bullet 7.2.0 → 8.0.8

data/lib/bullet/detector/association.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+using Bullet::Ext::Object
+
 module Bullet
   module Detector
     class Association < Base
@@ -34,7 +36,7 @@ module Bullet
         # that the objects may cause N+1 query.
         # e.g. { Post => ["Post:1", "Post:2"] }
         def possible_objects
-          Thread.current[:bullet_possible_objects]
+          Thread.current.thread_variable_get(:bullet_possible_objects)
         end
 
         # impossible_objects keep the class to objects relationships
@@ -43,7 +45,7 @@ module Bullet
         # if find collection returns only one object, then the object is impossible object,
         # impossible_objects are used to avoid treating 1+1 query to N+1 query.
         def impossible_objects
-          Thread.current[:bullet_impossible_objects]
+          Thread.current.thread_variable_get(:bullet_impossible_objects)
         end
 
         private
@@ -54,7 +56,7 @@ module Bullet
         # the object_associations keep all associations that may be or may no be
         # unpreload associations or unused preload associations.
         def object_associations
-          Thread.current[:bullet_object_associations]
+          Thread.current.thread_variable_get(:bullet_object_associations)
         end
 
         # call_object_associations keep the object relationships
@@ -62,27 +64,27 @@ module Bullet
         # e.g. { "Post:1" => [:comments] }
         # they are used to detect unused preload associations.
         def call_object_associations
-          Thread.current[:bullet_call_object_associations]
+          Thread.current.thread_variable_get(:bullet_call_object_associations)
         end
 
         # inversed_objects keeps object relationships
         # that association is inversed.
         # e.g. { "Comment:1" => ["post"] }
         def inversed_objects
-          Thread.current[:bullet_inversed_objects]
+          Thread.current.thread_variable_get(:bullet_inversed_objects)
         end
 
         # eager_loadings keep the object relationships
         # that the associations are preloaded by find :include.
         # e.g. { ["Post:1", "Post:2"] => [:comments, :user] }
         def eager_loadings
-          Thread.current[:bullet_eager_loadings]
+          Thread.current.thread_variable_get(:bullet_eager_loadings)
         end
 
-        # cal_stacks keeps stacktraces where querie-objects were called from.
+        # call_stacks keeps stacktraces where querie-objects were called from.
         # e.g. { 'Object:111' => [SomeProject/app/controllers/...] }
         def call_stacks
-          Thread.current[:bullet_call_stacks]
+          Thread.current.thread_variable_get(:bullet_call_stacks)
         end
       end
     end

data/lib/bullet/detector/counter_cache.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+using Bullet::Ext::Object
+
 module Bullet
   module Detector
     class CounterCache < Base
@@ -44,11 +46,11 @@ module Bullet
         end
 
         def possible_objects
-          Thread.current[:bullet_counter_possible_objects]
+          Thread.current.thread_variable_get(:bullet_counter_possible_objects)
         end
 
         def impossible_objects
-          Thread.current[:bullet_counter_impossible_objects]
+          Thread.current.thread_variable_get(:bullet_counter_impossible_objects)
         end
 
         private

data/lib/bullet/detector/n_plus_one_query.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+using Bullet::Ext::Object
+
 module Bullet
   module Detector
     class NPlusOneQuery < Association
@@ -25,7 +27,7 @@ module Bullet
           )
           if !excluded_stacktrace_path? && conditions_met?(object, associations)
             Bullet.debug('detect n + 1 query', "object: #{object.bullet_key}, associations: #{associations}")
-            create_notification caller_in_project(object.bullet_key), object.class.to_s, associations
+            create_notification(caller_in_project(object.bullet_key), object.class.to_s, associations)
           end
         end
 
@@ -36,16 +38,17 @@ module Bullet
           objects = Array.wrap(object_or_objects)
           class_names_match_regex = true
           primary_key_values_are_empty = true
-          keys_joined = ""
-          objects.each do |obj|
+
+          keys_joined = objects.map do |obj|
             unless obj.class.name =~ /^HABTM_/
               class_names_match_regex = false
             end
             unless obj.bullet_primary_key_value.nil?
               primary_key_values_are_empty = false
             end
-            keys_joined += "#{(keys_joined.empty? ? '' : ', ')}#{obj.bullet_key}"
-          end
+            obj.bullet_key
+          end.join(", ")
+
           unless class_names_match_regex || primary_key_values_are_empty
             Bullet.debug('Detector::NPlusOneQuery#add_possible_objects', "objects: #{keys_joined}")
             objects.each { |object| possible_objects.add object.bullet_key }
@@ -64,13 +67,23 @@ module Bullet
         def add_inversed_object(object, association)
           return unless Bullet.start?
           return unless Bullet.n_plus_one_query_enable?
-          return unless object.bullet_primary_key_value
 
