3 files changed, 22 insertions, 2 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 8bd99ac..d9cf1be 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -71,4 +71,11 @@ class AdminController < ApplicationController
       end
     end
   end
+
+  # Deliberately raises, to verify the error-log tripwire end to end.
+  # Behind login_required like the rest of the controller; harmless --
+  # the visitor gets the ordinary 500 page.
+  def boom
+    raise "Deliberate test exception via admin/boom"
+  end
 end
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
index 08cbc98..a8f8edb 100644
--- a/app/controllers/csp_reports_controller.rb
+++ b/app/controllers/csp_reports_controller.rb
@@ -3,8 +3,20 @@ class CspReportsController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   def create
-    report = request.body.read(8192)
-    Rails.logger.warn("CSP violation: #{report}") if report.present?
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      Rails.logger.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      Rails.logger.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
     head :no_content
   end
 end
diff --git a/config/routes.rb b/config/routes.rb
index 3aa5c69..743b46e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -92,6 +92,7 @@ Cccms::Application.routes.draw do
       match 'conventions'      => 'admin#conventions',      :as => :admin_conventions,      :via => :get
       match 'dashboard_search' => 'admin#dashboard_search', :as => :admin_dashboard_search, :via => :get
       match 'log'              => 'node_actions#index',     :as => :admin_log,              :via => :get
+      match 'boom'             => 'admin#boom',             :as => :admin_boom,             :via => :get
     end
 
     match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete