Merge branch 'master' of github.com:rails/rails

24 files changed, 380 insertions, 51 deletions

diff --git a/actionpack/test/abstract/callbacks_test.rb b/actionpack/test/abstract/callbacks_test.rb
index 1090af3060..8cba049485 100644
--- a/actionpack/test/abstract/callbacks_test.rb
+++ b/actionpack/test/abstract/callbacks_test.rb
@@ -259,7 +259,7 @@ module AbstractController
     end
 
     class TestCallbacksWithArgs < ActiveSupport::TestCase
-      test "callbacks still work when invoking process with multiple args" do
+      test "callbacks still work when invoking process with multiple arguments" do
         controller = CallbacksWithArgs.new
         controller.process(:index, " Howdy!")
         assert_equal "Hello world Howdy!", controller.response_body
diff --git a/actionpack/test/abstract/collector_test.rb b/actionpack/test/abstract/collector_test.rb
index c14d24905b..5709ad0378 100644
--- a/actionpack/test/abstract/collector_test.rb
+++ b/actionpack/test/abstract/collector_test.rb
@@ -42,7 +42,7 @@ module AbstractController
         end
       end
 
-      test "generated methods call custom with args received" do
+      test "generated methods call custom with arguments received" do
         collector = MyCollector.new
         collector.html
         collector.text(:foo)
diff --git a/actionpack/test/abstract/layouts_test.rb b/actionpack/test/abstract/layouts_test.rb
index 558a45b87f..92baad4523 100644
--- a/actionpack/test/abstract/layouts_test.rb
+++ b/actionpack/test/abstract/layouts_test.rb
@@ -72,13 +72,21 @@ module AbstractControllerTests
     end
 
     class WithProc < Base
-      layout proc { |c| "overwrite" }
+      layout proc { "overwrite" }
 
       def index
         render :template => ActionView::Template::Text.new("Hello proc!")
       end
     end
 
+    class WithProcReturningNil < Base
+      layout proc { nil }
+
+      def index
+        render template: ActionView::Template::Text.new("Hello nil!")
+      end
+    end
+
     class WithZeroArityProc < Base
       layout proc { "overwrite" }
 
@@ -249,6 +257,12 @@ module AbstractControllerTests
         assert_equal "Overwrite Hello proc!", controller.response_body
       end
 
+      test "when layout is specified as a proc and the proc retuns nil, don't use a layout" do
+        controller = WithProcReturningNil.new
+        controller.process(:index)
+        assert_equal "Hello nil!", controller.response_body
+      end
+
       test "when layout is specified as a proc without parameters it works just the same" do
         controller = WithZeroArityProc.new
         controller.process(:index)
diff --git a/actionpack/test/controller/base_test.rb b/actionpack/test/controller/base_test.rb
index 9b42e7631f..d4f18d55a6 100644
--- a/actionpack/test/controller/base_test.rb
+++ b/actionpack/test/controller/base_test.rb
@@ -68,6 +68,12 @@ class RecordIdentifierWithoutDeprecationController < ActionController::Base
   include ActionView::RecordIdentifier
 end
 
+class ActionMissingController < ActionController::Base
+  def action_missing(action)
+    render :text => "Response for #{action}"
+  end
+end
+
 class ControllerClassTests < ActiveSupport::TestCase
 
   def test_controller_path
@@ -186,6 +192,12 @@ class PerformActionTest < ActionController::TestCase
     assert_raise(AbstractController::ActionNotFound) { get :hidden_action }
     assert_raise(AbstractController::ActionNotFound) { get :another_hidden_action }
   end
+
+  def test_action_missing_should_work
+    use_controller ActionMissingController
+    get :arbitrary_action
+    assert_equal "Response for arbitrary_action", @response.body
+  end
 end
 
 class UrlOptionsTest < ActionController::TestCase
diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb
index 537de7a2dd..4287856550 100644
--- a/actionpack/test/controller/http_digest_authentication_test.rb
+++ b/actionpack/test/controller/http_digest_authentication_test.rb
@@ -249,6 +249,14 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
     assert_equal 'Definitely Maybe', @response.body
   end
 
