web-console 3.6.0 → 3.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb1461a9213387e0c8158f62623d63b0ecff23c0cc6ccd91433ab203eec3eb8b
-  data.tar.gz: 45336b5c06bff19cd02d1b651d5917934434367d0efcb546ec55afd9b0b66804
+  metadata.gz: d439be9277cff602e612a47dd3186aaa0ab3800040f978d2ca68d3dd330b8379
+  data.tar.gz: bdf788f4b48c2a615235a180db5b5b3b9d3a8d0d20326c5ed4157875a04503c5
 SHA512:
-  metadata.gz: 638a0796f7049de3544b8d342d72545d72c06a56e0ecc82dbc2974fd16b2e81ab91a56ff9615e61ef34bfded1dda8f29187b4792db3d2bd757fed7e27dcf5d27
-  data.tar.gz: b52c4650487ec31ef5ba20ec4fdf180016f730ddffe2a8bf9909a32db39c362a4ae2ae60a59441fe1c0fc1a177933d4e09e634a5af3b4f51b23b4b51dfe13321
+  metadata.gz: 3ae6bec4c77114a1930b367211b2b093b3378e7618f59c27dfa88fb6824179e68c13d4d57a8bf54e92eb4587e7e77b0fe5b625d83623f57a55dbac2066c988d3
+  data.tar.gz: e9282ecc93234e6dc296d65583d8028b3274a87ac83d46e8d4c429f06b965e5ba0de39ea4fc1355be0c0a616a99ca97dcbaf7e5f2c27cbd490be24467ab01fdf

data/CHANGELOG.markdown

@@ -2,6 +2,10 @@
 
 ## master (unreleased)
 
+## 3.6.1
+
+* [#252](https://github.com/rails/web-console/pull/252) Fix improper injection in Rack bodies like ActionDispatch::Response::RackBody ([@gsamokovarov])
+
 ## 3.6.0
 
 * [#254](https://github.com/rails/web-console/pull/254) Rescue ActionDispatch::RemoteIp::IpSpoofAttackError ([@wjordan])

data/lib/web_console.rb

@@ -10,7 +10,7 @@ module WebConsole
   autoload :Evaluator
   autoload :ExceptionMapper
   autoload :Session
-  autoload :Response
+  autoload :Injector
   autoload :Request
   autoload :WhinyRequest
   autoload :Whitelist

data/lib/web_console/injector.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module WebConsole
+  # Injects content into a Rack body.
+  class Injector
+    def initialize(body)
+      @body = "".dup
+
+      body.each { |part| @body << part }
+      body.close if body.respond_to?(:close)
+    end
+
+    def inject(content)
+      if position = @body.rindex("</body>")
+        [ @body.insert(position, content) ]
+      else
+        [ @body << content ]
+      end
+    end
+  end
+end

data/lib/web_console/middleware.rb

@@ -30,16 +30,14 @@ module WebConsole
         status, headers, body = call_app(env)
 
         if (session = Session.from(Thread.current)) && acceptable_content_type?(headers)
-          response = Response.new(body, status, headers)
-          template = Template.new(env, session)
+          headers["X-Web-Console-Session-Id"] = session.id
+          headers["X-Web-Console-Mount-Point"] = mount_point
 
-          response.headers["X-Web-Console-Session-Id"] = session.id
-          response.headers["X-Web-Console-Mount-Point"] = mount_point
-          response.write(template.render("index"))
-          response.finish
-        else
-          [ status, headers, body ]
+          template = Template.new(env, session)
+          body = Injector.new(body).inject(template.render("index"))
         end
+
+        [ status, headers, body ]
       end
     rescue => e
       WebConsole.logger.error("\n#{e.class}: #{e}\n\tfrom #{e.backtrace.join("\n\tfrom ")}")
@@ -64,7 +62,7 @@ module WebConsole
         headers = { "Content-Type" => "application/json; charset = utf-8" }
         body    = yield.to_json
 
-        Rack::Response.new(body, status, headers).finish
+        [ status, headers, [ body ] ]
       end
 
       def json_response_with_session(id, request, opts = {})

data/lib/web_console/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebConsole
-  VERSION = "3.6.0"
+  VERSION = "3.6.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: web-console
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.6.1
 platform: ruby
 authors:
 - Charlie Somerville
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-10 00:00:00.000000000 Z
+date: 2018-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -90,11 +90,11 @@ files:
 - lib/web_console/evaluator.rb
 - lib/web_console/exception_mapper.rb
 - lib/web_console/extensions.rb
+- lib/web_console/injector.rb
 - lib/web_console/locales/en.yml
 - lib/web_console/middleware.rb
 - lib/web_console/railtie.rb
 - lib/web_console/request.rb
-- lib/web_console/response.rb
 - lib/web_console/session.rb
 - lib/web_console/tasks/extensions.rake
 - lib/web_console/tasks/templates.rake

data/lib/web_console/response.rb

@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-module WebConsole
-  # A response object that writes content before the closing </body> tag, if
-  # possible.
-  #
-  # The object quacks like Rack::Response.
-  class Response < Struct.new(:body, :status, :headers)
-    def write(content)
-      raw_body = Array(body).first.to_s
-
-      # We're done with the original body object, so make sure to close it to comply with the Rack SPEC
-      body.close if body.respond_to?(:close)
-
-      self.body =
-        if position = raw_body.rindex("</body>")
-          raw_body.dup.insert(position, content)
-        else
-          raw_body.dup << content
-        end
-    end
-
-    def finish
-      Rack::Response.new(body, status, headers).finish
-    end
-  end
-end