slash_console 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09b6efbfc6effb15fae37a397c78d62ae8408e98d44819f64eadac99f438c0f9'
-  data.tar.gz: 6e5f82dd8814dda0aa99f4b7d5875e406977e78f01099fe98e68684be306361b
+  metadata.gz: fe6fc75ab8103bf062f9a10eefdcc0385749f4c1889b04fb1c6ba0f1a99a939d
+  data.tar.gz: 6186eb67c87e30ebb7c0e09dca9cd4d38212d5186fd32571a0ee89aedaaea780
 SHA512:
-  metadata.gz: 6a2714e7502c931378d6f9fdd3598ce60c8577fc159bd214bd23826f64b3218c6115d2294a5ac885a7a4d4f3c17fee0e09aa07c241210bd7379ea1af78ba1b7b
-  data.tar.gz: e0219858fd1e1b7f768a71d0d35d9fe2b711804b30e4f9a5297fafd007990986a84194b6007e6aca84b7fb9980c09bbde7b943d46c981986af5ca32487f59619
+  metadata.gz: 611af64c4b066ec322875c66d9eac0a50ff0cc0102344240b24f1dd501ec60cd2241f3d19cd3f45fd593c0c63205685483bcdf79df23b18081e91e141618432d
+  data.tar.gz: 9f7f467142f12e16668899c9cb150e7b7165be1f2df1b099d93d2809bc2d5fb0ffb36f32d2befdd752be3c83cb2850331ad91bae944510704b76379c8400d6d1

data/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.7] - 2026-07-10
+
+### Security
+- Authentication is now required in every environment except `development`
+  and `test`, instead of only `production`. The engine force-enables
+  web-console and allows all IPs everywhere, so a `staging`/`preview`
+  deployment previously served an unauthenticated console.
+- Require web-console >= 4.2.1: versions before 4.1.0 do not put CSP
+  nonces on injected assets (silently breaking under a strict CSP), and
+  versions before 4.2.1 lack Rack 3 / Rails 7.1 support.
+- Enabled `rubygems_mfa_required`, so future gem pushes and yanks require
+  a multi-factor-authenticated RubyGems session.
+
+### Fixed
+- A malformed Basic Authorization header (credentials without a colon)
+  now gets a 401 on Rack 2 instead of raising.
+- Stored console sessions are capped at 50 per process. web-console's
+  session store is never evicted otherwise, so each console page load
+  pinned a binding in memory until process restart.
+
+### Removed
+- Deleted the engine's unused application layout, which referenced a
+  stylesheet that does not ship with the gem, and a no-op CSRF skip in
+  the console controller (the console page is GET-only).
+
+## [0.1.6] - 2026-07-10
+
+### Security
+- Production Basic authentication moved from the controller into a Rack
+  middleware inserted in front of `WebConsole::Middleware`, so it now covers
+  web-console's evaluator endpoints (`/__web_console/repl_sessions/:id`) as
+  well as the console page. Previously a console session ID acted as an
+  unauthenticated bearer token for code execution until process restart.
+
+### Fixed
+- The console renders under a strict nonce-based Content Security Policy.
+  The page stylesheet carries Rails' per-request nonce, and requesting the
+  nonce during rendering makes it available to web-console's injected
+  scripts even when the app hoists the CSP middleware above web-console
+  (previously such apps got a nonempty header nonce but `nonce=""` scripts,
+  i.e. a blank console).
+- Console input evaluates in a fresh top-level binding, so constants
+  resolve the same way as in `bin/rails console` instead of inside the
+  engine's namespace (`ApplicationController` no longer resolves to
+  `SlashConsole::ApplicationController`, and app constants no longer need a
+  leading `::`). Local variables persist within a console session but not
+  across sessions.
+- Removed the duplicate `WebConsole::Middleware` the engine inserted
+  alongside the copy web-console's own railtie already adds.
+
 ## [0.1.5] - 2025-09-15
 
 ### Fixed
@@ -53,5 +103,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Development mode with no authentication required
 - Standard Ruby style guide compliance
 
-[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0
+[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.7...HEAD
+[0.1.7]: https://github.com/firstdraft/slash_console/compare/v0.1.6...v0.1.7
+[0.1.6]: https://github.com/firstdraft/slash_console/compare/v0.1.0...v0.1.6
+[0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0

data/README.md

@@ -2,6 +2,12 @@
 
 A Rails engine that provides a web-based console interface at `/rails/console`, allowing easy access to a Rails console in both development and production environments.
 
