Extract CSP report classification into CspReport

sethherr · claude · sethherr · commit b0b098dec1a9 · 2026-08-05T12:21:05.000-07:00
The job's own work is three lines; everything else was stateless domain
logic about what a report means, which is what CspPolicy already models.
Its specs no longer need a job harness, WebMock and a production Rails.env
to ask whether a report is noise.

Also scope the fetch-error filter to an actual navigation. Failed to fetch
and Load failed are what browsers report for any rejected fetch, so the
filter was suppressing the genuine failures the retry UI was just built
for. A pagehide flag distinguishes them.

Co-Authored-By: Claude Opus 5 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/app/javascript/application.js b/app/javascript/application.js
@@ -26,6 +26,15 @@ function localizeTime () {
   window.timeLocalizer.localize()
 }
 
+// A fetch still in flight when the page goes away rejects with a generic network
+// error, not an AbortError, so the message alone can't separate it from real
+// breakage - only treat these phrasings as noise while we're actually leaving.
+const NAVIGATION_FETCH_ERROR = /Failed to fetch|Load failed|Fetch is aborted|aborted a request/
+let navigatingAway = false
+// pagehide rather than beforeunload, which costs the page its bfcache entry
+window.addEventListener('pagehide', () => { navigatingAway = true })
+window.addEventListener('pageshow', () => { navigatingAway = false })
+
 // Load honeybadger dynamically so ad blockers don't break the entire app
 const honeybadgerApiKey = document.querySelector('meta[name="honeybadger-api-key"]')?.content
 if (honeybadgerApiKey) {
@@ -44,8 +53,7 @@ if (honeybadgerApiKey) {
         if (notice.message?.includes('ResizeObserver loop')) {
           return false
         }
-        // A fetch killed by navigating away, in the phrasings browsers give it
-        if (/Failed to fetch|Load failed|Fetch is aborted|aborted a request/.test(notice.message)) {
+        if (navigatingAway && NAVIGATION_FETCH_ERROR.test(notice.message)) {
           return false
         }
       })
diff --git a/app/jobs/forward_csp_report_job.rb b/app/jobs/forward_csp_report_job.rb
@@ -3,103 +3,23 @@ class ForwardCspReportJob < ApplicationJob
 
   HONEYBADGER_URL = "https://api.honeybadger.io/v1/browser/csp"
   HONEYBADGER_CSP_API_KEY = ENV["HONEYBADGER_CSP_API_KEY"]
-  EXTENSION_SCHEME = %r{\A(chrome|moz|safari|safari-web)-extension://}
-  IN_APP_BROWSER = /\b(FBAN|FBAV|FB_IAB|Instagram|Line\/)\b/
-  TRANSLATE_DOCUMENT = /\.translate\.goog\z|translate\.google(apis)?\.com/
-  # Google Ads conversion iframes load on country-specific google.<tld> domains;
-  # CSP frame_src allowlists common ones, we silence reports for the rest. Frame
-  # violations report the bare origin, hence the trailing slash-or-end.
-  GOOGLE_FRAME = %r{\Ahttps://www\.google\.[a-z.]+(/|\z)}
-  # Corporate proxies, antivirus, and carriers inject frames pointing at private
-  # or loopback IPs — the user's own network, nothing we serve or can fix.
-  PRIVATE_IP_FRAME = %r{\Ahttps?://(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)}
-  BLOCKED_URI_NOISE = Regexp.union(GOOGLE_FRAME, PRIVATE_IP_FRAME)
 
   # The query is rebuilt here, not forwarded from the client, so the API key and
   # user context never ride in the browser-facing CSP report_uri.
   def perform(body, user_id, user_agent = nil)
     # dev/sandbox browsers still emit reports; only production forwards to Honeybadger
     return unless Rails.env.production? && HONEYBADGER_CSP_API_KEY.present?
 
