[Snyk] Security upgrade codemirror from 5.65.19 to 6.0.0

Gemfile

@@ -53,13 +53,14 @@ gem 'sass-rails', '~> 6.0', '>= 6.0.0'
 gem 'uglifier', '~> 4.2'
 gem 'kaminari', '>= 1.2.2'
 gem 'simple_form', '>= 5.3.1'
+gem 'importmap-rails', '~> 2.2'
 
 gem 'aws-sdk-cloudwatch', require: false
 gem 'aws-sdk-s3', require: false
 gem 'azure-storage-blob', '>= 2.0.3', require: false
 
 # Exception tracking
-gem 'rollbar'
+gem 'rollbar', '~> 3.5', '>= 3.5.1'
 
 # Logging
 gem 'lograge', '>= 0.14.0'

Gemfile.lock

@@ -243,6 +243,10 @@ GEM
     http-form_data (2.3.0)
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
+    importmap-rails (2.2.2)
+      actionpack (>= 6.0.0)
+      activesupport (>= 6.0.0)
+      railties (>= 6.0.0)
     io-console (0.8.1)
     irb (1.15.2)
       pp (>= 0.6.0)
@@ -472,7 +476,7 @@ GEM
       netrc (~> 0.8)
     retryable (3.0.5)
     rexml (3.4.4)
-    rollbar (3.4.0)
+    rollbar (3.6.2)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -637,6 +641,7 @@ DEPENDENCIES
   haml-rails (>= 3.0.0)
   hashdiff
   http (>= 4.0.0)
+  importmap-rails (~> 2.2)
   jbuilder (~> 2.13, >= 2.13.0)
   jquery-rails (>= 4.5.0)
   jsonapi-rails
@@ -661,7 +666,7 @@ DEPENDENCIES
   rails (~> 8.0, >= 8.0.2.1)
   rails_event_store (~> 2.15, >= 2.15.0)
   redcarpet (~> 3.6)
-  rollbar
+  rollbar (~> 3.5, >= 3.5.1)
   rspec-json_expectations
   rspec-rails (~> 7.0, >= 7.0.0)
   rubocop (>= 1.66.0)

app/assets/config/manifest.js

@@ -1,3 +1,8 @@
+// app/assets/config/manifest.js
+
 //= link_tree ../images
-//= link_directory ../javascripts .js
 //= link_directory ../stylesheets .css
+//= link_tree ../../../vendor/javascript .js
+//= link_tree ../../javascript .js
+//= link_tree ../builds .js
+//= link govuk-frontend/govuk/all.js

app/assets/stylesheets/application.scss

@@ -11,8 +11,6 @@
  * It is generally better to create a new file per style scope.
  *
  *= require_self
- *= require codemirror/lib/codemirror
- *= require codemirror/theme/twilight
  *= require reportmi
 
  */

app/assets/stylesheets/components/code/fdl.scss

@@ -10,12 +10,13 @@
   display: none;
 }
 
-.govuk-textarea--fdl-source, .CodeMirror {
+.govuk-textarea--fdl-source, 
+.cm-editor,
+.cm-editor .cm-scroller {
   min-height: 40em;
   min-width: 100%;
 }
 
-.CodeMirror {
+.cm-editor  {
   font-family: Consolas, Monaco, 'Andale Mono', 'Ubuntu Mono', monospace;
 }
-

app/javascript/application.js

@@ -0,0 +1,23 @@
+import Rails from "@rails/ujs"
+Rails.start()
+
+import * as ActiveStorage from "@rails/activestorage"
+ActiveStorage.start()
+
+import "jquery"
+
+import { initializeCodeMirror } from "./codemirror_editor";
+
+import "./main";
+
+const readyEvents = ["DOMContentLoaded", "turbo:load", "turboLinks:load"];
+
+readyEvents.forEach((event) => {
+    document.addEventListener(event, () => {
+    const textArea = document.getElementById('code-editor');
+    if (textArea) {
+      console.log("Initializing CodeMirror editor");
+      initializeCodeMirror('code-editor');
+    }
+  });
+});

app/javascript/codemirror_editor.js

@@ -0,0 +1,37 @@
+import { EditorState } from "@codemirror/state";
+import { EditorView, keymap, lineNumbers } from "@codemirror/view";
+import { defaultKeymap } from "@codemirror/commands";
+import { oneDark } from "@codemirror/theme-one-dark";
+
+export function initializeCodeMirror(textAreaId) {
+    const textArea = document.getElementById('code-editor');
+    if (!textArea) return;
+
+    const extensions = [
+        lineNumbers(),
+        keymap.of(defaultKeymap),
+        oneDark,
+    ];
+
+    if (textArea.hasAttribute('readonly')) {
+        extensions.push(EditorView.editable.of(false));
+    }
+
+    const state = EditorState.create({
+        doc: textArea.value,
+        extensions: extensions
+    });
+
+    const view = new EditorView({
+        state,
+        parent: textArea.parentNode
+    });
+
+    if (textArea.className) view.dom.className += ` ${textArea.className}`;
+
+    // Hide the original textarea and update the value before form submission
+    textArea.style.display = 'none';
+    textArea.form?.addEventListener("submit", () => {
+        textArea.value = view.state.doc.toString();
+    });
+}

