Skip to content

Commit b0cb2c7

Browse files
ankaneankane
committed
Improved CSP support
1 parent 4e3c5b3 commit b0cb2c7

13 files changed

+46
-42
lines changed

‎CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 3.0.4 (unreleased)
2+
3+
- Improved CSP support
4+
15
## 3.0.3 (2024-01-10)
26

37
- Fixed error with Trilogy, non-ASCII column names, and charts

‎app/views/blazer/_variables.html.erb

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<% if @bind_vars.any? %>
22
<% var_params = request.query_parameters %>
3-
<script>
3+
<%= javascript_tag nonce: true do %>
44
<%= blazer_js_var "timeZone", Blazer.time_zone.tzinfo.name %>
55
var now = moment.tz(timeZone)
66
var format = "YYYY-MM-DD"
77

88
function toDate(time) {
99
return moment.tz(time.format(format), timeZone)
1010
}
11-
</script>
11+
<% end %>
1212
<form id="bind" method="get" action="<%= action %>" class="form-inline" style="margin-bottom: 15px;">
1313
<% date_vars = ["start_time", "end_time"] %>
1414
<% if (date_vars - @bind_vars).empty? %>
@@ -21,11 +21,11 @@
2121
<%= label_tag var, var %>
2222
<% if (data = @smart_vars[var]) %>
2323
<%= select_tag var, options_for_select([[nil, nil]] + data, selected: var_params[var]), style: "margin-right: 20px; width: 200px; display: none;" %>
24-
<script>
24+
<%= javascript_tag nonce: true do %>
2525
$("#<%= var %>").selectize({
2626
create: true
2727
});
28-
</script>
28+
<% end %>
2929
<% elsif var.end_with?("_at") || var == "start_time" || var == "end_time" %>
3030
<%= hidden_field_tag var, var_params[var] %>
3131

@@ -35,7 +35,7 @@
3535
</div>
3636
</div>
3737

38-
<script>
38+
<%= javascript_tag nonce: true do %>
3939
(function() {
4040
var input = $("#<%= var %>")
4141
var datePicker = $("#<%= var %>-select")
@@ -57,7 +57,7 @@
5757
datePicker.find("span").html(toDate(picker.startDate).format("MMMM D, YYYY"))
5858
}
5959
})()
60-
</script>
60+
<% end %>
6161
<% else %>
6262
<%= text_field_tag var, var_params[var], style: "width: 120px; margin-right: 20px;", autofocus: i == 0 && !var.end_with?("_at") && !var_params[var], class: "form-control" %>
6363
<% end %>
@@ -75,7 +75,7 @@
7575
</div>
7676
</div>
7777

78-
<script>
78+
<%= javascript_tag nonce: true do %>
7979
function dateStr(daysAgo) {
8080
return now.clone().subtract(daysAgo || 0, "days").format(format)
8181
}
@@ -119,7 +119,7 @@
119119
$("#reportrange").trigger("apply.daterangepicker", picker)
120120
submitIfCompleted($("#start_time").closest("form"))
121121
}
122-
</script>
122+
<% end %>
123123
<% end %>
124124

125125
<input type="submit" class="btn btn-success" value="Run" style="vertical-align: top;" />

‎app/views/blazer/checks/_form.html.erb

+8-8
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@
1212
<div class="hide">
1313
<%= f.select :query_id, [], {include_blank: true} %>
1414
</div>
15-
<script>
15+
<%= javascript_tag nonce: true do %>
1616
<%= blazer_js_var "queries", Blazer::Query.active.named.order(:name).select("id, name").map { |q| {text: q.name, value: q.id} } %>
1717
<%= blazer_js_var "items", [@check.query_id].compact %>
1818

1919
$("#check_query_id").selectize({options: queries, items: items, highlight: false, maxOptions: 100}).parents(".hide").removeClass("hide");
20-
</script>
20+
<% end %>
2121
</div>
2222

2323
<% if @check.respond_to?(:check_type) %>
@@ -28,19 +28,19 @@
2828
<% check_options << ["Anomaly (most recent data point)", "anomaly"] if Blazer.anomaly_checks %>
2929
<%= f.select :check_type, check_options %>
3030
</div>
31-
<script>
31+
<%= javascript_tag nonce: true do %>
3232
$("#check_check_type").selectize({}).parent().removeClass("hide");
33-
</script>
33+
<% end %>
3434
</div>
3535
<% elsif @check.respond_to?(:invert) %>
3636
<div class="form-group">
3737
<%= f.label :invert, "Fails if" %>
3838
<div class="hide">
3939
<%= f.select :invert, [["Any results (bad data)", false], ["No results (missing data)", true]] %>
4040
</div>
41-
<script>
41+
<%= javascript_tag nonce: true do %>
4242
$("#check_invert").selectize({}).parent().removeClass("hide");
43-
</script>
43+
<% end %>
4444
</div>
4545
<% end %>
4646

@@ -50,9 +50,9 @@
5050
<div class="hide">
5151
<%= f.select :schedule, Blazer.check_schedules.map { |v| [v, v] } %>
5252
</div>
53-
<script>
53+
<%= javascript_tag nonce: true do %>
5454
$("#check_schedule").selectize({}).parent().removeClass("hide");
55-
</script>
55+
<% end %>
5656
</div>
5757
<% end %>
5858

‎app/views/blazer/checks/index.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@
6262
</tbody>
6363
</table>
6464

65-
<script>
65+
<%= javascript_tag nonce: true do %>
6666
$("#search").on("keyup", function() {
6767
var value = $(this).val().toLowerCase()
6868
$("#checks tbody tr").filter( function() {
6969
$(this).toggle($(this).text().toLowerCase().indexOf(value) > -1)
7070
})
7171
}).focus()
72-
</script>
72+
<% end %>

‎app/views/blazer/dashboards/_form.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
</p>
3131
<% end %>
3232

33-
<script>
33+
<%= javascript_tag nonce: true do %>
3434
<%= blazer_js_var "queries", Blazer::Query.active.named.order(:name).select("id, name").map { |q| {text: q.name, value: q.id} } %>
3535
<%= blazer_js_var "dashboardQueries", @queries || @dashboard.dashboard_queries.order(:position).map(&:query) %>
3636

@@ -79,4 +79,4 @@
7979
app.queries.splice(e.newIndex, 0, app.queries.splice(e.oldIndex, 1)[0])
8080
}
8181
})
82-
</script>
82+
<% end %>

‎app/views/blazer/dashboards/show.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
<p class="text-muted">Loading...</p>
3939
</div>
4040
</div>
41-
<script>
41+
<%= javascript_tag nonce: true do %>
4242
<% data = {statement: query.statement, query_id: query.id, data_source: query.data_source, variables: variable_params(query), only_chart: true} %>
4343
<% data.merge!(cohort_period: params[:cohort_period]) if params[:cohort_period] %>
4444
<%= blazer_js_var "data", data %>
@@ -49,5 +49,5 @@
4949
}, function (message) {
5050
$("#chart-<%= i %>").addClass("query-error").html(message)
5151
});
52-
</script>
52+
<% end %>
5353
<% end %>

‎app/views/blazer/queries/_form.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@
6868
</div>
6969
</div>
7070

71-
<script>
71+
<%= javascript_tag nonce: true do %>
7272
<%= blazer_js_var "variableParams", @variable_params %>
7373
<%= blazer_js_var "previewStatement", Blazer.data_sources.to_h { |k, v| [k, (v.preview_statement rescue "")] } %>
7474

@@ -252,4 +252,4 @@
252252
})
253253
app.config.compilerOptions.whitespace = "preserve"
254254
app.mount("#app")
255-
</script>
255+
<% end %>

‎app/views/blazer/queries/home.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
<p v-if="more" class="text-muted">Loading...</p>
5757
</div>
5858

59-
<script>
59+
<%= javascript_tag nonce: true do %>
6060
<%= blazer_js_var "dashboards", @dashboards %>
6161
<%= blazer_js_var "queries", @queries %>
6262
<%= blazer_js_var "more", @more %>
@@ -166,4 +166,4 @@
166166
})
167167
app.config.compilerOptions.whitespace = "preserve"
168168
app.mount("#queries")
169-
</script>
169+
<% end %>

‎app/views/blazer/queries/run.html.erb

+4-4
Original file line numberDiff line numberDiff line change
@@ -75,21 +75,21 @@
7575
<% if @markers.any? %>
7676
<% map_id = SecureRandom.hex %>
7777
<%= content_tag :div, nil, id: map_id, style: "height: #{@only_chart ? 300 : 500}px;" %>
78-
<script>
78+
<%= javascript_tag nonce: true do %>
7979
<%= blazer_js_var "mapboxAccessToken", Blazer.mapbox_access_token %>
8080
<%= blazer_js_var "markers", @markers %>
8181
<%= blazer_js_var "mapId", map_id %>
8282
new Mapkick.Map(mapId, markers, {accessToken: mapboxAccessToken, tooltips: {hover: false, html: true}});
83-
</script>
83+
<% end %>
8484
<% elsif @geojson.any? %>
8585
<% map_id = SecureRandom.hex %>
8686
<%= content_tag :div, nil, id: map_id, style: "height: #{@only_chart ? 300 : 500}px;" %>
87-
<script>
87+
<%= javascript_tag nonce: true do %>
8888
<%= blazer_js_var "mapboxAccessToken", Blazer.mapbox_access_token %>
8989
<%= blazer_js_var "geojson", @geojson %>
9090
<%= blazer_js_var "mapId", map_id %>
9191
new Mapkick.AreaMap(mapId, geojson, {accessToken: mapboxAccessToken, tooltips: {hover: false, html: true}});
92-
</script>
92+
<% end %>
9393
<% elsif chart_type == "line" %>
9494
<% chart_data = @columns[1..-1].each_with_index.map{ |k, i| {name: blazer_series_name(k), data: @rows.map{ |r| [r[0], r[i + 1]] }, library: series_library[i]} } %>
9595
<%= line_chart chart_data, **chart_options %>