-    report = parsed_report(body)
-    return unless forward?(report, user_agent)
+    report = CspReport.parse(body)
+    return if report.blank? || CspReport.noise?(report, user_agent)
 
     # Honeybadger records this request's user agent, which is Faraday - so the
     # browser's rides along as context, or a report can't be attributed at all
     query = URI.encode_www_form(api_key: HONEYBADGER_CSP_API_KEY, report_only: false,
       env: Rails.env, "context[user_id]": user_id.to_s,
       "context[user_agent]": user_agent.to_s)
-    Faraday.post("#{HONEYBADGER_URL}?#{query}", normalized_body(report),
+    Faraday.post("#{HONEYBADGER_URL}?#{query}",
+      {"csp-report" => CspReport.normalize(report)}.to_json,
       "Content-Type" => "application/csp-report")
   end
-
-  private
-
-  # Honeybadger fingerprints a fault on the whole blocked-uri, so a query string
-  # that varies per request mints a new fault every time — one ad conversion url
-  # accounted for hundreds of them.
-  def normalized_body(report)
-    uri = parsed_uri(report["blocked-uri"])
-    normalized = uri ? "#{uri.scheme}://#{uri.host}#{uri.path}" : report["blocked-uri"]
-    {"csp-report" => report.merge("blocked-uri" => normalized)}.to_json
-  end
-
-  def parsed_report(body)
-    parsed = JSON.parse(body)
-    parsed["csp-report"] if parsed.is_a?(Hash) && parsed["csp-report"].is_a?(Hash)
-  rescue JSON::ParserError, TypeError
-    nil
-  end
-
-  def forward?(report, user_agent)
-    report.present? && !user_agent.to_s.match?(IN_APP_BROWSER) &&
-      !extension_noise?(report) && !translate_noise?(report) &&
-      !report["blocked-uri"].to_s.match?(BLOCKED_URI_NOISE) &&
-      !third_party_font_noise?(report) && !foreign_policy_noise?(report)
-  end
-
-  def extension_noise?(report)
-    [report["blocked-uri"], report["source-file"]].compact
-      .any? { |uri| uri.match?(EXTENSION_SCHEME) }
-  end
-
-  # Google Translate reskins the page and injects read-aloud TTS audio as data: media
-  def translate_noise?(report)
-    return true if report["document-uri"].to_s.match?(TRANSLATE_DOCUMENT)
-    report["effective-directive"] == "media-src" && report["blocked-uri"].to_s == "data"
-  end
-
-  # An extension that tightens our response header still reports to our report-uri,
-  # so a cross-origin block our own policy would have permitted wasn't ours. Same
-  # origin is exempt: 'self' always permits it, and what the browser is actually
-  # reporting is a redirect to a target it won't name.
-  def foreign_policy_noise?(report)
-    uri = cross_origin_blocked_uri(report)
-    uri && CspPolicy.permits?(directive(report), uri)
-  end
-
-  # Every font we load is on our own origin or in font_src, so a font blocked from
-  # a third party was injected into the page — coupon and citation extensions add
-  # page-level <link>s, which carry an https uri EXTENSION_SCHEME can't recognize.
-  # The cost is that a webfont host we forget to allowlist goes unreported.
-  def third_party_font_noise?(report)
-    directive(report) == "font-src" && cross_origin_blocked_uri(report).present?
-  end
-
-  # Old browsers send the sources along with the name: "font-src https://x"
-  def directive(report)
-    (report["effective-directive"].presence || report["violated-directive"]).to_s.split.first
-  end
-
-  def cross_origin_blocked_uri(report)
-    uri = parsed_uri(report["blocked-uri"])
-    uri if uri && uri.host != parsed_uri(report["document-uri"])&.host
-  end
-
-  def parsed_uri(value)
-    uri = URI.parse(value.to_s)
-    uri if uri.is_a?(URI::HTTP) && uri.host.present?
-  rescue URI::InvalidURIError
-    nil
-  end
 end
diff --git a/app/services/csp_report.rb b/app/services/csp_report.rb
@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+# Parses a browser CSP report and decides whether it describes something we can
+# act on. CspPolicy answers what our own policy permits; this decides what's
+# worth forwarding, and normalizes what is.