+⚠️ **Security Warning**: This gem provides direct access to the `rails console`. Anyone who accesses it can run arbitrary code on the server: stealing/deleting all your data, planting bugs, sending scam emails, mining cryptocurrency, etc. So, be careful.
+
+- Only use this gem in applications where the security trade-offs are acceptable. Basically, only for toy apps/proofs-of-concept/portfolio projects that contain only sample data. Never use this gem when real user data is at risk.
+- For serious apps, SSH into the server and run `rails console` at the command-line. This may require upgrading your hosting from free to paid, but you should be doing that anyway if you have real users.
+- Make up a strong, unique `ADMIN_PASSWORD` for each app. There is no rate limiting on the password prompt, so a short or guessable password can be brute-forced.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -10,7 +16,7 @@ Add this line to your application's Gemfile:
 gem "slash_console"
 ```
 
-And then execute:
+And then:
 
 ```bash
 bundle install
@@ -22,15 +28,11 @@ That's it! Navigate to `/rails/console` in your browser.
 
 ### Development
 
-In development, no authentication is required. Simply visit:
-
-```
-http://localhost:3000/rails/console
-```
+In development, no authentication is required. Simply visit `/rails/console`.
 
-### Production
+### Deployed environments
 
-For production use, authentication is **required**. Set these environment variables:
+In every environment other than `development` and `test` — production, staging, previews, anything — authentication is required. Set these environment variables:
 
 ```bash
 ADMIN_USERNAME="choose_your_own_username"
@@ -39,30 +41,33 @@ ADMIN_PASSWORD="choose_your_own_strong_password"
 
 Without these environment variables, you'll see an error message explaining what needs to be configured.
 
-⚠️ **Security Warning**: This gem provides direct access to your Rails console. In production:
-
-- Only use for applications where the security trade-offs are acceptable. Basically, only for toy apps; never where real user data is at risk. For serious apps, SSH into the server and run `rails console` at the command-line.
-- Make up a strong, unique `ADMIN_PASSWORD` for each app.
-- In production, the gem allows console access from all IP addresses (0.0.0.0/0) when authenticated. The authentication layer is your only protection.
+If your server runs multiple processes (e.g. Puma workers), console sessions live in the memory of whichever process rendered the page, so evaluating code may intermittently report that your session is no longer available. Run a single process (e.g. `WEB_CONCURRENCY=1`) for a reliable console.
 
 ## How It Works
 
-SlashConsole is a lightweight wrapper around the excellent `web-console` gem. It:
+SlashConsole is a lightweight wrapper around [the excellent `web-console` gem](https://github.com/rails/web-console). It:
 
 1. Provides a dedicated route for console access (instead of only on error pages).
-2. Renders a full-page console interface.
-3. Uses basic authentication when in production.
+2. Renders a full-page console interface, including in apps that enforce a strict nonce-based Content Security Policy.
+3. In every environment except development and test, requires basic authentication via a Rack middleware that protects both the console page and web-console's code-evaluation endpoints (`/__web_console/repl_sessions/:id`).
+4. Evaluates console input at the top level, so constants resolve the same way as in `bin/rails console`.
+
+Note that SlashConsole configures web-console itself: it activates it in all environments and clears its IP allowlist (authentication replaces it). Any `config.web_console` settings in your app will be overridden.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests.
+After checking out the repo, run `bundle install` to install dependencies.
 
 To install this gem onto your local machine, run `bundle exec rake install`.
 
 ### Running Tests
 
+The test suite needs a local PostgreSQL server. Prepare the test database once, then:
+
 ```bash
-bundle exec rake test
+bundle exec rake app:db:test:prepare
+bundle exec rake test         # integration + unit tests
+bundle exec rake test:system  # browser smoke tests (needs Chrome)
 ```
 
 ### Linting

data/Rakefile

@@ -6,3 +6,19 @@ load "rails/tasks/engine.rake"
 load "rails/tasks/statistics.rake"
 
 require "bundler/gem_tasks"
+
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/**/*_test.rb"].exclude("test/system/**/*", "test/dummy/**/*")
+  t.verbose = false
+end
+
+Rake::TestTask.new("test:system") do |t|
+  t.libs << "test"
+  t.test_files = FileList["test/system/**/*_test.rb"]
+  t.verbose = false
+end
+
+task default: :test

data/app/controllers/slash_console/console_controller.rb

@@ -2,30 +2,44 @@ module SlashConsole
