dispatch-rails 0.10.1 → 0.10.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a712af989dbaa59fcd32135400b74a6ddb41058f291d60dce865516e117a50c6
-  data.tar.gz: 1e1d88267bcffb7177556c6a0dd92c7e9e191356288e647881a1ef04410bbeb3
+  metadata.gz: 8dd9b609e2bdb00f81b4b7dc54d47460a9a2d687c51870331459fbbf9019542e
+  data.tar.gz: 33a57685d7ae26719a1aba2871e84fc0cce87159bdf741664dc8169badb5ee5f
 SHA512:
-  metadata.gz: 891dee4bfc449f10ba4e4478ebd3fdd695d023f1853179563f63ccbbfa0a67c5431151576b403db02520c6132a0bb0ea6c93d64fe4999bde11006d820c39af26
-  data.tar.gz: f5be0e31f9ecbfce518e7533fc6a483c7bc12bcb5a624aae24a8617666232bf2d7a10f1787367313c7b741bf5ffe88dc07fff8e05bc0805e70012a50c65ef517
+  metadata.gz: 6d33ec2cc1b41aeb2f1f563c819f91272e8ea3f983b6c9ca638ca152ac9e532014e8b22a5e66d9b947c11506f189d8e6c4f747b6332e8aca08b5d3b5a6422d5f
+  data.tar.gz: 12985b909215d106a6bcda904d031758f276b8f4c8fb766e58f66a6e3672e87d7bdd82951b962389a5bf8877ed4b2706ff88d36aebdb7e1dddd8a195d3b2fa66

data/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `dispatch-rails` are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.3] - 2026-07-08
+
+### Fixed
+- The browser error tracker could **report on its own transport failures**. The
+  `send()` fetch had no rejection handler, so a failed report (flaky connection,
+  a blocked or CORS-less endpoint response) surfaced as an `unhandledrejection` —
+  which the tracker's own listener then reported via `send()`, firing another
+  fetch at the same failing endpoint. Hosts saw a `TypeError: Failed to fetch`
+  attributed to `error_tracker.js#send`, and a reachable-but-erroring endpoint
+  could turn it into a self-amplifying loop. The `fetch` now has a `.catch` that
+  swallows transport failures, so the tracker never reports on its own delivery.
+
+## [0.10.2] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget bootstrapped via an **inline** `<script>` (a nonced
+  `javascript_tag` that ran `import("/dispatch/…")`). Inline scripts are fragile
+  under Turbo + CSP — the nonce attribute is blanked after parse and must be
+  re-applied from the `csp-nonce` meta tag on every navigation — so hosts kept
+  seeing `script-src-elem blocked inline`. Both loaders are now plain **external
+  same-origin** `<script type="module" src="/dispatch/…">` tags, which
+  `script-src 'self'` allows outright — no nonce, no `'unsafe-inline'`, no Turbo
+  nonce drift. The nonce is still attached when the host generates one, so strict
+  nonce-only / `strict-dynamic` policies keep working. (`type="module"` also lets
+  the browser de-dupe the load across Turbo navigations via the module map.)
+- Browser CSP/Reporting-API events were attributed to the `/dispatch/reports`
+  endpoint the browser POSTs to, collapsing every violation across the app onto
+  one bogus URL. CSP reports now carry the violation's `document-uri` as the event
+  URL, so the dashboard groups and links them to the page that actually violated.
+
 ## [0.10.1] - 2026-06-18
 
 ### Fixed

data/app/assets/javascripts/dispatch/error_tracker.js

@@ -156,11 +156,19 @@
     // Preferred: fetch keepalive (proper CORS + Authorization header).
     if (window.fetch) {
       try {
+        // The .catch is essential: fetch reports network/CORS failures as a
+        // REJECTED PROMISE, not a synchronous throw. Without it, a failed report
+        // (flaky connection, blocked endpoint, CORS-less error response) becomes
+        // an unhandledrejection — which our own listener below reports via send(),
+        // firing another fetch at the same failing endpoint. That self-reporting
+        // loop is exactly what "TypeError: Failed to fetch" at send() means.
+        // Swallow transport failures silently; the tracker must never report on
+        // its own transport.
         fetch(cfg.endpoint, {
           method: "POST", keepalive: true, mode: "cors",
           headers: { "Content-Type": "application/json", "Authorization": "Bearer " + cfg.apiKey },
           body: body
-        });
+        }).catch(function () { /* transport failed; never self-report */ });
         return;
       } catch (e) { /* fall through */ }
     }

