Avoid calling content_security_policy_nonce internally - #389
Conversation
Sorry, something went wrong.
Rails 5.2 adds support for configuring a Content-Security-Policy header, including adding nonces to tags produced by the `javascript_tag` helper. Unfortunately, Rails and this gem now both define a helper named `content_security_policy_nonce`: https://github.com/rails/rails/blob/v5.2.0.rc2/actionpack/lib/action_controller/metal/content_security_policy.rb#L44 https://github.com/twitter/secureheaders/blob/v5.0.5/lib/secure_headers/view_helper.rb#L69 The Rails helper wins over the Secure Headers one, and helpers like `nonced_javascript_tag` currently raise this error on Rails 5.2: ArgumentError: wrong number of arguments (given 1, expected 0) By using a method with a different name internally, we avoid clashing with the Rails implementation, and `nonced_javascript_tag` works again.
|
|
Sorry, something went wrong.
jacobbednarz
left a comment
There was a problem hiding this comment.
Nice find! 🏆
I'm not usually a fan of the underscore prefixed methods but it seems reasonable here.
Sorry, something went wrong.
|
I have no strong opinion on the particular method name, and will happily change it to anything else. 🙂 |
Sorry, something went wrong.
|
This is going to break things 😢. While people should use the tag helpers, I'm sure someone is using the raw value for something. Luckily, 6.0 hasn't been released so we can sneak this in there. It was meant to be a private API to begin with. The name collision is unfortunate but it's a polluted namespace. |
Sorry, something went wrong.
|
Released in v6.0.0.alpha02. |
Sorry, something went wrong.
|
Thanks @oreoshake! I think you may have missed this line though: content_security_policy_nonce will still work as before on Rails < 5.2. Unless I got something wrong, the only behavioural change here is that the tag helper methods (e.g. nonced_javascript_tag) will work correctly on Rails 5.2; everything else stays the same. |
Sorry, something went wrong.
|
@eugeneius We were using content_security_policy_nonce directly in a couple cases (some third-party script tags), so this is definitely a breaking change on Rails 5.1. |
Sorry, something went wrong.
|
I'm not saying that Rails didn't break Secure Headers; I'm saying that this patch makes Secure Headers mostly compatible with Rails 5.2, without affecting its compatibility with earlier versions. As such I think it's not a breaking change, and could be backported to 5.0.x so that there's a non-prerelease version available that (mostly) works with Rails 5.2.0 when it's out in a couple of weeks. |
Sorry, something went wrong.
|
It may be backwards-compatible with Rails (in that nonced_javascript_tag works on both Rails 5.1 and 5.2), but it's definitely not backwards compatible with some Rails applications, since a public-accessible API content_security_policy_nonce is being renamed (and is now inferred to be private with the prefixed _). |
Sorry, something went wrong.
|
content_security_policy_nonce is still available as an alias to the underscore-prefixed version. Rails 5.1 applications will still be able to call it, just like before. If calling content_security_policy_nonce doesn't work in your app when using v6.0.0.alpha02, please tell me about the error so that I can fix it! |
Sorry, something went wrong.
|
I completely missed that, sorry! We already updated to use the tag helpers (and 6.0.0.alpha02) but it looks like it's indeed backwards-compatible and could be backported to 5.x. |
Sorry, something went wrong.
Rails 5.2 adds support for configuring a Content-Security-Policy header, including adding nonces to tags produced by the javascript_tag helper.
Unfortunately, Rails and this gem now both define a helper named content_security_policy_nonce:
https://github.com/rails/rails/blob/v5.2.0.rc2/actionpack/lib/action_controller/metal/content_security_policy.rb#L44
https://github.com/twitter/secureheaders/blob/v5.0.5/lib/secure_headers/view_helper.rb#L69
The Rails helper wins over the Secure Headers one, and helpers like nonced_javascript_tag currently raise this error on Rails 5.2:
By using a method with a different name internally, we avoid clashing with the Rails implementation, and nonced_javascript_tag works again.