govuk_app_config 7.2.1 → 8.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f921d89549f7203b1e80f23a4e7b4c7c20634120eac39d551a05ba41fc986625
-  data.tar.gz: 7af7692a9eec9676df25822f2988d00fe73a863cfabf2e4294c51747f1bff743
+  metadata.gz: 86a7c7bbd8a1996a9e919b875f782fc90a1c5fca1f5356dfa219c76868f2a2cf
+  data.tar.gz: 0e1ea3f6bbe677dc656e4b99d27d43c49e6b67368120b3cf2a0a2cd1e754928b
 SHA512:
-  metadata.gz: f0e6360036a9b2c80c96899d00129a0e270fbb15b7d070d67fa54abe45c2c02f38ed3ed95c4aa0c055b4934217030f504c049b9ac09c7a0d0c3a2dfd0c3b00ee
-  data.tar.gz: f5c29754f917bb57d50dfe8658d5d1c0c91fcfaded23ca2563595e59a40f46f59f52efb440d8599a7118b4182a2fce41c9286fa207fc13aff71b6d652ef3efc2
+  metadata.gz: 0e5360f08d06a6e24f922a214746fabf2a981ba048ca81b6ac11441f759d7b4044e725f9ca9672206645adbe06541aef480e51e4e4ba553fcde2c881adb75704
+  data.tar.gz: f64dfad4c602b668a01685b384956a7f8f3d593fb3876f19357ac142d97c36de10d54224958115070d10596d9f9e06c51fd812685def74267d646052e8aa5fe1

data/.github/workflows/ci.yml

@@ -1,4 +1,15 @@
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch, tag or SHA to checkout'
+        default: main
+        type: string
+
 jobs:
   # Run the test suite against multiple Ruby and Rails versions
   test_matrix:
@@ -10,6 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
+      with:
+        ref: ${{ inputs.ref || github.ref }}
     - uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}
@@ -24,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: echo "All matrix tests have passed 🚀"
-     
+
   publish:
     needs: test
     if: ${{ github.ref == 'refs/heads/main' }}

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 8.0.1
+
+* Change the "source" field in Rails logs from logstasher from string representing IP host address to an empty object. 
+
+# 8.0.0
+
+* BREAKING: Content Security Policy forbids the use of inline style attributes.
+
 # 7.2.1
 
 * Allow prometheus binding to fail with a warning rather than a crash ([#294](https://github.com/alphagov/govuk_app_config/pull/294))

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -56,17 +56,10 @@ module GovukContentSecurityPolicy
                       "www.youtube-nocookie.com"
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
-    # Note: we purposely don't include `data:` or `unsafe-eval` because
+    # Note: we purposely don't include `data:`, `unsafe-inline` or `unsafe-eval` because
     # they are security risks, if you need them for a legacy app please only apply them at
     # an app level.
-    policy.style_src :self,
-                     *GOOGLE_STATIC_DOMAINS,
-                     # This allows `style=""` attributes and `<style>` elements.
-                     # As of January 2023 our intentions to remove this were scuppered
-                     # by Govspeak [1] using inline styles on tables. Until that
-                     # is resolved we'll keep unsafe_inline
-                     # [1]: https://github.com/alphagov/govspeak/blob/5642fcc4231f215d1c58ad7feb30ca42fb8cfb91/lib/govspeak/html_sanitizer.rb#L72-L73
-                     :unsafe_inline
+    policy.style_src :self, *GOOGLE_STATIC_DOMAINS
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
     # Note: we purposely don't include data here because it produces a security risk.

data/lib/govuk_app_config/govuk_logging.rb

@@ -48,6 +48,10 @@ module GovukLogging
     Rails.application.config.logstasher.view_enabled = false
     Rails.application.config.logstasher.job_enabled = false
 
+    # Elasticsearch index expect source to be an object and logstash defaults
+    # source to be the host IP address causing logs to be dropped.
+    Rails.application.config.logstasher.source = {}
+
     Rails.application.config.logstasher.logger = Logger.new(
       $real_stdout, # rubocop:disable Style/GlobalVars
       level: Rails.logger.level,

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "7.2.1".freeze
+  VERSION = "8.0.1".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 7.2.1
+  version: 8.0.1
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-05-11 00:00:00.000000000 Z
+date: 2023-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher