unpoly-rails 3.3.0 → 3.5.0

data/lib/unpoly/rails/change/field.rb

@@ -48,7 +48,7 @@ module Unpoly
         end
 
         ##
-        # An array of strings, serialized as JSON.
+        # An array of strings, separated by a space character.
         class SeparatedValues < Field
 
           def initialize(name, separator: ' ', default: nil)
@@ -60,8 +60,8 @@ module Unpoly
           def parse(raw)
             if raw
               raw.split(@separator)
-            elsif @default
-              instance_exec(&@default)
+            else
+              @default&.call
             end
           end
 
@@ -101,11 +101,7 @@ module Unpoly
           end
 
           def parse(raw)
-            if raw.present?
-              result = Util.json_decode(raw)
-            elsif @default
-              result = instance_exec(&@default)
-            end
+            result = Util.guard_json_decode(raw, &@default)
 
             if result.is_a?(::Hash)
               result = ActiveSupport::HashWithIndifferentAccess.new(result)
@@ -132,13 +128,7 @@ module Unpoly
           end
 
           def parse(raw)
-            if raw.present?
-              result = Util.json_decode(raw)
-            elsif @default
-              result = instance_exec(&@default)
-            end
-
-            result
+            Util.guard_json_decode(raw, &@default)
           end
 
           def stringify(value)

data/lib/unpoly/rails/util.rb

@@ -3,8 +3,20 @@ module Unpoly
     class Util
       class << self
 
-        def json_decode(string)
-          ActiveSupport::JSON.decode(string)
+        def guard_json_decode(raw, &default)
+          if raw.present?
+            begin
+              ActiveSupport::JSON.decode(raw)
+            rescue ActiveSupport::JSON.parse_error
+              # We would love to crash here, as it might indicate a bug in the frontend code.
+              # Unfortunately security scanners may be spamming malformed JSON in X-Up headers,
+              # DOSing us with error notifications.
+              ::Rails.logger.error('unpoly-rails: Ignoring malformed JSON in X-Up header')
+              default&.call
+            end
+          else
+            default&.call
+          end
         end
 
         # We build a lot of JSON that goes into HTTP header.

data/lib/unpoly/rails/version.rb

@@ -2,8 +2,7 @@ module Unpoly
   module Rails
     ##
     # The current version of the unpoly-rails gem.
-    # This version number is also used for releases of the Unpoly
-    # frontend code.
-    VERSION = '3.3.0'
+    # The first 3 digits should match the version of the Unpoly frontend code.
+    VERSION = '3.5.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unpoly-rails
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.5.0
 platform: ruby
 authors:
 - Henning Koch
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-16 00:00:00.000000000 Z
+date: 2023-11-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties