From 590522c96e157b3a6752a85843e09ce39b3d1bfe Mon Sep 17 00:00:00 2001
From: Neil Matatall <oreoshake@users.noreply.github.com>
Date: Tue, 21 Jan 2020 10:38:33 -1000
Subject: [PATCH 1/4] remove ancient versions

---
 .travis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 30723457..fae1c744 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,9 +2,9 @@ language: ruby
 
 rvm:
   - ruby-head
-  - 2.4.2
-  - 2.3.5
-  - 2.2.8
+  - 2.6
+  - 2.4
+  - 2.4
   - jruby-head
 
 env:

From e4075d5a4233b2c0e85489007bccbdf06d348980 Mon Sep 17 00:00:00 2001
From: Neil Matatall <oreoshake@users.noreply.github.com>
Date: Tue, 21 Jan 2020 08:44:58 -1000
Subject: [PATCH 2/4] escape semicolons by replacing them with spaces

See https://github.com/twitter/secure_headers/issues/418
---
 lib/secure_headers/headers/content_security_policy.rb  | 10 ++++++++--
 .../headers/content_security_policy_spec.rb            |  5 +++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/secure_headers/headers/content_security_policy.rb b/lib/secure_headers/headers/content_security_policy.rb
index 42751817..8507f03c 100644
--- a/lib/secure_headers/headers/content_security_policy.rb
+++ b/lib/secure_headers/headers/content_security_policy.rb
@@ -138,8 +138,14 @@ def build_source_list_directive(directive)
       end
 
       if source_list != OPT_OUT && source_list && source_list.any?
-        normalized_source_list = minify_source_list(directive, source_list)
-        [symbol_to_hyphen_case(directive), normalized_source_list].join(" ")
+        minified_source_list = minify_source_list(directive, source_list).join(" ")
+
+        if minified_source_list.include?(";")
+          Kernel.warn("#{directive} contains a ; in '#{minified_source_list}' which will raise an error in future versions. It has been replaced with a blank space.")
+        end
+
+        escaped_source_list = minified_source_list.gsub(";", " ")
+        [symbol_to_hyphen_case(directive), escaped_source_list].join(" ").strip
       end
     end
 
diff --git a/spec/lib/secure_headers/headers/content_security_policy_spec.rb b/spec/lib/secure_headers/headers/content_security_policy_spec.rb
index 2f190607..a9dc310c 100644
--- a/spec/lib/secure_headers/headers/content_security_policy_spec.rb
+++ b/spec/lib/secure_headers/headers/content_security_policy_spec.rb
@@ -28,6 +28,11 @@ module SecureHeaders
         expect(ContentSecurityPolicy.new.value).to eq("default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:")
       end
 
+      it "deprecates and escapes semicolons in directive source lists" do
+        expect(Kernel).to receive(:warn).with("frame_ancestors contains a ; in 'google.com;script-src *;.;' which will raise an error in future versions. It has been replaced with a blank space.")
+        expect(ContentSecurityPolicy.new(frame_ancestors: %w(https://google.com;script-src https://*;.;)).value).to eq("frame-ancestors google.com script-src * .")
+      end
+
       it "discards 'none' values if any other source expressions are present" do
         csp = ContentSecurityPolicy.new(default_opts.merge(child_src: %w('self' 'none')))
         expect(csp.value).not_to include("'none'")

From c140809dd2f7b7194d38b4204fb828c91f3c4f10 Mon Sep 17 00:00:00 2001
From: Neil Matatall <448516+oreoshake@users.noreply.github.com>
Date: Tue, 21 Jan 2020 10:45:34 -1000
Subject: [PATCH 3/4] Update .travis.yml

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index fae1c744..f9ca0088 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@ language: ruby
 rvm:
   - ruby-head
   - 2.6
-  - 2.4
+  - 2.5
   - 2.4
   - jruby-head
 

From ca01ecfbf62406e3a66d57c7a441e80676d0a929 Mon Sep 17 00:00:00 2001
From: Neil Matatall <oreoshake@users.noreply.github.com>
Date: Tue, 21 Jan 2020 11:16:05 -1000
Subject: [PATCH 4/4] pin to legacy robocop

---
 Gemfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile b/Gemfile
index 39d06141..c2f29818 100644
--- a/Gemfile
+++ b/Gemfile
@@ -9,7 +9,7 @@ group :test do
   gem "pry-nav"
   gem "rack"
   gem "rspec"
-  gem "rubocop"
+  gem "rubocop", "< 0.68"
   gem "rubocop-github"
   gem "term-ansicolor"
   gem "tins"