Skip to content

Commit

Permalink
FEATURE: Support dynamic config.content_security_policy_nonce
Browse files Browse the repository at this point in the history
CSP nonce values change on every request, so accepting a static string as an option doesn't really make sense. This commit allows `config.content_security_policy_nonce` to be set to a Proc which is run for each request, and can return a nonce based on the `env` and current response headers.
  • Loading branch information
davidtaylorhq committed Feb 14, 2024
1 parent 68a69b3 commit 4024c92
Show file tree
Hide file tree
Showing 5 changed files with 52 additions and 4 deletions.
4 changes: 4 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# CHANGELOG

## Unreleased
- [FEATURE] Support dynamic `config.content_security_policy_nonce` [#609](https://github.com/MiniProfiler/rack-mini-profiler/pull/609)


## 3.3.0 - 2023-12-07
- [FEATURE] Use `?pp=flamegraph?ignore_gc=true` or `config.flamegraph_ignore_gc` to ignore gc in flamegraphs. [#599](https://github.com/MiniProfiler/rack-mini-profiler/pull/599)

Expand Down
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -448,7 +448,7 @@ snapshots_transport_destination_url | `nil`
snapshots_transport_auth_key | `nil` | `POST` requests made by the snapshots transporter to the destination URL will have a `Mini-Profiler-Transport-Auth` header with the value of this config. Make sure you use a secure and random key for this config.
snapshots_redact_sql_queries | `true` | When this is true, SQL queries will be redacted from sampling snapshots, but the backtrace and duration of each SQL query will be saved with the snapshot to keep debugging performance issues possible.
snapshots_transport_gzip_requests | `false` | Make the snapshots transporter gzip the requests it makes to `snapshots_transport_destination_url`.
content_security_policy_nonce | Rails: Current nonce<br>Rack: nil | Set the content security policy nonce to use when inserting MiniProfiler's script block.
content_security_policy_nonce | Rails: Current nonce<br>Rack: nil | Set the content security policy nonce to use when inserting MiniProfiler's script block. Can be set to a static string, or a Proc which receives `env` and `response_headers` as arguments and returns the nonce.
enable_hotwire_turbo_drive_support | `false` | Enable support for Hotwire TurboDrive page transitions.
profile_parameter | `'pp'` | The query parameter used to interact with this gem.

Expand Down
2 changes: 1 addition & 1 deletion lib/mini_profiler.rb
Original file line number Diff line number Diff line change
Expand Up @@ -440,7 +440,7 @@ def inject_profiler(env, status, headers, body)

if current.inject_js && content_type =~ /text\/html/
response = Rack::Response.new([], status, headers)
script = self.get_profile_script(env)
script = self.get_profile_script(env, headers)

if String === body
response.write inject(body, script)
Expand Down
9 changes: 7 additions & 2 deletions lib/mini_profiler/views.rb
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ def generate_html(page_struct, env, result_json = page_struct.to_json)
# Use it when:
# * you have disabled auto append behaviour throught :auto_inject => false flag
# * you do not want script to be automatically appended for the current page. You can also call cancel_auto_inject
def get_profile_script(env)
def get_profile_script(env, response_headers = {})
path = public_base_path(env)
version = MiniProfiler::ASSET_VERSION
if @config.assets_url
Expand All @@ -39,7 +39,12 @@ def get_profile_script(env)
url = "#{path}includes.js?v=#{version}" if !url
css_url = "#{path}includes.css?v=#{version}" if !css_url

content_security_policy_nonce = @config.content_security_policy_nonce ||
configured_nonce = @config.content_security_policy_nonce
if configured_nonce && !configured_nonce.is_a?(String)
configured_nonce = configured_nonce.call(env, response_headers)
end

content_security_policy_nonce = configured_nonce ||
env["action_dispatch.content_security_policy_nonce"] ||
env["secure_headers_content_security_policy_nonce"]

Expand Down
39 changes: 39 additions & 0 deletions spec/integration/middleware_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -242,4 +242,43 @@ def with_profile_parameter(param)
end
end
end

context "with CSP nonce" do
def app
Rack::Builder.new do
use Rack::MiniProfiler
run lambda { |env|
env["action_dispatch.content_security_policy_nonce"] = "railsnonce"
[200, { 'Content-Type' => 'text/html' }, [+'<html><body><h1>Hello world</h1></body></html>']]
}
end
end

it 'uses Rails value when available' do
do_get
expect(last_response.body).to include("nonce=\"railsnonce\"")
end

it 'uses configured string when available' do
Rack::MiniProfiler.config.content_security_policy_nonce = "configurednonce"
do_get
expect(last_response.body).to include("nonce=\"configurednonce\"")
end

it 'calls configured block when available' do
proc_arguments = nil

Rack::MiniProfiler.config.content_security_policy_nonce = Proc.new do |env, response_headers|
proc_arguments = [env, response_headers]
"dynamicnonce"
end

do_get
expect(last_response.body).to include("nonce=\"dynamicnonce\"")

(env, response_headers) = proc_arguments
expect(env["REQUEST_METHOD"]).to eq("GET")
expect(response_headers["Content-Type"]).to eq("text/html")
end
end
end

0 comments on commit 4024c92

Please sign in to comment.