google.com to test the plugin.
Working on #284. Updated test_xcontent.py
Working on #284. Updated test_xxssprotection.py
Working on #284. Updated test_server_details.py
Working #284. Updated test_robot.py
Fixed #284. Rewrite all plugin tests using the new test driver.

Sumamary:

This final patch abstract common codes into base.py. The code should be
much cleaner to read.

+test_robots.py

test_robots.py is one that doesn't use the /test endpoint. It launches three
instances of Flask servers because to test the plugin we need a server that runs
with valid robots.txt, one with invalid robots.txt and one without robots.txt.

+ test_hsts.py

test_hsts.py test still rely on external sites (mozillalabs.com and google.com) to
test the existence and absence of HSTS header. We can't launch a local HTTPS server
because minion.curly.get will do certificate check. I need to speak with stefan about
allowing curly to receive an option to enable or disable verification on each call.

- cold boot

If we try to run multiple test files together there will be failure. This seems to be
race condition, the fact that some servers have not been terminated. This is a regression.
One way to solve this is to provide a test runner script that invoke individual test file.
I will file another bug to look at this issue but for now I know each file runs perfectly
fine.
Merge pull request #285 from yeukhon/issue#284

Pull request for #284 to rewrite all plugin tests
Fix typo in setup.py that prevents develop command
Fixed #265. Give an explicit description for each issue in ServerDetails plugin.

Each "problematic" header has a short description about its purpose and a quote
from RFC 2068.
Merge pull request #289 from yeukhon/issue#265

Fixed #265. Give an explicit description for each issue in ServerDetails...