glib-web 5.0.5 → 5.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f17a1a4daae7e40a97af1832e97b2d8c9dd67310f5c633cbdeb4ab3dd5d5d46a
-  data.tar.gz: 669a156ca671210d00fb34383fc99bdfe9089e69470709d733b4a686922b4291
+  metadata.gz: 2e9d0b6eb1a02d147f08a0166a4d67075ebbf903af3601e78ab592c5f9a11808
+  data.tar.gz: ee0d8980dfa1158fa65126b8d29dad29e2b788f1b51e4fb062a2de306a1d789a
 SHA512:
-  metadata.gz: e707bdf53ababa1afe4b53fa4a8d6d0f6c7bf4db2730a18fc576cf58fd7c7d16e3081a98a488c18a5c8d6ee953edaa44c4a8c2f4e53840ae367f44d735435e2d
-  data.tar.gz: f88d6a7ddec4a1c364396579a3b56eaaf82e98dd32a16a5d2f0595c0ea0d79dbfa63ab94df4ccefefd47aa6a4b12b601793a67aed5d51d22ee8c2670ed8993c0
+  metadata.gz: 21960f43365ee50457f2ad2856d5bf5e6cf6c1a5014332006e9fe43e7f2e6cec9633a35cb5678a34388310d88e69222ab4641d1267125e87e01d822d00fb7e4f
+  data.tar.gz: cf920f5f56177c092fc2bd84bacf4b096d1b41ae4364b47bcfe3beba1b58bb8afa76883a33210a9f9ad709085c7dc33644933128cddbe93b4ff2251e6f2367b5

data/app/controllers/concerns/glib/analytics/funnel.rb

@@ -38,7 +38,16 @@ module Glib::Analytics
       referrer_url = request.headers['referer'] # Notice that the HTTP header uses one "r"
       if group.nil? && action.nil? && !referrer_url.nil?
         current_host = request.host
-        referrer_host = URI.parse(referrer_url).host
+        # The Referer header is attacker-controlled and may not be a valid URI
+        # (scanners send junk like "() { ignored; }; cat /etc/passwd"). Treat an
+        # unparseable referer as "no referer" rather than letting URI::InvalidURIError
+        # bubble up mid-render, where the 500 rescue then double-renders.
+        referrer_host =
+          begin
+            URI.parse(referrer_url).host
+          rescue URI::InvalidURIError
+            nil
+          end
 
         # Replace the subdomain portion with regex so it will only match the non-subdomain part.
         # This will allow cross-subdomain referral, but it will not work if the host is a bare domain,

data/app/controllers/concerns/glib/json/libs.rb

@@ -249,6 +249,13 @@ module Glib::Json::Libs
           Rollbar.error(exception, use_exception_level_filters: true)
         end
 
+        # The exception may have been raised AFTER a response was already rendered
+        # (e.g. from an after_action injection). Rendering the error page on top of that
+        # would raise AbstractController::DoubleRenderError, which masks the genuine
+        # exception reported above. The real cause is already logged, so leave the
+        # already-rendered response in place rather than double-rendering.
+        return if performed?
+
         render file: Rails.root.join('public', '500.html'), status: :internal_server_error
       else
         raise exception
@@ -261,6 +268,12 @@ module Glib::Json::Libs
   def glib_json_handle_404(exception, preview_mode)
     if json_ui_activated?
       if Rails.env.production? || preview_mode
+        # As with glib_json_handle_500: if a response was already rendered (e.g. an
+        # after_action raised RecordNotFound), rendering the 404 page on top would raise
+        # AbstractController::DoubleRenderError and mask the real exception. Keep the
+        # already-rendered response instead of double-rendering.
+        return if performed?
+
         render file: Rails.root.join('public', '404.html'), status: :not_found
       else
         raise exception

data/lib/glib/mailer_tester.rb

@@ -8,11 +8,7 @@ module Glib
 
     module ClassMethods
       def generate_preview_tests
-        project_root = Rails.root
-        paths = Dir.glob(project_root + 'test/mailers/previews/*')
-        paths.each do |file|
-          require file
-        end
+        Glib::MailerTester.load_preview_files
 