+          object_key = object.bullet_primary_key_value ? object.bullet_key : object.object_id
           Bullet.debug(
             'Detector::NPlusOneQuery#add_inversed_object',
-            "object: #{object.bullet_key}, association: #{association}"
+            "object: #{object_key}, association: #{association}"
           )
-          inversed_objects.add object.bullet_key, association
+          inversed_objects.add object_key, association
+        end
+
+        def update_inversed_object(object)
+          if inversed_objects&.key?(object.object_id)
+            Bullet.debug(
+              'Detector::NPlusOneQuery#update_inversed_object',
+              "object from #{object.object_id} to #{object.bullet_key}"
+            )
+            inversed_objects.add(object.bullet_key, inversed_objects[object.object_id].to_a)
+          end
         end
 
         # decide whether the object.associations is unpreloaded or not.

data/lib/bullet/detector/unused_eager_loading.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+using Bullet::Ext::Object
+using Bullet::Ext::String
+
 module Bullet
   module Detector
     class UnusedEagerLoading < Association

data/lib/bullet/ext/object.rb

@@ -1,30 +1,37 @@
 # frozen_string_literal: true
 
-class Object
-  def bullet_key
-    "#{self.class}:#{bullet_primary_key_value}"
-  end
+module Bullet
+  module Ext
+    module Object
+      refine ::Object do
+        attr_writer :bullet_key, :bullet_primary_key_value
 
-  def bullet_primary_key_value
-    return if respond_to?(:persisted?) && !persisted?
+        def bullet_key
+          return "#{self.class}:" if respond_to?(:persisted?) && !persisted?
 
-    if self.class.respond_to?(:primary_keys) && self.class.primary_keys
-      primary_key = self.class.primary_keys
-    elsif self.class.respond_to?(:primary_key) && self.class.primary_key
-      primary_key = self.class.primary_key
-    else
-      primary_key = :id
-    end
+          @bullet_key ||= "#{self.class}:#{bullet_primary_key_value}"
+        end
 
-    bullet_join_potential_composite_primary_key(primary_key)
-  end
+        def bullet_primary_key_value
+          return if respond_to?(:persisted?) && !persisted?
 
-  private
+          @bullet_primary_key_value ||=
+            begin
+              primary_key = self.class.try(:primary_keys) || self.class.try(:primary_key) || :id
 
-  def bullet_join_potential_composite_primary_key(primary_keys)
-    return send(primary_keys) unless primary_keys.is_a?(Enumerable)
+              bullet_join_potential_composite_primary_key(primary_key)
+            end
+        end
 
-    primary_keys.map { |primary_key| send primary_key }
-                .join(',')
+        private
+
+        def bullet_join_potential_composite_primary_key(primary_keys)
+          return read_attribute(primary_keys) unless primary_keys.is_a?(Enumerable)
+
+          primary_keys.map { |primary_key| read_attribute primary_key }
+                      .compact.join(',')
+        end
+      end
+    end
   end
 end

data/lib/bullet/ext/string.rb

@@ -1,7 +1,14 @@
 # frozen_string_literal: true
 
-class String
-  def bullet_class_name
-    sub(/:[^:]*?$/, '')
+module Bullet
+  module Ext
+    module String
+      refine ::String do
+        def bullet_class_name
+          last_colon = self.rindex(':')
+          last_colon ? self[0...last_colon].dup : self.dup
+        end
+      end
+    end
   end
 end