+module CspReport
+  extend Functionable
+
+  EXTENSION_SCHEME = %r{\A(chrome|moz|safari|safari-web)-extension://}
+  IN_APP_BROWSER = /\b(FBAN|FBAV|FB_IAB|Instagram|Line\/)\b/
+  TRANSLATE_DOCUMENT = /\.translate\.goog\z|translate\.google(apis)?\.com/
+  # Google Ads conversion iframes load on country-specific google.<tld> domains;
+  # CSP frame_src allowlists common ones, we silence reports for the rest. Frame
+  # violations report the bare origin, hence the trailing slash-or-end.
+  GOOGLE_FRAME = %r{\Ahttps://www\.google\.[a-z.]+(/|\z)}
+  # Corporate proxies, antivirus, and carriers inject frames pointing at private
+  # or loopback IPs — the user's own network, nothing we serve or can fix.
+  PRIVATE_IP_FRAME = %r{\Ahttps?://(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)}
+  BLOCKED_URI_NOISE = Regexp.union(GOOGLE_FRAME, PRIVATE_IP_FRAME)
+
+  def parse(body)
+    parsed = JSON.parse(body)
+    parsed["csp-report"] if parsed.is_a?(Hash) && parsed["csp-report"].is_a?(Hash)
+  rescue JSON::ParserError, TypeError
+    nil
+  end
+
+  def noise?(report, user_agent = nil)
+    user_agent.to_s.match?(IN_APP_BROWSER) || extension_noise?(report) ||
+      translate_noise?(report) || report["blocked-uri"].to_s.match?(BLOCKED_URI_NOISE) ||
+      third_party_font_noise?(report) || foreign_policy_noise?(report)
+  end
+
+  # Honeybadger fingerprints a fault on the whole blocked-uri, so a query string
+  # that varies per request mints a new fault every time — one ad conversion url
+  # accounted for hundreds of them.
+  def normalize(report)
+    uri = parsed_uri(report["blocked-uri"])
+    return report if uri.nil?
+
+    report.merge("blocked-uri" => "#{uri.scheme}://#{uri.host}#{uri.path}")
+  end
+
+  #
+  # private below here
+  #
+
+  def extension_noise?(report)
+    [report["blocked-uri"], report["source-file"]].compact
+      .any? { |uri| uri.match?(EXTENSION_SCHEME) }
+  end
+
+  # Google Translate reskins the page and injects read-aloud TTS audio as data: media
+  def translate_noise?(report)
+    return true if report["document-uri"].to_s.match?(TRANSLATE_DOCUMENT)
+    report["effective-directive"] == "media-src" && report["blocked-uri"].to_s == "data"
+  end
+
+  # An extension that tightens our response header still reports to our report-uri,
+  # so a cross-origin block our own policy would have permitted wasn't ours. Same
+  # origin is exempt: 'self' always permits it, and what the browser is actually
+  # reporting is a redirect to a target it won't name.
+  def foreign_policy_noise?(report)
+    uri = cross_origin_blocked_uri(report)
+    uri && CspPolicy.permits?(directive(report), uri)
+  end
+
+  # Every font we load is on our own origin or in font_src, so a font blocked from
+  # a third party was injected into the page — coupon and citation extensions add
+  # page-level <link>s, which carry an https uri EXTENSION_SCHEME can't recognize.
+  # The cost is that a webfont host we forget to allowlist goes unreported.
+  def third_party_font_noise?(report)
+    directive(report) == "font-src" && cross_origin_blocked_uri(report).present?
+  end
+
+  # Old browsers send the sources along with the name: "font-src https://x"
+  def directive(report)
+    (report["effective-directive"].presence || report["violated-directive"]).to_s.split.first
+  end
+
+  def cross_origin_blocked_uri(report)
+    uri = parsed_uri(report["blocked-uri"])
+    uri if uri && uri.host != parsed_uri(report["document-uri"])&.host
+  end
+
+  def parsed_uri(value)
+    uri = URI.parse(value.to_s)
+    uri if uri.is_a?(URI::HTTP) && uri.host.present?
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  conceal :extension_noise?, :translate_noise?, :foreign_policy_noise?,
+    :third_party_font_noise?, :directive, :cross_origin_blocked_uri, :parsed_uri
+end
diff --git a/spec/jobs/forward_csp_report_job_spec.rb b/spec/jobs/forward_csp_report_job_spec.rb
@@ -2,9 +2,8 @@
 
