2 files changed, 21 insertions, 2 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 8bd99ac..d9cf1be 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -71,4 +71,11 @@ class AdminController < ApplicationController
       end
     end
   end
+
+  # Deliberately raises, to verify the error-log tripwire end to end.
+  # Behind login_required like the rest of the controller; harmless --
+  # the visitor gets the ordinary 500 page.
+  def boom
+    raise "Deliberate test exception via admin/boom"
+  end
 end
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
index 08cbc98..a8f8edb 100644
--- a/app/controllers/csp_reports_controller.rb
+++ b/app/controllers/csp_reports_controller.rb
@@ -3,8 +3,20 @@ class CspReportsController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   def create
-    report = request.body.read(8192)
-    Rails.logger.warn("CSP violation: #{report}") if report.present?
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      Rails.logger.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      Rails.logger.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
     head :no_content
   end
 end