Merge branch 'master' into loofah

Conflicts:
	actionpack/CHANGELOG.md

4 files changed, 108 insertions, 73 deletions

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index ac9e5effe2..83ac62a83d 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -3,6 +3,7 @@ require 'active_support/core_ext/module/attribute_accessors'
 require 'active_support/core_ext/object/blank'
 require 'active_support/key_generator'
 require 'active_support/message_verifier'
+require 'active_support/json'
 
 module ActionDispatch
   class Request < Rack::Request
@@ -90,6 +91,7 @@ module ActionDispatch
     SECRET_TOKEN = "action_dispatch.secret_token".freeze
     SECRET_KEY_BASE = "action_dispatch.secret_key_base".freeze
     COOKIES_SERIALIZER = "action_dispatch.cookies_serializer".freeze
+    COOKIES_DIGEST = "action_dispatch.cookies_digest".freeze
 
     # Cookies can typically store 4096 bytes.
     MAX_COOKIE_SIZE = 4096
@@ -173,10 +175,14 @@ module ActionDispatch
       end
     end
 
+    # Passing the ActiveSupport::MessageEncryptor::NullSerializer downstream
+    # to the Message{Encryptor,Verifier} allows us to handle the
+    # (de)serialization step within the cookie jar, which gives us the
+    # opportunity to detect and migrate legacy cookies.
     module VerifyAndUpgradeLegacySignedMessage
       def initialize(*args)
         super
-        @legacy_verifier = ActiveSupport::MessageVerifier.new(@options[:secret_token], serializer: NullSerializer)
+        @legacy_verifier = ActiveSupport::MessageVerifier.new(@options[:secret_token], serializer: ActiveSupport::MessageEncryptor::NullSerializer)
       end
 
       def verify_and_upgrade_legacy_signed_message(name, signed_message)
@@ -212,7 +218,8 @@ module ActionDispatch
           secret_token: env[SECRET_TOKEN],
           secret_key_base: env[SECRET_KEY_BASE],
           upgrade_legacy_signed_cookies: env[SECRET_TOKEN].present? && env[SECRET_KEY_BASE].present?,
-          serializer: env[COOKIES_SERIALIZER]
+          serializer: env[COOKIES_SERIALIZER],
+          digest: env[COOKIES_DIGEST]
         }
       end
 
@@ -385,24 +392,11 @@ module ActionDispatch
 
     class JsonSerializer
       def self.load(value)
-        JSON.parse(value, quirks_mode: true)
+        ActiveSupport::JSON.decode(value)
       end
 
       def self.dump(value)
-        JSON.generate(value, quirks_mode: true)
-      end
-    end
-
-    # Passing the NullSerializer downstream to the Message{Encryptor,Verifier}
-    # allows us to handle the (de)serialization step within the cookie jar,
-    # which gives us the opportunity to detect and migrate legacy cookies.
-    class NullSerializer
-      def self.load(value)
-        value
-      end
-
-      def self.dump(value)
-        value
+        ActiveSupport::JSON.encode(value)
       end
     end
 
@@ -441,6 +435,10 @@ module ActionDispatch
             serializer
           end
         end
+
+        def digest
+          @options[:digest] || 'SHA1'
+        end
     end
 
     class SignedCookieJar #:nodoc:
@@ -451,7 +449,7 @@ module ActionDispatch
         @parent_jar = parent_jar
         @options = options
         secret = key_generator.generate_key(@options[:signed_cookie_salt])
-        @verifier = ActiveSupport::MessageVerifier.new(secret, serializer: NullSerializer)
+        @verifier = ActiveSupport::MessageVerifier.new(secret, digest: digest, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
       end
 
       def [](name)
@@ -508,7 +506,7 @@ module ActionDispatch
         @options = options
         secret = key_generator.generate_key(@options[:encrypted_cookie_salt])
         sign_secret = key_generator.generate_key(@options[:encrypted_signed_cookie_salt])
-        @encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret, serializer: NullSerializer)
+        @encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret, digest: digest, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
       end
 
       def [](name)
diff --git a/actionpack/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb b/actionpack/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb
index 36b01bf952..c0b53068f7 100644
--- a/actionpack/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb
+++ b/actionpack/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb
@@ -3,7 +3,7 @@ Rails.root: <%= defined?(Rails) && Rails.respond_to?(:root) ? Rails.root : "unse
 <% @traces.each do |name, trace| %>
 <% if trace.any? %>
 <%= name %>
-<%= trace.map(&:trace).join("\n") %>
+<%= trace.map { |t| t[:trace] }.join("\n") %>
 
 <% end %>
 <% end %>
diff --git a/actionpack/lib/action_dispatch/routing/mapper.rb b/actionpack/lib/action_dispatch/routing/mapper.rb
index cd94f35e8f..e92baa5aa7 100644
--- a/actionpack/lib/action_dispatch/routing/mapper.rb
+++ b/actionpack/lib/action_dispatch/routing/mapper.rb
@@ -63,7 +63,7 @@ module ActionDispatch
         attr_reader :requirements, :conditions, :defaults
         attr_reader :to, :default_controller, :default_action, :as, :anchor
 
