don't strip schemes from report-uris

Author: oreoshake

lib/secure_headers/headers/content_security_policy.rb

@@ -313,7 +313,8 @@ def build_directive(directive_name)
         end
 
         # remove schemes and dedup source expressions
-        dedup_source_list(strip_source_schemes(source_list)).join(" ")
+        source_list = strip_source_schemes(source_list) unless directive_name == REPORT_URI
+        dedup_source_list(source_list).join(" ")
       end
       [symbol_to_hyphen_case(directive_name), value].join(" ")
     end

spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -85,6 +85,11 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does not remove schemes from report-uri values" do
+        csp = ContentSecurityPolicy.new(default_src: %w(https:), report_uri: %w(https://example.org))
+        expect(csp.value).to eq("default-src https:; report-uri https://example.org")
+      end
+
       it "removes nil from source lists" do
         csp = ContentSecurityPolicy.new(default_src: ["https://example.org", nil])
         expect(csp.value).to eq("default-src example.org")