Navigate explicitly in custom_styles XSS system test

The test relied on the post-login landing page implicitly, so the
custom_styles <link> coverage could silently evaporate if that landing
changes. Visit root_url explicitly (matching the writebook sibling) to pin
the page under test. Assertions are unchanged and still non-vacuous.

Dockerfile

@@ -66,6 +66,9 @@ ENV HTTP_WRITE_TIMEOUT=300
 COPY --from=build --chown=rails:rails /usr/local/bundle /usr/local/bundle
 COPY --from=build --chown=rails:rails /rails /rails
 
+# Install ONCE backup/restore hooks
+COPY --chmod=755 hooks /hooks
+
 # Set version and revision
 ARG APP_VERSION
 ENV APP_VERSION=$APP_VERSION

app/controllers/accounts/custom_styles_controller.rb

@@ -1,5 +1,14 @@
 class Accounts::CustomStylesController < ApplicationController
-  before_action :ensure_can_administer, :set_account
+  allow_unauthenticated_access only: :show
+  before_action :ensure_can_administer, :set_account, except: :show
+
+  def show
+    if stale?(etag: Current.account)
+      expires_in 5.minutes, public: true, stale_while_revalidate: 1.week
+
+      render plain: Current.account&.custom_styles.to_s, content_type: "text/css"
+    end
+  end
 
   def edit
   end

app/helpers/application_helper.rb

@@ -12,12 +12,6 @@ module ApplicationHelper
     end
   end
 
-  def custom_styles_tag
-    if custom_styles = Current.account&.custom_styles
-      tag.style(custom_styles.to_s.html_safe, data: { turbo_track: "reload" })
-    end
-  end
-
   def body_classes
     [ @body_class, admin_body_class, account_logo_body_class ].compact.join(" ")
   end

app/views/layouts/application.html.erb

@@ -22,7 +22,7 @@
     <%= tag.link rel: "apple-touch-icon", href: fresh_account_logo_path %>
 
     <%= stylesheet_link_tag :all, "data-turbo-track": "reload" %>
-    <%= custom_styles_tag %>
+    <%= tag.link rel: "stylesheet", href: fresh_custom_styles_path, data: { turbo_track: "reload" } %>
 
     <%= javascript_importmap_tags %>
 

bin/release

@@ -15,6 +15,7 @@ include SSHKit::DSL
 ARCH = "linux/amd64,linux/arm64"
 BUILDER_NAME = "campfire-builder"
 GIT_SHA = `git rev-parse HEAD`.strip
+MANUAL_NOTES = ARGV.delete("--notes")
 VERSION = ARGV[0]
 
 DOCKER_IMAGE_NAME = "registry.once.com/campfire"
@@ -28,7 +29,7 @@ EXPORT_REMOTE_USER = "app"
 EXPORT_DEPLOY_HOSTS = %w[ once-store-app-101 once-store-app-102 ]
 EXPORT_DEPLOY_LOCATION = "/local/app/product_releases/"
 
-abort "You must specify a version, e.g. `bin/release 1.0.0`" unless VERSION
+abort "You must specify a version, e.g. `bin/release 1.0.0` (pass --notes to write release notes manually)" unless VERSION
 
 current_branch = `git rev-parse --abbrev-ref HEAD`.strip
 if current_branch != "main"
@@ -57,19 +58,25 @@ on(:local) do
 end
 
 announcing "Creating GitHub release v#{VERSION}..." do
-  notes_file = "tmp/release_notes.md"
-
   on(:local) do
-    execute :mkdir, "-p", "tmp"
+    if MANUAL_NOTES
+      notes_file = "tmp/release_notes.md"
 
-    File.write(notes_file, "# What's Changed\n\n- \n")
-    system ENV["EDITOR"] || "vim", notes_file
+      execute :mkdir, "-p", "tmp"
 
-    unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
-      abort "Failed to create release; check that the version doesn't already exist"
+      File.write(notes_file, "# What's Changed\n\n- \n")
+      system ENV["EDITOR"] || "vim", notes_file
+
+      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--notes-file", notes_file
+        abort "Failed to create release; check that the version doesn't already exist"
+      end
+
+      execute :rm, notes_file
+    else
+      unless system "gh", "release", "create", "v#{VERSION}", "--title", "v#{VERSION}", "--generate-notes"
+        abort "Failed to create release; check that the version doesn't already exist"
+      end
     end
-
-    execute :rm, notes_file
   end
 end
 

config/routes.rb

@@ -21,7 +21,7 @@ Rails.application.routes.draw do
 
       resource :join_code, only: :create
       resource :logo, only: %i[ show destroy ]
-      resource :custom_styles, only: %i[ edit update ]
+      resource :custom_styles, only: %i[ show edit update ]
     end
   end
 
