Merge branch 'main' into patch-1

Author: igorkasyanchuk

lib/rails_live_reload/engine.rb

@@ -1,7 +1,11 @@
 module RailsLiveReload
   class Railtie < ::Rails::Engine
-    if RailsLiveReload.enabled? && (defined?(::Rails::Server) || ENV['SERVER_PROCESS'])
-      initializer "rails_live_reload.middleware" do |app|
+    def enabled?
+      RailsLiveReload.enabled? && (defined?(::Rails::Server) || ENV['SERVER_PROCESS'])
+    end
+
+    initializer "rails_live_reload.middleware" do |app|
+      if enabled?
         if ::Rails::VERSION::MAJOR.to_i >= 5
           app.middleware.insert_after ActionDispatch::Executor, RailsLiveReload::Middleware::Base
         else
@@ -12,30 +16,38 @@ class Railtie < ::Rails::Engine
           end
         end
       end
+    end
 
-      initializer "rails_live_reload.watcher" do
+    initializer "rails_live_reload.watcher" do
+      if enabled?
         RailsLiveReload::Watcher.init
       end
+    end
 
-      initializer "rails_live_reload.configure_metrics", after: :initialize_logger do
+    initializer "rails_live_reload.configure_metrics", after: :initialize_logger do
+      if enabled?
         ActiveSupport::Notifications.subscribe(
           /\.action_view/,
           RailsLiveReload::Instrument::MetricsCollector.new
         )
       end
+    end
 
-      initializer "rails_live_reload.reset_current_request", after: :initialize_logger do |app|
+    initializer "rails_live_reload.reset_current_request", after: :initialize_logger do |app|
+      if enabled?
         app.executor.to_run      { CurrentRequest.cleanup }
         app.executor.to_complete { CurrentRequest.cleanup }
       end
+    end
 
-      initializer "rails_live_reload.routes" do
-        config.after_initialize do |app|
+    initializer "rails_live_reload.routes" do
+      config.after_initialize do |app|
+        if enabled?
           app.routes.prepend do
             mount RailsLiveReload.server => RailsLiveReload.config.url, internal: true
           end
         end
       end
     end
   end
-end
+end

lib/rails_live_reload/middleware/base.rb

@@ -15,11 +15,11 @@ def call!(env)
             @app.call(env)
           end
         else
-          request = Rack::Request.new(env)
+          request = ActionDispatch::Request.new(env)
           status, headers, body = @app.call(env)
 
           if html?(headers) && (status == 500 || status == 422 || (status.to_s =~ /20./ && request.get?))
-            return inject_rails_live_reload(status, headers, body)
+            return inject_rails_live_reload(request, status, headers, body)
           end
 
           [status, headers, body]
@@ -28,25 +28,26 @@ def call!(env)
 
       private
 
-      def inject_rails_live_reload(status, headers, body)
+      def inject_rails_live_reload(request, status, headers, body)
         response = Rack::Response.new([], status, headers)
-
+        
+        nonce = request&.content_security_policy_nonce
         if String === body
-          response.write make_new_response(body)
+          response.write make_new_response(body, nonce)
         else
-          body.each { |fragment| response.write make_new_response(fragment) }
+          body.each { |fragment| response.write make_new_response(fragment, nonce) }
         end
         body.close if body.respond_to?(:close)
         response.finish
       end
 
-      def make_new_response(body)
+      def make_new_response(body, nonce)
         index = body.rindex(/<\/body>/i) || body.rindex(/<\/html>/i)
         return body if index.nil?
 
         body.insert(index, <<~HTML.html_safe)
           <script defer type="text/javascript" src="#{RailsLiveReload.config.url}/script"></script>
-          <script id="rails-live-reload-options" type="application/json">
+          <script id="rails-live-reload-options" type="application/json" nonce="#{nonce}">
             #{{
               files: CurrentRequest.current.data.to_a,
               time: Time.now.to_i,
@@ -57,7 +58,7 @@ def make_new_response(body)
       end
 
       def html?(headers)
-        headers["Content-Type"].to_s.include?("text/html")
+        headers["content-type"].to_s.include?("text/html")
       end
     end
   end