data/app/views/dispatch/_error_tracker.html.erb

@@ -1,9 +1,9 @@
 <script type="application/json" id="dispatch-error-config"><%= raw error_config_json.gsub("</", "<\\/") %></script>
-<%# nonce: true picks up the host app's CSP nonce; the JSON config island above is non-executable and needs none %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchErrorTrackerLoaded) {
-    import("/dispatch/error_tracker.js").catch(() => {
-      console.error("[dispatch-rails] failed to load error_tracker.js — ensure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# The config island above is a non-executable application/json data block, so CSP
+    never applies to it. The tracker itself loads as an EXTERNAL same-origin script
+    (served by the engine's AssetMiddleware at this exact path), which script-src
+    'self' allows on its own — no nonce, no 'unsafe-inline', and none of the inline-
+    script-under-Turbo nonce drift that an inline loader is prone to. We still attach
+    the nonce when the host generates one, so strict nonce-only / strict-dynamic
+    policies (where 'self' alone isn't enough) keep working. %>
+<%= tag.script type: "module", src: "/dispatch/error_tracker.js", nonce: content_security_policy_nonce %>

data/app/views/dispatch/_widget.html.erb

@@ -60,12 +60,10 @@
   </div>
 </div>
 
-<%# nonce: true picks up the host app's CSP nonce; omitted when no nonce generator is configured %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchWidgetLoaded) {
-    window.__dispatchWidgetLoaded = true;
-    import("/dispatch/widget.js").catch(() => {
-      console.error("[dispatch-rails] failed to load widget.js — make sure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# Loaded as an EXTERNAL same-origin module (served by the engine's AssetMiddleware
+    at this exact path), so script-src 'self' allows it without a nonce or
+    'unsafe-inline' — no inline loader to be blocked under script-src-elem. type=module
+    both resolves widget.js's `import "@hotwired/stimulus"` via the host importmap and
+    de-dupes the load across Turbo navigations via the module map. The nonce is
+    attached when the host generates one, for strict nonce-only / strict-dynamic CSPs. %>
+<%= tag.script type: "module", src: "/dispatch/widget.js", nonce: content_security_policy_nonce %>

data/lib/dispatch/rails/event_builder.rb

@@ -16,17 +16,23 @@ module Dispatch
       MAX_PARAMS_BYTES    = 8_000
       SAFE_HEADERS        = %w[User-Agent Referer Accept Content-Type Host X-Request-Id].freeze
 
-      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
-        new(exception, handled: handled, env: env, user: user, tags: tags, level: level).call
+      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
+        new(exception, handled: handled, env: env, user: user, tags: tags, level: level,
+                       request_url: request_url).call
       end
 
-      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
+      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
         @exception = exception
         @handled = handled
         @env = env
         @user = user
         @tags = tags || {}
         @level = level
+        # Override for the event's request URL. A browser report (CSP, NEL, …) is
+        # POSTed to /dispatch/reports, so the env URL is that endpoint, not the page
+        # that violated the policy — the caller passes the report's document-uri here
+        # so the dashboard attributes (and groups) the event to the real page.
+        @request_url_override = request_url
         @source_cache = {}
         @config = Dispatch::Rails.configuration
       end
@@ -221,6 +227,8 @@ module Dispatch
       end
 
       def request_url
+        return @request_url_override if @request_url_override.present?
+
         scheme = @env["rack.url_scheme"] || "http"
         host = @env["HTTP_HOST"] || @env["SERVER_NAME"]
         return nil if host.nil?

data/lib/dispatch/rails/reporter.rb

@@ -21,7 +21,8 @@ module Dispatch
         user = resolve_user(config, env, context)
         tags = merged_tags(config, env, context)
         event = EventBuilder.call(exception, handled: handled, env: env, user: user,
-                                             tags: tags, level: level)
+                                             tags: tags, level: level,
+                                             request_url: context[:request_url])
         event = config.before_send.call(event) if config.before_send.respond_to?(:call)
         return if event.nil?
 

data/lib/dispatch/rails/reporting_endpoint_middleware.rb

@@ -100,7 +100,13 @@ module Dispatch
           handled: true, env: env,
           # report-only disposition is monitoring, not a live block — keep it quieter.
           level: fields[:disposition].to_s == "report" ? "info" : "warning",
-          context: { tags: { csp: "true", report_type: "csp-violation" }.merge(fields) }
+          context: {
+            # Attribute the violation to the page it happened on, not to this
+            # /dispatch/reports endpoint the browser POSTed the report to — otherwise
+            # every CSP violation across the app collapses onto one bogus URL.
+            request_url: fields[:document_uri],
+            tags: { csp: "true", report_type: "csp-violation" }.merge(fields)
+          }
         )
       end
 

data/lib/dispatch/rails/version.rb

@@ -1,5 +1,5 @@
 module Dispatch
   module Rails
-    VERSION = "0.10.1".freeze
+    VERSION = "0.10.3".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dispatch-rails
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.10.3
 platform: ruby
 authors:
 - Dispatch Team