dispatch-rails 0.10.1 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a712af989dbaa59fcd32135400b74a6ddb41058f291d60dce865516e117a50c6
-  data.tar.gz: 1e1d88267bcffb7177556c6a0dd92c7e9e191356288e647881a1ef04410bbeb3
+  metadata.gz: 5f742aa0ca8db65f9db9c6b5a135ae7d926fdf57dffde8d1d011ae3449298d32
+  data.tar.gz: e7b3df1d90a904e8c2383a03d3231c0ff7398b4f269632d697c5d728c42c386a
 SHA512:
-  metadata.gz: 891dee4bfc449f10ba4e4478ebd3fdd695d023f1853179563f63ccbbfa0a67c5431151576b403db02520c6132a0bb0ea6c93d64fe4999bde11006d820c39af26
-  data.tar.gz: f5be0e31f9ecbfce518e7533fc6a483c7bc12bcb5a624aae24a8617666232bf2d7a10f1787367313c7b741bf5ffe88dc07fff8e05bc0805e70012a50c65ef517
+  metadata.gz: b9cb75b00f87e29843b6837051100d1cac96448ab6db77a048837303b62cd98d18a1ab7dac1bd1f25a8f527b17cf644f2dab6ef46a4a62cf7edc88f1b02d71fd
+  data.tar.gz: f409e09011d0492ccf0ea168ac6f89129ee6fcb83431617a5560ea977c1872a4346586996679538db4b14ea3ae50396d95d47df42f4626f77fff59cd3a00d804

data/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `dispatch-rails` are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-06-18
+
+### Fixed
+- The browser tracker/widget bootstrapped via an **inline** `<script>` (a nonced
+  `javascript_tag` that ran `import("/dispatch/…")`). Inline scripts are fragile
+  under Turbo + CSP — the nonce attribute is blanked after parse and must be
+  re-applied from the `csp-nonce` meta tag on every navigation — so hosts kept
+  seeing `script-src-elem blocked inline`. Both loaders are now plain **external
+  same-origin** `<script type="module" src="/dispatch/…">` tags, which
+  `script-src 'self'` allows outright — no nonce, no `'unsafe-inline'`, no Turbo
+  nonce drift. The nonce is still attached when the host generates one, so strict
+  nonce-only / `strict-dynamic` policies keep working. (`type="module"` also lets
+  the browser de-dupe the load across Turbo navigations via the module map.)
+- Browser CSP/Reporting-API events were attributed to the `/dispatch/reports`
+  endpoint the browser POSTs to, collapsing every violation across the app onto
+  one bogus URL. CSP reports now carry the violation's `document-uri` as the event
+  URL, so the dashboard groups and links them to the page that actually violated.
+
 ## [0.10.1] - 2026-06-18
 
 ### Fixed

data/app/views/dispatch/_error_tracker.html.erb

@@ -1,9 +1,9 @@
 <script type="application/json" id="dispatch-error-config"><%= raw error_config_json.gsub("</", "<\\/") %></script>
-<%# nonce: true picks up the host app's CSP nonce; the JSON config island above is non-executable and needs none %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchErrorTrackerLoaded) {
-    import("/dispatch/error_tracker.js").catch(() => {
-      console.error("[dispatch-rails] failed to load error_tracker.js — ensure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# The config island above is a non-executable application/json data block, so CSP
+    never applies to it. The tracker itself loads as an EXTERNAL same-origin script
+    (served by the engine's AssetMiddleware at this exact path), which script-src
+    'self' allows on its own — no nonce, no 'unsafe-inline', and none of the inline-
+    script-under-Turbo nonce drift that an inline loader is prone to. We still attach
+    the nonce when the host generates one, so strict nonce-only / strict-dynamic
+    policies (where 'self' alone isn't enough) keep working. %>
+<%= tag.script type: "module", src: "/dispatch/error_tracker.js", nonce: content_security_policy_nonce %>

