query_diet 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: e714d7e589b1eb0c4b8b40c4fb3719fb2ea002d1
-  data.tar.gz: 9b63133c9734edd60d207705ab3587a8fb2effec
+SHA256:
+  metadata.gz: 17f9c2961a95f7d7c70c35ae50bc6f0e659bc3c746ddf519c65448cc9faefa98
+  data.tar.gz: 7f76be36042170e1e8d5aff0b066d552f9fff66f2ea5d31bffee3924e5e21368
 SHA512:
-  metadata.gz: 0c488e7757fe3bd1ed06857994306b69c4daffa3335a1577502b5cda2d284195984242494f471385b0bdd431b637b84127442af07cadd2a4c963fd4fed663fb6
-  data.tar.gz: 3bf7d7333153b318e90c67718e906e2952bef913b4e41b0778c72b0ffa66522c5c545ce145229869c34d5b59e527be125f9684daa8920e5e3cfc67f9cb16828a
+  metadata.gz: 17e90e9a4ec095f1c333f719226ec938d8f058526bdf14c2d731842cf1322057d3d14f35b279e0dd62b86600366b4318e8206852e104a71a25a0bc9dc323f309
+  data.tar.gz: 2c7d0bac77d92987974d9229535bff8b438e520c2b00ae71ef37206eef6d2d114ffa07515e5b67af5b78a08a103738fd588ae5c64f8f80dc00f373950dd1e583

data/README.md

@@ -45,6 +45,25 @@ To change the default, simply pass them to the `query_diet_widget` helper:
 <%= query_diet_widget(:bad_count => 4, :bad_time => 2000) %>
 ```
 
+### Content Security Policy
+
+You can pass whether to use a nonce for style and script tags.
+Note that the key must be a symbol like in the example below, otherwise it defaults to `false`.
+
+```Erb
+<%= query_diet_widget(:nonce => true) if Rails.env.development? %>
+```
+
+In your content security policy initializer of the project you should set the nonce to those directives:
+```Erb
+Rails.application.config.content_security_policy_nonce_directives = %w[script-src style-src]
+```
+
+When you do not want to use a nonce, but use a style tag, for example, you could use `unsafe_inline`:
+```Erb
+Rails.application.config.content_security_policy do |policy|
+  policy.style_src   :self, :unsafe_inline
+```
 
 ### Rails compatibility
 

data/lib/query_diet/version.rb

@@ -1,3 +1,3 @@
 module QueryDiet
-  VERSION = '0.6.2'
+  VERSION = '0.7.0'
 end

data/lib/query_diet/widget.rb

@@ -2,9 +2,9 @@ module QueryDiet
   module Widget
     class << self
 
-      def css
+      def css(nonce_attribute)
         <<-EOF
-        <style type="text/css"><!--
+        <style type="text/css"#{nonce_attribute}><!--
           div#query_diet {
             position: absolute;
             top: 0;
@@ -31,9 +31,19 @@ module QueryDiet
         EOF
       end
 
+      def js(nonce_attribute)
+        <<-EOF
+        <script type="text/javascript"#{nonce_attribute}>
+          document.getElementById("query_diet").addEventListener("click", function() {
+            this.parentNode.removeChild(this);
+          });
+        </script>
+        EOF
+      end
+
       def html(options)
         <<-EOF
-        <div id="query_diet" class="#{QueryDiet::Logger.bad?(options) ? 'bad' : 'good' }" onclick="this.parentNode.removeChild(this);">
+        <div id="query_diet" class="#{QueryDiet::Logger.bad?(options) ? 'bad' : 'good' }">
           #{QueryDiet::Logger.count} / #{QueryDiet::Logger.time}ms
         </div>
         EOF
@@ -43,7 +53,12 @@ module QueryDiet
 
     module Helper
       def query_diet_widget(options = {})
-        html = Widget.css + Widget.html(options)
+        default_html_options = {:nonce => false}
+        options = options.reverse_merge(default_html_options)
+
+        nonce_attribute = options.fetch(:nonce) ? " nonce=\"#{content_security_policy_nonce}\"" : ''
+
+        html = Widget.css(nonce_attribute) + Widget.html(options) + Widget.js(nonce_attribute)
         html.respond_to?(:html_safe) ? html.html_safe : html
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: query_diet
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Henning Koch
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-04 00:00:00.000000000 Z
+date: 2020-09-24 00:00:00.000000000 Z
 dependencies: []
 description: Rails database query counter that stays out of your way
 email: github@makandra.de
@@ -44,8 +44,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 3.1.3
 signing_key: 
 specification_version: 4
 summary: Rails database query counter that stays out of your way