blazer 3.0.0 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2162f01b076af999532a8e117f91398e2856e20877b114a0ab9f3c40cc41563b
-  data.tar.gz: 53826d22d24afdd1ea5c5456939480926cd8f75a7c06d6065f75e42f8d6a79fc
+  metadata.gz: 5c0195ef0a71f12d25336eeb7e50ddcf7a307480a34c778c884d805cb046068e
+  data.tar.gz: '068f14c8b5c5df75a8638fd1f6354d9957f56fc3bf855944dadb23ce69aa336a'
 SHA512:
-  metadata.gz: 47d13182d74b1cd21bed954519c7b6a38253db3bf88f09b75e7f1172c7ac1d62cbfefe402c7a9eb9f0e232f470f35c3f55f7b2bcc535ad8aa50e22c9814ff71f
-  data.tar.gz: 74af2d3652a256f1d4ec05da4ef0a86e53dd9b8671c42bc3f60b5862279059c2d5c846d813d6720030326df249caeaec6fca87a49336999ea9bbf97579d26ade
+  metadata.gz: 9fe14dbedbe3705c61339074437c2117d102d03a15050a3caaa9df4b2077937911891b01a1d4afd92ca432330191133a1f8e098d2695d050c00799a918badf82
+  data.tar.gz: 074d5b2d452d90741a950257fb69b96b01f3e3d0b5ae5570a096d6a23e17d529322018b3d4ebad2ca5793fa77386d41c1472c22fa9a8f272c5026e5ccca4e618

data/CHANGELOG.md

@@ -1,3 +1,43 @@
+## 3.3.0 (2025-04-12)
+
+- Fixed error with forecasting with Rails 7.2+
+- Dropped support for Ruby < 3.2 and Rails < 7.1
+
+## 3.2.1 (2025-03-21)
+
+- Added thousands separator to charts
+- Improved i18n for charts
+- Fixed leading zeros in variables
+
+## 3.2.0 (2025-02-23)
+
+- Added support for Trino
+- Added support for `neo4j-ruby-driver` gem
+- Fixed types for SQLite
+- Fixed table preview and schema page for SQLite
+
+## 3.1.0 (2024-10-14)
+
+- Fixed error when Propshaft is installed but not used
+- Dropped support for Ruby < 3.1 and Rails < 7
+
+## 3.0.4 (2024-09-04)
+
+- Improved CSP support
+- Fixed error with Trilogy and Rails 7.2
+
+## 3.0.3 (2024-01-10)
+
+- Fixed error with Trilogy, non-ASCII column names, and charts
+
+## 3.0.2 (2023-11-28)
+
+- Fixed error with SQLite and prepared statements
+
+## 3.0.1 (2023-10-08)
+
+- Fixed error with Rails 7.1 when no user model
+
 ## 3.0.0 (2023-09-20)
 
 - Switched from Mapbox.js to Mapbox GL JS v1 for maps (this affects Mapbox billing)
@@ -424,3 +464,20 @@ There was no 1.8.1 release.
 - Added support for Rails 4.2
 - Fixed error with `mysql2` adapter
 - Added `user_class` option
+
+## 0.0.4 (2014-11-19)
+
+- Added timeout
+
+## 0.0.3 (2014-10-08)
+
+- Made editor bigger
+
+## 0.0.2 (2014-10-01)
+
+- Added query to audits
+- Added `user_name` option
+
+## 0.0.1 (2014-09-30)
+
+- First release

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2014-2023 Andrew Kane
+Copyright (c) 2014-2025 Andrew Kane
 
 MIT License
 

data/README.md

@@ -4,13 +4,13 @@ Explore your data with SQL. Easily create charts and dashboards, and share them
 
 [Try it out](https://blazer.dokkuapp.com)
 
-[![Screenshot](https://blazer.dokkuapp.com/assets/blazer-a10baa40fef1ca2f5bb25fc97bcf261a6a54192fb1ad0f893c0f562b8c7c4697.png)](https://blazer.dokkuapp.com)
+[![Screenshot](https://blazer.dokkuapp.com/assets/blazer-176c595c.png)](https://blazer.dokkuapp.com)
 
 Blazer is also available as a [Docker image](https://github.com/ankane/blazer-docker).
 