   class ConsoleController < ApplicationController
     layout false
 
-    skip_before_action :verify_authenticity_token, if: -> { defined?(verify_authenticity_token) }
+    # web-console stores every console session (and the binding it holds)
+    # in an in-memory hash that is never evicted, so each page load would
+    # otherwise pin memory until the process restarts. Old sessions are
+    # dropped once this many accumulate; an evicted session's tab shows
+    # web-console's normal "session is no longer available" message.
+    MAX_STORED_SESSIONS = 50
 
-    before_action :ensure_credentials_configured, if: -> { Rails.env.production? }
-    before_action :authenticate_user, if: -> { Rails.env.production? }
+    # BasicAuthMiddleware is the primary guard: it protects both this page
+    # and web-console's evaluator endpoints, but only at the engine's
+    # standard /rails mount point. These filters remain as a second layer
+    # so the page stays protected if an application mounts the engine at a
+    # custom path.
+    before_action :ensure_credentials_configured, if: -> { BasicAuthMiddleware.authentication_required? }
+    before_action :authenticate_user, if: -> { BasicAuthMiddleware.authentication_required? }
 
     def index
-      console
+      prune_console_sessions
+      console(SlashConsole.console_binding)
       render :index
     end
 
     private
 
     def ensure_credentials_configured
-      if ENV["ADMIN_USERNAME"].blank? || ENV["ADMIN_PASSWORD"].blank?
-        render plain: 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".',
-          status: :service_unavailable
+      unless BasicAuthMiddleware.credentials_configured?
+        render plain: BasicAuthMiddleware::CREDENTIALS_MESSAGE, status: :service_unavailable
       end
     end
 
     def authenticate_user
-      authenticate_or_request_with_http_basic("Rails Console") do |username, password|
-        ActiveSupport::SecurityUtils.secure_compare(username, ENV["ADMIN_USERNAME"]) &&
-          ActiveSupport::SecurityUtils.secure_compare(password, ENV["ADMIN_PASSWORD"])
+      authenticate_or_request_with_http_basic(BasicAuthMiddleware::REALM) do |username, password|
+        BasicAuthMiddleware.authorized?(username, password)
       end
     end
+
+    def prune_console_sessions
+      storage = WebConsole::Session.inmemory_storage
+      storage.shift while storage.size >= MAX_STORED_SESSIONS
+    end
   end
 end

data/app/views/slash_console/console/index.html.erb

@@ -3,7 +3,9 @@
   <head>
     <title>Rails Console</title>
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <style>
+    <%# Asking Rails for the nonce here also makes it available to the
+        web-console middleware when it injects the console scripts below. %>
+    <style nonce="<%= content_security_policy_nonce %>">
       body, html {
         margin: 0;
         padding: 0;
@@ -18,4 +20,4 @@
   <body>
     <!-- Console will be injected here by web-console middleware -->
   </body>
-</html>
+</html>

data/lib/slash_console/basic_auth_middleware.rb

@@ -0,0 +1,89 @@
+module SlashConsole
+  # Basic authentication for the console in deployed environments.
+  #
+  # Authentication must happen in the middleware stack, not in
+  # ConsoleController: web-console's evaluator endpoints (PUT/POST
+  # <mount_point>/repl_sessions/:id) are served directly by
+  # WebConsole::Middleware and never reach the router, so a controller
+  # filter cannot protect them. This middleware is inserted before
+  # WebConsole::Middleware and guards both the console page and the
+  # evaluator endpoints with the same credentials.
+  class BasicAuthMiddleware
+    REALM = "Rails Console"
+    CREDENTIALS_MESSAGE = 'Before you can access the console, you must set environment variables called "ADMIN_USERNAME" and "ADMIN_PASSWORD".'
+
+    # The paths the engine serves at its standard mount point: the root
+    # (/rails), the console page, and either with a format suffix or
+    # trailing slash. Deliberately does not cover other /rails/* paths --
+    # unmatched requests cascade past the engine to the host app, which
+    # owns paths like /rails/active_storage/*.
+    CONSOLE_PATHS = %r{\A/rails(?:/(?:console)?(?:\.[^/]*)?/?)?\z}
+
+    class << self
+      # Development and test are the only environments that get an open
+      # console. Any deployed environment -- production, staging, preview,
+      # or anything else -- must present credentials, because the engine
+      # force-enables web-console everywhere and allows all IPs.
+      def authentication_required?
+        !(Rails.env.development? || Rails.env.test?)
+      end
+
+      def credentials_configured?
+        ENV["ADMIN_USERNAME"].present? && ENV["ADMIN_PASSWORD"].present?
+      end
+
+      def authorized?(username, password)
