asset_bom_removal-rails 0.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: f59301107c46145d4c017052fe4d35ddf67e91db
+  data.tar.gz: 185fba902717de245bdd7ab9399a70b92fe85984
+SHA512:
+  metadata.gz: 7becb82d56a30be368f6d4ca288e4ae012484d715607a05edb8acdb7f17013f9d05d0dec4950c55b56920e668b6bc6cd2302a82876fb1259bc0e62692d197f0f
+  data.tar.gz: 2682457fadeac5509561b443a469b18eedce056ad22683ebcb2c59acbbed8d15e192bf17b66532b76941e3637b3cbfc1f6d545f9a0e14bd29619c1b63b4a1fbd

data/.gitignore

@@ -0,0 +1,12 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+
+# rspec failure tracking
+.rspec_status

data/.rspec

@@ -0,0 +1,2 @@
+--format documentation
+--color

data/.ruby-version

@@ -0,0 +1 @@
+2.4

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in asset-bom-removal-rails.gemspec
+gemspec

data/Jenkinsfile

@@ -0,0 +1,6 @@
+#!/usr/bin/env groovy
+
+node {
+  def govuk = load '/var/lib/jenkins/groovy_scripts/govuk_jenkinslib.groovy'
+  govuk.buildProject()
+}

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Crown Copyright (Government Digital Service)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,42 @@
+# Asset::Bom::Removal::Rails
+
+This gem hooks into [Rails `assets:precompile` task](http://guides.rubyonrails.org/asset_pipeline.html#precompiling-assets) and removes the BOM from any CSS files (and their gzipped versions) in the asset root.
+
+We do this because we want to use [SRI](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) on our assets, but [a bug in Firefox versions < 52](https://bugzilla.mozilla.org/show_bug.cgi?id=1269241) means it calculates the hash incorrectly when the CSS asset has a [BOM](https://en.wikipedia.org/wiki/Byte_order_mark#UTF-8) and refuses to load the asset.  The BOM is [generated by SASS versions > 3.4](https://github.com/sass/sass/blob/3.4.0/lib/sass/tree/visitors/to_css.rb#L131-L140) and in the versions of rails, sass, sprockets, sass-rails, and sprockets-rails we use it is impossible to configure SASS to stop doing this (as mentioned [in the sass-rails readme](https://github.com/rails/sass-rails/blob/v4.0.0/README.md#configuration) from version 4.0+).
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'asset-bom-removal-rails'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install asset_bom_removal-rails
+
+## Usage
+
+The gem hooks itself into rails assets pipeline so when you run `assets:precompile` it will be used.  When a css file is compiled with this gem in the app any BOM added by sass will be removed before the compiled CSS is passed to the rest of the asset pipeline to be persisted and added to the manifest.
+
+It should only affect production environments because sass is (by default) only configured to use `:compressed` style (and thus generate BOMs) in production mode.  In development it uses `:expanded` which does not trigger the BOM insertion.
+
+It replaces the default `css_compressor` (as configured in rails via `config.assets.css_compressor`) with a version that strips the BOM.  It won't do it if the `css_compressor` is configured and is not `:sass` or `:scss`.
+
+## Development
+
+After checking out the repo, run `bundle install` to install dependencies. Then, run `rake spec` to run the tests.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/alphagov/asset-bom-removal-rails.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
+

data/Rakefile

@@ -0,0 +1,6 @@
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task test: :spec
+task default: :spec

data/asset_bom_removal-rails.gemspec

@@ -0,0 +1,29 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'asset_bom_removal/rails/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "asset_bom_removal-rails"
+  spec.version       = AssetBomRemoval::Rails::VERSION
+  spec.authors       = ["Government Digital Service"]
+  spec.email         = ["govuk-dev@digital.cabinet-office.gov.uk"]
+
+  spec.summary       = "Removes the BOM from CSS files in rails asset pipeline"
+  spec.description   = "Hooks into rails asset:precompile task to remove the BOM from any CSS files generated by SASS.  Firefox < 52 has a bug when calculating SRI for CSS files with a BOM and removing it has no downsides so that's what we do."
+  spec.homepage      = "https://github.com/alphagov/asset_bom_removal-rails"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "rails", ">= 4.2"
+  spec.add_dependency "sass", "> 3.4"
+
+  spec.add_development_dependency "bundler", "~> 1.14"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_development_dependency "govuk-lint"
+end

