govuk_app_config 4.13.0 → 5.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/ci.yml +1 -1
- data/CHANGELOG.md +60 -50
- data/govuk_app_config.gemspec +1 -1
- data/lib/govuk_app_config/govuk_content_security_policy.rb +30 -14
- data/lib/govuk_app_config/govuk_prometheus_exporter.rb +4 -1
- data/lib/govuk_app_config/version.rb +1 -1
- metadata +5 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 043f58b5ab2db86cab41a12db947c9a22985a0cab93a0a673a313c026f9df172
|
|
4
|
+
data.tar.gz: 94ad0af53466f3cafcb59e967c69eafae770ed2abb4f75efca92b4f382d13044
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 334c9ea1a036cf06dde586d86af5a6d3bfbc89e22ea10e329c4f043341939815cab56eb1a8ede54eab398fc44c1cce08f04736d32a21bff74909b8590fccb55f
|
|
7
|
+
data.tar.gz: 3fad672d0d868f84ebe91db228f983b00818793b916f3ce503a28428d62fcf2568350978b235b81b6e01cbd0453628885c8d779e8f25e041bd0f773334d8df9d
|
data/.github/workflows/ci.yml
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -1,6 +1,15 @@
|
|
|
1
|
+
# 5.1.0
|
|
2
|
+
|
|
3
|
+
* Add support to force-load the GovukPrometheusExporter by setting `GOVUK_PROMETHEUS_EXPORTER` to `force`. ([#282](https://github.com/alphagov/govuk_app_config/pull/282))
|
|
4
|
+
|
|
5
|
+
# 5.0.0
|
|
6
|
+
|
|
7
|
+
* Forbid base elements in the Content Security Policy
|
|
8
|
+
* BREAKING: Content Security Policy forbids unsafe-inline script-src and data: image-src. It provides a nonce generator. Apps that can't support this will need to amend their CSP configuration in an initializer, see [example](https://github.com/alphagov/signon/commit/ddcf31f5c30b8fd334e4aea74986b24bf2b0e9be) in signon. Any apps that still use jQuery 1.x will need unsafe-inline for Firefox compatibility.
|
|
9
|
+
|
|
1
10
|
# 4.13.0
|
|
2
11
|
|
|
3
|
-
|
|
12
|
+
* Flush log writes to stdout immediately so that structured (JSON) logs are not lost on crash or delayed indefinitely.
|
|
4
13
|
|
|
5
14
|
# 4.12.0
|
|
6
15
|
|
|
@@ -13,148 +22,149 @@
|
|
|
13
22
|
|
|
14
23
|
# 4.11.1
|
|
15
24
|
|
|
16
|
-
|
|
25
|
+
* Remove govuk_i18n plural rules file
|
|
17
26
|
|
|
18
27
|
# 4.11.0
|
|
19
28
|
|
|
20
|
-
|
|
21
|
-
|
|
29
|
+
* Update Plek support to allow version 5
|
|
30
|
+
* Add I18n plural rules for Welsh (cy), Maltese (mt) and Chinese (zh) since Rails-I18n has [dropped support](https://github.com/svenfuchs/rails-i18n/pull/1017) for them in 7.0.6 ([#266](https://github.com/alphagov/govuk_app_config/pull/266))
|
|
22
31
|
|
|
23
32
|
# 4.10.1
|
|
24
33
|
|
|
25
|
-
|
|
34
|
+
* Fix an object ownership/sharing bug where the Rails log level was erroneously being set to `WARN` when initialising Sentry.
|
|
26
35
|
|
|
27
36
|
# 4.10.0
|
|
28
37
|
|
|
29
|
-
|
|
38
|
+
* Reduce log level for the Sentry gem from `INFO` to `WARN` to avoid polluting logs with uninformative messages. This only affects log messages from the Sentry gem itself, which go to `stdout`.
|
|
30
39
|
|
|
31
40
|
# 4.9.0
|
|
32
41
|
|
|
33
|
-
|
|
42
|
+
* Add GovukProxy::StaticProxy to forward Static asset requests by setting `GOVUK_PROXY_STATIC_ENABLED=true`.([#261](https://github.com/alphagov/govuk_app_config/pull/261))
|
|
34
43
|
|
|
35
44
|
# 4.8.0
|
|
36
45
|
|
|
37
|
-
|
|
46
|
+
* Enables Sentry environment names for EKS versions of integration, staging and production.([#260](https://github.com/alphagov/govuk_app_config/pull/260))
|
|
38
47
|
|
|
39
48
|
# 4.7.1
|
|
40
49
|
|
|
41
|
-
|
|
50
|
+
* Fix the ability to open the Rails console (`bundle exec rails c`) when running inside a container ([#257](https://github.com/alphagov/govuk_app_config/pull/257)).
|
|
42
51
|
|
|
43
52
|
# 4.7.0
|
|
44
53
|
|
|
45
|
-
|
|
54
|
+
* Adds Prometheus Sidekiq monitoring ([#255](https://github.com/alphagov/govuk_app_config/pull/255))
|
|
46
55
|
|
|
47
56
|
# 4.6.3
|
|
48
57
|
|
|
49
|
-
|
|
58
|
+
* Adds `region1.google-analytics.com` to the security policy for GA ([#250](https://github.com/alphagov/govuk_app_config/pull/250))
|
|
50
59
|
|
|
51
60
|
# 4.6.2
|
|
52
61
|
|
|
53
|
-
|
|
62
|
+
* Adds a new domain to the security policy for GA ([#248](https://https://github.com/alphagov/govuk_app_config/pull/248))
|
|
54
63
|
|
|
55
64
|
# 4.6.1
|
|
56
65
|
|
|
57
|
-
|
|
66
|
+
* Fixes warning message to refer to correct Sidekiq gem dependency name ([#243](https://github.com/alphagov/govuk_app_config/pull/243)).
|
|
58
67
|
|
|
59
68
|
# 4.6.0
|
|
60
69
|
|
|
61
|
-
|
|
62
|
-
|
|
70
|
+
* Add a warning for apps using GovukError with Sidekiq that don't have sentry-sidekiq installed ([#241](https://github.com/alphagov/govuk_app_config/pull/241)).
|
|
71
|
+
* Add internal Sidekiq exception "Sidekiq::JobRetry::Skip" to excluded exceptions ([#241](https://github.com/alphagov/govuk_app_config/pull/241)).
|
|
63
72
|
|
|
64
73
|
# 4.5.0
|
|
65
74
|
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
75
|
+
* Add lux.speedcurve.com to connect_src for GOV.UK Content Security Policy ([#232](https://github.com/alphagov/govuk_app_config/pull/232))
|
|
76
|
+
* Fix prometheus_exporter to only be enabled when the GOVUK_PROMETHEUS_EXPORTER env var is set to "true" ([#231](https://github.com/alphagov/govuk_app_config/pull/231)).
|
|
77
|
+
* Add Prometheus monitoring for EKS section to README.md ([#231](https://github.com/alphagov/govuk_app_config/pull/231)).
|
|
78
|
+
* Fix govuk_error being incompatible with Ruby >= 3 ([#233](https://github.com/alphagov/govuk_app_config/pull/233))
|
|
79
|
+
* Require Ruby 2.7 as the minimum supported Ruby version ([#233](https://github.com/alphagov/govuk_app_config/pull/233))
|
|
80
|
+
* Require Sentry 5 and Unicorn 6 major versions ([#237](https://github.com/alphagov/govuk_app_config/pull/237))
|
|
81
|
+
* Prevent sentry-rails logger warnings when govuk_error is used with non-Rails apps ([#234](https://github.com/alphagov/govuk_app_config/pull/234))
|
|
73
82
|
|
|
74
83
|
# 4.4.3
|
|
75
84
|
|
|
76
|
-
|
|
85
|
+
* Update prometheus exporter server to 0.0.0.0 from localhost ([#227](https://github.com/alphagov/govuk_app_config/pull/227)).
|
|
77
86
|
|
|
78
87
|
# 4.4.2
|
|
79
88
|
|
|
80
|
-
|
|
89
|
+
* Update HMPO webchat address in security policy ([#225](https://github.com/alphagov/govuk_app_config/pull/225)).
|
|
81
90
|
|
|
82
91
|
# 4.4.1
|
|
83
92
|
|
|
84
|
-
|
|
85
|
-
|
|
93
|
+
* Fix issue where GovukPrometheusExporter module prevented the gem to load due to missing constant "PrometheusExporter" ([#224](https://github.com/alphagov/govuk_app_config/pull/224)).
|
|
94
|
+
* Lazy load the prometheus_exporter dependency for only apps that use GovukPrometheusExporter ([#224](https://github.com/alphagov/govuk_app_config/pull/224)).
|
|
86
95
|
|
|
87
96
|
# 4.4.0
|
|
88
97
|
|
|
89
|
-
|
|
98
|
+
* Add GovukPrometheusModule, to allow for export of prometheus metrics ([#223](https://github.com/alphagov/govuk_app_config/pull/223)).
|
|
90
99
|
|
|
91
100
|
# 4.3.0
|
|
92
101
|
|
|
93
|
-
|
|
102
|
+
* Remove Speedcurve's LUX from the connect-src policy ([#216](https://github.com/alphagov/govuk_app_config/pull/216)).
|
|
94
103
|
|
|
95
104
|
# 4.2.0
|
|
96
105
|
|
|
97
|
-
|
|
106
|
+
* Add pluralisation rules for Azerbaijani, Persian, Georgian, and Turkish. ([#219](https://github.com/alphagov/govuk_app_config/pull/219))
|
|
98
107
|
|
|
99
108
|
# 4.1.0
|
|
100
109
|
|
|
101
|
-
|
|
110
|
+
* Add Puma to dependencies ([#214](https://github.com/alphagov/govuk_app_config/pull/214)).
|
|
102
111
|
|
|
103
112
|
# 4.0.1
|
|
104
113
|
|
|
105
|
-
|
|
114
|
+
* Update Content Security Policy with new klick2contact.com subdomain ([#213](https://github.com/alphagov/govuk_app_config/pull/213)).
|
|
106
115
|
|
|
107
116
|
# 4.0.0
|
|
108
117
|
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
118
|
+
* BREAKING: replaces deprecated `sentry-raven` with `sentry-ruby` and `sentry-rails`. Follow the **[migration guide](https://docs.sentry.io/platforms/ruby/migration/)** before upgrading to this version of govuk_app_config to ensure full compatibility with the new gems.
|
|
119
|
+
* BREAKING: `GovukError.configure` can only be called once, and non-Rails apps will have to manually call `GovukError.configure` in order to initialise Sentry.
|
|
120
|
+
* BREAKING: apps will no longer increment the `error_reports_failed` statsd if events fail to get sent to Sentry.
|
|
121
|
+
* BREAKING: the behaviour of `before_send` has changed, and the `should_capture` method is deprecated.
|
|
122
|
+
* See pre-release notes below for details.
|
|
123
|
+
* PR: [#212](https://github.com/alphagov/govuk_app_config/pull/212)
|
|
115
124
|
|
|
116
125
|
# 4.0.0.pre.4
|
|
117
126
|
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
127
|
+
* Fix Sentry client initialisation ([#205](https://github.com/alphagov/govuk_app_config/pull/205)).
|
|
128
|
+
* BREAKING: non-Rails apps will need to manually call `GovukError.configure` in order to initialise Sentry.
|
|
129
|
+
* BREAKING: `GovukError.configure` can only be called once by the downstream application.
|
|
121
130
|
|
|
122
131
|
# 4.0.0.pre.3
|
|
123
132
|
|
|
124
|
-
|
|
133
|
+
* Include [sentry-rails](https://github.com/getsentry/sentry-ruby/tree/master/sentry-rails) by default ([#203](https://github.com/alphagov/govuk_app_config/pull/203)).
|
|
125
134
|
|
|
126
135
|
# 4.0.0.pre.2
|
|
127
136
|
|
|
128
|
-
|
|
129
|
-
|
|
137
|
+
* Fix default Sentry configuration ([#202](https://github.com/alphagov/govuk_app_config/pull/202)).
|
|
138
|
+
* BREAKING: this means no more `silence_ready` or `transport_failure_callback` options.
|
|
130
139
|
|
|
131
140
|
# 4.0.0.pre.1
|
|
132
141
|
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
142
|
+
* BREAKING: upgrades Sentry gem from `sentry-raven` to `sentry-ruby` ([#199](https://github.com/alphagov/govuk_app_config/pull/199)). There is a **[migration guide](https://docs.sentry.io/platforms/ruby/migration/)** you should follow before upgrading to this version of govuk_app_config.
|
|
143
|
+
* This release also fixes the `data_sync_excluded_exceptions` behaviour that was broken in v3.1.0 (later fixed in v3.3.0, which was released after 4.0.0.pre.1).
|
|
144
|
+
* Released as a pre-release to identify and fix any problems before a wider rollout.
|
|
136
145
|
|
|
137
146
|
# 3.3.0
|
|
138
147
|
|
|
139
|
-
|
|
148
|
+
* Revert the `should_capture`/`before_send` consolidation introduced in 3.1.0. This fixes the `data_sync_excluded_exceptions` behaviour that has been broken since v3.1.0. ([#211](https://github.com/alphagov/govuk_app_config/pull/211))
|
|
140
149
|
|
|
141
150
|
# 3.2.0
|
|
142
151
|
|
|
143
|
-
|
|
152
|
+
* Add Speedcurve's LUX to connect-src policy ([#206](https://github.com/alphagov/govuk_app_config/pull/206))
|
|
144
153
|
|
|
145
154
|
# 3.1.1
|
|
146
155
|
|
|
147
|
-
|
|
156
|
+
* Fix the new before_send behaviour & tests, and add documentation ([#197](https://github.com/alphagov/govuk_app_config/pull/197))
|
|
148
157
|
|
|
149
158
|
# 3.1.0
|
|
150
159
|
|
|
151
|
-
|
|
160
|
+
* Remove support for `should_capture` callbacks in favour of `before_send` ([#196](https://github.com/alphagov/govuk_app_config/pull/196))
|
|
152
161
|
|
|
153
162
|
# 3.0.0
|
|
154
163
|
|
|
155
164
|
* BREAKING: Implement RFC 141 - remove unsuitable healthchecks and return a 500 on healthcheck failure ([#193](https://github.com/alphagov/govuk_app_config/pull/193))
|
|
156
165
|
|
|
157
166
|
# 2.10.0
|
|
167
|
+
|
|
158
168
|
* Allow LUX domain on img-src policy ([#191](https://github.com/alphagov/govuk_app_config/pull/191))
|
|
159
169
|
|
|
160
170
|
# 2.9.1
|
data/govuk_app_config.gemspec
CHANGED
|
@@ -37,6 +37,6 @@ Gem::Specification.new do |spec|
|
|
|
37
37
|
spec.add_development_dependency "rake", "~> 13.0"
|
|
38
38
|
spec.add_development_dependency "rspec", "~> 3.10"
|
|
39
39
|
spec.add_development_dependency "rspec-its", "~> 1.3"
|
|
40
|
-
spec.add_development_dependency "rubocop-govuk", "4.
|
|
40
|
+
spec.add_development_dependency "rubocop-govuk", "4.10.0"
|
|
41
41
|
spec.add_development_dependency "webmock"
|
|
42
42
|
end
|
|
@@ -28,13 +28,12 @@ module GovukContentSecurityPolicy
|
|
|
28
28
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
|
|
29
29
|
policy.default_src :self
|
|
30
30
|
|
|
31
|
+
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri
|
|
32
|
+
policy.base_uri :none
|
|
33
|
+
|
|
31
34
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
|
|
35
|
+
# Note: we purposely don't include `data:` here because it produces a security risk.
|
|
32
36
|
policy.img_src :self,
|
|
33
|
-
# This allows Base64 encoded images, but is a security
|
|
34
|
-
# risk as it can embed third party resources.
|
|
35
|
-
# As of December 2022, we intend to remove this prior
|
|
36
|
-
# to making the CSP live.
|
|
37
|
-
:data,
|
|
38
37
|
*GOVUK_DOMAINS,
|
|
39
38
|
*GOOGLE_ANALYTICS_DOMAINS, # Tracking pixels
|
|
40
39
|
# Speedcurve real user monitoring (RUM) - as per: https://support.speedcurve.com/docs/add-rum-to-your-csp
|
|
@@ -45,25 +44,28 @@ module GovukContentSecurityPolicy
|
|
|
45
44
|
"https://img.youtube.com"
|
|
46
45
|
|
|
47
46
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
|
|
47
|
+
# Note: we purposely don't include `data:`, `unsafe-inline` or `unsafe-eval` because
|
|
48
|
+
# they are security risks, if you need them for a legacy app please only apply them at
|
|
49
|
+
# an app level.
|
|
48
50
|
policy.script_src :self,
|
|
49
51
|
*GOOGLE_ANALYTICS_DOMAINS,
|
|
50
52
|
*GOOGLE_STATIC_DOMAINS,
|
|
51
53
|
# Allow YouTube Embeds (Govspeak turns YouTube links into embeds)
|
|
52
54
|
"*.ytimg.com",
|
|
53
55
|
"www.youtube.com",
|
|
54
|
-
"www.youtube-nocookie.com"
|
|
55
|
-
# This allows inline scripts and thus is a XSS risk.
|
|
56
|
-
# As of December 2022, we intend to work towards removing
|
|
57
|
-
# this from apps that don't use jQuery 1.12 (which needs
|
|
58
|
-
# this) once we've set up nonces.
|
|
59
|
-
:unsafe_inline
|
|
56
|
+
"www.youtube-nocookie.com"