app/javascript/main.js

@@ -0,0 +1,80 @@
+// Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails
+
+const readyEvents = ["DOMContentLoaded", "turbo:load", "turboLinks:load"];
+
+readyEvents.forEach((event) => {
+  document.addEventListener(event, () => {
+    // From the govuk-frontend template.njk
+    document.body.className = ((document.body.className) ? document.body.className + ' js-enabled' : 'js-enabled');
+
+    window.GOVUKFrontend.initAll()
+
+    $("body").on('click', '.rmi-govuk-table-accordion-icon', function( event ) {
+        var tableIconVal = this.getAttribute("data-table-icon");
+
+        var tableAccContent = document.querySelector("[data-table-accordion='" + tableIconVal + "']");
+
+        if (tableAccContent.classList.contains("rmi-table-accordion-content--expanded")) {
+        tableAccContent.classList.remove("rmi-table-accordion-content--expanded");
+        this.classList.remove("rmi-govuk-table-accordion-expanded")
+        } else {
+        tableAccContent.classList.add("rmi-table-accordion-content--expanded");
+        this.classList.add("rmi-govuk-table-accordion-expanded")
+        }
+    });
+
+    $("body").on('click', '#markdown-preview-btn', function( event ) {
+        const summary = document.getElementById("notification_summary").value;
+        const message = document.getElementById("notification_notification_message").value;
+        const previewContainer = document.getElementById('preview-container');
+        const data = { summary: summary, message: message }
+
+        fetch('/admin/notifications/preview', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-CSRF-Token': document.querySelector('[name="csrf-token"]').content 
+        },
+        body: JSON.stringify(data)
+        })
+        .then(response => {
+        if(response.ok) {
+            return response.json();
+        }
+        throw new Error('Network response was not ok.');
+        })
+        .then(html => {
+        previewContainer.classList.remove('govuk-visually-hidden');
+        document.getElementById("summary-preview").innerHTML = html.summary;
+        document.getElementById("markdown-preview").innerHTML = html.message;
+        })
+    });
+
+    $("body").on('click', '#release-note-markdown-preview-btn', function( event ) {
+        const header = document.getElementById("release_note_header").value;
+        const body = document.getElementById("release_note_body").value;
+        const previewContainer = document.getElementById('release-note-preview-container');
+        const data = { header: header, body: body }
+
+        fetch('/admin/release_notes/preview', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-CSRF-Token': document.querySelector('[name="csrf-token"]').content 
+        },
+        body: JSON.stringify(data)
+        })
+        .then(response => {
+        if(response.ok) {
+            return response.json();
+        }
+        throw new Error('Network response was not ok.');
+        })
+        .then(html => {
+        previewContainer.classList.remove('govuk-visually-hidden');
+        document.getElementById("header-preview").innerHTML = html.header;
+        document.getElementById("release-note-markdown-preview").innerHTML = html.body;
+        })
+    });
+  });
+});

app/views/layouts/admin.html.haml

@@ -11,7 +11,7 @@
     = content_for(:head)
     = csrf_meta_tags
     = stylesheet_link_tag    'application', media: 'all'
-    = javascript_include_tag 'application'
+    = javascript_importmap_tags 'application'
 
   %body.govuk-template__body.app-body-class
     %a{ href: '#main-content', class: 'govuk-skip-link' }

bin/importmap

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+
+require_relative "../config/application"
+require "importmap/commands"

config/importmap.rb

@@ -0,0 +1,23 @@
+# Pin npm packages by running ./bin/importmap
+
+pin 'application', to: 'application.js'
+
+pin '@rails/activestorage', to: '@rails--activestorage.js' # @8.1.0
+pin '@rails/ujs', to: '@rails--ujs.js' # @7.1.3
+pin 'govuk-frontend'
+pin 'jquery' # @3.7.1
+
+pin '@codemirror/commands', to: '@codemirror--commands.js' # @6.10.0
+pin '@codemirror/language', to: '@codemirror--language.js' # @6.11.3
+pin '@codemirror/search', to: '@codemirror--search.js' # @6.5.11
+pin '@codemirror/state', to: '@codemirror--state.js' # @6.5.2
+pin '@codemirror/view', to: '@codemirror--view.js' # @6.38.6
+pin '@codemirror/autocomplete', to: '@codemirror--autocomplete.js' # @6.19.0
+
+pin '@lezer/common', to: '@lezer--common.js' # @1.3.0
+pin '@lezer/highlight', to: '@lezer--highlight.js' # @1.2.3
+pin '@marijn/find-cluster-break', to: '@marijn--find-cluster-break.js' # @1.0.2
+pin 'crelt' # @1.0.6
+pin 'style-mod' # @4.1.3
+pin 'w3c-keyname' # @2.2.8
+pin '@codemirror/theme-one-dark', to: '@codemirror--theme-one-dark.js' # @6.1.2

config/initializers/content_security_policy.rb

@@ -7,16 +7,12 @@
 Rails.application.config.content_security_policy do |policy|
   policy.default_src :self
 
-  if ENV['MAINTENANCE'].present?
-    policy.style_src   :self, :unsafe_inline, 'https://fonts.googleapis.com'
-  else
-    policy.style_src   :self, 'https://fonts.googleapis.com'
-  end
+  policy.style_src   :self, :unsafe_inline, 'https://fonts.googleapis.com'
   # For loading fonts referenced by the aforementioned styles
   # (https://fonts.gstatic.com at time of writing, but I see nothing to
   # suggest we can hardcode this host)
   policy.font_src    :self, :https
-  policy.script_src  :self, :unsafe_inline
+  policy.script_src  :self, :unsafe_inline, 'https://esm.sh'
 end
 
 # If you are using UJS then enable automatic nonce generation