 :tangerine: Battle-tested at [Instacart](https://www.instacart.com/opensource)
 
-[![Build Status](https://github.com/ankane/blazer/workflows/build/badge.svg?branch=master)](https://github.com/ankane/blazer/actions)
+[![Build Status](https://github.com/ankane/blazer/actions/workflows/build.yml/badge.svg)](https://github.com/ankane/blazer/actions)
 
 ## Features
 
@@ -71,7 +71,7 @@ Be sure to set a host in `config/environments/production.rb` for emails to work.
 config.action_mailer.default_url_options = {host: "blazer.dokkuapp.com"}
 ```
 
-Schedule checks to run (with cron, [Heroku Scheduler](https://elements.heroku.com/addons/scheduler), etc). The default options are every 5 minutes, 1 hour, or 1 day, which you can customize. For each of these options, set up a task to run.
+Schedule checks to run (with cron, Solid Queue, [Heroku Scheduler](https://elements.heroku.com/addons/scheduler), etc). The default options are every 5 minutes, 1 hour, or 1 day, which you can customize. For each of these options, set up a task to run.
 
 ```sh
 rake blazer:run_checks SCHEDULE="5 minutes"
@@ -94,6 +94,24 @@ Here’s what it looks like with cron.
 0   8 * * * rake blazer:send_failing_checks
 ```
 
+For Solid Queue, update `config/recurring.yml`.
+
+```yml
+production:
+  blazer_run_checks_5_minutes:
+    command: "Blazer.run_checks(schedule: '5 minutes')"
+    schedule: every 5 minutes
+  blazer_run_checks_1_hour:
+    command: "Blazer.run_checks(schedule: '1 hour')"
+    schedule: every hour
+  blazer_run_checks_1_day:
+    command: "Blazer.run_checks(schedule: '1 day')"
+    schedule: every day at 7:30am
+  blazer_send_failing_checks:
+    command: "Blazer.send_failing_checks"
+    schedule: every day at 8am
+```
+
 For Slack notifications, create an [incoming webhook](https://slack.com/apps/A0F7XDUAZ-incoming-webhooks) and set:
 
 ```sh
@@ -125,7 +143,7 @@ end
 
 ### Other
 
-Specify a `before_action` method to run in `blazer.yml`.
+Specify a `before_action` method to run in `config/blazer.yml`.
 
 ```yml
 before_action_method: require_admin
@@ -136,7 +154,7 @@ You can define this method in your `ApplicationController`.
 ```ruby
 def require_admin
   # depending on your auth, something like...
-  redirect_to root_path unless current_user && current_user.admin?
+  redirect_to main_app.root_path unless current_user && current_user.admin?
 end
 ```
 
@@ -158,7 +176,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO blazer;
 COMMIT;
 ```
 
-### MySQL
+### MySQL and MariaDB
 
 Create a user with read-only permissions:
 
@@ -213,7 +231,7 @@ SELECT * FROM users WHERE occupation_id = {occupation_id}
 
 Instead of remembering each occupation’s id, users can select occupations by name.
 
-Add a smart variable with:
+Add a smart variable in `config/blazer.yml` with:
 
 ```yml
 smart_variables:
@@ -431,24 +449,22 @@ anomaly_checks: prophet
 
 ### Trend
 
-[Trend](https://trendapi.org/) uses an external service by default, but you can run it on your own infrastructure as well.
-
 Add [trend](https://github.com/ankane/trend) to your Gemfile:
 
 ```ruby
 gem "trend"
 ```
 
-And add to `config/blazer.yml`:
+Set the URL to the [API](https://github.com/ankane/trend-api) in an initializer:
 
-```yml
-anomaly_checks: trend
+```ruby
+Trend.url = "http://localhost:8000"
 ```
 
-For the [self-hosted API](https://github.com/ankane/trend-api), create an initializer with:
+And add to `config/blazer.yml`:
 
-```ruby
-Trend.url = "http://localhost:8000"
+```yml
+anomaly_checks: trend
 ```
 
 ### AnomalyDetection.rb
@@ -487,24 +503,22 @@ forecasting: prophet
 
 ### Trend
 
-[Trend](https://trendapi.org/) uses an external service by default, but you can run it on your own infrastructure as well.
-
 Add [trend](https://github.com/ankane/trend) to your Gemfile:
 
 ```ruby
 gem "trend"
 ```
 
-And add to `config/blazer.yml`:
+Set the URL to the [API](https://github.com/ankane/trend-api) in an initializer:
 
-```yml
-forecasting: trend
+```ruby
+Trend.url = "http://localhost:8000"
 ```
 