 RSpec.describe ForwardCspReportJob, type: :job do
   let(:blocked_uri) { "https://evil.example.com/x.js" }
-  let(:effective_directive) { "script-src" }
   let(:document_uri) { "https://bikeindex.org/bikes/1" }
-  let(:report) { {"csp-report" => {"blocked-uri" => blocked_uri, "document-uri" => document_uri, "effective-directive" => effective_directive}} }
+  let(:report) { {"csp-report" => {"blocked-uri" => blocked_uri, "document-uri" => document_uri, "effective-directive" => "script-src"}} }
   let(:body) { report.to_json }
   let(:user_agent) { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.36" }
   let(:forwarded) { [] }
@@ -46,9 +45,9 @@ def perform(request_body = body)
       end
 
       context "blocked-uri with a query string" do
-        let(:blocked_uri) { "https://evil.example.com/x.js?label=WADeCPKg7gYQtvfc0wM&guid=ON" }
+        let(:blocked_uri) { "https://evil.example.com/x.js?label=WADeCPKg7gYQtvfc0wM" }
 
-        it "forwards it without the query, so the fault doesn't fingerprint per-request" do
+        it "forwards it normalized" do
           perform
           expect(forwarded_blocked_uri).to eq "https://evil.example.com/x.js"
         end
@@ -62,118 +61,20 @@ def perform(request_body = body)
         end
       end
 
-      context "browser-extension noise" do
+      context "a report CspReport treats as noise" do
         let(:blocked_uri) { "chrome-extension://0dca8e62/fonts/Inter-Variable.ttf" }
         it "does not forward" do
           perform
           expect(forwarded).to be_empty
         end
       end
 
-      context "in-app browser user agent" do
-        let(:user_agent) { "Mozilla/5.0 (Linux; Android 12) Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/488.0.0.78.79;]" }
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "google country-domain frame (origin only, no path)" do
-        let(:blocked_uri) { "https://www.google.co.id" }
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "private-ip frame injection" do
-        let(:blocked_uri) { "https://10.255.99.112" }
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "read-aloud data: media" do
-        let(:blocked_uri) { "data" }
-        let(:effective_directive) { "media-src" }
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "blocked by a policy that isn't ours" do
-        # An extension tightening our header still reports to our report-uri
-        let(:blocked_uri) { "https://www.googletagmanager.com/gtm.js?id=GTM-K88RMWC" }
-        let(:effective_directive) { "script-src-elem" }
-
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "an old browser sending the sources alongside the directive name" do
-        let(:report) { {"csp-report" => {"blocked-uri" => "https://www.google-analytics.com/analytics.js", "document-uri" => document_uri, "violated-directive" => "script-src https://www.googletagmanager.com"}} }
-
-        it "does not forward" do
-          perform
-          expect(forwarded).to be_empty
-        end
-      end
-
-      context "a host our policy does not allow" do
-        let(:blocked_uri) { "https://images.simplycodes.com/tracker.gif" }
-        let(:effective_directive) { "img-src" }
-
-        it "forwards" do
-          perform
-          expect(forwarded_blocked_uri).to eq blocked_uri
-        end
-      end
-
-      context "a font from a third party" do
-        # Coupon and citation extensions inject page-level <link>s
-        let(:blocked_uri) { "https://images.simplycodes.com/fonts/CircularXXWeb-Medium.woff2" }
-        let(:effective_directive) { "font-src" }
-
+      context "malformed body" do
         it "does not forward" do
-          perform
+          perform("not json")
           expect(forwarded).to be_empty
         end
       end
-
-      context "a font from our own origin" do
-        let(:blocked_uri) { "https://bikeindex.org/assets/inter.woff2" }
-        let(:effective_directive) { "font-src" }
-
-        it "forwards" do
-          perform
-          expect(forwarded_blocked_uri).to eq blocked_uri
-        end
-      end
-
-      context "same-origin blocked-uri our policy would allow" do
-        # 'self' permits it, so this is a redirect to a target the browser won't name
-        let(:blocked_uri) { "https://bikeindex.org/payments" }
-        let(:document_uri) { "https://bikeindex.org/donate" }
-        let(:effective_directive) { "connect-src" }
-
-        it "forwards" do
-          perform
-          expect(forwarded_blocked_uri).to eq blocked_uri
-        end
-      end
-
-      context "malformed body" do
-        ["not json", "null", "123", {"csp-report" => 5}.to_json].each do |raw_body|
-          it "does not forward for #{raw_body.inspect}" do
-            perform(raw_body)
-            expect(forwarded).to be_empty
-          end
-        end
-      end
     end
   end
 end
diff --git a/spec/services/csp_report_spec.rb b/spec/services/csp_report_spec.rb