‎app/views/blazer/queries/schema.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
</table>
2929
<% end %>
3030

31-
<script>
31+
<%= javascript_tag nonce: true do %>
3232
$("#search").on("keyup", function() {
3333
var value = $(this).val().toLowerCase()
3434
$(".schema-table").filter(function() {
@@ -52,4 +52,4 @@
5252
$(this).toggle(found)
5353
})
5454
}).focus()
55-
</script>
55+
<% end %>

‎app/views/blazer/queries/show.html.erb

+4-4
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
<p class="text-muted">Loading...</p>
4747
</div>
4848

49-
<script>
49+
<%= javascript_tag nonce: true do %>
5050
function showRun(data) {
5151
$("#results").html(data)
5252
$("#results table").stupidtable(stupidtableCustomSettings).stickyTableHeaders({fixedOffset: 60})
@@ -59,14 +59,14 @@
5959
<%= blazer_js_var "data", @run_data %>
6060

6161
runQuery(data, showRun, showError)
62-
</script>
62+
<% end %>
6363
<% end %>
6464

65-
<script>
65+
<%= javascript_tag nonce: true do %>
6666
// do not highlight really long queries
6767
// this can lead to performance issues
6868
var code = $("#code code")
6969
if (code.text().length < 10000) {
7070
hljs.highlightElement(code.get(0))
7171
}
72-
</script>
72+
<% end %>

‎app/views/blazer/uploads/index.html.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,11 @@
4545
</tbody>
4646
</table>
4747

48-
<script>
48+
<%= javascript_tag nonce: true do %>
4949
$("#search").on("keyup", function() {
5050
var value = $(this).val().toLowerCase()
5151
$("#uploads tbody tr").filter( function() {
5252
$(this).toggle($(this).text().toLowerCase().indexOf(value) > -1)
5353
})
5454
}).focus()
55-
</script>
55+
<% end %>

‎app/views/layouts/blazer/application.html.erb

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@
77
<%= favicon_link_tag "blazer/favicon.png" %>
88
<% if defined?(Propshaft::Railtie) %>
99
<%= stylesheet_link_tag "blazer/bootstrap-propshaft", "blazer/bootstrap", "blazer/selectize", "blazer/github", "blazer/daterangepicker", "blazer/application" %>
10-
<%= javascript_include_tag "blazer/jquery", "blazer/rails-ujs", "blazer/stupidtable", "blazer/stupidtable-custom-settings", "blazer/jquery.stickytableheaders", "blazer/selectize", "blazer/highlight.min", "blazer/moment", "blazer/moment-timezone-with-data", "blazer/daterangepicker", "blazer/chart.umd", "blazer/chartjs-adapter-date-fns.bundle", "blazer/chartkick", "blazer/mapkick.bundle", "blazer/ace/ace", "blazer/ace/ext-language_tools", "blazer/ace/theme-twilight", "blazer/ace/mode-sql", "blazer/ace/snippets/text", "blazer/ace/snippets/sql", "blazer/Sortable", "blazer/bootstrap", "blazer/vue.global.prod", "blazer/routes", "blazer/queries", "blazer/fuzzysearch", "blazer/application" %>
10+
<%= javascript_include_tag "blazer/jquery", "blazer/rails-ujs", "blazer/stupidtable", "blazer/stupidtable-custom-settings", "blazer/jquery.stickytableheaders", "blazer/selectize", "blazer/highlight.min", "blazer/moment", "blazer/moment-timezone-with-data", "blazer/daterangepicker", "blazer/chart.umd", "blazer/chartjs-adapter-date-fns.bundle", "blazer/chartkick", "blazer/mapkick.bundle", "blazer/ace/ace", "blazer/ace/ext-language_tools", "blazer/ace/theme-twilight", "blazer/ace/mode-sql", "blazer/ace/snippets/text", "blazer/ace/snippets/sql", "blazer/Sortable", "blazer/bootstrap", "blazer/vue.global.prod", "blazer/routes", "blazer/queries", "blazer/fuzzysearch", "blazer/application", nonce: true %>
1111
<% else %>
1212
<%= stylesheet_link_tag "blazer/application" %>
13-
<%= javascript_include_tag "blazer/application" %>
13+
<%= javascript_include_tag "blazer/application", nonce: true %>
1414
<% end %>
15-
<script>
15+
<%= javascript_tag nonce: true do %>
1616
<%= blazer_js_var "rootPath", root_path %>
17-
</script>
17+
<% end %>
1818
<%= csrf_meta_tags %>
1919
</head>
2020
<body>

0 commit comments

Comments
 (0)