solid_stack_web 1.6.0 → 1.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db27129d1f850266817f633ff0109fdd3708c7105fdea6d0bcf3035ec1734769
-  data.tar.gz: 1549319d21ac55da226b2ce4487a8a8a1340531b13c838643fb2754843620518
+  metadata.gz: fc70dcb623bcb04ca239a23b6a15e173129bc9362166565d73671bfb7dc08edc
+  data.tar.gz: 1afc6e66782fb662ab28b1a50425a05f4de49c3f67a0a6504f6b965c4849d7b0
 SHA512:
-  metadata.gz: '02499cb54b94ad58e62204d18f60780cc88e22c62706248f5fb60a4905f36eb822e8243de0351df15a915f740501bde0b973fa9e6a17754ba2741b64f4b6b695'
-  data.tar.gz: 627aae0342fa4f93ef0a6e25b89e56764ff6bda2e2c75d7b0315675ee2daacdc2e57ed428698485302b2a6950725bf5d63bb5c5c51a6e566d55f141cbf820c08
+  metadata.gz: e2fd1f48e168729bdcaf663b2f14d9246fdc34aa6dd1722f569a815990d646a8f60a42b7c8d46f38bd7d1289fdd089d22df9cd50405fcb8720019dc64f259ff4
+  data.tar.gz: 2fb4bf7fa63f65c33f4fed44b0e3c8803b1de86bf5c3f83aad42d87620ddff4a7c6ceb1c84731d6a5d4e6a0eb2b9a460ecb3e79b1890f36fb0cf0cbfde7f9ce4

data/README.md

@@ -428,10 +428,7 @@ When a public API item is renamed or removed, the old interface is deprecated in
 
 ## Contributing
 
-1. Fork the repository
-2. Create a feature branch (`git checkout -b feat/my-feature`)
-3. Run the test suite: `bundle exec rake`
-4. Open a pull request
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, the check suite, and the pull request workflow.
 
 Bug reports and feature requests are welcome on [GitHub Issues](https://github.com/eclectic-coding/solid_stack_web/issues).
 

data/Rakefile

@@ -9,8 +9,13 @@ RuboCop::RakeTask.new
 RSpec::Core::RakeTask.new(:spec)
 Bundler::Audit::Task.new
 
-desc "Run bundler-audit, rubocop, and rspec (full CI suite)"
-task ci: ["bundle:audit:update", "bundle:audit:check", :rubocop, :spec]
+desc "Run Brakeman against the engine code (dummy app excluded)"
+task :brakeman do
+  sh "bundle exec brakeman -q --no-pager --force-scan --skip-files spec/dummy/ -i config/brakeman.ignore"
+end
+
+desc "Run bundler-audit, brakeman, rubocop, and rspec (full CI suite)"
+task ci: ["bundle:audit:update", "bundle:audit:check", :brakeman, :rubocop, :spec]
 
 task default: :ci
 

data/app/helpers/solid_stack_web/application_helper.rb

@@ -21,6 +21,17 @@ module SolidStackWeb
       { label: "Text", content: str }
     end
 
+    # Solid Cable stores payloads (and channel names) in a binary (bytea) column,
+    # so ActiveRecord hands the view a string with ASCII-8BIT (BINARY) encoding.
+    # Appending such a value — once it holds non-ASCII bytes (e.g. a "→" in a
+    # Turbo Stream payload) and the UTF-8 output buffer already contains
+    # non-ASCII text — raises Encoding::CompatibilityError. Re-tag the bytes as
+    # UTF-8 (lossless; the underlying data is UTF-8 source text) before it
+    # reaches the view. dup keeps the ActiveRecord attribute string unmutated.
+    def to_utf8_text(value)
+      value.to_s.dup.force_encoding("UTF-8").scrub
+    end
+
     def format_duration(seconds)
       return "—" if seconds.nil?
       return "#{(seconds * 1000).round}ms" if seconds < 1

data/app/views/solid_stack_web/cable/index.html.erb

@@ -61,8 +61,8 @@
     <tbody>
       <% @channels.each do |channel| %>
         <tr>
-          <td class="sqw-monospace sqw-truncate" title="<%= channel[:channel] %>">
-            <%= link_to channel[:channel], cable_channel_messages_path(channel[:channel_hash]), class: "sqw-link" %>
+          <td class="sqw-monospace sqw-truncate" title="<%= to_utf8_text(channel[:channel]) %>">
+            <%= link_to to_utf8_text(channel[:channel]), cable_channel_messages_path(channel[:channel_hash]), class: "sqw-link" %>
           </td>
           <td><%= channel[:message_count] %></td>
           <td class="sqw-muted"><%= local_time(channel[:last_message_at]) %></td>

