GitHub PullRequestReviewCommentEvent at 2014-06-17 20:12:27
Repository: rails
Actor: chancancode
Payload: {"action":"created","comment":{"url":"https://api.github.com/repos/rails/rails/pulls/comments/13882194","id":13882194,"diff_hunk":"@@ -0,0 +1,75 @@\n+module ActionDispatch\n+  class CSP\n+\n+    def self.default_csp_options\n+      { :enforce => false, :default_src => 'self' }\n+    end\n+\n+    def initialize(app, options = {})\n+      @app = app\n+\n+      @csp = options.is_a?(Hash) ? options : {}","path":"actionpack/lib/action_dispatch/middleware/csp.rb","position":11,"original_position":11,"commit_id":"9f3c36e97e8b3158a5728721b4ac07332084692b","original_commit_id":"9f3c36e97e8b3158a5728721b4ac07332084692b","user":{"login":"chancancode","id":55829,"avatar_url":"https://avatars.githubusercontent.com/u/55829?","gravatar_id":"22bb3e56828870ee9a0dd93aeadbe04a","url":"https://api.github.com/users/chancancode","html_url":"https://github.com/chancancode","followers_url":"https://api.github.com/users/chancancode/followers","following_url":"https://api.github.com/users/chancancode/following{/other_user}","gists_url":"https://api.github.com/users/chancancode/gists{/gist_id}","starred_url":"https://api.github.com/users/chancancode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chancancode/subscriptions","organizations_url":"https://api.github.com/users/chancancode/orgs","repos_url":"https://api.github.com/users/chancancode/repos","events_url":"https://api.github.com/users/chancancode/events{/privacy}","received_events_url":"https://api.github.com/users/chancancode/received_events","type":"User","site_admin":false},"body":"What is the `is_a?(Hash)` intend to guard against?","created_at":"2014-06-17T20:12:27Z","updated_at":"2014-06-17T20:12:27Z","html_url":"https://github.com/rails/rails/pull/15777#discussion_r13882194","pull_request_url":"https://api.github.com/repos/rails/rails/pulls/15777","_links":{"self":{"href":"https://api.github.com/repos/rails/rails/pulls/comments/13882194"},"html":{"href":"https://github.com/rails/rails/pull/15777#discussion_r13882194"},"pull_request":{"href":"https://api.github.com/repos/rails/rails/pulls/15777"}}},"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/15777","id":17256937,"html_url":"https://github.com/rails/rails/pull/15777","diff_url":"https://github.com/rails/rails/pull/15777.diff","patch_url":"https://github.com/rails/rails/pull/15777.patch","issue_url":"https://api.github.com/repos/rails/rails/issues/15777","number":15777,"state":"open","title":"Add Content Security Policy(CSP)","user":{"login":"xuchu","id":1195715,"avatar_url":"https://avatars.githubusercontent.com/u/1195715?","gravatar_id":"2623a9eba095dc8d1575bac36c0344fb","url":"https://api.github.com/users/xuchu","html_url":"https://github.com/xuchu","followers_url":"https://api.github.com/users/xuchu/followers","following_url":"https://api.github.com/users/xuchu/following{/other_user}","gists_url":"https://api.github.com/users/xuchu/gists{/gist_id}","starred_url":"https://api.github.com/users/xuchu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xuchu/subscriptions","organizations_url":"https://api.github.com/users/xuchu/orgs","repos_url":"https://api.github.com/users/xuchu/repos","events_url":"https://api.github.com/users/xuchu/events{/privacy}","received_events_url":"https://api.github.com/users/xuchu/received_events","type":"User","site_admin":false},"body":"This middleware is going to add support for Content Security Policy(CSP) for Rails. CSP helps to detect and mitigate XSS attacks and data injection attacks by setting the content-security-policy HTTP header.\r\n\r\nThe value of content-security-policy header is made up of one or more directives and each directive come with a source whitelists to specify the trusted resources that can be load by the browser. Any resources that are not specified in the source whitelists will be blocked by the browser.\r\n\r\nFor more information about the directives and source whitelists, check out here http://content-security-policy.com/\r\n\r\nThe middleware provides convenient API to set the CSP:\r\n\r\n    config.csp = {\r\n      :enforce => true,\r\n      :default_src => 'self',\r\n      :script_src => 'inline eval https://api.google.com\"\r\n    }\r\n\r\nwill set the content-security-policy header like below:\r\n    \r\n    Content-Security-Policy:default-src 'self';script-src 'unsafe-inline' 'unsafe-eval' https://api.google.com;\r\n\r\nThe option :enforce is used to indicate if the browser will block the untrusted resources. By default, the option is set to false. So the browser will only report violations of the policy rather than blocking untrusted resource. \r\n\r\nHere is also a good introduction, http://www.html5rocks.com/en/tutorials/security/content-security-policy/\r\n\r\ncc @rafaelfranca @chancancode","created_at":"2014-06-17T19:44:12Z","updated_at":"2014-06-17T20:12:27Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5269b765481e30cd53f7a16857f075bb66ccedda","assignee":{"login":"chancancode","id":55829,"avatar_url":"https://avatars.githubusercontent.com/u/55829?","gravatar_id":"22bb3e56828870ee9a0dd93aeadbe04a","url":"https://api.github.com/users/chancancode","html_url":"https://github.com/chancancode","followers_url":"https://api.github.com/users/chancancode/followers","following_url":"https://api.github.com/users/chancancode/following{/other_user}","gists_url":"https://api.github.com/users/chancancode/gists{/gist_id}","starred_url":"https://api.github.com/users/chancancode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chancancode/subscriptions","organizations_url":"https://api.github.com/users/chancancode/orgs","repos_url":"https://api.github.com/users/chancancode/repos","events_url":"https://api.github.com/users/chancancode/events{/privacy}","received_events_url":"https://api.github.com/users/chancancode/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/rails/rails/pulls/15777/commits","review_comments_url":"https://api.github.com/repos/rails/rails/pulls/15777/comments","review_comment_url":"https://api.github.com/repos/rails/rails/pulls/comments/{number}","comments_url":"https://api.github.com/repos/rails/rails/issues/15777/comments","statuses_url":"https://api.github.com/repos/rails/rails/statuses/9f3c36e97e8b3158a5728721b4ac07332084692b","head":{"label":"xuchu:csp","ref":"csp","sha":"9f3c36e97e8b3158a5728721b4ac07332084692b","user":{"login":"xuchu","id":1195715,"avatar_url":"https://avatars.githubusercontent.com/u/1195715?","gravatar_id":"2623a9eba095dc8d1575bac36c0344fb","url":"https://api.github.com/users/xuchu","html_url":"https://github.com/xuchu","followers_url":"https://api.github.com/users/xuchu/followers","following_url":"https://api.github.com/users/xuchu/following{/other_user}","gists_url":"https://api.github.com/users/xuchu/gists{/gist_id}","starred_url":"https://api.github.com/users/xuchu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xuchu/subscriptions","organizations_url":"https://api.github.com/users/xuchu/orgs","repos_url":"https://api.github.com/users/xuchu/repos","events_url":"https://api.github.com/users/xuchu/events{/privacy}","received_events_url":"https://api.github.com/users/xuchu/received_events","type":"User","site_admin":false},"repo":{"id":19758786,"name":"rails","full_name":"xuchu/rails","owner":{"login":"xuchu","id":1195715,"avatar_url":"https://avatars.githubusercontent.com/u/1195715?","gravatar_id":"2623a9eba095dc8d1575bac36c0344fb","url":"https://api.github.com/users/xuchu","html_url":"https://github.com/xuchu","followers_url":"https://api.github.com/users/xuchu/followers","following_url":"https://api.github.com/users/xuchu/following{/other_user}","gists_url":"https://api.github.com/users/xuchu/gists{/gist_id}","starred_url":"https://api.github.com/users/xuchu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xuchu/subscriptions","organizations_url":"https://api.github.com/users/xuchu/orgs","repos_url":"https://api.github.com/users/xuchu/repos","events_url":"https://api.github.com/users/xuchu/events{/privacy}","received_events_url":"https://api.github.com/users/xuchu/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/xuchu/rails","description":"Ruby on Rails","fork":true,"url":"https://api.github.com/repos/xuchu/rails","forks_url":"https://api.github.com/repos/xuchu/rails/forks","keys_url":"https://api.github.com/repos/xuchu/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xuchu/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xuchu/rails/teams","hooks_url":"https://api.github.com/repos/xuchu/rails/hooks","issue_events_url":"https://api.github.com/repos/xuchu/rails/issues/events{/number}","events_url":"https://api.github.com/repos/xuchu/rails/events","assignees_url":"https://api.github.com/repos/xuchu/rails/assignees{/user}","branches_url":"https://api.github.com/repos/xuchu/rails/branches{/branch}","tags_url":"https://api.github.com/repos/xuchu/rails/tags","blobs_url":"https://api.github.com/repos/xuchu/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xuchu/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xuchu/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/xuchu/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xuchu/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/xuchu/rails/languages","stargazers_url":"https://api.github.com/repos/xuchu/rails/stargazers","contributors_url":"https://api.github.com/repos/xuchu/rails/contributors","subscribers_url":"https://api.github.com/repos/xuchu/rails/subscribers","subscription_url":"https://api.github.com/repos/xuchu/rails/subscription","commits_url":"https://api.github.com/repos/xuchu/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/xuchu/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/xuchu/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/xuchu/rails/issues/comments/{number}","contents_url":"https://api.github.com/repos/xuchu/rails/contents/{+path}","compare_url":"https://api.github.com/repos/xuchu/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xuchu/rails/merges","archive_url":"https://api.github.com/repos/xuchu/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xuchu/rails/downloads","issues_url":"https://api.github.com/repos/xuchu/rails/issues{/number}","pulls_url":"https://api.github.com/repos/xuchu/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/xuchu/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/xuchu/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xuchu/rails/labels{/name}","releases_url":"https://api.github.com/repos/xuchu/rails/releases{/id}","created_at":"2014-05-13T22:57:30Z","updated_at":"2014-06-17T19:44:12Z","pushed_at":"2014-06-17T04:35:27Z","git_url":"git://github.com/xuchu/rails.git","ssh_url":"git@github.com:xuchu/rails.git","clone_url":"https://github.com/xuchu/rails.git","svn_url":"https://github.com/xuchu/rails","homepage":"http://rubyonrails.org","size":112034,