|
|
60
57
|
|
|
61
58
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
|
|
59
|
+
# Note: we purposely don't include `data:` or `unsafe-eval` because
|
|
60
|
+
# they are security risks, if you need them for a legacy app please only apply them at
|
|
61
|
+
# an app level.
|
|
62
62
|
policy.style_src :self,
|
|
63
63
|
*GOOGLE_STATIC_DOMAINS,
|
|
64
|
-
# This allows style="" attributes and style elements.
|
|
65
|
-
# As of
|
|
66
|
-
#
|
|
64
|
+
# This allows `style=""` attributes and `<style>` elements.
|
|
65
|
+
# As of January 2023 our intentions to remove this were scuppered
|
|
66
|
+
# by Govspeak [1] using inline styles on tables. Until that
|
|
67
|
+
# is resolved we'll keep unsafe_inline
|
|
68
|
+
# [1]: https://github.com/alphagov/govspeak/blob/5642fcc4231f215d1c58ad7feb30ca42fb8cfb91/lib/govspeak/html_sanitizer.rb#L72-L73
|
|
67
69
|
:unsafe_inline
|
|
68
70
|
|
|
69
71
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
|
|
@@ -91,6 +93,20 @@ module GovukContentSecurityPolicy
|
|
|
91
93
|
def self.configure
|
|
92
94
|
Rails.application.config.content_security_policy_report_only = ENV.include?("GOVUK_CSP_REPORT_ONLY")
|
|
93
95
|
|
|
96
|
+
# Sets a nonce per request that can be set on script-src and style-src
|
|
97
|
+
# directives depending on the value of Rails.application.config.content_security_policy_nonce_directives
|
|
98
|
+
#
|
|
99
|
+
# Note: if an application needs to set unsafe-inline they will need to
|
|
100
|
+
# unset this generator (by setting this config option to nil in their application)
|
|
101
|
+
Rails.application.config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
|
|
102
|
+
|
|
103
|
+
# This only applies the nonce generator to the script-src directive. We need this to
|
|
104
|
+
# use unsafe-inline for style-src as a nonce will override it.
|
|
105
|
+
#
|
|
106
|
+
# When we want to apply it to style-src we can remove this line as the Rails default
|
|
107
|
+
# is for both script-src and style-src
|
|
108
|
+
Rails.application.config.content_security_policy_nonce_directives = %w[script-src]
|
|
109
|
+
|
|
94
110
|
policy = Rails.application.config.content_security_policy(&method(:build_policy))
|
|
95
111
|
|
|
96
112
|
# # allow apps to customise the CSP by passing a block e.g:
|
|
@@ -1,6 +1,9 @@
|
|
|
1
1
|
module GovukPrometheusExporter
|
|
2
2
|
def self.should_configure
|
|
3
|
-
|
|
3
|
+
# Allow us to force the Prometheus Exporter for persistent Rake tasks...
|
|
4
|
+
if ENV["GOVUK_PROMETHEUS_EXPORTER"] == "force"
|
|
5
|
+
true
|
|
6
|
+
elsif File.basename($PROGRAM_NAME) == "rake" ||
|
|
4
7
|
defined?(Rails) && (Rails.const_defined?("Console") || Rails.env == "test")
|
|
5
8
|
false
|
|
6
9
|
else
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: govuk_app_config
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version:
|
|
4
|
+
version: 5.1.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- GOV.UK Dev
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2023-
|
|
11
|
+
date: 2023-02-20 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: logstasher
|
|
@@ -252,14 +252,14 @@ dependencies:
|
|
|
252
252
|
requirements:
|
|
253
253
|
- - '='
|
|
254
254
|
- !ruby/object:Gem::Version
|
|
255
|
-
version: 4.
|
|
255
|
+
version: 4.10.0
|
|
256
256
|
type: :development
|
|
257
257
|
prerelease: false
|
|
258
258
|
version_requirements: !ruby/object:Gem::Requirement
|
|
259
259
|
requirements:
|
|
260
260
|
- - '='
|
|
261
261
|
- !ruby/object:Gem::Version
|
|
262
|
-
version: 4.
|
|
262
|
+
version: 4.10.0
|
|
263
263
|
- !ruby/object:Gem::Dependency
|
|
264
264
|
name: webmock
|
|
265
265
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -336,7 +336,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
336
336
|
- !ruby/object:Gem::Version
|
|
337
337
|
version: '0'
|
|
338
338
|
requirements: []
|
|
339
|
-
rubygems_version: 3.4.
|
|
339
|
+
rubygems_version: 3.4.7
|
|
340
340
|
signing_key:
|
|
341
341
|
specification_version: 4
|
|
342
342
|
summary: Base configuration for GOV.UK applications
|