+  test "when sent a basic auth header, returns Unauthorized" do
+    @request.env['HTTP_AUTHORIZATION'] = 'Basic Gwf2aXq8ZLF3Hxq='
+
+    get :display
+
+    assert_response :unauthorized
+  end
+
   private
 
   def encode_credentials(options)
diff --git a/actionpack/test/controller/integration_test.rb b/actionpack/test/controller/integration_test.rb
index 72b882539c..c3bdf74d93 100644
--- a/actionpack/test/controller/integration_test.rb
+++ b/actionpack/test/controller/integration_test.rb
@@ -573,6 +573,21 @@ class MetalIntegrationTest < ActionDispatch::IntegrationTest
   def test_generate_url_without_controller
     assert_equal 'http://www.example.com/foo', url_for(:controller => "foo")
   end
+
+  def test_pass_headers
+    get "/success", {}, "Referer" => "http://www.example.com/foo", "Host" => "http://nohost.com"
+
+    assert_equal "http://nohost.com", @request.env["HTTP_HOST"]
+    assert_equal "http://www.example.com/foo", @request.env["HTTP_REFERER"]
+  end
+
+  def test_pass_env
+    get "/success", {}, "HTTP_REFERER" => "http://test.com/", "HTTP_HOST" => "http://test.com"
+
+    assert_equal "http://test.com", @request.env["HTTP_HOST"]
+    assert_equal "http://test.com/", @request.env["HTTP_REFERER"]
+  end
+
 end
 
 class ApplicationIntegrationTest < ActionDispatch::IntegrationTest
diff --git a/actionpack/test/controller/layout_test.rb b/actionpack/test/controller/layout_test.rb
index 71bcfd664e..34304cf640 100644
--- a/actionpack/test/controller/layout_test.rb
+++ b/actionpack/test/controller/layout_test.rb
@@ -94,6 +94,18 @@ class HasOwnLayoutController < LayoutTest
   layout 'item'
 end
 
+class HasNilLayoutSymbol < LayoutTest
+  layout :nilz
+
+  def nilz
+    nil
+  end
+end
+
+class HasNilLayoutProc < LayoutTest
+  layout proc { nil }
+end
+
 class PrependsViewPathController < LayoutTest
   def hello
     prepend_view_path File.dirname(__FILE__) + '/../fixtures/layout_tests/alt/'
@@ -142,6 +154,18 @@ class LayoutSetInResponseTest < ActionController::TestCase
     assert_template :layout => "layouts/item"
   end
 
+  def test_layout_symbol_set_in_controller_returning_nil_falls_back_to_default
+    @controller = HasNilLayoutSymbol.new
+    get :hello
+    assert_template layout: "layouts/layout_test"
+  end
+
+  def test_layout_proc_set_in_controller_returning_nil_falls_back_to_default
+    @controller = HasNilLayoutProc.new
+    get :hello
+    assert_template layout: "layouts/layout_test"
+  end
+
   def test_layout_only_exception_when_included
     @controller = OnlyLayoutController.new
     get :hello
diff --git a/actionpack/test/controller/live_stream_test.rb b/actionpack/test/controller/live_stream_test.rb
index 3b1a07d7af..5755444a65 100644
--- a/actionpack/test/controller/live_stream_test.rb
+++ b/actionpack/test/controller/live_stream_test.rb
@@ -48,6 +48,10 @@ module ActionController
         end
         response.stream.close
       end
+
+      def with_stale
+        render :text => 'stale' if stale?(:etag => "123")
+      end
     end
 
