web-console 2.1.3 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5cf0cbd5310d3c232a6dc3f3ffac02155928afaf
-  data.tar.gz: df79c6d5af175c9987a6b4e5361b6ad4bbb99761
+  metadata.gz: bde2832a1ef7a0ace010d61011afb4c74a116a93
+  data.tar.gz: c0e5de96dab453f1a3e233d969bf5ada72ba848a
 SHA512:
-  metadata.gz: 4cb26884dfa66837135c89f632aaed9a2643d816a8955a3967005f5884c95f35f65597569b82431bc8027f3de35125e7282f6a8803fd329d2356538c44436816
-  data.tar.gz: 51ee3fcdfa8f4a37f2607d48a9c4e1019c706937d074c74946e25f7d064136be67a7b492bafc23170b4963303f465d844942fc5c28ba2f024ece111b17a82648
+  metadata.gz: eb74d0994835ccc223df24cb3a5ee1e034ca2456580f99962724864994438f04a14c67aa05f9425263f1c36773623969abdc7bca5a2b255535e90449b6394ac3
+  data.tar.gz: 31f90bb5c32ed53a95f43cb1a0f25cf89765847c92010255a9df5c0235423203711be37e09eda9af4f435616772d247502b682a2ef367f5409cbbbcc23cca963

data/CHANGELOG.markdown

@@ -0,0 +1,45 @@
+# CHANGELOG
+
+## master (unreleased)
+
+## 2.2.0
+
+* [#140](https://github.com/rails/web-console/pull/140) Add the ability to close the console on each page ([@sh19910711])
+* [#135](https://github.com/rails/web-console/pull/135) Run the console only in development mode and raise warning in tests ([@frenesim])
+
+## 2.1.3
+
+* Fix remote code execution vulnerability in Web Console. CVE-2015-3224.
+* [#123](https://github.com/rails/web-console/pull/123) Replace deprecated `alias_method_chain` with `alias_method` ([@jonatack])
+
+## 2.1.2
+
+* [#115](https://github.com/rails/web-console/pull/115) Show proper binding when raising an error in a template ([@gsamokovarov])
+* [#114](https://github.com/rails/web-console/pull/114) Fix templates non rendering, because of missing template suffix ([@gsamokovarov])
+
+## 2.1.1
+
+* [#112](https://github.com/rails/web-console/pull/112) Always allow application/x-www-form-urlencoded content type ([@gsamokovarov])
+
+## 2.1.0
+
+* [#109](https://github.com/rails/web-console/pull/109) Revamp unavailable session response message ([@gsamokovarov])
+* [#107](https://github.com/rails/web-console/pull/107) Fix pasting regression for all browsers ([@parterburn])
+* [#105](https://github.com/rails/web-console/pull/105) Lock scroll bottom on console window resize ([@noahpatterson])
+* [#104](https://github.com/rails/web-console/pull/104) Always whitelist localhost and inform users why no console is displayed ([@gsamokovarov])
+* [#100](https://github.com/rails/web-console/pull/100) Accept text/plain as acceptable content type for Puma ([@gsamokovarov])
+* [#98](https://github.com/rails/web-console/pull/98) Add arbitrary big z-index to the console ([@bglbruno])
+* [#88](https://github.com/rails/web-console/pull/88) Spelling fixes ([@jeffnv])
+* [#86](https://github.com/rails/web-console/pull/86) Disable autofocus when initializing the console ([@ryandao])
+* [#84](https://github.com/rails/web-console/pull/84) Allow Rails 5 as dependency in gemspec ([@jonatack])
+* [#69](https://github.com/rails/web-console/pull/69) Introduce middleware for request dispatch and console rendering ([@gsamokovarov])
+
+[@jonatack]: https://github.com/jonatack
+[@ryandao]: https://github.com/ryandao
+[@jeffnv]: https://github.com/jeffnv
+[@gsamokovarov]: https://github.com/gsamokovarov
+[@bglbruno]: https://github.com/bglbruno
+[@noahpatterson]: https://github.com/noahpatterson
+[@parterburn]: https://github.com/parterburn
+[@sh19910711]: https://github.com/sh19910711
+[@frenesim]: https://github.com/frenesim

