bullet 8.0.4 → 8.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a61908a92c8bc22bba69f9ea56946f1b6b2abd320e392e7539a3a6024b939b0c
-  data.tar.gz: 1fc844bc72f0e9e4c046590ef3f981180ce0beb5e32fab2217592d21e3456705
+  metadata.gz: f00b664af513340b8b094dfa967a2dbd2c3a72edfcb0031532dd4ba38a1fb4b2
+  data.tar.gz: 76b42f07c889542a50cc75a52d52fef26bf8647721d3c9913eb4f1dbb21db9a0
 SHA512:
-  metadata.gz: 456c8c81a574243cda8ad3a3bb728b0ae97f169434e1608158a72967b8f9a6e7153939fcb2ce7c9d9e363921e918871e6a8b3ed7c374a45bc910170a4cb3e779
-  data.tar.gz: 3ebfc6724a13326f9d2286506727edb5d47b66b01253fbc48a2407d9e7f1c6c3f8ac700d7405024fcc86766a9fd65d170d0eea0678ffd1af3c60dd90b0c82b06
+  metadata.gz: db329cba6757c1ec372a7a7b6a8a9aa4a92fd5c63ce1a0e92cd43c89abd852768a83eddd95873a1cdeb2155abfa899d4c385df2a670b326c3eaa8736398a996e
+  data.tar.gz: 35c6df4a0e0aefd934c1038f2dc5faa7978cbe7b81e482ea0ca931045d4b445a67d33d0c69d603830111cee46f9bf5128a9824277de7ef3dc347c10eae5d84ea

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 ## Next Release
 
-## 8.0.4 (04/18/2024)
+## 8.0.6 (05/07/2025)
+
+* Add CSP nonce for footer styles as well
+* Add support for OpenTelemetry reporting
+
+## 8.0.5 (04/21/2025)
+
+* Properly insert ContentSecurityPolicy middleware
+* Properly parse query string
+
+## 8.0.4 (04/18/2025)
 
 * Insert bullet middleware before `ContentSecurityPolicy`
 * Support url query `skip_html_injection=true`

