i18n_feedback 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db55035ed25835495f5e4840e9b3e6663a7e745d52600803207e8e38b7f92dcf
-  data.tar.gz: 82cd102f8766cbab2de69c3c69fe56b6fefd8e27efb4f1e897b2556e9ef76510
+  metadata.gz: ab6f3f1bb7c4568e3491627e947cf38424ec76f0c21cff477bee95440c4df762
+  data.tar.gz: 8440049b960f561014f0217caf61395de948a0f665dc580b39e97f07bc55dddf
 SHA512:
-  metadata.gz: 886de0912affd3a3d0e9ed7a20bca10605b6d2da21cb8446028049e0568cefe74ea2c57ee28f083cb29010220eabb3790cd0eec0e0af478ded46f45761a66ef2
-  data.tar.gz: 94e65e65440bf08316bf2b55eacdc8af421dfad8072ac62b1172b93bb8b93ed4974f3b31d2051ba11bb9c4e708299a7a97a4a7bfa60d0fe4606312a888439844
+  metadata.gz: b0cafcd664c77f1f39c1a2029fe3f22d3e8d3dc3753c40a3d087a31d3b11c7bedaa73d2e22ddcc4abf9106a45510dcc63f2b287874555d439f536e09f7018c6f
+  data.tar.gz: d402186abbb1c9437feee55e52110ddb11b82332f29d7d3443524b204eaa2a30dff4691ef2edcae7a28cfc71bae80eabd0b2b62283c0224167ddaaf9c02cefe6

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.2.0]
+
+- Stamp the injected widget scripts with the request's Content-Security-Policy
+  nonce when one is present, so the tool works under a nonce-based CSP (including
+  `strict-dynamic`). No-op for apps without a CSP nonce.
+
 ## [0.1.0]
 
 - Initial release.

data/README.md

@@ -35,11 +35,11 @@ It is meant for development and staging, never production.
 
 ## Installation
 
-Add the gem (from source until it is published on RubyGems):
+Add the gem:
 
 ```ruby
 # Gemfile
-gem "i18n_feedback", github: "yshmarov/i18n-feedback"
+gem "i18n_feedback"
 ```
 
 ```bash

data/app/helpers/i18n_feedback/tag_helper.rb

@@ -11,7 +11,8 @@ module I18nFeedback
       Widget.snippet(
         endpoint: I18nFeedback.config.suggestions_endpoint,
         locale: I18n.locale,
-        active: I18nFeedback::Marking.enabled?
+        active: I18nFeedback::Marking.enabled?,
+        nonce: (content_security_policy_nonce if respond_to?(:content_security_policy_nonce))
       ).html_safe
     end
   end

data/lib/i18n_feedback/middleware.rb

@@ -30,7 +30,7 @@ module I18nFeedback
       headers = persist_choice(headers, override) if available && !override.nil?
 
       if available && I18nFeedback.config.auto_inject && html?(headers) && !request.xhr?
-        status, headers, body = inject(status, headers, body, marking)
+        status, headers, body = inject(status, headers, body, marking, csp_nonce(env))
       end
 
       [status, headers, body]
@@ -44,6 +44,17 @@ module I18nFeedback
       !request.cookies[COOKIE].to_s.empty?
     end
 
+    # The request's CSP nonce, so the injected scripts run under a nonce-based
+    # Content-Security-Policy. Reads the value Rails memoizes on the env, which is
+    # the same nonce the CSP header uses. nil when the app sets no nonce.
+    def csp_nonce(env)
+      return nil unless defined?(ActionDispatch::Request)
+
+      ActionDispatch::Request.new(env).content_security_policy_nonce
+    rescue StandardError
+      nil
+    end
+
     def toggle_override(request)
       param = I18nFeedback.config.toggle_param
       return nil unless request.params.key?(param)
@@ -80,7 +91,7 @@ module I18nFeedback
       headers['Content-Type'] || headers['content-type']
     end
 
-    def inject(status, headers, body, marking)
+    def inject(status, headers, body, marking, nonce)
       html = +''
       body.each { |part| html << part.to_s }
       body.close if body.respond_to?(:close)
@@ -88,7 +99,8 @@ module I18nFeedback
       snippet = Widget.snippet(
         endpoint: I18nFeedback.config.suggestions_endpoint,
         locale: I18n.locale,
-        active: marking
+        active: marking,
+        nonce: nonce
       )
       html = html.include?('</body>') ? html.sub('</body>', "#{snippet}</body>") : html + snippet
 

data/lib/i18n_feedback/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module I18nFeedback
-  VERSION = '0.1.0'
+  VERSION = '0.2.0'
 end

data/lib/i18n_feedback/widget.rb

@@ -17,8 +17,10 @@ module I18nFeedback
       end
 
       # The two <script> tags to place before </body>: one carrying the runtime
-      # config, one carrying the widget itself.
-      def snippet(endpoint:, locale:, active:)
+      # config, one carrying the widget itself. `nonce:` stamps both tags so the
+      # widget runs under a nonce-based Content-Security-Policy (e.g. one using
+      # 'strict-dynamic'); pass nil when the app has no CSP nonce.
+      def snippet(endpoint:, locale:, active:, nonce: nil)
         config = {
           endpoint: endpoint,
           locale: locale.to_s,
@@ -26,9 +28,10 @@ module I18nFeedback
           showPill: I18nFeedback.config.show_pill ? true : false,
           pillLabel: I18nFeedback.config.pill_label
         }
+        nonce_attr = nonce ? %( nonce="#{nonce}") : ''
 
-        %(<script data-i18n-feedback>window.__i18nFeedback=#{config.to_json};</script>) +
-          %(<script data-i18n-feedback-widget>#{javascript}</script>)
+        %(<script data-i18n-feedback#{nonce_attr}>window.__i18nFeedback=#{config.to_json};</script>) +
+          %(<script data-i18n-feedback-widget#{nonce_attr}>#{javascript}</script>)
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: i18n_feedback
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yaroslav Shmarov