bullet 8.0.2 → 8.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69ace15062b915463985d5257ca7b054b482ca842f05f832dc45c1134bc7c8cd
-  data.tar.gz: a43533c8d894791edffcb4cbd9ad4ceba1dd238a8b736d23e3444ca7f766c57c
+  metadata.gz: 7ed7921469ed264816680bf580bd37cc8e9033287d90a86c65bb4d486fb789f3
+  data.tar.gz: a0c0ca44bc16b3673b3c7ea14f03a12dee3c73fc72084ee959ef19839bbd4f68
 SHA512:
-  metadata.gz: 262e12b9be4eeae23494a06eb71d6c6823674ecfa8ec9a0c5a5eaff7d7bf268a52cb35ee8198cf0712312745735bc4ad2a6474e3a6a5a6fa8820ed896754795a
-  data.tar.gz: b16503b483682cb94121442f8ee1d74145cb835031e62a864765629b0dbffd6b360136ee3b09f1b14d1e35a25794c06ace1579415829ad0dfdcff1ae2be0b3bf
+  metadata.gz: 354d9bd9b4d126ef45edf063184e7c9d612aa243caa7c2044a67f665f625a40e7c23ca61efcfe70193823689499bb6bb868022647770c8ed9dba60f9dff3e26f
+  data.tar.gz: f19a948e75f612a65143fb069559c4691d12a73bb8cd0b45699b4b80e372565d39ed0c193eabcdc4d8e289cefaa3f0845f380d2509b4d6f69a32d57392339840

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 ## Next Release
 
+## 8.0.7 (05/15/2025)
+
+* Try to insert `Bullet::Rack` properly
+
+## 8.0.6 (05/07/2025)
+
+* Add CSP nonce for footer styles as well
+* Add support for OpenTelemetry reporting
+
+## 8.0.5 (04/21/2025)
+
+* Properly insert ContentSecurityPolicy middleware
+* Properly parse query string
+
+## 8.0.4 (04/18/2025)
+
+* Insert bullet middleware before `ContentSecurityPolicy`
+* Support url query `skip_html_injection=true`
+* Mark object as impossible after updating inversed
+
+## 8.0.3 (04/04/2025)
+
+* Update non persisted `inversed_objects`
+
 ## 8.0.2 (04/02/2025)
 
