Move inline JS to rendered files to support CSP

jejacks0n · Apr 16, 2019 · a1b53af · a1b53af
1 parent 7695127
commit a1b53af
Show file tree

Hide file tree

Showing 8 changed files with 30 additions and 26 deletions.
diff --git a/app/controllers/teaspoon/suite_controller.rb b/app/controllers/teaspoon/suite_controller.rb
@@ -16,6 +16,12 @@ def show
     @suite = Teaspoon::Suite.new(params)
   end
 
+  def js
+    jstype = params.extract!(:jstype).fetch(:jstype, 'vanilla')
+    @suite = Teaspoon::Suite.new(params)
+    render "teaspoon/suite/#{jstype}", :content_type => 'application/javascript'
+  end
+
   def hook
     hooks = Teaspoon::Suite.new(params).hooks[params[:hook].to_s]
 

diff --git a/app/views/teaspoon/suite/_boot.html.erb b/app/views/teaspoon/suite/_boot.html.erb
@@ -1,4 +1,2 @@
 <%= javascript_include_tag *@suite.spec_assets, debug: @suite.config.expand_assets, allow_non_precompiled: true %>
-<script type="text/javascript">
-  Teaspoon.onWindowLoad(Teaspoon.execute);
-</script>
+<%= javascript_include_tag "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.vanilla.js" %>
diff --git a/app/views/teaspoon/suite/_boot_require_js.html.erb b/app/views/teaspoon/suite/_boot_require_js.html.erb
@@ -1,20 +1,2 @@
-<%
-rails_config = Rails.application.config
-require_options = {baseUrl: rails_config.assets.prefix}
-require_options.merge!(urlArgs: "instrument=1", waitSeconds: 0) if Teaspoon.configuration.use_coverage
-require_options.merge!(rails_config.requirejs.user_config) if rails_config.respond_to?(:requirejs)
-specs = @suite.spec_assets(false).map{ |s| "#{s.gsub(/\.js.*$/, "")}" }
-%>
-
 <%= javascript_include_tag @suite.helper %>
-<script type="text/javascript">
-  Teaspoon.onWindowLoad(function () {
-    // setup the Teaspoon path prefix to load /assets
-    require.config(<%= require_options.to_json.html_safe %>);
-
-    // require specs by striping off the .js file extension
-    require(<%= specs.to_json.html_safe %>, function() {
-      Teaspoon.execute();
-    });
-  });
-</script>
+<%= javascript_include_tag "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.require.js" %>
diff --git a/app/views/teaspoon/suite/config.js.erb b/app/views/teaspoon/suite/config.js.erb
@@ -0,0 +1,2 @@
+Teaspoon.version = <%= Teaspoon::VERSION.to_json.html_safe %>;
+Teaspoon.suites  = <%= {all: Teaspoon.configuration.suite_configs.keys, active: @suite.name}.to_json.html_safe %>;
diff --git a/app/views/teaspoon/suite/require.js.erb b/app/views/teaspoon/suite/require.js.erb
@@ -0,0 +1,17 @@
+<%
+rails_config = Rails.application.config
+require_options = {baseUrl: rails_config.assets.prefix}
+require_options.merge!(urlArgs: "instrument=1", waitSeconds: 0) if Teaspoon.configuration.use_coverage
+require_options.merge!(rails_config.requirejs.user_config) if rails_config.respond_to?(:requirejs)
+specs = @suite.spec_assets(false).map{ |s| "#{s.gsub(/\.js.*$/, "")}" }
+%>
+
+Teaspoon.onWindowLoad(function () {
+  // setup the Teaspoon path prefix to load /assets
+  require.config(<%= require_options.to_json.html_safe %>);
+
+  // require specs by striping off the .js file extension
+  require(<%= specs.to_json.html_safe %>, function() {
+    Teaspoon.execute();
+  });
+});
diff --git a/app/views/teaspoon/suite/show.html.erb b/app/views/teaspoon/suite/show.html.erb
@@ -7,10 +7,7 @@
 
     <%= stylesheet_link_tag *@suite.stylesheets %>
     <%= javascript_include_tag *@suite.javascripts %>
-    <script type="text/javascript">
-      Teaspoon.version = <%= Teaspoon::VERSION.to_json.html_safe %>;
-      Teaspoon.suites  = <%= {all: Teaspoon.configuration.suite_configs.keys, active: @suite.name}.to_json.html_safe %>;
-    </script>
+    <%= javascript_include_tag "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.config.js" %>
     <%= render @suite.boot_partial %>
   </head>
   <body data-no-turbolink>

diff --git a/app/views/teaspoon/suite/vanilla.js.erb b/app/views/teaspoon/suite/vanilla.js.erb
@@ -0,0 +1 @@
+Teaspoon.onWindowLoad(Teaspoon.execute);
diff --git a/lib/teaspoon/engine.rb b/lib/teaspoon/engine.rb
@@ -9,6 +9,7 @@ class Engine < ::Rails::Engine
     routes do
       root to: "suite#index"
       match "/fixtures/*filename", to: "suite#fixtures", via: :get, as: "fixture"
+      match "/js/:suite.:jstype.js", to: "suite#js", via: :get, defaults: { suite: "default", jstype: "vanilla" }
       match "/:suite", to: "suite#show", via: :get, as: "suite", defaults: { suite: "default" }
       match "/:suite/:hook", to: "suite#hook", via: :post, defaults: { suite: "default", hook: "default" }
     end