From 4024c922622551cc9b5ff0662907b73c494da165 Mon Sep 17 00:00:00 2001 From: David Taylor Date: Wed, 14 Feb 2024 17:26:53 +0000 Subject: [PATCH] FEATURE: Support dynamic `config.content_security_policy_nonce` CSP nonce values change on every request, so accepting a static string as an option doesn't really make sense. This commit allows `config.content_security_policy_nonce` to be set to a Proc which is run for each request, and can return a nonce based on the `env` and current response headers. --- CHANGELOG.md | 4 +++ README.md | 2 +- lib/mini_profiler.rb | 2 +- lib/mini_profiler/views.rb | 9 +++++-- spec/integration/middleware_spec.rb | 39 +++++++++++++++++++++++++++++ 5 files changed, 52 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f57807da..b570e23f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # CHANGELOG +## Unreleased +- [FEATURE] Support dynamic `config.content_security_policy_nonce` [#609](https://github.com/MiniProfiler/rack-mini-profiler/pull/609) + + ## 3.3.0 - 2023-12-07 - [FEATURE] Use `?pp=flamegraph?ignore_gc=true` or `config.flamegraph_ignore_gc` to ignore gc in flamegraphs. [#599](https://github.com/MiniProfiler/rack-mini-profiler/pull/599) diff --git a/README.md b/README.md index 00322cad..99a95ee7 100644 --- a/README.md +++ b/README.md @@ -448,7 +448,7 @@ snapshots_transport_destination_url | `nil` snapshots_transport_auth_key | `nil` | `POST` requests made by the snapshots transporter to the destination URL will have a `Mini-Profiler-Transport-Auth` header with the value of this config. Make sure you use a secure and random key for this config. snapshots_redact_sql_queries | `true` | When this is true, SQL queries will be redacted from sampling snapshots, but the backtrace and duration of each SQL query will be saved with the snapshot to keep debugging performance issues possible. snapshots_transport_gzip_requests | `false` | Make the snapshots transporter gzip the requests it makes to `snapshots_transport_destination_url`. -content_security_policy_nonce | Rails: Current nonce
Rack: nil | Set the content security policy nonce to use when inserting MiniProfiler's script block. +content_security_policy_nonce | Rails: Current nonce
Rack: nil | Set the content security policy nonce to use when inserting MiniProfiler's script block. Can be set to a static string, or a Proc which receives `env` and `response_headers` as arguments and returns the nonce. enable_hotwire_turbo_drive_support | `false` | Enable support for Hotwire TurboDrive page transitions. profile_parameter | `'pp'` | The query parameter used to interact with this gem. diff --git a/lib/mini_profiler.rb b/lib/mini_profiler.rb index 46743b11..e040af49 100644 --- a/lib/mini_profiler.rb +++ b/lib/mini_profiler.rb @@ -440,7 +440,7 @@ def inject_profiler(env, status, headers, body) if current.inject_js && content_type =~ /text\/html/ response = Rack::Response.new([], status, headers) - script = self.get_profile_script(env) + script = self.get_profile_script(env, headers) if String === body response.write inject(body, script) diff --git a/lib/mini_profiler/views.rb b/lib/mini_profiler/views.rb index f5754b01..5b987cfa 100644 --- a/lib/mini_profiler/views.rb +++ b/lib/mini_profiler/views.rb @@ -28,7 +28,7 @@ def generate_html(page_struct, env, result_json = page_struct.to_json) # Use it when: # * you have disabled auto append behaviour throught :auto_inject => false flag # * you do not want script to be automatically appended for the current page. You can also call cancel_auto_inject - def get_profile_script(env) + def get_profile_script(env, response_headers = {}) path = public_base_path(env) version = MiniProfiler::ASSET_VERSION if @config.assets_url @@ -39,7 +39,12 @@ def get_profile_script(env) url = "#{path}includes.js?v=#{version}" if !url css_url = "#{path}includes.css?v=#{version}" if !css_url - content_security_policy_nonce = @config.content_security_policy_nonce || + configured_nonce = @config.content_security_policy_nonce + if configured_nonce && !configured_nonce.is_a?(String) + configured_nonce = configured_nonce.call(env, response_headers) + end + + content_security_policy_nonce = configured_nonce || env["action_dispatch.content_security_policy_nonce"] || env["secure_headers_content_security_policy_nonce"] diff --git a/spec/integration/middleware_spec.rb b/spec/integration/middleware_spec.rb index 063153f8..acb6f98a 100644 --- a/spec/integration/middleware_spec.rb +++ b/spec/integration/middleware_spec.rb @@ -242,4 +242,43 @@ def with_profile_parameter(param) end end end + + context "with CSP nonce" do + def app + Rack::Builder.new do + use Rack::MiniProfiler + run lambda { |env| + env["action_dispatch.content_security_policy_nonce"] = "railsnonce" + [200, { 'Content-Type' => 'text/html' }, [+'

Hello world

']] + } + end + end + + it 'uses Rails value when available' do + do_get + expect(last_response.body).to include("nonce=\"railsnonce\"") + end + + it 'uses configured string when available' do + Rack::MiniProfiler.config.content_security_policy_nonce = "configurednonce" + do_get + expect(last_response.body).to include("nonce=\"configurednonce\"") + end + + it 'calls configured block when available' do + proc_arguments = nil + + Rack::MiniProfiler.config.content_security_policy_nonce = Proc.new do |env, response_headers| + proc_arguments = [env, response_headers] + "dynamicnonce" + end + + do_get + expect(last_response.body).to include("nonce=\"dynamicnonce\"") + + (env, response_headers) = proc_arguments + expect(env["REQUEST_METHOD"]).to eq("GET") + expect(response_headers["Content-Type"]).to eq("text/html") + end + end end