bullet 8.0.3 → 8.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b32cc08a4de57560f18996d4ff4c96cb7a8cbc36cfb6dc285f612ac8ccd8f2e
-  data.tar.gz: 1d5b9e6f885039b6a3208d546b2ebad0a44e8063c4e1fffc7d74790ba79c1f71
+  metadata.gz: 257c8bc067513839f2adb33e6630d62c3b92d6cd7cbdc3656b01349cfc385e20
+  data.tar.gz: 131c0be29b73f72d828eaf3825ab37bd2dda9e8880228f3f2b467589fb9dd080
 SHA512:
-  metadata.gz: fb317b0bab9154eb40be0a315f1fe767ff8c227f631ee6b25e270c31422fb6aa7b4857ae7cb33b9155eb8a2300a1c52d6097fef899ad02b7cae42c8c7082e2a6
-  data.tar.gz: ba13a423de83f43a6a5a2d75a576e4612011c21cf835f2204cda2b02114680f03cf397b7d28f476eefd1c8e933da2a7e0ab9e860ee28f9e0dbbb1ecbf5abeef7
+  metadata.gz: fe1cfd7baac8c98b3937e7c32a9b54e73446275371501e47f151bd8ec51c95089bb959280419204d33f4a7fffbb0c46bf6d403c03cefe188ab8c02e8de7c5bf4
+  data.tar.gz: 8290a945d4ee31300b46ddc622845dc63b1ae33172331e20a4a2ef6b6b7f597766afb4e1c3632225b5de6a6c09c8e7b13fb6b42e69f7fe8148cb76af28ab5f59

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## Next Release
 
+## 8.0.5 (04/21/2025)
+
+* Properly insert ContentSecurityPolicy middleware
+* Properly parse query string
+
+## 8.0.4 (04/18/2025)
+
+* Insert bullet middleware before `ContentSecurityPolicy`
+* Support url query `skip_html_injection=true`
+* Mark object as impossible after updating inversed
+
 ## 8.0.3 (04/04/2025)
 
 * Update non persisted `inversed_objects`

data/README.md

@@ -192,6 +192,11 @@ see [https://github.com/flyerhzm/uniform_notifier](https://github.com/flyerhzm/u
 
 Growl support is dropped from uniform_notifier 1.16.0, if you still want it, please use uniform_notifier 1.15.0.
 
+## URL query control
+
+You can add the URL query parameter `skip_html_injection` to make the current HTML request behave as if `Bullet.skip_html_injection` is enabled,
+e.g. `http://localhost:3000/posts?skip_html_injection=true`
+
 ## Important
 
 If you find Bullet does not work for you, *please disable your browser's cache*.

data/lib/bullet/active_record4.rb

@@ -49,7 +49,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.update_inversed_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record41.rb

@@ -52,7 +52,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.update_inversed_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record42.rb

@@ -45,7 +45,10 @@ module Bullet
 
       ::ActiveRecord::Persistence.class_eval do
         def _create_record_with_bullet(*args)
-          _create_record_without_bullet(*args).tap { Bullet::Detector::NPlusOneQuery.update_inversed_object(self) }
+          _create_record_without_bullet(*args).tap do
+            Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+            Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
+          end
         end
         alias_method_chain :_create_record, :bullet
       end

data/lib/bullet/active_record5.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record52.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record60.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record61.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record70.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record71.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record72.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/active_record80.rb

@@ -5,6 +5,7 @@ module Bullet
     def _create_record(*)
       super do
         Bullet::Detector::NPlusOneQuery.update_inversed_object(self)
+        Bullet::Detector::NPlusOneQuery.add_impossible_object(self)
         yield(self) if block_given?
       end
     end

data/lib/bullet/rack.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require 'rack/request'
+require 'json'
+require 'cgi'
+
 module Bullet
   class Rack
     include Dependency
@@ -19,7 +23,8 @@ module Bullet
       response_body = nil
 
       if Bullet.notification? || Bullet.always_append_html_body
-        if Bullet.inject_into_page? && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
+        request = ::Rack::Request.new(env)
+        if Bullet.inject_into_page? && !skip_html_injection?(request) && !file?(headers) && !sse?(headers) && !empty?(response) && status == 200
           if html_request?(headers, response)
             response_body = response_body(response)
 
@@ -73,8 +78,26 @@ module Bullet
       # Many proxy applications such as Nginx and AWS ELB limit
       # the size a header to 8KB, so truncate the list of reports to
       # be under that limit
-      header_array.pop while header_array.to_json.length > 8 * 1024
-      headers[header_name] = header_array.to_json
+      header_array.pop while JSON.generate(header_array).length > 8 * 1024
+      headers[header_name] = JSON.generate(header_array)
+    end
+
+    def skip_html_injection?(request)
+      query_string = request.env['QUERY_STRING']
+      return false if query_string.nil? || query_string.empty?
+
+      params = simple_parse_query_string(query_string)
+      params['skip_html_injection'] == 'true'
+    end
+
+    # Simple query string parser
+    def simple_parse_query_string(query_string)
+      params = {}
+      query_string.split('&').each do |pair|
+        key, value = pair.split('=', 2).map { |s| CGI.unescape(s) }
+        params[key] = value if key && !key.empty?
+      end
+      params
     end
 
     def file?(headers)

data/lib/bullet/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullet
-  VERSION = '8.0.3'
+  VERSION = '8.0.5'
 end

data/lib/bullet.rb

@@ -23,11 +23,14 @@ module Bullet
 
   if defined?(Rails::Railtie)
     class BulletRailtie < Rails::Railtie
-      initializer 'bullet.configure_rails_initialization' do |app|
-        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware) && Rails.application.config.content_security_policy
-          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
-        else
+      initializer 'bullet.add_middleware' do |app|
+        # I don't find a way to detect if the middleware is already in the stack,
+        # so I'm using the api_only flag.
+        # If it is true, ActionDispatch::ContentSecurityPolicy::Middleware is not in the stack.
+        if app.config.api_only || !defined?(ActionDispatch::ContentSecurityPolicy::Middleware)
           app.middleware.use Bullet::Rack
+        else
+          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
         end
       end
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bullet
 version: !ruby/object:Gem::Version
-  version: 8.0.3
+  version: 8.0.5
 platform: ruby
 authors:
 - Richard Huang
 bindir: bin
 cert_chain: []
-date: 2025-04-04 00:00:00.000000000 Z
+date: 2025-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport