Fix using javascript_importmap_tag in console #139
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously this would error because there is no request object in the console for `content_security_policy_nonce` to be called on.
skipkayhil
force-pushed
the
fix-importmap-tag-in-console
branch
from
1c811f3 to
3f716fd
Compare
rmacklin
reviewed
Jul 15, 2022
| @@ -14,12 +14,12 @@ def javascript_importmap_tags(entry_point = "application", shim: true) | |||
| # By default, `Rails.application.importmap.to_json(resolver: self)` is used. | |||
| def javascript_inline_importmap_tag(importmap_json = Rails.application.importmap.to_json(resolver: self)) | |||
| tag.script importmap_json.html_safe, | |||
| type: "importmap", "data-turbo-track": "reload", nonce: content_security_policy_nonce | |||
| type: "importmap", "data-turbo-track": "reload", nonce: request&.content_security_policy | |||
There was a problem hiding this comment.
Shouldn't this be
Suggested change
| type: "importmap", "data-turbo-track": "reload", nonce: request&.content_security_policy | |
| type: "importmap", "data-turbo-track": "reload", nonce: request&.content_security_policy_nonce |
?
| @@ -28,14 +28,14 @@ def javascript_importmap_shim_nonce_configuration_tag | |||
| # Include the es-modules-shim needed to make importmaps work in browsers without native support (like Firefox + Safari). | |||
| def javascript_importmap_shim_tag(minimized: true) | |||
| javascript_include_tag minimized ? "es-module-shims.min.js" : "es-module-shims.js", | |||
| async: true, "data-turbo-track": "reload", nonce: content_security_policy_nonce | |||
| async: true, "data-turbo-track": "reload", nonce: request&.content_security_policy | |||
There was a problem hiding this comment.
And similarly
Suggested change
| async: true, "data-turbo-track": "reload", nonce: request&.content_security_policy | |
| async: true, "data-turbo-track": "reload", nonce: request&.content_security_policy_nonce |
| end | ||
|
|
||
| # Import a named JavaScript module(s) using a script-module tag. | ||
| def javascript_import_module_tag(*module_names) | ||
| imports = Array(module_names).collect { |m| %(import "#{m}") }.join("\n") | ||
| tag.script imports.html_safe, | ||
| type: "module", nonce: content_security_policy_nonce | ||
| type: "module", nonce: request&.content_security_policy |
There was a problem hiding this comment.
And similarly
Suggested change
| type: "module", nonce: request&.content_security_policy | |
| type: "module", nonce: request&.content_security_policy_nonce |
| @@ -48,7 +48,7 @@ def javascript_importmap_module_preload_tags(importmap = Rails.application.impor | |||
| # Link tag(s) for preloading the JavaScript module residing in `*paths`. Will return one link tag per path element. | |||
| def javascript_module_preload_tag(*paths) | |||
| safe_join(Array(paths).collect { |path| | |||
| tag.link rel: "modulepreload", href: path, nonce: content_security_policy_nonce | |||
| tag.link rel: "modulepreload", href: path, nonce: request&.content_security_policy | |||
There was a problem hiding this comment.
And similarly
Suggested change
| tag.link rel: "modulepreload", href: path, nonce: request&.content_security_policy | |
| tag.link rel: "modulepreload", href: path, nonce: request&.content_security_policy_nonce |
This was referenced Jul 15, 2022
|
I've opened #143 with the above changes. As mentioned there, we should ideally backfill test coverage that exercises this properly so that CI would catch this type of bug. I don't currently have the bandwidth to do that, but if you do, please feel free to open a follow-up PR! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Previously this would error because there is no request object in the
console for
content_security_policy_nonceto be called on.Other information
This is based on #138 which should be merged first✔️Fixes rails/rails#44809