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rails:master","ref":"master","sha":"f55ea89e47a62192ef1a51e201e4a80dd52871d1","user":{"login":"rails","id":4223,"avatar_url":"https://avatars.githubusercontent.com/u/4223?","gravatar_id":"30f39a09e233e8369dddf6feb4be0308","url":"https://api.github.com/users/rails","html_url":"https://github.com/rails","followers_url":"https://api.github.com/users/rails/followers","following_url":"https://api.github.com/users/rails/following{/other_user}","gists_url":"https://api.github.com/users/rails/gists{/gist_id}","starred_url":"https://api.github.com/users/rails/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rails/subscriptions","organizations_url":"https://api.github.com/users/rails/orgs","repos_url":"https://api.github.com/users/rails/repos","events_url":"https://api.github.com/users/rails/events{/privacy}","received_events_url":"https://api.github.com/users/rails/received_events","type":"Organization","site_admin":false},"repo":{"id":8514,"name":"rails","full_name":"rails/rails","owner":{"login":"rails","id":4223,"avatar_url":"https://avatars.githubusercontent.com/u/4223?","gravatar_id":"30f39a09e233e8369dddf6feb4be0308","url":"https://api.github.com/users/rails","html_url":"https://github.com/rails","followers_url":"https://api.github.com/users/rails/followers","following_url":"https://api.github.com/users/rails/following{/other_user}","gists_url":"https://api.github.com/users/rails/gists{/gist_id}","starred_url":"https://api.github.com/users/rails/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rails/subscriptions","organizations_url":"https://api.github.com/users/rails/orgs","repos_url":"https://api.github.com/users/rails/repos","events_url":"https://api.github.com/users/rails/events{/privacy}","received_events_url":"https://api.github.com/users/rails/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rails/rails","description":"Ruby on Rails","fork":false,"url":"https://api.github.com/repos/rails/rails","forks_url":"https://api.github.com/repos/rails/rails/forks","keys_url":"https://api.github.com/repos/rails/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rails/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rails/rails/teams","hooks_url":"https://api.github.com/repos/rails/rails/hooks","issue_events_url":"https://api.github.com/repos/rails/rails/issues/events{/number}","events_url":"https://api.github.com/repos/rails/rails/events","assignees_url":"https://api.github.com/repos/rails/rails/assignees{/user}","branches_url":"https://api.github.com/repos/rails/rails/branches{/branch}","tags_url":"https://api.github.com/repos/rails/rails/tags","blobs_url":"https://api.github.com/repos/rails/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rails/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rails/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/rails/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rails/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/rails/rails/languages","stargazers_url":"https://api.github.com/repos/rails/rails/stargazers","contributors_url":"https://api.github.com/repos/rails/rails/contributors","subscribers_url":"https://api.github.com/repos/rails/rails/subscribers","subscription_url":"https://api.github.com/repos/rails/rails/subscription","commits_url":"https://api.github.com/repos/rails/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/rails/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/rails/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/rails/rails/issues/comments/{number}","contents_url":"https://api.github.com/repos/rails/rails/contents/{+path}","compare_url":"https://api.github.com/repos/rails/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rails/rails/merges","archive_url":"https://api.github.com/repos/rails/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rails/rails/downloads","issues_url":"https://api.github.com/repos/rails/rails/issues{/number}","pulls_url":"https://api.github.com/repos/rails/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/rails/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/rails/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rails/rails/labels{/name}","releases_url":"https://api.github.com/repos/rails/rails/releases{/id}","created_at":"2008-04-11T02:19:47Z","updated_at":"2014-06-17T20:06:39Z","pushed_at":"2014-06-17T20:06:38Z","git_url":"git://github.com/rails/rails.git","ssh_url":"git@github.com:rails/rails.git","clone_url":"https://github.com/rails/rails.git","svn_url":"https://github.com/rails/rails","homepage":"http://rubyonrails.org","size":323042,"stargazers_count":22185,"watchers_count":22185,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"forks_count":8238,"mirror_url":null,"open_issues_count":611,"forks":8238,"open_issues":611,"watchers":22185,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rails/rails/pulls/15777"},"html":{"href":"https://github.com/rails/rails/pull/15777"},"issue":{"href":"https://api.github.com/repos/rails/rails/issues/15777"},"comments":{"href":"https://api.github.com/repos/rails/rails/issues/15777/comments"},"review_comments":{"href":"https://api.github.com/repos/rails/rails/pulls/15777/comments"},"review_comment":{"href":"https://api.github.com/repos/rails/rails/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/rails/rails/pulls/15777/commits"},"statuses":{"href":"https://api.github.com/repos/rails/rails/statuses/9f3c36e97e8b3158a5728721b4ac07332084692b"}}}}