govuk_app_config 9.2.0 → 9.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a879f92fed2a4b6f098a3a1bbd367853413b3314c4d45f3d38802897cc9ecc68
-  data.tar.gz: 2dcd94fb037f6799cf9ce5229cb3ba6b7e391063091c3f3a65e4085d5eab9195
+  metadata.gz: 273b6b6ef65edc0acb8786a4e5352dfbd0c06d54ed7df78b71352f513b74ba22
+  data.tar.gz: a929e8ecabac4aada60d6c31337d1f36b7ce077a259fa596124f44cfc7c8ab0c
 SHA512:
-  metadata.gz: cab7cd78d7ffd83c19e37ad9bcd7865b3c1d7731baf1dd607556d3a758e99288b56186786fa20789011fc84f340e83caa7df6c1d9324c63d934f9b15733e6003
-  data.tar.gz: c547b53fca4fa5ad8f9f4444451dd8facc04bfcbe2312dfe5f591ac6236c6df90f9c49c7d0c3ab2a2cdcd25336b50ab3b23711cf137804286040e1b39b383d0d
+  metadata.gz: 86bf49ce98b88af4c0781a94797eeb55cd4007830004fa6ed90c65dd19e4b0b409897b53f10b0293f2e5120ea3241517e3c08548527d34daab165e8f838b0e06
+  data.tar.gz: fa89fb00c3e24406151b4e5cdce2f54596ecf56846192b1dfc378f3237a00beffb129805d205a0d001e6ce2205ae4d404b468b6fd240a3011e0a41aa8ad3e06f

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+# 9.4.0
+
+* Disallow any domain from embeding a page to prevent clickjacking ([#322](https://github.com/alphagov/govuk_app_config/pull/322))
+* Fix GovukContentSecurityPolicy test ([#324](https://github.com/alphagov/govuk_app_config/pull/324))
+
+# 9.3.0
+
+* Get prometheus labels from controller, not params ([#320](https://github.com/alphagov/govuk_app_config/pull/320))
+
 # 9.2.0
 
 * Default to Prometheus histograms, not summaries ([#318](https://github.com/alphagov/govuk_app_config/pull/318))

data/govuk_app_config.gemspec

@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "logstasher", "~> 2.1"
   spec.add_dependency "opentelemetry-exporter-otlp", ">= 0.25", "< 0.27"
-  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.41.0"
+  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.51.0"
   spec.add_dependency "opentelemetry-sdk", "~> 1.2"
   spec.add_dependency "plek", ">= 4", "< 6"
   spec.add_dependency "prometheus_exporter", "~> 2.0"

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -80,6 +80,11 @@ module GovukContentSecurityPolicy
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src
     policy.frame_src :self, *GOVUK_DOMAINS, "www.youtube.com", "www.youtube-nocookie.com" # Allow youtube embeds
 
+    # Disallow any domain from embeding a page using <frame>, <iframe>, <object>, or <embed> to prevent clickjacking
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
+    policy.frame_ancestors :none
+
     policy.report_uri ENV["GOVUK_CSP_REPORT_URI"] if ENV.include?("GOVUK_CSP_REPORT_URI")
   end
 

data/lib/govuk_app_config/govuk_prometheus_exporter.rb

@@ -4,6 +4,43 @@ require "prometheus_exporter/server"
 require "prometheus_exporter/middleware"
 
 module GovukPrometheusExporter
+  #
+  # See https://github.com/discourse/prometheus_exporter/pull/293
+  #
+  # RailsMiddleware can be removed and replaced with the default middleware if
+  # that PR is merged / released
+  #
+  class RailsMiddleware < PrometheusExporter::Middleware
+    def default_labels(env, _result)
+      controller_instance = env["action_controller.instance"]
+      action = controller = nil
+      if controller_instance
+        action = controller_instance.action_name
+        controller = controller_instance.controller_name
+      elsif (cors = env["rack.cors"]) && cors.respond_to?(:preflight?) && cors.preflight?
+        # if the Rack CORS Middleware identifies the request as a preflight request,
+        # the stack doesn't get to the point where controllers/actions are defined
+        action = "preflight"
+        controller = "preflight"
+      end
+      {
+        action: action || "other",
+        controller: controller || "other",
+      }
+    end
+  end
+
+  class SinatraMiddleware < PrometheusExporter::Middleware
+    def default_labels(_env, _result)
+      # The default prometheus exporter middleware uses the controller and
+      # action as labels.  These aren't meaningful in Sinatra applications, and
+      # other options (such as request.path_info) have potentially very high
+      # cardinality.  For now, just accept that we can't be more specific than
+      # the application / pod and don't provide any other labels
+      {}
+    end
+  end
+
   def self.should_configure
     # Allow us to force the Prometheus Exporter for persistent Rake tasks...
     if ENV["GOVUK_PROMETHEUS_EXPORTER"] == "force"
@@ -50,11 +87,11 @@ module GovukPrometheusExporter
       server.start
 
       if defined?(Rails)
-        Rails.application.middleware.unshift PrometheusExporter::Middleware, instrument: :prepend
+        Rails.application.middleware.unshift RailsMiddleware, instrument: :prepend
       end
 
       if defined?(Sinatra)
-        Sinatra.use PrometheusExporter::Middleware
+        Sinatra.use SinatraMiddleware
       end
     rescue Errno::EADDRINUSE
       warn "Could not start Prometheus metrics server as address already in use."

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "9.2.0".freeze
+  VERSION = "9.4.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 9.2.0
+  version: 9.4.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-09-14 00:00:00.000000000 Z
+date: 2023-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher
@@ -53,7 +53,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.41.0
+        version: 0.51.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -63,7 +63,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.41.0
+        version: 0.51.0
 - !ruby/object:Gem::Dependency
   name: opentelemetry-sdk
   requirement: !ruby/object:Gem::Requirement
@@ -375,7 +375,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
+rubygems_version: 3.4.20
 signing_key: 
 specification_version: 4
 summary: Base configuration for GOV.UK applications