Filter out unnecessary headers

Author: Inbal Tako

lib/securenative/frameworks/hanami.rb

@@ -36,11 +36,9 @@ def self.get_method(request)
       def self.get_headers(request)
         begin
           headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) }.each { |header|
-            headers.append(header[0].downcase.gsub("_", "-"))
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
           }
-          headers.append({'user-agent' => request.env['HTTP_USER_AGENT']})
-
           return headers
         rescue StandardError
           nil

lib/securenative/frameworks/rails.rb

@@ -38,11 +38,9 @@ def self.get_method(request)
       def self.get_headers(request)
         begin
           headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) }.each { |header|
-            headers.append(header[0].downcase.gsub("_", "-"))
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
           }
-          headers.append({'user-agent' => request.env['HTTP_USER_AGENT']})
-
           return headers
         rescue StandardError
           nil

lib/securenative/frameworks/sinatra.rb

@@ -36,11 +36,9 @@ def self.get_method(request)
       def self.get_headers(request)
         begin
           headers = []
-          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) }.each { |header|
-            headers.append(header[0].downcase.gsub("_", "-"))
+          request.headers.env.select { |k, _| k.in?(ActionDispatch::Http::Headers::CGI_VARIABLES) || k =~ /^HTTP_/ }.each { |header|
+            headers.append(header[0].downcase.gsub("http_", "").gsub("_", "-"))
           }
-          headers.append({'user-agent' => request.env['HTTP_USER_AGENT']})
-
           return headers
         rescue StandardError
           nil