     tests TestController
@@ -117,5 +121,16 @@ module ActionController
       assert_equal 'zomg', response.body
       assert response.stream.closed?, 'stream should be closed'
     end
+
+    def test_stale_without_etag
+      get :with_stale
+      assert_equal 200, @response.status.to_i
+    end
+
+    def test_stale_with_etag
+      @request.if_none_match = Digest::MD5.hexdigest("123")
+      get :with_stale
+      assert_equal 304, @response.status.to_i
+    end
   end
 end
diff --git a/actionpack/test/controller/localized_templates_test.rb b/actionpack/test/controller/localized_templates_test.rb
index bac1d02977..6b02eedaed 100644
--- a/actionpack/test/controller/localized_templates_test.rb
+++ b/actionpack/test/controller/localized_templates_test.rb
@@ -25,4 +25,13 @@ class LocalizedTemplatesTest < ActionController::TestCase
   ensure
     I18n.locale = old_locale
   end
+
+  def test_use_fallback_locales
+    I18n.locale = :"de-AT"
+    I18n.backend.class.send(:include, I18n::Backend::Fallbacks)
+    I18n.fallbacks[:"de-AT"] = [:de]
+
+    get :hello_world
+    assert_equal "Gutten Tag", @response.body
+  end
 end
diff --git a/actionpack/test/controller/output_escaping_test.rb b/actionpack/test/controller/output_escaping_test.rb
index 43a8c05cda..c3c549fbfc 100644
--- a/actionpack/test/controller/output_escaping_test.rb
+++ b/actionpack/test/controller/output_escaping_test.rb
@@ -11,8 +11,6 @@ class OutputEscapingTest < ActiveSupport::TestCase
   end
 
   test "escapeHTML shouldn't touch explicitly safe strings" do
-    # TODO this seems easier to compose and reason about, but
-    # this should be verified
     assert_equal "<", ERB::Util.h("<".html_safe)
   end
 
diff --git a/actionpack/test/controller/routing_test.rb b/actionpack/test/controller/routing_test.rb
index 93e94f0f48..978c5aa7ac 100644
--- a/actionpack/test/controller/routing_test.rb
+++ b/actionpack/test/controller/routing_test.rb
@@ -908,12 +908,13 @@ class RouteSetTest < ActiveSupport::TestCase
     assert_equal set.routes.first, set.named_routes[:hello]
   end
 
-  def test_earlier_named_routes_take_precedence
-    set.draw do
-      get '/hello/world' => 'a#b', :as => 'hello'
-      get '/hello'       => 'a#b', :as => 'hello'
+  def test_duplicate_named_route_raises_rather_than_pick_precedence
+    assert_raise ArgumentError do
+      set.draw do
+        get '/hello/world' => 'a#b', :as => 'hello'
+        get '/hello'       => 'a#b', :as => 'hello'
+      end
     end
-    assert_equal set.routes.first, set.named_routes[:hello]
   end
 
   def setup_named_route_test
diff --git a/actionpack/test/controller/test_case_test.rb b/actionpack/test/controller/test_case_test.rb
index df31338f09..38b9794b4d 100644
--- a/actionpack/test/controller/test_case_test.rb
+++ b/actionpack/test/controller/test_case_test.rb
@@ -57,6 +57,10 @@ class TestCaseTest < ActionController::TestCase
       render :text => request.protocol
     end
 
+    def test_headers
+      render text: request.headers.env.to_json
+    end
+
     def test_html_output
       render :text => <<HTML
 <html>
@@ -626,6 +630,24 @@ XML
     assert_equal 2004, page[:year]
   end
 
+  test "set additional HTTP headers" do
+    @request.headers['Referer'] = "http://nohost.com/home"
+    @request.headers['Content-Type'] = "application/rss+xml"
+    get :test_headers
+    parsed_env = JSON.parse(@response.body)
+    assert_equal "http://nohost.com/home", parsed_env["HTTP_REFERER"]
+    assert_equal "application/rss+xml", parsed_env["CONTENT_TYPE"]
+  end
+
+  test "set additional env variables" do
+    @request.headers['HTTP_REFERER'] = "http://example.com/about"
+    @request.headers['CONTENT_TYPE'] = "application/json"
+    get :test_headers
+    parsed_env = JSON.parse(@response.body)
+    assert_equal "http://example.com/about", parsed_env["HTTP_REFERER"]
+    assert_equal "application/json", parsed_env["CONTENT_TYPE"]
+  end
+
   def test_id_converted_to_string
     get :test_params, :id => 20, :foo => Object.new
     assert_kind_of String, @request.path_parameters['id']
diff --git a/actionpack/test/dispatch/cookies_test.rb b/actionpack/test/dispatch/cookies_test.rb
index 5ada5a7603..c532e0b8cc 100644
--- a/actionpack/test/dispatch/cookies_test.rb
+++ b/actionpack/test/dispatch/cookies_test.rb
@@ -1,6 +1,15 @@
 require 'abstract_unit'
+
+begin
+  require 'openssl'
+  OpenSSL::PKCS5
+rescue LoadError, NameError
+  $stderr.puts "Skipping KeyGenerator test: broken OpenSSL install"
+else
+
 # FIXME remove DummyKeyGenerator and this require in 4.1
 require 'active_support/key_generator'
+require 'active_support/message_verifier'
 