-For the [self-hosted API](https://github.com/ankane/trend-api), create an initializer with:
+And add to `config/blazer.yml`:
 
-```ruby
-Trend.url = "http://localhost:8000"
+```yml
+forecasting: trend
 ```
 
 ## Uploads
@@ -566,15 +580,15 @@ data_sources:
 - [Google BigQuery](#google-bigquery)
 - [IBM DB2 and Informix](#ibm-db2-and-informix)
 - [InfluxDB](#influxdb)
-- [MySQL](#mysql-1)
+- [MySQL and MariaDB](#mysql-and-mariadb-1)
 - [Neo4j](#neo4j)
 - [OpenSearch](#opensearch)
 - [Oracle](#oracle)
 - [PostgreSQL](#postgresql-1)
-- [Presto](#presto)
+- [Presto and Trino](#presto-and-trino)
 - [Salesforce](#salesforce)
-- [Socrata Open Data API (SODA)](#socrata-open-data-api-soda)
 - [Snowflake](#snowflake)
+- [Socrata Open Data API (SODA)](#socrata-open-data-api-soda)
 - [SQLite](#sqlite)
 - [SQL Server](#sql-server)
 
@@ -639,11 +653,11 @@ Here’s an example IAM policy:
 }
 ```
 
-You also need to configure [S3 permissions](https://aws.amazon.com/premiumsupport/knowledge-center/access-denied-athena/).
+You also need to configure [S3 permissions](https://repost.aws/knowledge-center/access-denied-athena).
 
 ### Amazon Redshift
 
-Add [activerecord6-redshift-adapter](https://github.com/kwent/activerecord6-redshift-adapter) or [activerecord5-redshift-adapter](https://github.com/ConsultingMD/activerecord5-redshift-adapter) to your Gemfile and set:
+Add [activerecord7-redshift-adapter-pennylane](https://github.com/pennylane-hq/activerecord-adapter-redshift) to your Gemfile and set:
 
 ```yml
 data_sources:
@@ -706,7 +720,7 @@ Use a read-only user. Requires the [Thrift server](https://spark.apache.org/docs
 
 ### Cassandra
 
-Add [cassandra-driver](https://github.com/datastax/ruby-driver) (and [sorted_set](https://github.com/knu/sorted_set) for Ruby 3+) to your Gemfile and set:
+Add [cassandra-driver](https://github.com/datastax/ruby-driver) and [sorted_set](https://github.com/knu/sorted_set) to your Gemfile and set:
 
 ```yml
 data_sources:
@@ -718,7 +732,7 @@ Use a [read-only role](https://docs.datastax.com/en/cql-oss/3.3/cql/cql_using/us
 
 ### Druid
 
-Enable [SQL support](http://druid.io/docs/latest/querying/sql.html#configuration) on the broker and set:
+Enable [SQL support](https://druid.apache.org/docs/latest/querying/sql) on the broker and set:
 
 ```yml
 data_sources:
@@ -744,7 +758,7 @@ Use a [read-only role](https://www.elastic.co/guide/en/elasticsearch/reference/c
 
 ### Google BigQuery
 
-Add [google-cloud-bigquery](https://github.com/GoogleCloudPlatform/google-cloud-ruby/tree/master/google-cloud-bigquery) to your Gemfile and set:
+Add [google-cloud-bigquery](https://github.com/GoogleCloudPlatform/google-cloud-ruby/tree/main/google-cloud-bigquery) to your Gemfile and set:
 
 ```yml
 data_sources:
@@ -779,7 +793,7 @@ data_sources:
 
 Use a [read-only user](https://docs.influxdata.com/influxdb/v1.8/administration/authentication_and_authorization/). Supports [InfluxQL](https://docs.influxdata.com/influxdb/v1.8/query_language/explore-data/).
 
-### MySQL
+### MySQL and MariaDB
 
 Add [mysql2](https://github.com/brianmario/mysql2) to your Gemfile (if it’s not there) and set:
 
@@ -789,17 +803,17 @@ data_sources:
     url: mysql2://user:password@hostname:3306/database
 ```
 
-Use a [read-only user](#mysql).
+Use a [read-only user](#mysql-and-mariadb).
 
 ### Neo4j
 
-Add [neo4j-core](https://github.com/neo4jrb/neo4j-core) to your Gemfile and set:
+Add [neo4j-ruby-driver](https://github.com/neo4jrb/neo4j-ruby-driver) to your Gemfile and set:
 
 ```yml
 data_sources:
   my_source:
     adapter: neo4j
-    url: http://user:password@hostname:7474
+    url: bolt://user:password@hostname:7687/database
 ```
 
 Use a [read-only user](https://neo4j.com/docs/cypher-manual/current/access-control/manage-privileges/).
@@ -841,17 +855,19 @@ data_sources:
 
 Use a [read-only user](#postgresql).
 
-### Presto
+### Presto and Trino
 
-Add [presto-client](https://github.com/treasure-data/presto-client-ruby) to your Gemfile and set:
+Add [presto-client](https://github.com/treasure-data/trino-client-ruby/tree/v0.6.5) or [trino-client](https://github.com/treasure-data/trino-client-ruby) to your Gemfile and set:
 
 ```yml
 data_sources:
   my_source:
     url: presto://user@hostname:8080/catalog
+    # or
+    url: trino://user@hostname:8080/catalog
 ```
 
-Use a [read-only user](https://prestodb.io/docs/current/security/built-in-system-access-control.html).
+Use a read-only user for [Presto](https://prestodb.io/docs/current/security/built-in-system-access-control.html) or [Trino](https://trino.io/docs/current/security/built-in-system-access-control.html).
 
 ### Salesforce
 
@@ -876,20 +892,6 @@ SALESFORCE_API_VERSION="41.0"
 
 Use a read-only user. Supports [SOQL](https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/sforce_api_calls_soql.htm).
 
-### Socrata Open Data API (SODA)
-
-Set:
-
-```yml
-data_sources:
-  my_source:
-    adapter: soda
-    url: https://soda.demo.socrata.com/resource/4tka-6guv.json
-    app_token: ...
-```
-
-Supports [SoQL](https://dev.socrata.com/docs/functions/).
-
 ### Snowflake
 
 First, install ODBC. For Homebrew, use:
@@ -913,7 +915,7 @@ https://sfc-repo.snowflakecomputing.com/odbc/linux/2.21.5/snowflake-odbc-2.21.5.
 
 > This installs the driver at `/app/.apt/usr/lib/snowflake/odbc/lib/libSnowflake.so`
 
-Then, download the [Snowflake ODBC driver](https://docs.snowflake.net/manuals/user-guide/odbc-download.html). Add [odbc_adapter](https://github.com/localytics/odbc_adapter) to your Gemfile and set:
+Then, download the [Snowflake ODBC driver](https://docs.snowflake.com/developer-guide/odbc/odbc-download). Add [odbc_adapter](https://github.com/localytics/odbc_adapter) to your Gemfile and set:
 
 ```yml
 data_sources:
@@ -924,6 +926,20 @@ data_sources:
 
 Use a [read-only role](https://docs.snowflake.com/en/user-guide/security-access-control-configure.html).
 
+### Socrata Open Data API (SODA)
+
+Set:
+
+```yml
+data_sources:
+  my_source:
+    adapter: soda
+    url: https://soda.demo.socrata.com/resource/4tka-6guv.json
+    app_token: ...
+```
+
+Supports [SoQL](https://dev.socrata.com/docs/functions/).
+
 ### SQLite
 
 Add [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) to your Gemfile and set:
@@ -986,10 +1002,6 @@ Have team members who want to learn SQL? Here are a few great, free resources.
 
 For an easy way to group by day, week, month, and more with correct time zones, check out [Groupdate.sql](https://github.com/ankane/groupdate.sql).
 
-## Standalone Version
-
-Looking for a standalone version? Check out [Ghost Blazer](https://github.com/buren/ghost_blazer).
-
 ## Performance
 
 By default, queries take up a request while they are running. To run queries asynchronously, add to your config:
@@ -1026,51 +1038,6 @@ override_csp: true
 
 Maps now use Mapbox GL JS v1 instead of Mapbox.js, which affects Mapbox billing.
 
-### 2.6
-
-Custom adapters now need to specify how to quote variables in queries (there is no longer a default)
-
-```ruby
-class FooAdapter < Blazer::Adapters::BaseAdapter
-  def quoting
-    :backslash_escape # single quote strings and convert ' to \' and \ to \\
-    # or
-    :single_quote_escape # single quote strings and convert ' to ''
-    # or
-    ->(value) { ... } # custom method
-  end
-end
-```
-
-### 2.3
-
-To archive queries, create a migration
-
-```sh
-rails g migration add_status_to_blazer_queries
-```
-
-with:
-
-```ruby
-add_column :blazer_queries, :status, :string
-Blazer::Query.update_all(status: "active")
-```
-
-### 2.0
-
-To use Slack notifications, create a migration
-
-```sh
-rails g migration add_slack_channels_to_blazer_checks
-```
-
-with:
-
-```ruby
-add_column :blazer_checks, :slack_channels, :text
-```
-
 ## History
 
 View the [changelog](https://github.com/ankane/blazer/blob/master/CHANGELOG.md)

data/app/controllers/blazer/base_controller.rb

@@ -30,6 +30,8 @@ module Blazer
 
     layout "blazer/application"
 
+    default_form_builder ::ActionView::Helpers::FormBuilder
+
     private
 
     def process_vars(statement, var_params = nil)
@@ -69,9 +71,9 @@ module Blazer
       if smart_var_data_source
         query = smart_var_data_source.smart_variables[var]
 
-        if query.is_a? Hash
-          smart_var = query.map { |k,v| [v, k] }
-        elsif query.is_a? Array
+        if query.is_a?(Hash)
+          smart_var = query.map { |k, v| [v, k] }
+        elsif query.is_a?(Array)
           smart_var = query.map { |v| [v, v] }
         elsif query
           result = smart_var_data_source.run_statement(query)

data/app/controllers/blazer/queries_controller.rb

@@ -26,8 +26,15 @@ module Blazer
     end
 
     def index
-      set_queries
-      render json: @queries
+      respond_to do |format|
+        format.html do
+          redirect_to root_path
+        end
+        format.json do
+          set_queries
+          render json: @queries
+        end
+      end
     end
 
     def new
@@ -225,6 +232,9 @@ module Blazer
 
     def set_data_source
       @data_source = Blazer.data_sources[params[:data_source]]
+    rescue Blazer::Error => e
+      raise unless e.message.start_with?("Unknown data source:")
+      render plain: "Unknown data source", status: :not_found
     end
 
     def continue_run

data/app/views/blazer/_variables.html.erb

@@ -1,6 +1,6 @@
 <% if @bind_vars.any? %>
   <% var_params = request.query_parameters %>
-  <script>
+  <%= javascript_tag nonce: true do %>
     <%= blazer_js_var "timeZone", Blazer.time_zone.tzinfo.name %>
     var now = moment.tz(timeZone)
     var format = "YYYY-MM-DD"
@@ -8,7 +8,7 @@
     function toDate(time) {
       return moment.tz(time.format(format), timeZone)
     }
-  </script>
+  <% end %>
   <form id="bind" method="get" action="<%= action %>" class="form-inline" style="margin-bottom: 15px;">
     <% date_vars = ["start_time", "end_time"] %>
     <% if (date_vars - @bind_vars).empty? %>
@@ -21,11 +21,11 @@
       <%= label_tag var, var %>
       <% if (data = @smart_vars[var]) %>
         <%= select_tag var, options_for_select([[nil, nil]] + data, selected: var_params[var]), style: "margin-right: 20px; width: 200px; display: none;" %>
-        <script>
+        <%= javascript_tag nonce: true do %>
           $("#<%= var %>").selectize({
             create: true
           });
-        </script>
+        <% end %>
       <% elsif var.end_with?("_at") || var == "start_time" || var == "end_time" %>
         <%= hidden_field_tag var, var_params[var] %>
 
@@ -35,7 +35,7 @@
           </div>
         </div>
 
-        <script>
+        <%= javascript_tag nonce: true do %>
           (function() {
             var input = $("#<%= var %>")
             var datePicker = $("#<%= var %>-select")
@@ -57,7 +57,7 @@
               datePicker.find("span").html(toDate(picker.startDate).format("MMMM D, YYYY"))
             }
           })()
-        </script>
+        <% end %>
       <% else %>
         <%= text_field_tag var, var_params[var], style: "width: 120px; margin-right: 20px;", autofocus: i == 0 && !var.end_with?("_at") && !var_params[var], class: "form-control" %>
       <% end %>
@@ -75,7 +75,7 @@
         </div>
       </div>
 
-      <script>
+      <%= javascript_tag nonce: true do %>
         function dateStr(daysAgo) {
           return now.clone().subtract(daysAgo || 0, "days").format(format)
         }
@@ -119,7 +119,7 @@
           $("#reportrange").trigger("apply.daterangepicker", picker)
           submitIfCompleted($("#start_time").closest("form"))
         }
-      </script>
+      <% end %>
     <% end %>
 
