slash_console 0.1.4 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb63a5b059ae9d711cdaf34435c86829ada9cb92a50b0599d8b571efae6dc1ff
-  data.tar.gz: 596977091e038ecb3a9da8dcc74d278da2fe30f2fd569e5896a50965091634cf
+  metadata.gz: 00dad9f1dd2b860398d627127e7bd3df9b5596b0e9fc8c8e915de93c7229ceed
+  data.tar.gz: 2f451ca16d04c7e89a008b1533b9ffcc355326689c3664fedeb8054fd37bfa85
 SHA512:
-  metadata.gz: 35d2c6cf00fda4a2e950fd04c925e463d74df9331d0559a65080ddf6702838344628e3f255b8ef06f9e15c6562088d80502fbf666996ff7ebeac9015b435f067
-  data.tar.gz: f666530036a635c0b35f7e842929ffa57989bce870dfde848c21c289225e89f722c1bc7555485cc6b4cc159a83aec9258e44def4cac4bfe7e81a99630eb1f717
+  metadata.gz: af3ca9a32035629be4bcdc38b7e8808bc2a4b7f92635359a7781a4e622a566b09d68a4963855ac614f18590d124e0fb953e731c92cc8d5670357f6a20804ebdb
+  data.tar.gz: 824164461e81532a821fdda656ff611e8ff6d662dc2fb8451fc030e7d1f79ee3adcf5f33230a475ab937318037e489937f48853cb40ab595150c8af567b237e9

data/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.6] - 2026-07-10
+
+### Security
+- Production Basic authentication moved from the controller into a Rack
+  middleware inserted in front of `WebConsole::Middleware`, so it now covers
+  web-console's evaluator endpoints (`/__web_console/repl_sessions/:id`) as
+  well as the console page. Previously a console session ID acted as an
+  unauthenticated bearer token for code execution until process restart.
+
+### Fixed
+- The console renders under a strict nonce-based Content Security Policy.
+  The page stylesheet carries Rails' per-request nonce, and requesting the
+  nonce during rendering makes it available to web-console's injected
+  scripts even when the app hoists the CSP middleware above web-console
+  (previously such apps got a nonempty header nonce but `nonce=""` scripts,
+  i.e. a blank console).
+- Console input evaluates in a fresh top-level binding, so constants
+  resolve the same way as in `bin/rails console` instead of inside the
+  engine's namespace (`ApplicationController` no longer resolves to
+  `SlashConsole::ApplicationController`, and app constants no longer need a
+  leading `::`). Local variables persist within a console session but not
+  across sessions.
+- Removed the duplicate `WebConsole::Middleware` the engine inserted
+  alongside the copy web-console's own railtie already adds.
+
+## [0.1.5] - 2025-09-15
+
+### Fixed
+- Load web-console extensions explicitly to fix blank page in production
+- Add full-page CSS for console element to ensure proper display
+- Use modern viewport units (100svh) for better mobile compatibility
+
 ## [0.1.4] - 2025-09-15
 
 ### Fixed
@@ -46,5 +78,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Development mode with no authentication required
 - Standard Ruby style guide compliance
 
-[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0
+[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.6...HEAD
+[0.1.6]: https://github.com/firstdraft/slash_console/compare/v0.1.0...v0.1.6
+[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0

data/README.md

@@ -2,6 +2,12 @@
 
 A Rails engine that provides a web-based console interface at `/rails/console`, allowing easy access to a Rails console in both development and production environments.
 
+⚠️ **Security Warning**: This gem provides direct access to the `rails console`. Anyone who accesses it can run arbitrary code on the server: stealing/deleting all your data, planting bugs, sending scam emails, mining cryptocurrency, etc. So, be careful.
+
+- Only use this gem in applications where the security trade-offs are acceptable. Basically, only for toy apps/proofs-of-concept/portfolio projects that contain only sample data. Never use this gem when real user data is at risk.
+- For serious apps, SSH into the server and run `rails console` at the command-line. This may require upgrading your hosting from free to paid, but you should be doing that anyway if you have real users.
+- Make up a strong, unique `ADMIN_PASSWORD` for each app.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -10,7 +16,7 @@ Add this line to your application's Gemfile:
 gem "slash_console"
 ```
 
-And then execute:
+And then:
 
 ```bash
 bundle install
@@ -22,15 +28,11 @@ That's it! Navigate to `/rails/console` in your browser.
 
 ### Development
 
-In development, no authentication is required. Simply visit:
-
-```
-http://localhost:3000/rails/console
-```
+In development, no authentication is required. Simply visit `/rails/console`.
 