data/lib/bullet/mongoid9x.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Bullet
+  module Mongoid
+    def self.enable
+      require 'mongoid'
+      require 'rubygems'
+      ::Mongoid::Contextual::Mongo.class_eval do
+        alias_method :origin_first, :first
+        alias_method :origin_last, :last
+        alias_method :origin_each, :each
+        alias_method :origin_eager_load, :eager_load
+
+        %i[first last].each do |context|
+          default = Gem::Version.new(::Mongoid::VERSION) >= Gem::Version.new('7.5') ? nil : {}
+          define_method(context) do |opts = default|
+            result = send(:"origin_#{context}", opts)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(result) if result
+            result
+          end
+        end
+
+        def each(&_block)
+          return to_enum unless block_given?
+
+          first_document = nil
+          document_count = 0
+
+          origin_each do |document|
+            document_count += 1
+
+            if document_count == 1
+              first_document = document
+            elsif document_count == 2
+              Bullet::Detector::NPlusOneQuery.add_possible_objects([first_document, document])
+              yield(first_document)
+              first_document = nil
+              yield(document)
+            else
+              Bullet::Detector::NPlusOneQuery.add_possible_objects(document)
+              yield(document)
+            end
+          end
+
+          if document_count == 1
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(first_document)
+            yield(first_document)
+          end
+
+          self
+        end
+
+        def eager_load(docs)
+          associations = criteria.inclusions.map(&:name)
+          docs.each { |doc| Bullet::Detector::NPlusOneQuery.add_object_associations(doc, associations) }
+          Bullet::Detector::UnusedEagerLoading.add_eager_loadings(docs, associations)
+          origin_eager_load(docs)
+        end
+      end
+
+      ::Mongoid::Association::Accessors.class_eval do
+        alias_method :origin_get_relation, :get_relation
+
+        def get_relation(name, association, object, reload = false)
+          result = origin_get_relation(name, association, object, reload)
+          Bullet::Detector::NPlusOneQuery.call_association(self, name) unless association.embedded?
+          result
+        end
+      end
+    end
+  end
+end

data/lib/bullet/rack.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
+require 'rack/request'
+require 'json'
+require 'cgi'
+
 module Bullet
   class Rack
     include Dependency
 
-    NONCE_MATCHER = /script-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
+    NONCE_MATCHER = /(script|style)-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
 
     def initialize(app)
       @app = app
@@ -19,12 +23,13 @@ module Bullet
       response_body = nil
 
       if Bullet.notification? || Bullet.always_append_html_body
-        if Bullet.inject_into_page? && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
+        request = ::Rack::Request.new(env)
+        if Bullet.inject_into_page? && !skip_html_injection?(request) && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
           if html_request?(headers, response)
             response_body = response_body(response)
 
             with_security_policy_nonce(headers) do |nonce|
-              response_body = append_to_html_body(response_body, footer_note) if Bullet.add_footer
+              response_body = append_to_html_body(response_body, footer_note(nonce)) if Bullet.add_footer
               response_body = append_to_html_body(response_body, Bullet.gather_inline_notifications)
               if Bullet.add_footer && !Bullet.skip_http_headers
                 response_body = append_to_html_body(response_body, xhr_script(nonce))
@@ -65,16 +70,48 @@ module Bullet
       end
     end
 
-    def footer_note
-      "<details #{details_attributes}><summary #{summary_attributes}>Bullet Warnings</summary><div #{footer_content_attributes}>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message}</div></details>"
+    def footer_note(nonce = nil)
+      %(<details id="bullet-footer" data-is-bullet-footer><summary>Bullet Warnings</summary><div>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message(nonce)}</div>#{footer_style(nonce)}</details>)
+    end
+
+    # Make footer styles work with ContentSecurityPolicy style-src as self
+    def footer_style(nonce = nil)
+      css = <<~CSS
+        details#bullet-footer {cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;}
+        details#bullet-footer summary {font-weight: 600; padding: 2px 8px;}
+        details#bullet-footer div {padding: 8px; border-top: 1px solid #9b1c1c;}
+      CSS
+      if nonce
+        %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+      else
+        %(<style type="text/css">#{css}</style>)
+      end
     end
 
     def set_header(headers, header_name, header_array)
       # Many proxy applications such as Nginx and AWS ELB limit
       # the size a header to 8KB, so truncate the list of reports to
       # be under that limit
-      header_array.pop while header_array.to_json.length > 8 * 1024
-      headers[header_name] = header_array.to_json
+      header_array.pop while JSON.generate(header_array).length > 8 * 1024
+      headers[header_name] = JSON.generate(header_array)
+    end
+
+    def skip_html_injection?(request)
+      query_string = request.env['QUERY_STRING']
+      return false if query_string.nil? || query_string.empty?
+
+      params = simple_parse_query_string(query_string)
+      params['skip_html_injection'] == 'true'
+    end
+
+    # Simple query string parser
+    def simple_parse_query_string(query_string)
+      params = {}
+      query_string.split('&').each do |pair|
+        key, value = pair.split('=', 2).map { |s| CGI.unescape(s) }
+        params[key] = value if key && !key.empty?
+      end
+      params
     end
 
