Bump secure_headers gem to a more recent version

[agrare]

Update the secure_headers gem to a more recent version

GHSA-xq52-rv6w-397c

[Fryguy]

@martinpovolny @himdel Can you also please review? If I recall, this affects the UI.

[himdel]

Looking...

(changelog: from https://github.com/twitter/secure_headers/blob/master/CHANGELOG.md#310-adding-secure-cookie-support to https://github.com/twitter/secure_headers/blob/master/CHANGELOG.md#372)

[Fryguy]

Not sure if this affects the API or not...I don't think so, but I could be wrong.

[himdel]

Agreed, not seeing any potential issues in the changelog.

The UI is overriding CSP for iframe menu items (/dashboard/iframe)
for websockets (every request),
and for html5 consoles (/vm*/launch_html5_console).

Websockets seem to keep working,
/dashboard/iframe fails to set x_frame_options now, but that seems caused by #6908, not here,
EDIT: dashboard/iframe works with domains which do not set their own x_frame_options,
(not testing remote consoles).

I think LGTM :)

[Fryguy]

Related to GHSA-xq52-rv6w-397c

[Fryguy]

Adam can you update the commit message to link to GHSA-xq52-rv6w-397c ?

[agrare]

👍 yeah, wasn't sure if this was like a "get the fix in before making the flaw public" thing

[Fryguy]

The flaw's already public 😅

[agrare]

True, the security issue on ManageIQ wasn't public (e.g. on the security tab) though

[miq-bot]

Checked commit agrare@822cebb with ruby 2.5.5, rubocop 0.69.0, haml-lint 0.20.0, and yamllint 1.10.0
1 file checked, 0 offenses detected
Everything looks fine. 🍰

[himdel]

Causes API failure on travis...

Failures:
1864
1865  1) Headers Response Headers returns some headers related to security
1866     Failure/Error: expect(content_security_policy_for("frame-src")).to include("'self'")
1867       expected nil to include "'self'", but it does not respond to `include?`
1868     # ./spec/requests/headers_spec.rb:84:in `block (3 levels) in <top (required)>'

[himdel]

(Fixed in ManageIQ/manageiq-api#729)

[himdel]

Given ManageIQ/manageiq-api#729 (comment),
are there any plans to upgrade to a newer secure_headers branch?

[agrare]

@himdel if you want to go to ~>6.3 I'd be all for that, for a security fix I wanted to stay on the same major version in the hopes that it'd minimize breakage