Niklas Häusele comments

Results 9 comments of


                                            Niklas Häusele

Add rename_csp_helper_nonce_attribute ActionView configuration to avoid value exfiltration

I added a commit to change UJS as well. It changes UJS to check for the nonce attribute first, and if absent falls back to the content attribute.

Add rename_csp_helper_nonce_attribute ActionView configuration to avoid value exfiltration

I removed the UJS changes, thank you for the hint! Since `main` now target Rails 8, I could also remove the configuration flag and default to the `nonce` attribute instead....

Add rename_csp_helper_nonce_attribute ActionView configuration to avoid value exfiltration

Thank you for the link/info @zzak! Can we still deprecate this in 7.2, or should we deprecate this in 8.0? There's no `new_framework_defaults_8_1.rb.tt` and corresponding case statement yet, I can...

Add rename_csp_helper_nonce_attribute ActionView configuration to avoid value exfiltration

Thx for pairing @gmcgibbon at RailsWorld! I rebased and applied the suggested change 👍 To recap: This change will not break any behavior now. It would probably be the best,...

Set the worker process count automatically with WEB_CONCURRENCY=auto

You're right, it wouldn't be required in most setups. I adapted the implementation to require `processor_counter` inline. I also added `concurrent-ruby` as a `runtime_dependency` with the same version constraints as...

Set the worker process count automatically with WEB_CONCURRENCY=auto

I think I managed to write an integration test without requiring concurrent-ruby in the main process. Also got most Github Actions to pass, the failures seem unrelated/flaky.

Set the worker process count automatically with WEB_CONCURRENCY=auto

Great, thank you for double checking :)

Set the worker process count automatically with WEB_CONCURRENCY=auto

Yes, I've been able to rebase 👍

Set the worker process count automatically with WEB_CONCURRENCY=auto

Nice! Thank you for finishing this up and the reviews :)