data/app/views/dispatch/_widget.html.erb

@@ -60,12 +60,10 @@
   </div>
 </div>
 
-<%# nonce: true picks up the host app's CSP nonce; omitted when no nonce generator is configured %>
-<%= javascript_tag type: "module", nonce: true do %>
-  if (!window.__dispatchWidgetLoaded) {
-    window.__dispatchWidgetLoaded = true;
-    import("/dispatch/widget.js").catch(() => {
-      console.error("[dispatch-rails] failed to load widget.js — make sure the engine assets are mounted");
-    });
-  }
-<% end %>
+<%# Loaded as an EXTERNAL same-origin module (served by the engine's AssetMiddleware
+    at this exact path), so script-src 'self' allows it without a nonce or
+    'unsafe-inline' — no inline loader to be blocked under script-src-elem. type=module
+    both resolves widget.js's `import "@hotwired/stimulus"` via the host importmap and
+    de-dupes the load across Turbo navigations via the module map. The nonce is
+    attached when the host generates one, for strict nonce-only / strict-dynamic CSPs. %>
+<%= tag.script type: "module", src: "/dispatch/widget.js", nonce: content_security_policy_nonce %>

data/lib/dispatch/rails/event_builder.rb

@@ -16,17 +16,23 @@ module Dispatch
       MAX_PARAMS_BYTES    = 8_000
       SAFE_HEADERS        = %w[User-Agent Referer Accept Content-Type Host X-Request-Id].freeze
 
-      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
-        new(exception, handled: handled, env: env, user: user, tags: tags, level: level).call
+      def self.call(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
+        new(exception, handled: handled, env: env, user: user, tags: tags, level: level,
+                       request_url: request_url).call
       end
 
-      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error")
+      def initialize(exception, handled:, env: nil, user: nil, tags: {}, level: "error", request_url: nil)
         @exception = exception
         @handled = handled
         @env = env
         @user = user
         @tags = tags || {}
         @level = level
+        # Override for the event's request URL. A browser report (CSP, NEL, …) is
+        # POSTed to /dispatch/reports, so the env URL is that endpoint, not the page
+        # that violated the policy — the caller passes the report's document-uri here
+        # so the dashboard attributes (and groups) the event to the real page.
+        @request_url_override = request_url
         @source_cache = {}
         @config = Dispatch::Rails.configuration
       end
@@ -221,6 +227,8 @@ module Dispatch
       end
 
       def request_url
+        return @request_url_override if @request_url_override.present?
+
         scheme = @env["rack.url_scheme"] || "http"
         host = @env["HTTP_HOST"] || @env["SERVER_NAME"]
         return nil if host.nil?

data/lib/dispatch/rails/reporter.rb

@@ -21,7 +21,8 @@ module Dispatch
         user = resolve_user(config, env, context)
         tags = merged_tags(config, env, context)
         event = EventBuilder.call(exception, handled: handled, env: env, user: user,
-                                             tags: tags, level: level)
+                                             tags: tags, level: level,
+                                             request_url: context[:request_url])
         event = config.before_send.call(event) if config.before_send.respond_to?(:call)
         return if event.nil?
 

data/lib/dispatch/rails/reporting_endpoint_middleware.rb

@@ -100,7 +100,13 @@ module Dispatch
           handled: true, env: env,
           # report-only disposition is monitoring, not a live block — keep it quieter.
           level: fields[:disposition].to_s == "report" ? "info" : "warning",
-          context: { tags: { csp: "true", report_type: "csp-violation" }.merge(fields) }
+          context: {
+            # Attribute the violation to the page it happened on, not to this
+            # /dispatch/reports endpoint the browser POSTed the report to — otherwise
+            # every CSP violation across the app collapses onto one bogus URL.
+            request_url: fields[:document_uri],
+            tags: { csp: "true", report_type: "csp-violation" }.merge(fields)
+          }
         )
       end
 

data/lib/dispatch/rails/version.rb

@@ -1,5 +1,5 @@
 module Dispatch
   module Rails
-    VERSION = "0.10.1".freeze
+    VERSION = "0.10.2".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dispatch-rails
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.10.2
 platform: ruby
 authors:
 - Dispatch Team