         ActionMailer::Preview.subclasses.each do |preview_class|
           preview = preview_class.new
@@ -45,6 +41,95 @@ module Glib
           end
         end
       end
+
+      # Opt-in companion to `generate_preview_tests`. That method only snapshot-tests
+      # the previews that EXIST; this asserts every mailer ACTION has a matching
+      # preview, so a new mailer/action can't silently ship with no preview.
+      #
+      # `except:` allowlists "Mailer#action" strings that intentionally have no
+      # preview — document the reason at the call site.
+      def assert_all_mailer_actions_have_previews(except: [])
+        test 'every mailer action has a preview' do
+          missing = Glib::MailerTester.missing_previews(except: except)
+          assert missing.empty?, Glib::MailerTester.missing_previews_message(missing)
+        end
+      end
+    end
+
+    # --- Preview coverage (companion to generate_preview_tests) ---------------
+
+    # Loads every preview file (idempotent — `require` no-ops if already loaded).
+    def self.load_preview_files
+      Dir.glob(Rails.root + 'test/mailers/previews/*').each { |file| require file }
+    end
+
+    # Sorted Array<String> of "Mailer#action" entries that have no preview.
+    def self.missing_previews(except: [])
+      load_preview_files
+      compute_missing_previews(
+        mailer_actions: reflect_mailer_actions,
+        previewed_actions: ->(mailer) { reflect_preview_methods(mailer) },
+        except: except
+      )
+    end
+
+    # Pure (no Rails reflection) so it is unit-testable.
+    #   mailer_actions:    { "FooMailer" => ["welcome", "goodbye"] }
+    #   previewed_actions: ->(mailer_name) { ["welcome"] }
+    #   except:            ["FooMailer#goodbye"]
+    def self.compute_missing_previews(mailer_actions:, previewed_actions:, except: [])
+      excluded = except.map(&:to_s).to_set
+      mailer_actions.flat_map do |mailer, actions|
+        previewed = Array(previewed_actions.call(mailer)).map(&:to_s).to_set
+        actions.map(&:to_s)
+               .reject { |action| previewed.include?(action) }
+               .map { |action| "#{mailer}##{action}" }
+      end.reject { |id| excluded.include?(id) }.sort
+    end
+
+    def self.missing_previews_message(missing)
+      <<~MSG
+        Every mailer action must have a preview so `generate_preview_tests` snapshot-tests it.
+        These actions have none:
+
+          #{missing.join("\n  ")}
+
+        Add a method named after the action to the matching `<Mailer>Preview` class under
+        test/mailers/previews/, returning `<Mailer>.<action>(...)`. If an action genuinely
+        cannot be previewed, allowlist it with a reason:
+
+          assert_all_mailer_actions_have_previews(except: ['FooMailer#some_action']) # why
+      MSG
+    end
+
+    # Reflection glue (needs a loaded Rails app). Scopes to app mailers under
+    # `ApplicationMailer` so third-party mailers (Devise, etc.) are not flagged.
+    def self.reflect_mailer_actions
+      load_mailer_files
+      base = '::ApplicationMailer'.safe_constantize || ActionMailer::Base
+      base.descendants.each_with_object({}) do |mailer, acc|
+        actions = mailer.action_methods.to_a
+        acc[mailer.name] = actions unless actions.empty?
+      end
+    end
+
+    # Loads only `app/mailers` (so every mailer subclass is defined) rather than
+    # eager-loading the whole app — faster, and avoids unrelated load failures.
+    def self.load_mailer_files
+      dir = Rails.root.join('app/mailers')
+      return unless dir.exist?
+
+      loader = Rails.respond_to?(:autoloaders) ? Rails.autoloaders.main : nil
+      if loader.respond_to?(:eager_load_dir)
+        loader.eager_load_dir(dir.to_s)
+      else
+        Rails.application.eager_load!
+      end
+    end
+
+    def self.reflect_preview_methods(mailer_name)
+      preview = "#{mailer_name}Preview".safe_constantize
+      preview ? preview.instance_methods(false).map(&:to_s) : []
     end
 
     def log_root_dir

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.0.5
+  version: 5.0.6
 platform: ruby
 authors:
 - ''