 ### Production
 
-For production use, authentication is **required**. Set these environment variables:
+For production use, authentication is required. Set these environment variables:
 
 ```bash
 ADMIN_USERNAME="choose_your_own_username"
@@ -39,30 +41,29 @@ ADMIN_PASSWORD="choose_your_own_strong_password"
 
 Without these environment variables, you'll see an error message explaining what needs to be configured.
 
-⚠️ **Security Warning**: This gem provides direct access to your Rails console. In production:
-
-- Only use for applications where the security trade-offs are acceptable. Basically, only for toy apps; never where real user data is at risk. For serious apps, SSH into the server and run `rails console` at the command-line.
-- Make up a strong, unique `ADMIN_PASSWORD` for each app.
-- In production, the gem allows console access from all IP addresses (0.0.0.0/0) when authenticated. The authentication layer is your only protection.
-
 ## How It Works
 
-SlashConsole is a lightweight wrapper around the excellent `web-console` gem. It:
+SlashConsole is a lightweight wrapper around [the excellent `web-console` gem](https://github.com/rails/web-console). It:
 
 1. Provides a dedicated route for console access (instead of only on error pages).
-2. Renders a full-page console interface.
-3. Uses basic authentication when in production.
+2. Renders a full-page console interface, including in apps that enforce a strict nonce-based Content Security Policy.
+3. In production, requires basic authentication via a Rack middleware that protects both the console page and web-console's code-evaluation endpoints (`/__web_console/repl_sessions/:id`).
+4. Evaluates console input at the top level, so constants resolve the same way as in `bin/rails console`.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests.
+After checking out the repo, run `bundle install` to install dependencies.
 
 To install this gem onto your local machine, run `bundle exec rake install`.
 
 ### Running Tests
 
+The test suite needs a local PostgreSQL server. Prepare the test database once, then:
+
 ```bash
-bundle exec rake test
+bundle exec rake app:db:test:prepare
+bundle exec rake test         # integration + unit tests
+bundle exec rake test:system  # browser smoke tests (needs Chrome)
 ```
 
 ### Linting

data/Rakefile

@@ -6,3 +6,19 @@ load "rails/tasks/engine.rake"
 load "rails/tasks/statistics.rake"
 
 require "bundler/gem_tasks"
+
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/**/*_test.rb"].exclude("test/system/**/*", "test/dummy/**/*")
+  t.verbose = false
+end
+
+Rake::TestTask.new("test:system") do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/system/**/*_test.rb"]
+  t.verbose = false
+end
+
+task default: :test

data/app/controllers/slash_console/console_controller.rb

@@ -4,27 +4,30 @@ module SlashConsole
 
     skip_before_action :verify_authenticity_token, if: -> { defined?(verify_authenticity_token) }
 
+    # BasicAuthMiddleware is the primary guard: it protects both this page
+    # and web-console's evaluator endpoints, but only at the engine's
+    # standard /rails mount point. These filters remain as a second layer
+    # so the page stays protected if an application mounts the engine at a
+    # custom path.
     before_action :ensure_credentials_configured, if: -> { Rails.env.production? }
     before_action :authenticate_user, if: -> { Rails.env.production? }
 
     def index
-      console
+      console(SlashConsole.console_binding)
       render :index
     end
 
     private
 
     def ensure_credentials_configured
-      if ENV["ADMIN_USERNAME"].blank? || ENV["ADMIN_PASSWORD"].blank?
-        render plain: 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".',
-          status: :service_unavailable
+      unless BasicAuthMiddleware.credentials_configured?
+        render plain: BasicAuthMiddleware::CREDENTIALS_MESSAGE, status: :service_unavailable
       end
     end
 
     def authenticate_user
-      authenticate_or_request_with_http_basic("Rails Console") do |username, password|
-        ActiveSupport::SecurityUtils.secure_compare(username, ENV["ADMIN_USERNAME"]) &&
-          ActiveSupport::SecurityUtils.secure_compare(password, ENV["ADMIN_PASSWORD"])
+      authenticate_or_request_with_http_basic(BasicAuthMiddleware::REALM) do |username, password|
+        BasicAuthMiddleware.authorized?(username, password)
       end
     end
   end

data/app/views/slash_console/console/index.html.erb

@@ -1,36 +1,23 @@
 <!DOCTYPE html>
 <html>
-<head>
-  <title>Rails Console</title>
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <style>
-    html, body {
-      height: 100%;
-      margin: 0;
-      padding: 0;
-      overflow: hidden;
-    }
-
-    /* Hide all content - console will fill the page */
-    body > * {
-      display: none !important;
-    }
-
-    /* Ensure the web-console div fills the entire viewport */
-    #console {
-      display: block !important;
-      position: fixed !important;
-      top: 0 !important;
-      left: 0 !important;
-      right: 0 !important;
-      bottom: 0 !important;
-      width: 100vw !important;
-      height: 100vh !important;
-      z-index: 999999 !important;
-    }
-  </style>
-</head>
-<body>
-  <!-- The console helper will inject the web-console here -->
-</body>
-</html>
+  <head>
+    <title>Rails Console</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <%# Asking Rails for the nonce here also makes it available to the
+        web-console middleware when it injects the console scripts below. %>
