kk

Author: syphar

crates/bin/docs_rs_web/src/config.rs

@@ -1,7 +1,8 @@
-use anyhow::Result;
+use anyhow::{Context as _, Result, ensure};
 use docs_rs_config::AppConfig;
 use docs_rs_env_vars::maybe_env;
 use docs_rs_types::{ByteSize, Duration};
+use url::Url;
 
 #[derive(Debug, bon::Builder)]
 #[builder(on(_, overwritable))]
@@ -39,10 +40,9 @@ pub struct Config {
     #[builder(default)]
     pub(crate) csp_report_only: bool,
 
-    /// Datadog graph embed URLs generated for a 400 × 200 viewport.
-    /// Unset URLs hide the corresponding graphs on the build queue page.
-    pub(crate) build_queue_length_graph_url: Option<String>,
-    pub(crate) build_queue_wait_time_graph_url: Option<String>,
+    /// Graph embed URLs, displayed in order. An empty list hides the metrics column.
+    #[builder(default)]
+    pub(crate) build_queue_graph_urls: Vec<Url>,
 
     // Cache-Control header, for versioned URLs.
     // If both are absent, don't generate the header. If only one is present,
@@ -60,18 +60,19 @@ use config_builder::State;
 
 impl<S: State> ConfigBuilder<S> {
     pub(crate) fn load_environment(self) -> Result<ConfigBuilder<S>> {
+        let graph_urls = maybe_env::<String>("DOCSRS_BUILD_QUEUE_GRAPH_URLS")?
+            .map(|value| parse_graph_urls(&value))
+            .transpose()?
+            .unwrap_or_default();
         Ok(self
+            .build_queue_graph_urls(graph_urls)
             .maybe_cratesio_token(maybe_env("DOCSRS_CRATESIO_TOKEN")?)
             .maybe_max_parse_memory(maybe_env("DOCSRS_MAX_PARSE_MEMORY")?)
             .maybe_render_threads(maybe_env("DOCSRS_RENDER_THREADS")?)
             .maybe_request_timeout(maybe_env("DOCSRS_REQUEST_TIMEOUT")?)
             .maybe_report_request_timeouts(maybe_env("DOCSRS_REPORT_REQUEST_TIMEOUTS")?)
             .maybe_random_crate_search_view_size(maybe_env("DOCSRS_RANDOM_CRATE_SEARCH_VIEW_SIZE")?)
             .maybe_csp_report_only(maybe_env("DOCSRS_CSP_REPORT_ONLY")?)
-            .maybe_build_queue_length_graph_url(maybe_env("DOCSRS_BUILD_QUEUE_LENGTH_GRAPH_URL")?)
-            .maybe_build_queue_wait_time_graph_url(maybe_env(
-                "DOCSRS_BUILD_QUEUE_WAIT_TIME_GRAPH_URL",
-            )?)
             .maybe_cache_control_stale_while_revalidate(maybe_env(
                 "CACHE_CONTROL_STALE_WHILE_REVALIDATE",
             )?)
@@ -101,3 +102,36 @@ impl AppConfig for Config {
         Ok(Self::builder().test_config()?.build())
     }
 }
+
+fn parse_graph_urls(value: &str) -> Result<Vec<Url>> {
+    value
+        .split_whitespace()
+        .map(|value| {
+            let url = Url::parse(value).context("invalid URL in DOCSRS_BUILD_QUEUE_GRAPH_URLS")?;
+            ensure!(
+                matches!(url.scheme(), "http" | "https") && url.host_str().is_some(),
+                "DOCSRS_BUILD_QUEUE_GRAPH_URLS requires HTTP(S) URLs"
+            );
+            Ok(url)
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn graph_urls_are_validated_and_preserve_order() {
+        let urls = parse_graph_urls(
+            "https://app.datadoghq.com/graph/embed?token=a&legend=true\nhttps://example.com/graph?token=b",
+        )
+        .unwrap();
+        assert_eq!(urls.len(), 2);
+        assert_eq!(urls[0].query(), Some("token=a&legend=true"));
+        assert_eq!(urls[1].host_str(), Some("example.com"));
+        assert!(parse_graph_urls(" ").unwrap().is_empty());
+        assert!(parse_graph_urls("not-a-url").is_err());
+        assert!(parse_graph_urls("javascript:alert(1)").is_err());
+    }
+}

crates/bin/docs_rs_web/src/handlers/releases.rs

@@ -768,8 +768,7 @@ struct BuildQueuePage {
     in_progress_builds: Vec<InProgressBuild>,
     expand_rebuild_queue: bool,
     show_length_warning: bool,
-    queue_length_graph_url: Option<String>,
-    queue_wait_time_graph_url: Option<String>,
+    graph_urls: Vec<url::Url>,
 }
 
 impl_axum_webpage! { BuildQueuePage }
@@ -852,10 +851,8 @@ pub(crate) async fn build_queue_handler(
         }
     });
 
-    if config.build_queue_length_graph_url.is_some()
-        || config.build_queue_wait_time_graph_url.is_some()
-    {
-        csp.allow_datadog_frame();
+    for url in &config.build_queue_graph_urls {
+        csp.allow_frame(url);
     }
 
     Ok(BuildQueuePage {
@@ -865,8 +862,7 @@ pub(crate) async fn build_queue_handler(
         in_progress_builds,
         expand_rebuild_queue: params.expand.is_some(),
         show_length_warning,
-        queue_length_graph_url: config.build_queue_length_graph_url.clone(),
-        queue_wait_time_graph_url: config.build_queue_wait_time_graph_url.clone(),
+        graph_urls: config.build_queue_graph_urls.clone(),
     })
 }
 
@@ -895,35 +891,39 @@ mod tests {
     use std::str::FromStr;
     use test_case::test_case;
 
-    #[test_case(false, false)]
-    #[test_case(true, false)]
-    #[test_case(false, true)]
-    #[test_case(true, true)]
-    fn test_build_queue_optional_graphs(length: bool, wait_time: bool) {
-        let url = "https://app.datadoghq.com/graph/embed?token=test&legend=true";
+    #[test_case(0)]
+    #[test_case(1)]
+    #[test_case(3)]
+    fn test_build_queue_optional_graphs(count: usize) {
+        let urls: Vec<url::Url> = (0..count)
+            .map(|index| {
+                format!("https://app.datadoghq.com/graph/embed?token={index}&legend=true")
+                    .parse()
+                    .unwrap()
+            })
+            .collect();
         let mut page = BuildQueuePage {
             description: "test",
             queue: Vec::new(),
             rebuild_queue: Vec::new(),
             in_progress_builds: Vec::new(),
             expand_rebuild_queue: false,
             show_length_warning: false,
-            queue_length_graph_url: length.then(|| url.to_owned()),
-            queue_wait_time_graph_url: wait_time.then(|| url.to_owned()),
+            graph_urls: urls.clone(),
         };
         let html =
             kuchikiki::parse_html().one(page.render_with_csp_nonce("test-nonce".into()).unwrap());
         let frames: Vec<_> = html
             .select(".build-queue-metrics iframe")
             .unwrap()
             .collect();
-        assert_eq!(frames.len(), usize::from(length) + usize::from(wait_time));
-        for frame in frames {
-            assert_eq!(frame.attributes.borrow().get("src"), Some(url));
+        assert_eq!(frames.len(), count);
+        for (frame, url) in frames.iter().zip(&urls) {
+            assert_eq!(frame.attributes.borrow().get("src"), Some(url.as_str()));
         }
         assert_eq!(
             html.select(".build-queue-layout").unwrap().count(),
-            usize::from(length || wait_time)
+            usize::from(count > 0)
         );
     }
 

crates/bin/docs_rs_web/src/middleware/csp.rs

@@ -6,17 +6,18 @@ use axum::{
 };
 use base64::{Engine, engine::general_purpose::STANDARD as b64};
 use std::{
+    collections::BTreeSet,
     fmt::Write,
     sync::{
-        Arc,
+        Arc, Mutex,
         atomic::{AtomicBool, Ordering},
     },
 };
 
 pub(crate) struct Csp {
     nonce: String,
     suppress: AtomicBool,
-    allow_datadog_frame: AtomicBool,
+    frame_origins: Mutex<BTreeSet<String>>,
 }
 
 impl Csp {
@@ -29,7 +30,7 @@ impl Csp {
         Self {
             nonce: b64.encode(random),
             suppress: AtomicBool::new(false),
-            allow_datadog_frame: AtomicBool::new(false),
+            frame_origins: Mutex::new(BTreeSet::new()),
         }
     }
 