-        def self.build(scope, set, path, options)
+        def self.build(scope, set, path, as, options)
           options = scope[:options].merge(options) if scope[:options]
 
           options.delete :only
@@ -74,10 +74,10 @@ module ActionDispatch
 
           defaults = (scope[:defaults] || {}).merge options.delete(:defaults) || {}
 
-          new scope, set, path, defaults, options
+          new scope, set, path, defaults, as, options
         end
 
-        def initialize(scope, set, path, defaults, options)
+        def initialize(scope, set, path, defaults, as, options)
           @requirements, @conditions = {}, {}
           @defaults = defaults
           @set = set
@@ -85,7 +85,7 @@ module ActionDispatch
           @to                 = options.delete :to
           @default_controller = options.delete(:controller) || scope[:controller]
           @default_action     = options.delete(:action) || scope[:action]
-          @as                 = options.delete :as
+          @as                 = as
           @anchor             = options.delete :anchor
 
           formatted = options.delete :format
@@ -1046,8 +1046,6 @@ module ActionDispatch
         VALID_ON_OPTIONS  = [:new, :collection, :member]
         RESOURCE_OPTIONS  = [:as, :controller, :path, :only, :except, :param, :concerns]
         CANONICAL_ACTIONS = %w(index create new show update destroy)
-        RESOURCE_METHOD_SCOPES = [:collection, :member, :new]
-        RESOURCE_SCOPES = [:resource, :resources]
 
         class Resource #:nodoc:
           attr_reader :controller, :path, :options, :param
@@ -1521,7 +1519,7 @@ module ActionDispatch
           if on = options.delete(:on)
             send(on) { decomposed_match(path, options) }
           else
-            case @scope[:scope_level]
+            case @scope.scope_level
             when :resources
               nested { decomposed_match(path, options) }
             when :resource
@@ -1544,13 +1542,13 @@ module ActionDispatch
             action = nil
           end
 
-          if !options.fetch(:as, true) # if it's set to nil or false
-            options.delete(:as)
-          else
-            options[:as] = name_for_action(options[:as], action)
-          end
+          as = if !options.fetch(:as, true) # if it's set to nil or false
+                 options.delete(:as)
+               else
+                 name_for_action(options.delete(:as), action)
+               end
 
-          mapping = Mapping.build(@scope, @set, URI.parser.escape(path), options)
+          mapping = Mapping.build(@scope, @set, URI.parser.escape(path), as, options)
           app, conditions, requirements, defaults, as, anchor = mapping.to_route
           @set.add_route(app, conditions, requirements, defaults, as, anchor)
         end
@@ -1564,7 +1562,7 @@ module ActionDispatch
             raise ArgumentError, "must be called with a path and/or options"
           end
 
-          if @scope[:scope_level] == :resources
+          if @scope.resources?
             with_scope_level(:root) do
               scope(parent_resource.path) do
                 super(options)
@@ -1631,15 +1629,15 @@ module ActionDispatch
           end
 
           def resource_scope? #:nodoc:
-            RESOURCE_SCOPES.include? @scope[:scope_level]
+            @scope.resource_scope?
           end
 
           def resource_method_scope? #:nodoc:
-            RESOURCE_METHOD_SCOPES.include? @scope[:scope_level]
+            @scope.resource_method_scope?
           end
 
           def nested_scope? #:nodoc:
-            @scope[:scope_level] == :nested
+            @scope.nested?
           end
 
           def with_exclusive_scope
@@ -1655,7 +1653,7 @@ module ActionDispatch
           end
 
           def with_scope_level(kind)
-            @scope = @scope.new(:scope_level => kind)
+            @scope = @scope.new_level(kind)
             yield
           ensure
             @scope = @scope.parent
@@ -1699,8 +1697,8 @@ module ActionDispatch
             @scope[:constraints][parent_resource.param]
           end
 
-          def canonical_action?(action, flag) #:nodoc:
-            flag && resource_method_scope? && CANONICAL_ACTIONS.include?(action.to_s)
+          def canonical_action?(action) #:nodoc:
+            resource_method_scope? && CANONICAL_ACTIONS.include?(action.to_s)
           end
 
           def shallow_scope(path, options = {}) #:nodoc:
@@ -1714,7 +1712,7 @@ module ActionDispatch
           end
 
           def path_for_action(action, path) #:nodoc:
-            if canonical_action?(action, path.blank?)
+            if path.blank? && canonical_action?(action)
               @scope[:path].to_s
             else
               "#{@scope[:path]}/#{action_path(action, path)}"
@@ -1729,15 +1727,17 @@ module ActionDispatch
           def prefix_name_for_action(as, action) #:nodoc:
             if as
               prefix = as
-            elsif !canonical_action?(action, @scope[:scope_level])
+            elsif !canonical_action?(action)
               prefix = action
             end
-            prefix.to_s.tr('-', '_') if prefix
+
+            if prefix && prefix != '/' && !prefix.empty?
+              Mapper.normalize_name prefix.to_s.tr('-', '_')
+            end
           end
 
           def name_for_action(as, action) #:nodoc:
             prefix = prefix_name_for_action(as, action)
-            prefix = Mapper.normalize_name(prefix) if prefix
             name_prefix = @scope[:as]
 
             if parent_resource
@@ -1747,22 +1747,9 @@ module ActionDispatch
               member_name = parent_resource.member_name
             end
 