data/README.md

@@ -74,6 +74,7 @@ config.after_initialize do
   Bullet.stacktrace_includes = [ 'your_gem', 'your_middleware' ]
   Bullet.stacktrace_excludes = [ 'their_gem', 'their_middleware', ['my_file.rb', 'my_method'], ['my_file.rb', 16..20] ]
   Bullet.slack = { webhook_url: 'http://some.slack.url', channel: '#default', username: 'notifier' }
+  Bullet.opentelemetry = true
 end
 ```
 
@@ -100,6 +101,7 @@ The code above will enable all of the Bullet notification systems:
    Each item can be a string (match substring), a regex, or an array where the first item is a path to match, and the second
    item is a line number, a Range of line numbers, or a (bare) method name, to exclude only particular lines in a file.
 * `Bullet.slack`: add notifications to slack
+* `Bullet.opentelemetry`: add notifications to OpenTelemetry
 * `Bullet.raise`: raise errors, useful for making your specs fail unless they have optimized queries
 * `Bullet.always_append_html_body`: always append the html body even if no notifications are present. Note: `console` or `add_footer` must also be true. Useful for Single Page Applications where the initial page load might not have any notifications present.
 * `Bullet.skip_user_in_notification`: exclude the OS user (`whoami`) from notifications.

data/lib/bullet/rack.rb

@@ -2,12 +2,13 @@
 
 require 'rack/request'
 require 'json'
+require 'cgi'
 
 module Bullet
   class Rack
     include Dependency
 
-    NONCE_MATCHER = /script-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
+    NONCE_MATCHER = /(script|style)-src .*'nonce-(?<nonce>[A-Za-z0-9+\/]+={0,2})'/
 
     def initialize(app)
       @app = app
@@ -28,7 +29,7 @@ module Bullet
             response_body = response_body(response)
 
             with_security_policy_nonce(headers) do |nonce|
-              response_body = append_to_html_body(response_body, footer_note) if Bullet.add_footer
+              response_body = append_to_html_body(response_body, footer_note(nonce)) if Bullet.add_footer
               response_body = append_to_html_body(response_body, Bullet.gather_inline_notifications)
               if Bullet.add_footer && !Bullet.skip_http_headers
                 response_body = append_to_html_body(response_body, xhr_script(nonce))
@@ -69,8 +70,22 @@ module Bullet
       end
     end
 
-    def footer_note
-      "<details #{details_attributes}><summary #{summary_attributes}>Bullet Warnings</summary><div #{footer_content_attributes}>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message}</div></details>"
+    def footer_note(nonce = nil)
+      %(<details id="bullet-footer" data-is-bullet-footer><summary>Bullet Warnings</summary><div>#{Bullet.footer_info.uniq.join('<br>')}#{footer_console_message(nonce)}</div>#{footer_style(nonce)}</details>)
+    end
+
+    # Make footer styles work with ContentSecurityPolicy style-src as self
+    def footer_style(nonce = nil)
+      css = <<~CSS
+        details#bullet-footer {cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;}
+        details#bullet-footer summary {font-weight: 600; padding: 2px 8px;}
+        details#bullet-footer div {padding: 8px; border-top: 1px solid #9b1c1c;}
+      CSS
+      if nonce
+        %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+      else
+        %(<style type="text/css">#{css}</style>)
+      end
     end
 
     def set_header(headers, header_name, header_array)
@@ -85,17 +100,20 @@ module Bullet
       query_string = request.env['QUERY_STRING']
       return false if query_string.nil? || query_string.empty?
 
-      if defined?(Rack::QueryParser)
-        parser = Rack::QueryParser.new
-        params = parser.parse_nested_query(query_string)
-      else
-        # compatible with rack 1.x,
-        # remove it after dropping rails 4.2 suppport
-        params = Rack::Utils.parse_nested_query(query_string)
-      end
+      params = simple_parse_query_string(query_string)
       params['skip_html_injection'] == 'true'
     end
 
+    # Simple query string parser
+    def simple_parse_query_string(query_string)
+      params = {}
+      query_string.split('&').each do |pair|
+        key, value = pair.split('=', 2).map { |s| CGI.unescape(s) }
+        params[key] = value if key && !key.empty?
+      end
+      params
+    end
+
     def file?(headers)
       headers['Content-Transfer-Encoding'] == 'binary' || headers['Content-Disposition']
     end
@@ -118,28 +136,18 @@ module Bullet
 
     private
 
-    def details_attributes
-      <<~EOF
-        id="bullet-footer" data-is-bullet-footer
-        style="cursor: pointer; position: fixed; left: 0px; bottom: 0px; z-index: 9999; background: #fdf2f2; color: #9b1c1c; font-size: 12px; border-radius: 0px 8px 0px 0px; border: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def summary_attributes
-      <<~EOF
-        style="font-weight: 600; padding: 2px 8px"
-      EOF
-    end
-
-    def footer_content_attributes
-      <<~EOF
-        style="padding: 8px; border-top: 1px solid #9b1c1c;"
-      EOF
-    end
-
-    def footer_console_message
+    def footer_console_message(nonce = nil)
       if Bullet.console_enabled?
-        "<br/><span style='font-style: italic;'>See 'Uniform Notifier' in JS Console for Stacktrace</span>"
+        footer = %(<br/><span id="console-message">See 'Uniform Notifier' in JS Console for Stacktrace</span>)
+        css = "details#bullet-footer #console-message {font-style: italic;}"
+        style =
+          if nonce
+            %(<style type="text/css" nonce="#{nonce}">#{css}</style>)
+          else
+            %(<style type="text/css">#{css}</style>)
+          end
+
+        footer + style
       end
     end
 

data/lib/bullet/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullet
-  VERSION = '8.0.4'
+  VERSION = '8.0.6'
 end

data/lib/bullet.rb

@@ -23,11 +23,14 @@ module Bullet
 
   if defined?(Rails::Railtie)
     class BulletRailtie < Rails::Railtie
-      initializer 'bullet.configure_rails_initialization' do |app|
-        if defined?(ActionDispatch::ContentSecurityPolicy::Middleware)
-          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
-        else
+      initializer 'bullet.add_middleware' do |app|
+        # I don't find a way to detect if the middleware is already in the stack,
+        # so I'm using the api_only flag.
+        # If it is true, ActionDispatch::ContentSecurityPolicy::Middleware is not in the stack.
+        if app.config.api_only || !defined?(ActionDispatch::ContentSecurityPolicy::Middleware)
           app.middleware.use Bullet::Rack
+        else
+          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, Bullet::Rack
         end
       end
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bullet
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.0.6
 platform: ruby
 authors:
 - Richard Huang
 bindir: bin
 cert_chain: []
-date: 2025-04-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -112,7 +112,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.7
 specification_version: 4
 summary: help to kill N+1 queries and unused eager loading.
 test_files: []