@@ -41,8 +42,13 @@ impl Csp {
         &self.nonce
     }
 
-    pub(crate) fn allow_datadog_frame(&self) {
-        self.allow_datadog_frame.store(true, Ordering::Relaxed);
+    pub(crate) fn allow_frame(&self, url: &url::Url) {
+        if matches!(url.scheme(), "http" | "https") {
+            self.frame_origins
+                .lock()
+                .unwrap()
+                .insert(url.origin().ascii_serialization());
+        }
     }
 
     fn render(&self, content_type: ContentType) -> Option<String> {
@@ -74,8 +80,12 @@ impl Csp {
     }
 
     fn render_html(&self, result: &mut String) {
-        if self.allow_datadog_frame.load(Ordering::Relaxed) {
-            result.push_str("; frame-src https://app.datadoghq.com");
+        let origins = self.frame_origins.lock().unwrap();
+        if !origins.is_empty() {
+            result.push_str("; frame-src");
+            for origin in origins.iter() {
+                write!(result, " {origin}").unwrap();
+            }
         }
 
         // Allow loading any CSS file from the current origin.
@@ -200,15 +210,20 @@ mod tests {
     }
 
     #[test]
-    fn test_csp_datadog_frame() {
+    fn test_csp_frame_origins() {
         let csp = Csp::new();
         assert!(!csp.render(ContentType::Html).unwrap().contains("frame-src"));
 
-        csp.allow_datadog_frame();
+        let url = "https://app.datadoghq.com/graph/embed?token=test"
+            .parse()
+            .unwrap();
+        csp.allow_frame(&url);
+        csp.allow_frame(&url);
+        csp.allow_frame(&"https://example.com:8443/graph".parse().unwrap());
         assert!(
             csp.render(ContentType::Html)
                 .unwrap()
-                .contains("; frame-src https://app.datadoghq.com;")
+                .contains("; frame-src https://app.datadoghq.com https://example.com:8443;")
         );
         assert!(!csp.render(ContentType::Svg).unwrap().contains("frame-src"));
         assert!(

crates/bin/docs_rs_web/templates/releases/build_queue.html

@@ -27,7 +27,7 @@
             </div>
         {%- endif %}
 
-        <div class="{% if queue_length_graph_url.is_some() || queue_wait_time_graph_url.is_some() %}build-queue-layout{% endif %}">
+        <div class="{% if !graph_urls.is_empty() %}build-queue-layout{% endif %}">
             <div class="recent-releases-container">
                 <div class="release">
                     <strong>Currently being built</strong>
@@ -128,28 +128,18 @@
                     </ol>
                 {%- endif -%}
             </div>
-            {% if queue_length_graph_url.is_some() || queue_wait_time_graph_url.is_some() %}
+            {% if !graph_urls.is_empty() %}
             <aside class="build-queue-metrics" aria-label="Build metrics">
-                {% if let Some(url) = queue_length_graph_url %}
+                {% for url in graph_urls %}
                 <iframe
                     class="build-metrics-graph"
                     src="{{ url }}"
-                    title="Queue length graph"
+                    title="Build metrics graph {{ loop.index }}"
                     width="400"
                     height="200"
                     frameborder="0"
                 ></iframe>
-                {% endif %}
-                {% if let Some(url) = queue_wait_time_graph_url %}
-                <iframe
-                    class="build-metrics-graph"
-                    src="{{ url }}"
-                    title="Queue waiting time graph"
-                    width="400"
-                    height="200"
-                    frameborder="0"
-                ></iframe>
-                {% endif %}
+                {% endfor %}
             </aside>
             {% endif %}
         </div>