     <input type="submit" class="btn btn-success" value="Run" style="vertical-align: top;" />

data/app/views/blazer/checks/_form.html.erb

@@ -12,12 +12,12 @@
     <div class="hide">
       <%= f.select :query_id, [], {include_blank: true} %>
     </div>
-    <script>
+    <%= javascript_tag nonce: true do %>
       <%= blazer_js_var "queries", Blazer::Query.active.named.order(:name).select("id, name").map { |q| {text: q.name, value: q.id} } %>
       <%= blazer_js_var "items", [@check.query_id].compact %>
 
       $("#check_query_id").selectize({options: queries, items: items, highlight: false, maxOptions: 100}).parents(".hide").removeClass("hide");
-    </script>
+    <% end %>
   </div>
 
   <% if @check.respond_to?(:check_type) %>
@@ -28,9 +28,9 @@
         <% check_options << ["Anomaly (most recent data point)", "anomaly"] if Blazer.anomaly_checks %>
         <%= f.select :check_type, check_options %>
       </div>
-      <script>
+      <%= javascript_tag nonce: true do %>
         $("#check_check_type").selectize({}).parent().removeClass("hide");
-      </script>
+      <% end %>
     </div>
   <% elsif @check.respond_to?(:invert) %>
     <div class="form-group">
@@ -38,9 +38,9 @@
       <div class="hide">
         <%= f.select :invert, [["Any results (bad data)", false], ["No results (missing data)", true]] %>
       </div>
-      <script>
+      <%= javascript_tag nonce: true do %>
         $("#check_invert").selectize({}).parent().removeClass("hide");
-      </script>
+      <% end %>
     </div>
   <% end %>
 
@@ -50,9 +50,9 @@
       <div class="hide">
         <%= f.select :schedule, Blazer.check_schedules.map { |v| [v, v] } %>
       </div>
-      <script>
+      <%= javascript_tag nonce: true do %>
         $("#check_schedule").selectize({}).parent().removeClass("hide");
-      </script>
+      <% end %>
     </div>
   <% end %>
 

data/app/views/blazer/checks/index.html.erb

@@ -62,11 +62,11 @@
   </tbody>
 </table>
 
-<script>
+<%= javascript_tag nonce: true do %>
   $("#search").on("keyup", function() {
     var value = $(this).val().toLowerCase()
     $("#checks tbody tr").filter( function() {
       $(this).toggle($(this).text().toLowerCase().indexOf(value) > -1)
     })
   }).focus()
-</script>
+<% end %>

data/app/views/blazer/dashboards/_form.html.erb

@@ -30,7 +30,7 @@
   </p>
 <% end %>
 
-<script>
+<%= javascript_tag nonce: true do %>
   <%= blazer_js_var "queries", Blazer::Query.active.named.order(:name).select("id, name").map { |q| {text: q.name, value: q.id} } %>
   <%= blazer_js_var "dashboardQueries", @queries || @dashboard.dashboard_queries.order(:position).map(&:query) %>
 
@@ -79,4 +79,4 @@
       app.queries.splice(e.newIndex, 0, app.queries.splice(e.oldIndex, 1)[0])
     }
   })
-</script>
+<% end %>

data/app/views/blazer/dashboards/show.html.erb

@@ -38,7 +38,7 @@
       <p class="text-muted">Loading...</p>
     </div>
   </div>
-  <script>
+  <%= javascript_tag nonce: true do %>
     <% data = {statement: query.statement, query_id: query.id, data_source: query.data_source, variables: variable_params(query), only_chart: true} %>
     <% data.merge!(cohort_period: params[:cohort_period]) if params[:cohort_period] %>
     <%= blazer_js_var "data", data %>
@@ -49,5 +49,5 @@
     }, function (message) {
       $("#chart-<%= i %>").addClass("query-error").html(message)
     });
-  </script>
+  <% end %>
 <% end %>

data/app/views/blazer/queries/_form.html.erb

@@ -68,7 +68,7 @@
   </div>
 </div>
 
-<script>
+<%= javascript_tag nonce: true do %>
   <%= blazer_js_var "variableParams", @variable_params %>
   <%= blazer_js_var "previewStatement", Blazer.data_sources.to_h { |k, v| [k, (v.preview_statement rescue "")] } %>
 
@@ -252,4 +252,4 @@
   })
   app.config.compilerOptions.whitespace = "preserve"
   app.mount("#app")
-</script>
+<% end %>