+    <style nonce="<%= content_security_policy_nonce %>">
+      body, html {
+        margin: 0;
+        padding: 0;
+        height: 100svh;
+        overflow: hidden;
+      }
+      #console {
+        height: 100svh !important;
+      }
+    </style>
+  </head>
+  <body>
+    <!-- Console will be injected here by web-console middleware -->
+  </body>
+</html>

data/lib/slash_console/basic_auth_middleware.rb

@@ -0,0 +1,71 @@
+module SlashConsole
+  # Basic authentication for the console in production.
+  #
+  # Authentication must happen in the middleware stack, not in
+  # ConsoleController: web-console's evaluator endpoints (PUT/POST
+  # <mount_point>/repl_sessions/:id) are served directly by
+  # WebConsole::Middleware and never reach the router, so a controller
+  # filter cannot protect them. This middleware is inserted before
+  # WebConsole::Middleware and guards both the console page and the
+  # evaluator endpoints with the same credentials.
+  class BasicAuthMiddleware
+    REALM = "Rails Console"
+    CREDENTIALS_MESSAGE = 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".'
+
+    # The paths the engine serves at its standard mount point: the root
+    # (/rails), the console page, and either with a format suffix or
+    # trailing slash. Deliberately does not cover other /rails/* paths --
+    # unmatched requests cascade past the engine to the host app, which
+    # owns paths like /rails/active_storage/*.
+    CONSOLE_PATHS = %r{\A/rails(?:/(?:console)?(?:\.[^/]*)?/?)?\z}
+
+    class << self
+      def credentials_configured?
+        ENV["ADMIN_USERNAME"].present? && ENV["ADMIN_PASSWORD"].present?
+      end
+
+      def authorized?(username, password)
+        ActiveSupport::SecurityUtils.secure_compare(username.to_s, ENV["ADMIN_USERNAME"].to_s) &&
+          ActiveSupport::SecurityUtils.secure_compare(password.to_s, ENV["ADMIN_PASSWORD"].to_s)
+      end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      return @app.call(env) unless Rails.env.production? && protects?(env[Rack::PATH_INFO].to_s)
+
+      unless self.class.credentials_configured?
+        return [503, {"content-type" => "text/plain"}, [CREDENTIALS_MESSAGE]]
+      end
+
+      auth = Rack::Auth::Basic::Request.new(env)
+      if auth.provided? && auth.basic? && self.class.authorized?(*auth.credentials)
+        @app.call(env)
+      else
+        unauthorized
+      end
+    end
+
+    private
+
+    def protects?(path)
+      CONSOLE_PATHS.match?(path) || evaluator_path?(path)
+    end
+
+    def evaluator_path?(path)
+      mount_point = WebConsole::Middleware.mount_point
+      path == mount_point || path.start_with?("#{mount_point}/")
+    end
+
+    def unauthorized
+      headers = {
+        "content-type" => "text/plain",
+        "www-authenticate" => %(Basic realm="#{REALM}")
+      }
+      [401, headers, ["HTTP Basic: Access denied.\n"]]
+    end
+  end
+end

data/lib/slash_console/engine.rb

@@ -5,10 +5,21 @@ module SlashConsole
     config.before_initialize do
       Rails.application.config.web_console ||= ActiveSupport::OrderedOptions.new
       Rails.application.config.web_console.development_only = false
+      Rails.application.config.web_console.allowed_ips = "0.0.0.0/0"
+    end
 
-      if Rails.env.production?
-        Rails.application.config.web_console.allowed_ips = "0.0.0.0/0"
-      end
+    initializer "slash_console.load_web_console_extensions", before: :load_config_initializers do
+      require "bindex"
+      require "web_console/extensions"
+    end
+
+    # web-console's own railtie already inserts WebConsole::Middleware
+    # (before ActionDispatch::DebugExceptions), so the engine must not
+    # insert a second copy. It only adds the authentication middleware,
+    # which has to sit in front of WebConsole::Middleware because the
+    # evaluator endpoints are served there and never reach the router.
+    initializer "slash_console.insert_basic_auth_middleware", after: "web_console.insert_middleware" do |app|
+      app.config.middleware.insert_before WebConsole::Middleware, SlashConsole::BasicAuthMiddleware
     end
 
     initializer "slash_console.mount_engine" do |app|

data/lib/slash_console/version.rb

@@ -1,3 +1,3 @@
 module SlashConsole
-  VERSION = "0.1.4"
+  VERSION = "0.1.6"
 end

data/lib/slash_console.rb

@@ -1,6 +1,15 @@
 require "slash_console/version"
+require "slash_console/basic_auth_middleware"
 require "slash_console/engine"
 require "web-console"
 
 module SlashConsole
+  # A fresh binding at the top level, so that console input sees the same
+  # +self+ and constant resolution as bin/rails console, rather than the
+  # engine's lexical namespace. Each call returns a new binding: local
+  # variables persist across evaluations within a console session but do
+  # not leak between sessions or into TOPLEVEL_BINDING itself.
+  def self.console_binding
+    TOPLEVEL_BINDING.eval("binding")
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: slash_console
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.6
 platform: ruby
 authors:
 - Raghu Betina
@@ -70,6 +70,7 @@ files:
 - app/views/slash_console/console/index.html.erb
 - config/routes.rb
 - lib/slash_console.rb
+- lib/slash_console/basic_auth_middleware.rb
 - lib/slash_console/engine.rb
 - lib/slash_console/version.rb
 - lib/tasks/slash_console_tasks.rake
@@ -96,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 4.0.9
 specification_version: 4
 summary: Mountable Rails console at /rails/console
 test_files: []