logster 2.17.1 → 2.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df699cbaae36c8b38d7a4926a59ea7d0b173cbb99610ad8328e99ed6aceb8524
-  data.tar.gz: ee85152c87778cc6da4b308b6a8f4f682dc477a9a765d8788b83a9afdaaf5a02
+  metadata.gz: b42108529f3d1efa06b9505e663768978d196547f3a740b93ef39e1c0e3fa799
+  data.tar.gz: e9dec0e088efd26bd4bb9fb68a8c42f08a29f20b05ce852c3c555525f77c187e
 SHA512:
-  metadata.gz: cd86967a08fe3d59fd8a71c002c280c04c498487a97171ea07630654372fcf90b33f473e9ff16d794aa0de380dddd35e6afdd7d97523f66eb5e36eb5bea7f147
-  data.tar.gz: bfedf2cc8b217c8e8461123408548f0876f9da22a8bdbd9998f73d28154c1a50973839eabae996fc3420839e9f3d27fca78e3494b5b570f43e01aa4184480013
+  metadata.gz: 507d69d608f83f30a6e9367669d692fce19056fd1be4a187b39c6cbacb3b20464f49a8569e8741f29c7e716d568fae1537ca01aa06dd98e1fa14a7b6fa3ccd2b
+  data.tar.gz: 45132294504ae2947342ffca2c2f9d973a6d405e1da941aec7e4757e72f7aec6497a73e79a1d2d40216e50a0436293ad9399db217fd3f38687aa259f3b1daa5a

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+- 2024-02-15: 2.18.0
+
+  - FEATURE: Implement a default Content-Security-Policy
+
 - 2024-02-15: 2.17.1
 
   - UX: fixed top menu when backlink to the site exists

data/assets/javascript/{chunk.143.9ad45aeee8109c9f708f.js → chunk.143.a2d29a1fb97842b7d0eb.js}

@@ -1,6 +1,6 @@
 var __ember_auto_import__
-!function(){var e,r={968:function(e,r,n){var o,t
-e.exports=(o=_eai_d,t=_eai_r,window.emberAutoImportDynamic=function(e){return 1===arguments.length?t("_eai_dyn_"+e):t("_eai_dynt_"+e)(Array.prototype.slice.call(arguments,1))},window.emberAutoImportSync=function(e){return t("_eai_sync_"+e)(Array.prototype.slice.call(arguments,1))},o("__v1-addons__early-boot-set__",[],(function(){})),void o("sinon",["__v1-addons__early-boot-set__"],(function(){return n(468)})))},19:function(e,r){window._eai_r=require,window._eai_d=define}},n={}
+!function(){var e,r={892:function(e,r,n){var o,t
+e.exports=(o=_eai_d,t=_eai_r,window.emberAutoImportDynamic=function(e){return 1===arguments.length?t("_eai_dyn_"+e):t("_eai_dynt_"+e)(Array.prototype.slice.call(arguments,1))},window.emberAutoImportSync=function(e){return t("_eai_sync_"+e)(Array.prototype.slice.call(arguments,1))},o("__v1-addons__early-boot-set__",[],(function(){})),void o("sinon",["__v1-addons__early-boot-set__"],(function(){return n(468)})))},308:function(e,r){window._eai_r=require,window._eai_d=define}},n={}
 function o(e){var t=n[e]
 if(void 0!==t)return t.exports
 var i=n[e]={exports:{}}
@@ -17,6 +17,6 @@ var r=function(r,n){var t,i,u=n[0],_=n[1],a=n[2],f=0
 if(u.some((function(r){return 0!==e[r]}))){for(t in _)o.o(_,t)&&(o.m[t]=_[t])
 if(a)var c=a(o)}for(r&&r(n);f<u.length;f++)i=u[f],o.o(e,i)&&e[i]&&e[i][0](),e[i]=0
 return o.O(c)},n=self.webpackChunk_ember_auto_import_=self.webpackChunk_ember_auto_import_||[]
-n.forEach(r.bind(null,0)),n.push=r.bind(null,n.push.bind(n))}(),o.O(void 0,[468],(function(){return o(19)}))
-var t=o.O(void 0,[468],(function(){return o(968)}))
+n.forEach(r.bind(null,0)),n.push=r.bind(null,n.push.bind(n))}(),o.O(void 0,[468],(function(){return o(308)}))
+var t=o.O(void 0,[468],(function(){return o(892)}))
 t=o.O(t),__ember_auto_import__=t}()

data/assets/javascript/{chunk.178.341075cf72464ad389e0.js → chunk.178.98ff138cdeebea372782.js}

@@ -1,5 +1,5 @@
 var __ember_auto_import__
-!function(){var r,n={19:function(r,n){window._eai_r=require,window._eai_d=define},80:function(r,n,e){var t,o
+!function(){var r,n={308:function(r,n){window._eai_r=require,window._eai_d=define},435:function(r,n,e){var t,o
 r.exports=(t=_eai_d,o=_eai_r,window.emberAutoImportDynamic=function(r){return 1===arguments.length?o("_eai_dyn_"+r):o("_eai_dynt_"+r)(Array.prototype.slice.call(arguments,1))},window.emberAutoImportSync=function(r){return o("_eai_sync_"+r)(Array.prototype.slice.call(arguments,1))},t("__v1-addons__early-boot-set__",[],(function(){})),void t("qunit",["__v1-addons__early-boot-set__"],(function(){return e(916)})))}},e={}
 function t(r){var o=e[r]
 if(void 0!==o)return o.exports
@@ -17,6 +17,6 @@ var n=function(n,e){var o,i,_=e[0],u=e[1],a=e[2],c=0
 if(_.some((function(n){return 0!==r[n]}))){for(o in u)t.o(u,o)&&(t.m[o]=u[o])
 if(a)var f=a(t)}for(n&&n(e);c<_.length;c++)i=_[c],t.o(r,i)&&r[i]&&r[i][0](),r[i]=0
 return t.O(f)},e=self.webpackChunk_ember_auto_import_=self.webpackChunk_ember_auto_import_||[]
-e.forEach(n.bind(null,0)),e.push=n.bind(null,e.push.bind(e))}(),t.O(void 0,[916],(function(){return t(19)}))
-var o=t.O(void 0,[916],(function(){return t(80)}))
+e.forEach(n.bind(null,0)),e.push=n.bind(null,e.push.bind(e))}(),t.O(void 0,[916],(function(){return t(308)}))
+var o=t.O(void 0,[916],(function(){return t(435)}))
 o=t.O(o),__ember_auto_import__=o}()

data/assets/javascript/client-app.js

@@ -1387,4 +1387,4 @@ var r=(0,t.createTemplateFactory)({id:"qqSpoh9d",block:'[[[10,0],[14,0,"settings
 e.default=r})),define("client-app/templates/show",["exports","@ember/template-factory"],(function(e,t){Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0
 var r=(0,t.createTemplateFactory)({id:"d6AYgHoB",block:'[[[8,[39,0],[[24,0,"recent-link"]],[["@route"],["index"]],[["default"],[[[[1,"Recent"]],[]]]]],[1,"\\n\\n"],[10,0],[14,1,"bottom-panel"],[14,0,"full"],[12],[1,"\\n  "],[8,[39,1],null,[["@currentMessage","@showTitle","@removeMessage","@solveMessage","@envChangedAction","@currentEnvPosition","@actionsInMenu"],[[30,0,["model"]],"true",[30,0,["removeMessage"]],[30,0,["solveMessage"]],[30,0,["envChanged"]],[30,0,["envPosition"]],false]],null],[1,"\\n"],[13]],[],false,["link-to","message-info"]]',moduleName:"client-app/templates/show.hbs",isStrictMode:!1})
 e.default=r})),define("client-app/config/environment",[],(function(){try{var e="client-app/config/environment",t=document.querySelector('meta[name="'+e+'"]').getAttribute("content"),r={default:JSON.parse(decodeURIComponent(t))}
-return Object.defineProperty(r,"__esModule",{value:!0}),r}catch(n){throw new Error('Could not read config from meta tag with name "'+e+'".')}})),runningTests||require("client-app/app").default.create({name:"client-app",version:"0.0.0+f4fb543b"})
+return Object.defineProperty(r,"__esModule",{value:!0}),r}catch(n){throw new Error('Could not read config from meta tag with name "'+e+'".')}})),runningTests||require("client-app/app").default.create({name:"client-app",version:"0.0.0+b7702e90"})

data/lib/logster/middleware/viewer.rb

@@ -85,7 +85,7 @@ module Logster
               [200, { "content-type" => "application/json; charset=utf-8" }, [message.to_json]]
             else
               preload = { "/show/#{key}" => message }
-              [200, { "content-type" => "text/html; charset=utf-8" }, [body(preload)]]
+              js_app(preload)
             end
           elsif resource =~ %r{/settings(\.json)?$}
             json = $1 == ".json"
@@ -114,7 +114,7 @@ module Logster
                 [JSON.generate(suppression: suppression, grouping: grouping)],
               ]
             else
-              [200, { "content-type" => "text/html; charset=utf-8" }, [body]]
+              js_app
             end
           elsif resource =~ %r{/patterns/([a-zA-Z0-9_]+)\.json$}
             unless Logster.config.enable_custom_patterns_via_ui
@@ -151,7 +151,7 @@ module Logster
             Logster.store.remove_ignore_count(pattern)
             [200, {}, ["OK"]]
           elsif resource == "/"
-            [200, { "content-type" => "text/html; charset=utf-8" }, [body]]
+            js_app
           elsif resource =~ %r{/fetch-env/([0-9a-f]+)\.json$}
             key = $1
             env = Logster.store.get_env(key)
@@ -299,15 +299,12 @@ module Logster
         $3 || "/" if path =~ @path_regex
       end
 
-      def css(name, attrs = {})
-        attrs = attrs.map { |k, v| "#{k}='#{v}'" }.join(" ")
-
-        "<link rel='stylesheet' type='text/css' href='#{@logs_path}/stylesheets/#{name}' #{attrs}>"
+      def css(name, csp_nonce)
+        "<link rel='stylesheet' type='text/css' href='#{@logs_path}/stylesheets/#{name}' nonce='#{csp_nonce}'>"
       end
 
-      def script(prod, dev = nil)
-        name = ENV["DEBUG_JS"] == "1" && dev ? dev : prod
-        "<script src='#{@logs_path}/javascript/#{name}'></script>"
+      def script(name, csp_nonce)
+        "<script src='#{@logs_path}/javascript/#{name}' nonce='#{csp_nonce}'></script>"
       end
 
       def to_json_and_escape(payload)
@@ -344,32 +341,43 @@ module Logster
         preload
       end
 
-      def body(preload = {})
+      def js_app(preload = {})
+        csp_nonce = SecureRandom.hex
         preload = preloaded_data.merge(preload)
         root_url = @logs_path
         root_url += "/" if root_url[-1] != "/"
-        <<~HTML
+        body = <<~HTML
           <!doctype html>
           <html>
             <head>
               <link rel="shortcut icon" href="#{@logs_path}/images/icon_64x64.png">
               <link rel="apple-touch-icon" href="#{@logs_path}/images/icon_144x144.png" />
               <title>#{Logster.config.web_title || "Logs"}</title>
-              <link href='//fonts.googleapis.com/css?family=Roboto' rel='stylesheet' type='text/css'>
-              <link href='//fonts.googleapis.com/css?family=Roboto+Mono' rel='stylesheet' type='text/css'>
+              <link href='//fonts.googleapis.com/css?family=Roboto' rel='stylesheet' type='text/css' nonce='#{csp_nonce}'>
+              <link href='//fonts.googleapis.com/css?family=Roboto+Mono' rel='stylesheet' type='text/css' nonce='#{csp_nonce}'>
               <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=yes">
               <meta name="color-scheme" content="dark light">
-              #{css("vendor.css")}
-              #{css("client-app.css")}
-              #{script("vendor.js")}
+              #{css("vendor.css", csp_nonce)}
+              #{css("client-app.css", csp_nonce)}
+              #{script("vendor.js", csp_nonce)}
               <meta id="preloaded-data" data-root-path="#{@logs_path}" data-preloaded="#{to_json_and_escape(preload)}">
               <meta name="client-app/config/environment" content="%7B%22modulePrefix%22%3A%22client-app%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22#{root_url}%22%2C%22locationType%22%3A%22history%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_DEFAULT_ASYNC_OBSERVERS%22%3Atrue%2C%22_JQUERY_INTEGRATION%22%3Afalse%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22name%22%3A%22client-app%22%2C%22version%22%3A%220.0.0%2B7a424002%22%7D%2C%22exportApplicationGlobal%22%3Afalse%7D" />
             </head>
             <body>
-              #{script("client-app.js")}
+              #{script("client-app.js", csp_nonce)}
             </body>
           </html>
         HTML
+
+        [
+          200,
+          {
+            "content-type" => "text/html; charset=utf-8",
+            "content-security-policy" =>
+              "script-src 'nonce-#{csp_nonce}'; style-src 'nonce-#{csp_nonce}'; object-src 'none'; base-uri 'none';",
+          },
+          [body],
+        ]
       end
     end
   end

data/lib/logster/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Logster
-  VERSION = "2.17.1"
+  VERSION = "2.18.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logster
 version: !ruby/object:Gem::Version
-  version: 2.17.1
+  version: 2.18.0
 platform: ruby
 authors:
 - Sam Saffron
@@ -172,8 +172,8 @@ files:
 - assets/images/icon_144x144.png
 - assets/images/icon_64x64.png
 - assets/javascript/.gitkeep
-- assets/javascript/chunk.143.9ad45aeee8109c9f708f.js
-- assets/javascript/chunk.178.341075cf72464ad389e0.js
+- assets/javascript/chunk.143.a2d29a1fb97842b7d0eb.js
+- assets/javascript/chunk.178.98ff138cdeebea372782.js
 - assets/javascript/chunk.468.95dd450003497c781cb3.js
 - assets/javascript/chunk.916.85a3fc9d873df80f5ea5.js
 - assets/javascript/client-app.js