FEATURE: Support dynamic config.content_security_policy_nonce (#609)

CSP nonce values change on every request, so accepting a static string as an option doesn't really make sense. This commit allows `config.content_security_policy_nonce` to be set to a Proc which is run for each request, and can return a nonce based on the `env` and current response headers.

Author: davidtaylorhq

CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## Unreleased
+- [FEATURE] Support dynamic `config.content_security_policy_nonce` [#609](https://github.com/MiniProfiler/rack-mini-profiler/pull/609)
+
+
 ## 3.3.0 - 2023-12-07
 - [FEATURE] Use `?pp=flamegraph?ignore_gc=true` or `config.flamegraph_ignore_gc` to ignore gc in flamegraphs. [#599](https://github.com/MiniProfiler/rack-mini-profiler/pull/599)
 

README.md

@@ -448,7 +448,7 @@ snapshots_transport_destination_url | `nil`
 snapshots_transport_auth_key        | `nil`                                                   | `POST` requests made by the snapshots transporter to the destination URL will have a `Mini-Profiler-Transport-Auth` header with the value of this config. Make sure you use a secure and random key for this config.
 snapshots_redact_sql_queries        | `true`                                                  | When this is true, SQL queries will be redacted from sampling snapshots, but the backtrace and duration of each SQL query will be saved with the snapshot to keep debugging performance issues possible.
 snapshots_transport_gzip_requests   | `false`                                                 | Make the snapshots transporter gzip the requests it makes to `snapshots_transport_destination_url`.
-content_security_policy_nonce       | Rails: Current nonce<br>Rack: nil                       | Set the content security policy nonce to use when inserting MiniProfiler's script block.
+content_security_policy_nonce       | Rails: Current nonce<br>Rack: nil                       | Set the content security policy nonce to use when inserting MiniProfiler's script block. Can be set to a static string, or a Proc which receives `env` and `response_headers` as arguments and returns the nonce.
 enable_hotwire_turbo_drive_support  | `false`                                                 | Enable support for Hotwire TurboDrive page transitions.
 profile_parameter                   | `'pp'`                                                  | The query parameter used to interact with this gem.
 

lib/mini_profiler.rb

@@ -440,7 +440,7 @@ def inject_profiler(env, status, headers, body)
 
       if current.inject_js && content_type =~ /text\/html/
         response = Rack::Response.new([], status, headers)
-        script   = self.get_profile_script(env)
+        script   = self.get_profile_script(env, headers)
 
         if String === body
           response.write inject(body, script)

lib/mini_profiler/views.rb

@@ -28,7 +28,7 @@ def generate_html(page_struct, env, result_json = page_struct.to_json)
       # Use it when:
       # * you have disabled auto append behaviour throught :auto_inject => false flag
       # * you do not want script to be automatically appended for the current page. You can also call cancel_auto_inject
-      def get_profile_script(env)
+      def get_profile_script(env, response_headers = {})
         path = public_base_path(env)
         version = MiniProfiler::ASSET_VERSION
         if @config.assets_url
@@ -39,7 +39,12 @@ def get_profile_script(env)
         url = "#{path}includes.js?v=#{version}" if !url
         css_url = "#{path}includes.css?v=#{version}" if !css_url
 
-        content_security_policy_nonce = @config.content_security_policy_nonce ||
+        configured_nonce = @config.content_security_policy_nonce
+        if configured_nonce && !configured_nonce.is_a?(String)
+          configured_nonce = configured_nonce.call(env, response_headers)
+        end
+
+        content_security_policy_nonce = configured_nonce ||
                                         env["action_dispatch.content_security_policy_nonce"] ||
                                         env["secure_headers_content_security_policy_nonce"]
 

spec/integration/middleware_spec.rb

@@ -242,4 +242,43 @@ def with_profile_parameter(param)
       end
     end
   end
+
+  context "with CSP nonce" do
+    def app
+      Rack::Builder.new do
+        use Rack::MiniProfiler
+        run lambda { |env|
+          env["action_dispatch.content_security_policy_nonce"] = "railsnonce"
+          [200, { 'Content-Type' => 'text/html' }, [+'<html><body><h1>Hello world</h1></body></html>']]
+        }
+      end
+    end
+
+    it 'uses Rails value when available' do
+      do_get
+      expect(last_response.body).to include("nonce=\"railsnonce\"")
+    end
+
+    it 'uses configured string when available' do
+      Rack::MiniProfiler.config.content_security_policy_nonce = "configurednonce"
+      do_get
+      expect(last_response.body).to include("nonce=\"configurednonce\"")
+    end
+
+    it 'calls configured block when available' do
+      proc_arguments = nil
+
+      Rack::MiniProfiler.config.content_security_policy_nonce = Proc.new do |env, response_headers|
+        proc_arguments = [env, response_headers]
+        "dynamicnonce"
+      end
+
+      do_get
+      expect(last_response.body).to include("nonce=\"dynamicnonce\"")
+
+      (env, response_headers) = proc_arguments
+      expect(env["REQUEST_METHOD"]).to eq("GET")
+      expect(response_headers["Content-Type"]).to eq("text/html")
+    end
+  end
 end