-            name = case @scope[:scope_level]
-            when :nested
-              [name_prefix, prefix]
-            when :collection
-              [prefix, name_prefix, collection_name]
-            when :new
-              [prefix, :new, name_prefix, member_name]
-            when :member
-              [prefix, name_prefix, member_name]
-            when :root
-              [name_prefix, collection_name, prefix]
-            else
-              [name_prefix, member_name, prefix]
-            end
+            name = @scope.action_name(name_prefix, prefix, collection_name, member_name)
 
-            if candidate = name.select(&:present?).join("_").presence
+            if candidate = name.compact.join("_").presence
               # If a name was not explicitly given, we check if it is valid
               # and return nil in case it isn't. Otherwise, we pass the invalid name
               # forward so the underlying router engine treats it and raises an exception.
@@ -1897,11 +1884,48 @@ module ActionDispatch
                    :controller, :action, :path_names, :constraints,
                    :shallow, :blocks, :defaults, :options]
 
-        attr_reader :parent
+        RESOURCE_SCOPES = [:resource, :resources]
+        RESOURCE_METHOD_SCOPES = [:collection, :member, :new]
+
+        attr_reader :parent, :scope_level
 
-        def initialize(hash, parent = {})
+        def initialize(hash, parent = {}, scope_level = nil)
           @hash = hash
           @parent = parent
+          @scope_level = scope_level
+        end
+
+        def nested?
+          scope_level == :nested
+        end
+
+        def resources?
+          scope_level == :resources
+        end
+
+        def resource_method_scope?
+          RESOURCE_METHOD_SCOPES.include? scope_level
+        end
+
+        def action_name(name_prefix, prefix, collection_name, member_name)
+          case scope_level
+          when :nested
+            [name_prefix, prefix]
+          when :collection
+            [prefix, name_prefix, collection_name]
+          when :new
+            [prefix, :new, name_prefix, member_name]
+          when :member
+            [prefix, name_prefix, member_name]
+          when :root
+            [name_prefix, collection_name, prefix]
+          else
+            [name_prefix, member_name, prefix]
+          end
+        end
+
+        def resource_scope?
+          RESOURCE_SCOPES.include? scope_level
         end
 
         def options
@@ -1909,7 +1933,15 @@ module ActionDispatch
         end
 
         def new(hash)
-          self.class.new hash, self
+          self.class.new hash, self, scope_level
+        end
+
+        def new_level(level)
+          self.class.new(self, self, level)
+        end
+
+        def fetch(key, &block)
+          @hash.fetch(key, &block)
         end
 
         def [](key)
diff --git a/actionpack/lib/action_dispatch/routing/polymorphic_routes.rb b/actionpack/lib/action_dispatch/routing/polymorphic_routes.rb
index bd3696cda1..cd8b1ab066 100644
--- a/actionpack/lib/action_dispatch/routing/polymorphic_routes.rb
+++ b/actionpack/lib/action_dispatch/routing/polymorphic_routes.rb
@@ -142,22 +142,27 @@ module ActionDispatch
 
       %w(edit new).each do |action|
         module_eval <<-EOT, __FILE__, __LINE__ + 1
-          def #{action}_polymorphic_url(record_or_hash, options = {})         # def edit_polymorphic_url(record_or_hash, options = {})
-            polymorphic_url(                                                  #   polymorphic_url(
-              record_or_hash,                                                 #     record_or_hash,
-              options.merge(:action => "#{action}"))                          #     options.merge(:action => "edit"))
-          end                                                                 # end
-                                                                              #
-          def #{action}_polymorphic_path(record_or_hash, options = {})        # def edit_polymorphic_path(record_or_hash, options = {})
-            polymorphic_url(                                                  #   polymorphic_url(
-              record_or_hash,                                                 #     record_or_hash,
-              options.merge(:action => "#{action}", :routing_type => :path))  #     options.merge(:action => "edit", :routing_type => :path))
-          end                                                                 # end
+          def #{action}_polymorphic_url(record_or_hash, options = {})
+            polymorphic_url_for_action("#{action}", record_or_hash, options)
+          end
+
+          def #{action}_polymorphic_path(record_or_hash, options = {})
+            polymorphic_path_for_action("#{action}", record_or_hash, options)
+          end
         EOT
       end
 
       private
 
+      def polymorphic_url_for_action(action, record_or_hash, options)
+        polymorphic_url(record_or_hash, options.merge(:action => action))
+      end
+
+      def polymorphic_path_for_action(action, record_or_hash, options)
+        options = options.merge(:action => action, :routing_type => :path)
+        polymorphic_path(record_or_hash, options)
+      end
+
       class HelperMethodBuilder # :nodoc:
         CACHE = { 'path' => {}, 'url' => {} }