bullet 8.0.4 → 8.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a61908a92c8bc22bba69f9ea56946f1b6b2abd320e392e7539a3a6024b939b0c
-  data.tar.gz: 1fc844bc72f0e9e4c046590ef3f981180ce0beb5e32fab2217592d21e3456705
+  metadata.gz: 257c8bc067513839f2adb33e6630d62c3b92d6cd7cbdc3656b01349cfc385e20
+  data.tar.gz: 131c0be29b73f72d828eaf3825ab37bd2dda9e8880228f3f2b467589fb9dd080
 SHA512:
-  metadata.gz: 456c8c81a574243cda8ad3a3bb728b0ae97f169434e1608158a72967b8f9a6e7153939fcb2ce7c9d9e363921e918871e6a8b3ed7c374a45bc910170a4cb3e779
-  data.tar.gz: 3ebfc6724a13326f9d2286506727edb5d47b66b01253fbc48a2407d9e7f1c6c3f8ac700d7405024fcc86766a9fd65d170d0eea0678ffd1af3c60dd90b0c82b06
+  metadata.gz: fe1cfd7baac8c98b3937e7c32a9b54e73446275371501e47f151bd8ec51c95089bb959280419204d33f4a7fffbb0c46bf6d403c03cefe188ab8c02e8de7c5bf4
+  data.tar.gz: 8290a945d4ee31300b46ddc622845dc63b1ae33172331e20a4a2ef6b6b7f597766afb4e1c3632225b5de6a6c09c8e7b13fb6b42e69f7fe8148cb76af28ab5f59

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 ## Next Release
 
-## 8.0.4 (04/18/2024)
+## 8.0.5 (04/21/2025)
+
+* Properly insert ContentSecurityPolicy middleware
+* Properly parse query string
+
+## 8.0.4 (04/18/2025)
 
 * Insert bullet middleware before `ContentSecurityPolicy`
 * Support url query `skip_html_injection=true`

data/lib/bullet/rack.rb

@@ -2,6 +2,7 @@
 
 require 'rack/request'
 require 'json'
+require 'cgi'
 
 module Bullet
   class Rack
@@ -85,17 +86,20 @@ module Bullet
       query_string = request.env['QUERY_STRING']
       return false if query_string.nil? || query_string.empty?
 
-      if defined?(Rack::QueryParser)
-        parser = Rack::QueryParser.new
-        params = parser.parse_nested_query(query_string)
-      else
-        # compatible with rack 1.x,
-        # remove it after dropping rails 4.2 suppport
-        params = Rack::Utils.parse_nested_query(query_string)
-      end
+      params = simple_parse_query_string(query_string)
       params['skip_html_injection'] == 'true'
     end
 
+    # Simple query string parser
+    def simple_parse_query_string(query_string)
+      params = {}
+      query_string.split('&').each do |pair|
+        key, value = pair.split('=', 2).map { |s| CGI.unescape(s) }
+        params[key] = value if key && !key.empty?
+      end
+      params
+    end
+
     def file?(headers)
       headers['Content-Transfer-Encoding'] == 'binary' || headers['Content-Disposition']
     end

data/lib/bullet/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullet
-  VERSION = '8.0.4'
+  VERSION = '8.0.5'
 end

data/lib/bullet.rb

@@ -23,11 +23,14 @@ module Bullet
 
   if defined?(Rails::Railtie)
     class BulletRailtie < Rails::Railtie
-      initializer 'bullet.configure_rails_initialization' do |app|
-        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware)
-          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
-        else
+      initializer 'bullet.add_middleware' do |app|
+        # I don't find a way to detect if the middleware is already in the stack,
+        # so I'm using the api_only flag.
+        # If it is true, ActionDispatch::ContentSecurityPolicy::Middleware is not in the stack.
+        if app.config.api_only || !defined?(ActionDispatch::ContentSecurityPolicy::Middleware)
           app.middleware.use Bullet::Rack
+        else
+          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
         end
       end
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bullet
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.0.5
 platform: ruby
 authors:
 - Richard Huang
 bindir: bin
 cert_chain: []
-date: 2025-04-18 00:00:00.000000000 Z
+date: 2025-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport