Fix CSP failure patching graphiql view

Backporting https://github.com/rmosolgo/graphiql-rails/pull/71

Fix CSP failure patching graphiql view
ce201834 · Alessio Caiazza · Mayra Cabrera · d20ce7de · ce201834 · ce201834
Commit ce201834 authored 5 years ago by Alessio Caiazza Committed by Mayra Cabrera 5 years ago
--- a/Gemfile
+++ b/Gemfile
@@ -84,7 +84,9 @@ gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
  
 # GraphQL API
 gem 'graphql', '~> 1.9.11'
-gem 'graphiql-rails', '~> 1.4.10'
+# TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 will be released
+# https://gitlab.com/gitlab-org/gitlab-ce/issues/67263
+gem 'graphiql-rails', '~> 1.7.0'
 gem 'apollo_upload_server', '~> 2.0.0.beta3'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
  

--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -398,7 +398,7 @@ GEM
      rake (~> 12)
    grape_logging (1.7.0)
      grape
-    graphiql-rails (1.4.10)
+    graphiql-rails (1.7.0)
      railties
      sprockets-rails
    graphql (1.9.11)
@@ -1142,7 +1142,7 @@ DEPENDENCIES
  grape-entity (~> 0.7.1)
  grape-path-helpers (~> 1.1)
  grape_logging (~> 1.7)
-  graphiql-rails (~> 1.4.10)
+  graphiql-rails (~> 1.7.0)
  graphql (~> 1.9.11)
  graphql-docs (~> 1.6.0)
  grpc (~> 1.19.0)

--- a/app/views/graphiql/rails/editors/show.html.erb
+++ b/app/views/graphiql/rails/editors/show.html.erb
+<!DOCTYPE html>
+<html>
+  <head>
+    <title><%= GraphiQL::Rails.config.title || 'GraphiQL' %></title>
+
+    <%= stylesheet_link_tag("graphiql/rails/application") %>
+    <%= javascript_include_tag("graphiql/rails/application", nonce: true) %>
+  </head>
+  <body>
+    <%= content_tag :div, 'Loading...', id: 'graphiql-container', data: {
+      graphql_endpoint_path: graphql_endpoint_path,
+      initial_query: GraphiQL::Rails.config.initial_query,
+      logo: GraphiQL::Rails.config.logo,
+      headers: GraphiQL::Rails.config.resolve_headers(self),
+      query_params: GraphiQL::Rails.config.query_params
+    } %>
+  </body>
+</html>