     def file?(headers)
@@ -99,28 +136,18 @@ module Bullet
 
     private
 
-    def details_attributes
-      <<~EOF
-        id="bullet-footer" data-is-bullet-footer
-        style="cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def summary_attributes
-      <<~EOF
-        style="font-weight: 600; padding: 2px 8px"
-      EOF
-    end
-
-    def footer_content_attributes
-      <<~EOF
-        style="padding: 8px; border-top: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def footer_console_message
+    def footer_console_message(nonce = nil)
       if Bullet.console_enabled?
-        "<br/><span style='font-style: italic;'>See 'Uniform Notifier' in JS Console for Stacktrace</span>"
+        footer = %(<br/><span id="console-message">See 'Uniform Notifier' in JS Console for Stacktrace</span>)
+        css = "details#bullet-footer #console-message {font-style: italic;}"
+        style =
+          if nonce
+            %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+          else
+            %(<style type="text/css">#{css}</style>)
+          end
+
+        footer + style
       end
     end
 

data/lib/bullet/registry/base.rb

@@ -35,7 +35,11 @@ module Bullet
       end
 
       def include?(key, value)
-        !@registry[key].nil? && @registry[key].include?(value)
+        key?(key) && @registry[key].include?(value)
+      end
+
+      def key?(key)
+        @registry.key?(key)
       end
     end
   end

data/lib/bullet/registry/call_stack.rb

@@ -5,7 +5,7 @@ module Bullet
     class CallStack < Base
       # remembers found association backtrace
       def add(key)
-        @registry[key] = Thread.current.backtrace
+        @registry[key] ||= Thread.current.backtrace
       end
     end
   end

data/lib/bullet/registry/object.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+using Bullet::Ext::Object
+using Bullet::Ext::String
+
 module Bullet
   module Registry
     class Object < Base

data/lib/bullet/stack_trace_filter.rb

@@ -2,10 +2,11 @@
 
 require "bundler"
 
+using Bullet::Ext::Object
+
 module Bullet
   module StackTraceFilter
     VENDOR_PATH = '/vendor'
-    IS_RUBY_19 = Gem::Version.new(RUBY_VERSION) < Gem::Version.new('2.0.0')
 
     # @param bullet_key[String] - use this to get stored call stack from call_stacks object.
     def caller_in_project(bullet_key = nil)
@@ -54,13 +55,12 @@ module Bullet
     def location_as_path(location)
       return location if location.is_a?(String)
 
-      IS_RUBY_19 ? location : location.absolute_path.to_s
+      location.absolute_path.to_s
     end
 
     def select_caller_locations(bullet_key = nil)
-      return caller.select { |caller_path| yield caller_path } if IS_RUBY_19
-
       call_stack = bullet_key ? call_stacks[bullet_key] : caller_locations
+
       call_stack.select { |location| yield location }
     end
   end

data/lib/bullet/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullet
-  VERSION = '7.2.0'
+  VERSION = '8.0.8'
 end

data/lib/bullet.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'active_support/core_ext/string/inflections'
 require 'active_support/core_ext/module/delegation'
 require 'set'
 require 'uniform_notifier'
@@ -22,8 +23,8 @@ module Bullet
 
   if defined?(Rails::Railtie)
     class BulletRailtie < Rails::Railtie
-      initializer 'bullet.configure_rails_initialization' do |app|
-        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware) && Rails.application.config.content_security_policy
+      initializer 'bullet.add_middleware', after: :load_config_initializers do |app|
+        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware) && Rails.application.config.content_security_policy && !app.config.api_only
           app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
         else
           app.middleware.use Bullet::Rack
@@ -63,7 +64,7 @@ module Bullet
     ].freeze
 
     def enable=(enable)
-      @enable = @n_plus_one_query_enable = @unused_eager_loading_enable = @counter_cache_enable = enable
+      @enable = enable
 
       if enable?
         reset_safelist
@@ -89,15 +90,15 @@ module Bullet
     end
 
     def n_plus_one_query_enable?
-      enable? && !!@n_plus_one_query_enable
+      enable? && (@n_plus_one_query_enable.nil? ? true : @n_plus_one_query_enable)
     end
 
     def unused_eager_loading_enable?
-      enable? && !!@unused_eager_loading_enable
+      enable? && (@unused_eager_loading_enable.nil? ? true : @unused_eager_loading_enable)
     end
 