data/app/views/solid_stack_web/cable_messages/index.html.erb

@@ -1,5 +1,5 @@
 <div class="sqw-page-header sqw-page-header--split">
-  <h1 class="sqw-page-title sqw-truncate" title="<%= @channel_name %>"><%= @channel_name %></h1>
+  <h1 class="sqw-page-title sqw-truncate" title="<%= to_utf8_text(@channel_name) %>"><%= to_utf8_text(@channel_name) %></h1>
   <div class="sqw-header-actions">
     <%= button_to t("solid_stack_web.cable_messages.purge_channel"),
           cable_channel_purge_path(params[:channel_hash]),
@@ -33,8 +33,8 @@
       <% @messages.each do |message| %>
         <tr>
           <td class="sqw-muted sqw-monospace"><%= message.id %></td>
-          <td class="sqw-monospace sqw-truncate" title="<%= message.payload %>">
-            <%= truncate(message.payload.to_s, length: 120) %>
+          <td class="sqw-monospace sqw-truncate" title="<%= to_utf8_text(message.payload) %>">
+            <%= truncate(to_utf8_text(message.payload), length: 120) %>
           </td>
           <td class="sqw-muted">
             <%= local_time(message.created_at, format: :relative) %>

data/config/brakeman.ignore

@@ -0,0 +1,51 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "SQL Injection",
+      "warning_code": 0,
+      "fingerprint": "5bc6f901074d04c2c3cf13a924de05ad909fdcdebc10af687e696f9af35ebcdf",
+      "check_name": "SQL",
+      "message": "Possible SQL injection",
+      "file": "app/controllers/solid_stack_web/history_controller.rb",
+      "line": 31,
+      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
+      "code": "Arel.sql(\"#{(params[:sort].presence_in(sortable_columns) or \"finished_at\")} #{((\"asc\" or \"desc\") == \"asc\") ? (\"ASC\") : (\"DESC\")}\")",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "SolidStackWeb::HistoryController",
+        "method": "sort_expression"
+      },
+      "user_input": "params[:sort].presence_in(sortable_columns)",
+      "confidence": "High",
+      "cwe_id": [
+        89
+      ],
+      "note": "Sort column is restricted via presence_in(sortable_columns) and direction is a ternary; no user input is interpolated."
+    },
+    {
+      "warning_type": "Cross-Site Request Forgery",
+      "warning_code": 7,
+      "fingerprint": "9fb3180dd778fb4f78855b53ccd5d37670f1a7de5b23273e9ae5edbdd8223f16",
+      "check_name": "ForgerySetting",
+      "message": "`protect_from_forgery` should be called in `SolidStackWeb::ApplicationController`",
+      "file": "app/controllers/solid_stack_web/application_controller.rb",
+      "line": 4,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/",
+      "code": null,
+      "render_path": null,
+      "location": {
+        "type": "controller",
+        "controller": "SolidStackWeb::ApplicationController"
+      },
+      "user_input": null,
+      "confidence": "High",
+      "cwe_id": [
+        352
+      ],
+      "note": "Rails enables forgery protection by default (default_protect_from_forgery) in host apps; engine inherits ActionController::Base."
+    }
+  ],
+  "brakeman_version": "8.1.0",
+  "updated": "2026-10-27"
+}

data/lib/solid_stack_web/version.rb

@@ -1,3 +1,3 @@
 module SolidStackWeb
-  VERSION = "1.6.0"
+  VERSION = "1.6.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solid_stack_web
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.6.2
 platform: ruby
 authors:
 - Chuck Smith
@@ -224,6 +224,7 @@ files:
 - app/views/solid_stack_web/shared/_flash.html.erb
 - app/views/solid_stack_web/shared/_locale_switcher.html.erb
 - app/views/solid_stack_web/stats/index.html.erb
+- config/brakeman.ignore
 - config/importmap.rb
 - config/locales/en.yml
 - config/locales/es.yml
@@ -258,7 +259,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A unified Rails engine dashboard for Solid Queue, Solid Cache, and Solid
   Cable.