twitter / secureheaders / 1167

97%

Pull #389

travis-ci

Avoid calling content_security_policy_nonce internally

Rails 5.2 adds support for configuring a Content-Security-Policy header,
including adding nonces to tags produced by the `javascript_tag` helper.

Unfortunately, Rails and this gem now both define a helper named
`content_security_policy_nonce`:

https://github.com/rails/rails/blob/v5.2.0.rc2/actionpack/lib/action_controller/metal/content_security_policy.rb#L44
https://github.com/twitter/secureheaders/blob/v5.0.5/lib/secure_headers/view_helper.rb#L69

The Rails helper wins over the Secure Headers one, and helpers like
`nonced_javascript_tag` currently raise this error on Rails 5.2:

    ArgumentError: wrong number of arguments (given 1, expected 0)

By using a method with a different name internally, we avoid clashing
with the Rails implementation, and `nonced_javascript_tag` works again.

25 of 25 new or added lines in 2 files covered. (100.0%)

2070 of 2138 relevant lines covered (96.82%)

216.15 hits per line