     def counter_cache_enable?
-      enable? && !!@counter_cache_enable
+      enable? && (@counter_cache_enable.nil? ? true : @counter_cache_enable)
     end
 
     def stacktrace_includes
@@ -148,42 +149,47 @@ module Bullet
     end
 
     def start_request
-      Thread.current[:bullet_start] = true
-      Thread.current[:bullet_notification_collector] = Bullet::NotificationCollector.new
-
-      Thread.current[:bullet_object_associations] = Bullet::Registry::Base.new
-      Thread.current[:bullet_call_object_associations] = Bullet::Registry::Base.new
-      Thread.current[:bullet_possible_objects] = Bullet::Registry::Object.new
-      Thread.current[:bullet_impossible_objects] = Bullet::Registry::Object.new
-      Thread.current[:bullet_inversed_objects] = Bullet::Registry::Base.new
-      Thread.current[:bullet_eager_loadings] = Bullet::Registry::Association.new
-      Thread.current[:bullet_call_stacks] = Bullet::Registry::CallStack.new
+      Thread.current.thread_variable_set(:bullet_start, true)
+      Thread.current.thread_variable_set(:bullet_notification_collector, Bullet::NotificationCollector.new)
+
+      Thread.current.thread_variable_set(:bullet_object_associations, Bullet::Registry::Base.new)
+      Thread.current.thread_variable_set(:bullet_call_object_associations, Bullet::Registry::Base.new)
+      Thread.current.thread_variable_set(:bullet_possible_objects, Bullet::Registry::Object.new)
+      Thread.current.thread_variable_set(:bullet_impossible_objects, Bullet::Registry::Object.new)
+      Thread.current.thread_variable_set(:bullet_inversed_objects, Bullet::Registry::Base.new)
+      Thread.current.thread_variable_set(:bullet_eager_loadings, Bullet::Registry::Association.new)
+      Thread.current.thread_variable_set(:bullet_call_stacks, Bullet::Registry::CallStack.new)
+
+      unless Thread.current.thread_variable_get(:bullet_counter_possible_objects)
+        Thread.current.thread_variable_set(:bullet_counter_possible_objects, Bullet::Registry::Object.new)
+      end
 
-      Thread.current[:bullet_counter_possible_objects] ||= Bullet::Registry::Object.new
-      Thread.current[:bullet_counter_impossible_objects] ||= Bullet::Registry::Object.new
+      unless Thread.current.thread_variable_get(:bullet_counter_impossible_objects)
+        Thread.current.thread_variable_set(:bullet_counter_impossible_objects, Bullet::Registry::Object.new)
+      end
     end
 
     def end_request
-      Thread.current[:bullet_start] = nil
-      Thread.current[:bullet_notification_collector] = nil
+      Thread.current.thread_variable_set(:bullet_start, nil)
+      Thread.current.thread_variable_set(:bullet_notification_collector, nil)
 
-      Thread.current[:bullet_object_associations] = nil
-      Thread.current[:bullet_call_object_associations] = nil
-      Thread.current[:bullet_possible_objects] = nil
-      Thread.current[:bullet_impossible_objects] = nil
-      Thread.current[:bullet_inversed_objects] = nil
-      Thread.current[:bullet_eager_loadings] = nil
+      Thread.current.thread_variable_set(:bullet_object_associations, nil)
+      Thread.current.thread_variable_set(:bullet_call_object_associations, nil)
+      Thread.current.thread_variable_set(:bullet_possible_objects, nil)
+      Thread.current.thread_variable_set(:bullet_impossible_objects, nil)
+      Thread.current.thread_variable_set(:bullet_inversed_objects, nil)
+      Thread.current.thread_variable_set(:bullet_eager_loadings, nil)
 
-      Thread.current[:bullet_counter_possible_objects] = nil
-      Thread.current[:bullet_counter_impossible_objects] = nil
+      Thread.current.thread_variable_set(:bullet_counter_possible_objects, nil)
+      Thread.current.thread_variable_set(:bullet_counter_impossible_objects, nil)
     end
 
     def start?
-      enable? && Thread.current[:bullet_start]
+      enable? && Thread.current.thread_variable_get(:bullet_start)
     end
 
     def notification_collector
-      Thread.current[:bullet_notification_collector]
+      Thread.current.thread_variable_get(:bullet_notification_collector)
     end
 
     def notification?