discourse/lib/highlight_js.rb
David Taylor ecf7a4f0c6
FIX: Ensure app-cdn CORS is not overridden by cors_origin setting (#24661)
We add `Access-Control-Allow-Origin: *` to all asset requests which are requested via a configured CDN. This is particularly important now that we're using browser-native `import()` to load the highlightjs bundle. Unfortunately, user-configurable 'cors_origins' site setting was overriding the wldcard value on CDN assets and causing CORS errors.

This commit updates the logic to give the `*` value precedence, and adds a spec for the situation. It also invalidates the cache of hljs assets (because CDNs will have cached the bad Access-Control-Allow-Origin header).

The rack-cors middleware is also slightly tweaked so that it is always inserted. This makes things easier to test and more consistent.
2023-12-01 12:57:11 +00:00

53 lines
1.3 KiB
Ruby

# frozen_string_literal: true
module HighlightJs
HIGHLIGHTJS_DIR ||= "#{Rails.root}/app/assets/javascripts/node_modules/@highlightjs/cdn-assets/"
VERSION ||= 1 # bump to invalidate caches following core changes
def self.languages
langs = Dir.glob(HIGHLIGHTJS_DIR + "languages/*.js").map { |path| File.basename(path)[0..-8] }
langs.sort
end
def self.bundle(langs)
lang_js =
langs.filter_map do |lang|
File.read(HIGHLIGHTJS_DIR + "languages/#{lang}.min.js")
rescue Errno::ENOENT
# no file, don't care
end
<<~JS
export default function registerLanguages(hljs) {
#{lang_js.join("\n")}
}
JS
end
def self.cache
@lang_string_cache ||= {}
end
def self.version(lang_string)
cache_info = cache[RailsMultisite::ConnectionManagement.current_db]
return cache_info[:digest] if cache_info&.[](:lang_string) == lang_string
cache_info = {
lang_string: lang_string,
digest:
Digest::SHA1.hexdigest(
bundle(lang_string.split("|")) + "|#{VERSION}|#{GlobalSetting.asset_url_salt}",
),
}
cache[RailsMultisite::ConnectionManagement.current_db] = cache_info
cache_info[:digest]
end
def self.path
"/highlight-js/#{Discourse.current_hostname}/#{version SiteSetting.highlighted_languages}.js"
end
end