+        ActiveSupport::SecurityUtils.secure_compare(username.to_s, ENV["ADMIN_USERNAME"].to_s) &&
+          ActiveSupport::SecurityUtils.secure_compare(password.to_s, ENV["ADMIN_PASSWORD"].to_s)
+      end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      return @app.call(env) unless self.class.authentication_required? && protects?(env[Rack::PATH_INFO].to_s)
+
+      unless self.class.credentials_configured?
+        return [503, {"content-type" => "text/plain"}, [CREDENTIALS_MESSAGE]]
+      end
+
+      if valid_credentials?(env)
+        @app.call(env)
+      else
+        unauthorized
+      end
+    end
+
+    private
+
+    # Destructures rather than splatting: Rack 2 (Rails 7.0 apps) does not
+    # validate credential arity in Request#basic?, so a header whose
+    # decoded value lacks a colon would otherwise raise instead of 401ing.
+    def valid_credentials?(env)
+      auth = Rack::Auth::Basic::Request.new(env)
+      return false unless auth.provided? && auth.basic?
+
+      username, password = auth.credentials
+      self.class.authorized?(username, password)
+    end
+
+    def protects?(path)
+      CONSOLE_PATHS.match?(path) || evaluator_path?(path)
+    end
+
+    def evaluator_path?(path)
+      mount_point = WebConsole::Middleware.mount_point
+      path == mount_point || path.start_with?("#{mount_point}/")
+    end
+
+    def unauthorized
+      headers = {
+        "content-type" => "text/plain",
+        "www-authenticate" => %(Basic realm="#{REALM}")
+      }
+      [401, headers, ["HTTP Basic: Access denied.\n"]]
+    end
+  end
+end

data/lib/slash_console/engine.rb

@@ -13,8 +13,13 @@ module SlashConsole
       require "web_console/extensions"
     end
 
-    initializer "slash_console.insert_middleware", after: :load_config_initializers do |app|
-      app.config.middleware.insert_after ActionDispatch::DebugExceptions, WebConsole::Middleware
+    # web-console's own railtie already inserts WebConsole::Middleware
+    # (before ActionDispatch::DebugExceptions), so the engine must not
+    # insert a second copy. It only adds the authentication middleware,
+    # which has to sit in front of WebConsole::Middleware because the
+    # evaluator endpoints are served there and never reach the router.
+    initializer "slash_console.insert_basic_auth_middleware", after: "web_console.insert_middleware" do |app|
+      app.config.middleware.insert_before WebConsole::Middleware, SlashConsole::BasicAuthMiddleware
     end
 
     initializer "slash_console.mount_engine" do |app|

data/lib/slash_console/version.rb

@@ -1,3 +1,3 @@
 module SlashConsole
-  VERSION = "0.1.5"
+  VERSION = "0.1.7"
 end

data/lib/slash_console.rb

@@ -1,6 +1,15 @@
 require "slash_console/version"
+require "slash_console/basic_auth_middleware"
 require "slash_console/engine"
 require "web-console"
 
 module SlashConsole
+  # A fresh binding at the top level, so that console input sees the same
+  # +self+ and constant resolution as bin/rails console, rather than the
+  # engine's lexical namespace. Each call returns a new binding: local
+  # variables persist across evaluations within a console session but do
+  # not leak between sessions or into TOPLEVEL_BINDING itself.
+  def self.console_binding
+    TOPLEVEL_BINDING.eval("binding")
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: slash_console
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - Raghu Betina
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.2.1
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -66,10 +66,10 @@ files:
 - app/assets/stylesheets/slash_console/application.css
 - app/controllers/slash_console/application_controller.rb
 - app/controllers/slash_console/console_controller.rb
-- app/views/layouts/slash_console/application.html.erb
 - app/views/slash_console/console/index.html.erb
 - config/routes.rb
 - lib/slash_console.rb
+- lib/slash_console/basic_auth_middleware.rb
 - lib/slash_console/engine.rb
 - lib/slash_console/version.rb
 - lib/tasks/slash_console_tasks.rake
@@ -77,6 +77,7 @@ homepage: https://github.com/firstdraft/slash_console
 licenses:
 - MIT
 metadata:
+  rubygems_mfa_required: 'true'
   homepage_uri: https://github.com/firstdraft/slash_console
   source_code_uri: https://github.com/firstdraft/slash_console
   changelog_uri: https://github.com/firstdraft/slash_console/blob/main/CHANGELOG.md
@@ -96,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 4.0.9
 specification_version: 4
 summary: Mountable Rails console at /rails/console
 test_files: []

data/app/views/layouts/slash_console/application.html.erb

@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Slash console</title>
-  <%= csrf_meta_tags %>
-  <%= csp_meta_tag %>
-
-  <%= yield :head %>
-
-  <%= stylesheet_link_tag    "slash_console/application", media: "all" %>
-</head>
-<body>
-
-<%= yield %>
-
-</body>
-</html>