data/README.markdown

@@ -1,6 +1,10 @@
 <p align=right>
   Documentation for:
   <a href=https://github.com/rails/web-console/tree/v2.0.0>v2.0.0</a>
+  <a href=https://github.com/rails/web-console/tree/v2.1.0>v2.1.0</a>
+  <a href=https://github.com/rails/web-console/tree/v2.1.1>v2.1.1</a>
+  <a href=https://github.com/rails/web-console/tree/v2.1.2>v2.1.2</a>
+  <a href=https://github.com/rails/web-console/tree/v2.1.3>v2.1.3</a>
 </p>
 
 # Web Console [![Build Status](https://travis-ci.org/rails/web-console.svg?branch=master)](https://travis-ci.org/rails/web-console)
@@ -119,7 +123,7 @@ end
 If you want to whitelist the whole private network, you can do:
 
 ```ruby
-class Application < Rails::Application
+Rails.application.configure do
   config.web_console.whitelisted_ips = '192.168.0.0/16'
 end
 ```
@@ -138,19 +142,19 @@ messages like the following is printed in the server logs:
 If you don't wanna see this message anymore, set this option to `false`:
 
 ```ruby
-class Application < Rails::Application
+Rails.application.configure do
   config.web_console.whiny_requests = false
 end
 ```
 
-### config.web_console.templates_path
+### config.web_console.template_paths
 
 If you wanna style the console yourself, you can place `style.css` at a
-directory pointed by `config.web_console.templates_path`:
+directory pointed by `config.web_console.template_paths`:
 
 ```ruby
-class Application < Rails::Application
-  config.web_console.templates_path = 'app/views/web_console'
+Rails.application.configure do
+  config.web_console.template_paths = 'app/views/web_console'
 end
 ```
 
@@ -181,6 +185,22 @@ server requests only out of one process.
 The interactive console executes Ruby code. Invoking `instance_variables` and
 `local_variables` will give you what you want.
 
+### Why does console only appear on error pages but not when I call it?
+
+This can be happening if you are using `Rack::Deflater`. Be sure that
+`WebConsole::Middleware` is used after `Rack::Deflater`. The easiest way to do
+this is to insert `Rack::Deflater` as early as possible
+
+```ruby
+Rails.application.configure do
+  config.middleware.insert(0, Rack::Deflater)
+end
+```
+
+### Why I'm getting an undefined method `web_console`?
+
+Make sure you configuration lives in `config/environments/development.rb`.
+
 ## Credits
 
 * Shoutout to [Charlie Somerville] for [better_errors] and [this] code.

data/Rakefile

@@ -6,6 +6,8 @@ end
 
 require 'socket'
 require 'rake/testtask'
+require 'tmpdir'
+require 'securerandom'
 
 EXPANDED_CWD = File.expand_path(File.dirname(__FILE__))
 
@@ -16,6 +18,41 @@ Rake::TestTask.new(:test) do |t|
   t.verbose = false
 end
 
+namespace :test do
+  desc "Run tests for templates"
+  task :templates => "templates:all"
+
+  namespace :templates do
+    task :all   => [:daemonize, :npm, :rackup, :mocha, :kill]
+    task :serve => [:npm, :rackup]
+
+    work_dir    = Pathname(__FILE__).dirname.join("test/templates")
+    pid_file    = Pathname(Dir.tmpdir).join("web_console.#{SecureRandom.uuid}.pid")
+    server_port = 29292
+    rackup_opts = "-p #{server_port}"
+
+    task :daemonize do
+      rackup_opts += " -D -P #{pid_file}"
+    end
+
+    task :npm do
+      Dir.chdir(work_dir) { system "npm install --silent" }
+    end
+
+    task :rackup do
+      Dir.chdir(work_dir) { system "bundle exec rackup #{rackup_opts}" }
+    end
+
+    task :mocha do
+      Dir.chdir(work_dir) { system "$(npm bin)/mocha-phantomjs http://localhost:#{server_port}/html/spec_runner.html" }
+    end
+
+    task :kill do
+      system "kill #{File.read pid_file}"
+    end
+  end
+end
+
 Bundler::GemHelper.install_tasks
 
 task default: :test

data/lib/web_console/extensions.rb

@@ -15,5 +15,6 @@ ActionDispatch::DebugExceptions.class_eval do
     end
   end
 
-  alias_method_chain :render_exception, :web_console
+  alias_method :render_exception_without_web_console, :render_exception
+  alias_method :render_exception, :render_exception_with_web_console
 end

data/lib/web_console/integration/cruby.rb

@@ -34,6 +34,7 @@ class Exception
       set_backtrace_without_binding_of_caller(*args)
     end
 