data/lib/asset_bom_removal/rails.rb

@@ -0,0 +1 @@
+require "asset_bom_removal/rails/railtie" if defined?(Rails)

data/lib/asset_bom_removal/rails/railtie.rb

@@ -0,0 +1,32 @@
+require 'asset_bom_removal/sass_no_bom_compressor'
+
+module AssetBomRemoval
+  module Rails
+    class Railtie < ::Rails::Railtie
+      def sass_might_output_bom?(app)
+        ::Rails.env.production? || app.config.sass.style == :compressed
+      end
+
+      def app_uses_sass_for_css_compression?(app)
+        # if css_compressor is not already set, it will be set to sass by
+        # sass-rails
+        css_compressor = (app.config.assets.fetch(:css_compressor, nil) || :sass)
+        [:sass, :scss].include? css_compressor.to_sym
+      end
+
+      def setup_css_compression_with_bom_removal(app)
+        if sass_might_output_bom?(app)
+          # We only need to do this if sass will be using :compressed style
+          # because other styles don't output a BOM
+          if app_uses_sass_for_css_compression?(app)
+            app.config.assets.css_compressor = AssetBomRemoval::SassNoBomCompressor
+          end
+        end
+      end
+
+      initializer :setup_css_compression_with_bom_removal, group: :all do |app|
+        setup_css_compression_with_bom_removal(app)
+      end
+    end
+  end
+end

data/lib/asset_bom_removal/rails/version.rb

@@ -0,0 +1,5 @@
+module AssetBomRemoval
+  module Rails
+    VERSION = '0.0.0'.freeze
+  end
+end

data/lib/asset_bom_removal/sass_no_bom_compressor.rb

@@ -0,0 +1,20 @@
+require 'sprockets/sass_compressor'
+
+module AssetBomRemoval
+  class SassNoBomCompressor < Sprockets::SassCompressor
+    # Let the default sass processor do all the hard work
+    def call(input)
+      remove_bom_from_css(super(input))
+    end
+
+  private
+
+    def remove_bom_from_css(css_string)
+      if css_string.bytes[0..2] == [0xEF, 0xBB, 0xBF]
+        css_string[3..-1]
+      else
+        css_string
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,144 @@
+--- !ruby/object:Gem::Specification
+name: asset_bom_removal-rails
+version: !ruby/object:Gem::Version
+  version: 0.0.0
+platform: ruby
+authors:
+- Government Digital Service
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-07-12 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+- !ruby/object:Gem::Dependency
+  name: sass
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.14'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.14'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: govuk-lint
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Hooks into rails asset:precompile task to remove the BOM from any CSS
+  files generated by SASS.  Firefox < 52 has a bug when calculating SRI for CSS files
+  with a BOM and removing it has no downsides so that's what we do.
+email:
+- govuk-dev@digital.cabinet-office.gov.uk
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".ruby-version"
+- CHANGELOG.md
+- Gemfile
+- Jenkinsfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- asset_bom_removal-rails.gemspec
+- lib/asset_bom_removal/rails.rb
+- lib/asset_bom_removal/rails/railtie.rb
+- lib/asset_bom_removal/rails/version.rb
+- lib/asset_bom_removal/sass_no_bom_compressor.rb
+homepage: https://github.com/alphagov/asset_bom_removal-rails
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.8
+signing_key: 
+specification_version: 4
+summary: Removes the BOM from CSS files in rails asset pipeline
+test_files: []