 * Do not cache `bullet_key` if object is not persisted

data/README.md

@@ -74,6 +74,7 @@ config.after_initialize do
   Bullet.stacktrace_includes = [ 'your_gem', 'your_middleware' ]
   Bullet.stacktrace_excludes = [ 'their_gem', 'their_middleware', ['my_file.rb', 'my_method'], ['my_file.rb', 16..20] ]
   Bullet.slack = { webhook_url: 'http://some.slack.url', channel: '#default', username: 'notifier' }
+  Bullet.opentelemetry = true
 end
 ```
 
@@ -100,6 +101,7 @@ The code above will enable all of the Bullet notification systems:
    Each item can be a string (match substring), a regex, or an array where the first item is a path to match, and the second
    item is a line number, a Range of line numbers, or a (bare) method name, to exclude only particular lines in a file.
 * `Bullet.slack`: add notifications to slack
+* `Bullet.opentelemetry`: add notifications to OpenTelemetry
 * `Bullet.raise`: raise errors, useful for making your specs fail unless they have optimized queries
 * `Bullet.always_append_html_body`: always append the html body even if no notifications are present. Note: `console` or `add_footer` must also be true. Useful for Single Page Applications where the initial page load might not have any notifications present.
 * `Bullet.skip_user_in_notification`: exclude the OS user (`whoami`) from notifications.
@@ -192,6 +194,11 @@ see [https://github.com/flyerhzm/uniform_notifier](https://github.com/flyerhzm/u
 
 Growl support is dropped from uniform_notifier 1.16.0, if you still want it, please use uniform_notifier 1.15.0.
 
+## URL query control
+
+You can add the URL query parameter `skip_html_injection` to make the current HTML request behave as if `Bullet.skip_html_injection` is enabled,
+e.g. `http://localhost:3000/posts?skip_html_injection=true`
+
 ## Important
 
 If you find Bullet does not work for you, *please disable your browser's cache*.

data/lib/bullet/active_record4.rb

@@ -49,7 +49,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.add_impossible_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record41.rb

@@ -52,7 +52,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.add_impossible_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record42.rb

@@ -45,7 +45,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.add_impossible_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record5.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record52.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record60.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record61.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record70.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record71.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record72.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/active_record80.rb

@@ -4,6 +4,7 @@ module Bullet
   module SaveWithBulletSupport
     def _create_record(*)
       super do
+        Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
         Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end

data/lib/bullet/detector/n_plus_one_query.rb

@@ -67,13 +67,23 @@ module Bullet
         def add_inversed_object(object, association)
           return unless Bullet.start?
           return unless Bullet.n_plus_one_query_enable?
-          return unless object.bullet_primary_key_value
 
+          object_key = object.bullet_primary_key_value ? object.bullet_key : object.object_id
           Bullet.debug(
             'Detector::NPlusOneQuery#add_inversed_object',
-            "object: #{object.bullet_key}, association: #{association}"
+            "object: #{object_key}, association: #{association}"
           )
-          inversed_objects.add object.bullet_key, association
+          inversed_objects.add object_key, association
+        end
+
+        def update_inversed_object(object)
+          if inversed_objects&.key?(object.object_id)
+            Bullet.debug(
+              'Detector::NPlusOneQuery#update_inversed_object',
+              "object from #{object.object_id} to #{object.bullet_key}"
+            )
+            inversed_objects.add(object.bullet_key, inversed_objects[object.object_id].to_a)
+          end
         end
 
         # decide whether the object.associations is unpreloaded or not.

data/lib/bullet/rack.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
+require 'rack/request'
+require 'json'
+require 'cgi'
+
 module Bullet
   class Rack
     include Dependency
 
-    NONCE_MATCHER = /script-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
+    NONCE_MATCHER = /(script|style)-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
 
     def initialize(app)
       @app = app
@@ -19,12 +23,13 @@ module Bullet
       response_body = nil
 
       if Bullet.notification? || Bullet.always_append_html_body
-        if Bullet.inject_into_page? && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
+        request = ::Rack::Request.new(env)
+        if Bullet.inject_into_page? && !skip_html_injection?(request) && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
           if html_request?(headers, response)
             response_body = response_body(response)
 
             with_security_policy_nonce(headers) do |nonce|
-              response_body = append_to_html_body(response_body, footer_note) if Bullet.add_footer
+              response_body = append_to_html_body(response_body, footer_note(nonce)) if Bullet.add_footer
               response_body = append_to_html_body(response_body, Bullet.gather_inline_notifications)
               if Bullet.add_footer && !Bullet.skip_http_headers
                 response_body = append_to_html_body(response_body, xhr_script(nonce))
@@ -65,16 +70,48 @@ module Bullet
       end
     end
 
-    def footer_note
-      "<details #{details_attributes}><summary #{summary_attributes}>Bullet Warnings</summary><div #{footer_content_attributes}>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message}</div></details>"
+    def footer_note(nonce = nil)
+      %(<details id="bullet-footer" data-is-bullet-footer><summary>Bullet Warnings</summary><div>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message(nonce)}</div>#{footer_style(nonce)}</details>)
+    end
+
+    # Make footer styles work with ContentSecurityPolicy style-src as self
+    def footer_style(nonce = nil)
+      css = <<~CSS
+        details#bullet-footer {cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;}
+        details#bullet-footer summary {font-weight: 600; padding: 2px 8px;}
+        details#bullet-footer div {padding: 8px; border-top: 1px solid #9b1c1c;}
+      CSS
+      if nonce
+        %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+      else
+        %(<style type="text/css">#{css}</style>)
+      end
     end
 
     def set_header(headers, header_name, header_array)
       # Many proxy applications such as Nginx and AWS ELB limit
       # the size a header to 8KB, so truncate the list of reports to
       # be under that limit
-      header_array.pop while header_array.to_json.length > 8 * 1024
-      headers[header_name] = header_array.to_json
+      header_array.pop while JSON.generate(header_array).length > 8 * 1024
+      headers[header_name] = JSON.generate(header_array)
+    end
+
+    def skip_html_injection?(request)
+      query_string = request.env['QUERY_STRING']
+      return false if query_string.nil? || query_string.empty?
+
+      params = simple_parse_query_string(query_string)
+      params['skip_html_injection'] == 'true'
+    end
+
+    # Simple query string parser
+    def simple_parse_query_string(query_string)
+      params = {}
+      query_string.split('&').each do |pair|
+        key, value = pair.split('=', 2).map { |s| CGI.unescape(s) }
+        params[key] = value if key && !key.empty?
+      end
+      params
     end
 
     def file?(headers)
@@ -99,28 +136,18 @@ module Bullet
 
     private
 
-    def details_attributes
-      <<~EOF
-        id="bullet-footer" data-is-bullet-footer
-        style="cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def summary_attributes
-      <<~EOF
-        style="font-weight: 600; padding: 2px 8px"
-      EOF
-    end
-
-    def footer_content_attributes
-      <<~EOF
-        style="padding: 8px; border-top: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def footer_console_message
+    def footer_console_message(nonce = nil)
       if Bullet.console_enabled?
-        "<br/><span style='font-style: italic;'>See 'Uniform Notifier' in JS Console for Stacktrace</span>"
+        footer = %(<br/><span id="console-message">See 'Uniform Notifier' in JS Console for Stacktrace</span>)
+        css = "details#bullet-footer #console-message {font-style: italic;}"
+        style =
+          if nonce
+            %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+          else
+            %(<style type="text/css">#{css}</style>)
+          end
+
+        footer + style
       end
     end
 

data/lib/bullet/registry/base.rb

@@ -35,7 +35,11 @@ module Bullet
       end
 
       def include?(key, value)
-        !@registry[key].nil? && @registry[key].include?(value)
+        key?(key) && @registry[key].include?(value)
+      end
+
+      def key?(key)
+        @registry.key?(key)
       end
     end
   end

data/lib/bullet/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullet
-  VERSION = '8.0.2'
+  VERSION = '8.0.7'
 end

data/lib/bullet.rb

@@ -23,8 +23,8 @@ module Bullet
 
   if defined?(Rails::Railtie)
     class BulletRailtie < Rails::Railtie
-      initializer 'bullet.configure_rails_initialization' do |app|
-        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware) && Rails.application.config.content_security_policy
+      initializer 'bullet.add_middleware' do |app|
+        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware) && Rails.application.config.content_security_policy && !app.config.api_only
           app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
         else
           app.middleware.use Bullet::Rack

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bullet
 version: !ruby/object:Gem::Version
-  version: 8.0.2
+  version: 8.0.7
 platform: ruby
 authors:
 - Richard Huang
 bindir: bin
 cert_chain: []
-date: 2025-04-02 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -112,7 +112,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.7
 specification_version: 4
 summary: help to kill N+1 queries and unused eager loading.
 test_files: []