@@ -29,6 +29,10 @@ Rails.application.routes.draw do
     route_for :account_logo, v: Current.account&.updated_at&.to_fs(:number), size: options[:size]
   end
 
+  direct :fresh_custom_styles do |options|
+    route_for :account_custom_styles, v: Current.account&.updated_at&.to_fs(:epoch)
+  end
+
   get "join/:join_code", to: "users#new", as: :join
   post "join/:join_code", to: "users#create"
 

hooks/post-restore

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+
+db_name="${RAILS_ENV:-production}.sqlite3"
+snapshot="/rails/storage/backups/$db_name"
+db="/rails/storage/db/$db_name"
+
+if [ -f "$snapshot" ]; then
+  mkdir -p "$(dirname "$db")"
+  cp "$snapshot" "$db"
+  rm -f "$db-wal" "$db-shm"
+fi

hooks/pre-backup

@@ -0,0 +1,2 @@
+#!/bin/bash
+exec /rails/script/admin/prepare-backup

test/controllers/accounts/custom_styles_controller_test.rb

@@ -5,6 +5,34 @@ class Accounts::CustomStylesControllerTest < ActionDispatch::IntegrationTest
     sign_in :david
   end
 
+  test "show serves custom styles as plain CSS" do
+    accounts(:signal).update! custom_styles: ":root { --color-text: red; }"
+
+    get account_custom_styles_url
+    assert_response :ok
+    assert_equal "text/css", @response.media_type
+    assert_equal ":root { --color-text: red; }", @response.body
+  end
+
+  test "show is accessible without authentication" do
+    accounts(:signal).update! custom_styles: ":root { --color-text: red; }"
+    reset!
+
+    get account_custom_styles_url
+    assert_response :ok
+    assert_equal "text/css", @response.media_type
+  end
+
+  test "show serves markup verbatim as inert CSS text, never HTML" do
+    payload = "</style><script>alert(1)</script>"
+    accounts(:signal).update! custom_styles: payload
+
+    get account_custom_styles_url
+    assert_response :ok
+    assert_equal "text/css", @response.media_type
+    assert_equal payload, @response.body
+  end
+
   test "edit" do
     get edit_account_custom_styles_url
     assert_response :ok

test/system/custom_styles_xss_test.rb

@@ -0,0 +1,44 @@
+require "application_system_test_case"
+
+class CustomStylesXssTest < ApplicationSystemTestCase
+  # A stored payload that breaks out of an inline <style> context and executes
+  # as HTML. Rendered inline (the old behavior) this <script> runs and sets the
+  # flag; delivered as an external text/css stylesheet it is inert text.
+  PAYLOAD = %(</style><script>window.__xss_fired = true</script>)
+
+  setup do
+    accounts(:signal).update!(custom_styles: PAYLOAD)
+    sign_in "jz@37signals.com"
+  end
+
+  test "custom styles payload loads as a stylesheet and never executes" do
+    # Navigate to the page under test explicitly (matching the writebook
+    # sibling) rather than leaning on the post-login landing page — otherwise
+    # this coverage could silently evaporate if that landing changes.
+    visit root_url
+
+    # (a) custom styles arrive via an external stylesheet link, not inline markup
+    assert_selector "link[rel='stylesheet'][href*='custom_styles']", visible: false
+
+    # (b) the payload's <script> never executed — no breakout from CSS context
+    assert_nil evaluate_script("window.__xss_fired")
+
+    # (b') and it injected no live <script> element into the document
+    assert_no_selector "script", text: "__xss_fired", visible: false
+
+    # (c) the browser fetched the payload verbatim as text/css, so it is styled,
+    #     never parsed as HTML
+    fetched = page.evaluate_async_script(<<~JS)
+      var done = arguments[arguments.length - 1];
+      var href = document.querySelector("link[rel='stylesheet'][href*='custom_styles']").href;
+      fetch(href).then(function(r) {
+        return r.text().then(function(body) {
+          done({ type: r.headers.get("content-type"), body: body });
+        });
+      });
+    JS
+
+    assert_includes fetched["type"], "text/css"
+    assert_includes fetched["body"], PAYLOAD
+  end
+end