-    alias_method_chain :set_backtrace, :binding_of_caller
+    alias_method :set_backtrace_without_binding_of_caller, :set_backtrace
+    alias_method :set_backtrace, :set_backtrace_with_binding_of_caller
   end
 end

data/lib/web_console/integration/rubinius.rb

@@ -62,5 +62,6 @@ end
     raise_exception_without_current_bindings(exc)
   end
 
-  alias_method_chain :raise_exception, :current_bindings
+  alias_method :raise_exception_without_current_bindings, :raise_exception
+  alias_method :raise_exception, :raise_exception_with_current_bindings
 end

data/lib/web_console/railtie.rb

@@ -17,11 +17,29 @@ module WebConsole
       end
     end
 
+    initializer 'web_console.development_only' do
+      unless (config.web_console.development_only == false) || Rails.env.development?
+        abort <<-END.strip_heredoc
+          Web Console is activated in the #{Rails.env} environment, which is
+          usually a mistake. To ensure it's only activated in development
+          mode, move it to the development group of your Gemfile:
+
+              gem 'web-console', group: :development
+
+          If you still want to run it the #{Rails.env} environment (and know
+          what you are doing), put this in your Rails application
+          configuration:
+
+              config.web_console.development_only = false
+        END
+      end
+    end
+
     initializer 'web_console.insert_middleware' do |app|
       app.middleware.insert_before ActionDispatch::DebugExceptions, Middleware
     end
 
-    initializer 'web_console.templates_path' do
+    initializer 'web_console.template_paths' do
       if template_paths = config.web_console.template_paths
         Template.template_paths.unshift(*Array(template_paths))
       end

data/lib/web_console/session.rb

@@ -9,7 +9,8 @@ module WebConsole
   # error pages only, as currently, this is the only client that needs to do
   # that.
   class Session
-    INMEMORY_STORAGE = {}
+    cattr_reader :inmemory_storage
+    @@inmemory_storage = {}
 
     class << self
       # Finds a persisted session in memory by its id.
@@ -17,7 +18,7 @@ module WebConsole
       # Returns a persisted session if found in memory.
       # Raises NotFound error unless found in memory.
       def find(id)
-        INMEMORY_STORAGE[id]
+        inmemory_storage[id]
       end
 
       # Create a Session from an exception.
@@ -59,7 +60,7 @@ module WebConsole
     private
 
       def store_into_memory
-        INMEMORY_STORAGE[id] = self
+        inmemory_storage[id] = self
       end
   end
 end

data/lib/web_console/templates/_inner_console_markup.html.erb

@@ -1,3 +1,8 @@
-<div id='resizer'></div>
-<div class='console-inner'></div>
-<input id='clipboard' type='text'>
+<div class='resizer layer'></div>
+<div class='console-outer layer'>
+  <div class='console-actions'>
+    <div class='close-button button' title='close'>x</div>
+  </div>
+  <div class='console-inner'></div>
+</div>
+<input class='clipboard' type='text'>

data/lib/web_console/templates/console.js.erb

@@ -1,40 +1,3 @@
-// DOM helpers
-function hasClass(el, className) {
-  var regex = new RegExp('(?:^|\\s)' + className + '(?!\\S)', 'g');
-  return el.className.match(regex);
-}
-
-function addClass(el, className) {
-  el.className += " " + className;
-}
-
-function removeClass(el, className) {
-  var regex = new RegExp('(?:^|\\s)' + className + '(?!\\S)', 'g');
-  el.className = el.className.replace(regex, '');
-}
-
-function removeAllChildren(el) {
-  while (el.firstChild) {
-    el.removeChild(el.firstChild);
-  }
-}
-
-function escapeHTML(html) {
-  return html
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#x27;')
-    .replace(/`/g, '&#x60;');
-}
-
-// Add CSS styles dynamically. This probably doesnt work for IE <8.
-var style = document.createElement('style');
-style.type = 'text/css';
-style.innerHTML = <%= render_inlined_string 'style.css' %>;
-document.getElementsByTagName('head')[0].appendChild(style);
-
 /**
  * Constructor for command storage.
  * It uses localStorage if available. Otherwise fallback to normal JS array.
@@ -84,6 +47,10 @@ function CommandStorage() {
 // HTML strings for dynamic elements.
 var consoleInnerHtml = <%= render_inlined_string '_inner_console_markup.html' %>;
 var promptBoxHtml = <%= render_inlined_string '_prompt_box_markup.html' %>;
+// CSS
+var consoleStyleCss = <%= render_inlined_string 'style.css' %>;
+// Insert a style element with the unique ID
+var styleElementId = 'sr02459pvbvrmhco';
 
 // REPLConsole Constructor
 function REPLConsole(config) {
@@ -122,17 +89,25 @@ REPLConsole.prototype.install = function(container) {
   // Render the console.
   container.innerHTML = consoleInnerHtml;
 
+  var consoleOuter = findChild(container, 'console-outer');
+  var consoleActions = findChild(consoleOuter, 'console-actions');
+
+  addClass(container, 'console');
+  addClass(container.getElementsByClassName('layer'), 'pos-absolute border-box');
+  addClass(container.getElementsByClassName('button'), 'border-box');
+  addClass(consoleActions, 'pos-fixed pos-right');
+
   // Make the console resizable.
-  document.getElementById('resizer').addEventListener('mousedown', function(ev) {
+  function resizeContainer(ev) {
     var startY                   = ev.clientY;
     var startHeight              = parseInt(document.defaultView.getComputedStyle(container).height, 10);
-    var consoleInner             = document.getElementsByClassName('console-inner')[0];
-    var innerScrollTopStart      = consoleInner.scrollTop;
-    var innerClientHeightStart   = consoleInner.clientHeight;
+    var scrollTopStart      = consoleOuter.scrollTop;
+    var clientHeightStart   = consoleOuter.clientHeight;
 
     var doDrag = function(e) {
       container.style.height = (startHeight + startY - e.clientY) + 'px';
-      consoleInner.scrollTop = innerScrollTopStart + (innerClientHeightStart - consoleInner.clientHeight);
+      consoleOuter.scrollTop = scrollTopStart + (clientHeightStart - consoleOuter.clientHeight);
+      shiftConsoleActions();
     };
 
     var stopDrag = function(e) {
@@ -142,12 +117,50 @@ REPLConsole.prototype.install = function(container) {
 
     document.documentElement.addEventListener('mousemove', doDrag, false);
     document.documentElement.addEventListener('mouseup', stopDrag, false);
-  });
+  }
+
+  function closeContainer(ev) {
+    container.parentNode.removeChild(container);
+  }
+
+  var shifted = false;
+  function shiftConsoleActions() {
+    if (consoleOuter.scrollHeight > consoleOuter.clientHeight) {
+      var widthDiff = document.documentElement.clientWidth - consoleOuter.clientWidth;
+      if (shifted || ! widthDiff) return;
+      shifted = true;
+      consoleActions.style.marginRight = widthDiff + 'px';
+    } else if (shifted) {
+      shifted = false;
+      consoleActions.style.marginRight = '0px';
+    }
+  }
 
   // Initialize
-  this.inner = container.getElementsByClassName('console-inner')[0];
-  this.clipboard = document.getElementById('clipboard');
+  this.outer = consoleOuter;
+  this.inner = findChild(this.outer, 'console-inner');
+  this.clipboard = findChild(container, 'clipboard');
+  this.remotePath = container.dataset.remotePath;
   this.newPromptBox();
+  this.insertCss();
+
+  findChild(container, 'resizer').addEventListener('mousedown', resizeContainer);
+  findChild(consoleActions, 'close-button').addEventListener('click', closeContainer);
+  consoleOuter.addEventListener('DOMNodeInserted', shiftConsoleActions);
+
+  REPLConsole.currentSession = this;
+};
+
+// Add CSS styles dynamically. This probably doesnt work for IE <8.
+REPLConsole.prototype.insertCss = function() {
+  if (document.getElementById(styleElementId)) {
+    return; // already inserted
+  }
+  var style = document.createElement('style');
+  style.type = 'text/css';
+  style.innerHTML = consoleStyleCss;
+  style.id = styleElementId;
+  document.getElementsByTagName('head')[0].appendChild(style);
 };
 
 REPLConsole.prototype.focus = function() {
@@ -367,7 +380,117 @@ REPLConsole.prototype.insertAtCurrent = function(char) {
 };
 
 REPLConsole.prototype.scrollToBottom = function() {
-  this.inner.scrollTop = this.inner.scrollHeight;
+  this.outer.scrollTop = this.outer.scrollHeight;
 };
 
+// Change the binding of the console
+REPLConsole.prototype.switchBindingTo = function(frameId, callback) {
+  var url = this.remotePath + "/trace";
+  var params = "frame_id=" + encodeURIComponent(frameId);
+  postRequest(url, params, callback);
+};
+
+/**
+ * Install the console into the element with a specific ID.
+ * Example: REPLConsole.installInto("target-id")
+ */
+REPLConsole.installInto = function(id) {
+  var consoleElement = document.getElementById(id);
+  var remotePath = consoleElement.dataset.remotePath;
+  var replConsole = new REPLConsole({
+    promptLabel: consoleElement.dataset.initialPrompt,
+    commandHandle: function(line) {
+      var _this = this;
+      var url = remotePath;
+      var params = "input=" + encodeURIComponent(line);
+      putRequest(url, params, function(xhr) {
+        var response = JSON.parse(xhr.responseText);
+        _this.writeOutput(response.output);
+      });
+    }
+  });
+
+  replConsole.install(consoleElement);
+  return replConsole;
+};
+
+// This is to store the latest single session, and the stored session
+// is updated by the REPLConsole#install() method.
+// It allows to operate the current session from the other scripts.
+REPLConsole.currentSession = null;
+
+// DOM helpers
+function hasClass(el, className) {
+  var regex = new RegExp('(?:^|\\s)' + className + '(?!\\S)', 'g');
+  return el.className && el.className.match(regex);
+}
+
+function isNodeList(el) {
+  return typeof el.length === 'number' &&
+    typeof el.item === 'function';
+}
+
+function addClass(el, className) {
+  if (isNodeList(el)) {
+    for (var i = 0; i < el.length; ++ i) {
+      addClass(el[i], className);
+    }
+  } else {
+    el.className += " " + className;
+  }
+}
+
+function removeClass(el, className) {
+  var regex = new RegExp('(?:^|\\s)' + className + '(?!\\S)', 'g');
+  el.className = el.className.replace(regex, '');
+}
+
+function removeAllChildren(el) {
+  while (el.firstChild) {
+    el.removeChild(el.firstChild);
+  }
+}
+
+function findChild(el, className) {
+  for (var i = 0; i < el.childNodes.length; ++ i) {
+    if (hasClass(el.childNodes[i], className)) {
+      return el.childNodes[i];
+    }
+  }
+}
+
+function escapeHTML(html) {
+  return html
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+    .replace(/`/g, '&#x60;');
+}
+
+// XHR helpers
+function request(method, url, params, callback) {
+  var xhr = new XMLHttpRequest();
+
+  xhr.open(method, url, true);
+  xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
+  xhr.setRequestHeader("X-Requested-With", "XMLHttpRequest");
+  xhr.send(params);
+
+  xhr.onreadystatechange = function() {
+    if (xhr.readyState === 4) {
+      callback(xhr);
+    }
+  }
+}
+
+function postRequest(url, params, callback) {
+  request("POST", url, params, callback);
+}
+
+function putRequest(url, params, callback) {
+  request("PUT", url, params, callback);
+}
+
 window.REPLConsole = REPLConsole;