rack-disable_css_animations 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea999d1e3559763383af7d5ee86a43a11d39db3b96a94f6ddd9b4e475948217c
-  data.tar.gz: 93fe65b137aeab7996bf2251eea15533a96954654113c754c908ca3408d7f7c8
+  metadata.gz: bad6feef29bab1e1a2a8e97b26657b599173d23b85fbb484a9b4cfe3efb05030
+  data.tar.gz: 3bca0f36e15ed91ecd7bae9deecec5d344cb82ae7cc27aae1e9064dd596a45e8
 SHA512:
-  metadata.gz: 33e7ed70f886c5b1ac11fcb98bc4783afdcd902dfae88f007180dcc773f9655115f02736decdb5fd530ad35a1a885c02f8fb53755c57ae2f9b7f412f18788cec
-  data.tar.gz: 252f743b815f325d8173caf19338987efa87a0e027b9208521eac101c4dcc9c931dfc2f6cf912fac8161b94acaa842dc1665a8c3ebe1501a132ea3a6db749177
+  metadata.gz: d4344c6fe201e54525d0c939c67466fe876fb305d88ec2dddd0d4d433d30efa4f4b28367e83d4bcdee5c2b0aa922fb4260d981426c57ced8711989fa8ad8fc85
+  data.tar.gz: d9bdb2f55b3dbe8e4ac7f2c3d5b50e35cf53b6f0082302623f6b56786eef363d35660af0915018573d6b0504c507fb4693eda74529e4c3d41b247724005e35bb

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.5.1
+
+- Recognize the `Content-Security-Policy-Report-Only` header (in both canonical and lowercase form) when no enforcing `Content-Security-Policy` header is present, so the injected `<style>` tag's nonce matches in apps running CSP in report-only mode.
+- Insert the middleware before `ActionDispatch::ContentSecurityPolicy::Middleware` so the CSP header has already been added to the response by the time we read it. Previously the middleware ran before CSP on the response, so the header was always absent.
+
 ## 0.5.0
 
 - Add CSP nonce support: when the response's `Content-Security-Policy` header sets a `style-src 'nonce-…'`, the injected `<style>` tag now carries a matching `nonce` attribute so it is not blocked by CSP.

data/lib/rack/disable_css_animations/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class DisableCSSAnimations
-    VERSION = "0.5.0"
+    VERSION = "0.5.1"
   end
 end

data/lib/rack/disable_css_animations.rb

@@ -4,7 +4,11 @@ module Rack
   class DisableCSSAnimations
     if defined?(Rails)
       class Rails < Rails::Railtie
-        config.app_middleware.use DisableCSSAnimations
+        initializer "rack-disable_css_animations.insert_middleware" do |app|
+          app.middleware.insert_before ActionDispatch::ContentSecurityPolicy::Middleware, DisableCSSAnimations
+        rescue RuntimeError
+          app.middleware.use DisableCSSAnimations
+        end
       end
     end
 
@@ -34,7 +38,11 @@ module Rack
     end
 
     def csp_header
-      @headers["Content-Security-Policy"] || @headers["content-security-policy"] || ""
+      @headers["Content-Security-Policy"] ||
+        @headers["content-security-policy"] ||
+        @headers["Content-Security-Policy-Report-Only"] ||
+        @headers["content-security-policy-report-only"] ||
+        ""
     end
 
     def directive_nonces

data/test/test_disable_css_animations.rb

@@ -81,4 +81,30 @@ class TestDisableCSSAnimations < Minitest::Test
 
     assert_includes last_response.body, %(<style nonce="lower1">)
   end
+
+  def test_report_only_csp_header_nonce_is_used_when_enforcing_header_absent
+    self.response_headers["Content-Security-Policy-Report-Only"] = "style-src 'nonce-reportonly1'"
+
+    get "/"
+
+    assert_includes last_response.body, %(<style nonce="reportonly1">)
+  end
+
+  def test_lowercase_report_only_csp_header_is_also_recognized
+    self.response_headers = { "Content-Type" => "text/html", "content-security-policy-report-only" => "style-src 'nonce-reportonly2'" }
+
+    get "/"
+
+    assert_includes last_response.body, %(<style nonce="reportonly2">)
+  end
+
+  def test_enforcing_header_takes_precedence_over_report_only
+    self.response_headers["Content-Security-Policy"] = "style-src 'nonce-enforced'"
+    self.response_headers["Content-Security-Policy-Report-Only"] = "style-src 'nonce-reportonly'"
+
+    get "/"
+
+    assert_includes last_response.body, %(<style nonce="enforced">)
+    refute_includes last_response.body, "reportonly"
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-disable_css_animations
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Micah Geisel