 class CookiesTest < ActionController::TestCase
   class TestController < ActionController::Base
@@ -67,6 +76,11 @@ class CookiesTest < ActionController::TestCase
       head :ok
     end
 
+    def get_signed_cookie
+      cookies.signed[:user_id]
+      head :ok
+    end
+
     def set_encrypted_cookie
       cookies.encrypted[:foo] = 'bar'
       head :ok
@@ -421,6 +435,55 @@ class CookiesTest < ActionController::TestCase
     }
   end
 
+  def test_signed_uses_signed_cookie_jar_if_only_secret_token_is_set
+    @request.env["action_dispatch.secret_token"] = "b3c631c314c0bbca50c1b2843150fe33"
+    @request.env["action_dispatch.secret_key_base"] = nil
+    get :set_signed_cookie
+    assert_kind_of ActionDispatch::Cookies::SignedCookieJar, cookies.signed
+  end
+
+  def test_signed_uses_signed_cookie_jar_if_only_secret_key_base_is_set
+    @request.env["action_dispatch.secret_token"] = nil
+    @request.env["action_dispatch.secret_key_base"] = "c3b95688f35581fad38df788add315ff"
+    get :set_signed_cookie
+    assert_kind_of ActionDispatch::Cookies::SignedCookieJar, cookies.signed
+  end
+
+  def test_signed_uses_upgrade_legacy_signed_cookie_jar_if_both_secret_token_and_secret_key_base_are_set
+    @request.env["action_dispatch.secret_token"] = "b3c631c314c0bbca50c1b2843150fe33"
+    @request.env["action_dispatch.secret_key_base"] = "c3b95688f35581fad38df788add315ff"
+    get :set_signed_cookie
+    assert_kind_of ActionDispatch::Cookies::UpgradeLegacySignedCookieJar, cookies.signed
+  end
+
+  def test_legacy_signed_cookie_is_read_and_transparently_upgraded_if_both_secret_token_and_secret_key_base_are_set
+    @request.env["action_dispatch.secret_token"] = "b3c631c314c0bbca50c1b2843150fe33"
+    @request.env["action_dispatch.secret_key_base"] = "c3b95688f35581fad38df788add315ff"
+
+    legacy_value = ActiveSupport::MessageVerifier.new("b3c631c314c0bbca50c1b2843150fe33").generate(45)
+
+    @request.headers["Cookie"] = "user_id=#{legacy_value}"
+    get :get_signed_cookie
+
+    assert_equal 45, @controller.send(:cookies).signed[:user_id]
+
+    key_generator = @request.env["action_dispatch.key_generator"]
+    secret = key_generator.generate_key(@request.env["action_dispatch.signed_cookie_salt"])
+    verifier = ActiveSupport::MessageVerifier.new(secret)
+    assert_equal 45, verifier.verify(@response.cookies["user_id"])
+  end
+
+  def test_legacy_signed_cookie_is_nil_if_tampered
+    @request.env["action_dispatch.secret_token"] = "b3c631c314c0bbca50c1b2843150fe33"
+    @request.env["action_dispatch.secret_key_base"] = "c3b95688f35581fad38df788add315ff"
+
+    @request.headers["Cookie"] = "user_id=45"
+    get :get_signed_cookie
+
+    assert_equal nil, @controller.send(:cookies).signed[:user_id]
+    assert_equal nil, @response.cookies["user_id"]
+  end
+
   def test_cookie_with_all_domain_option
     get :set_cookie_with_domain
     assert_response :success
@@ -669,3 +732,5 @@ class CookiesTest < ActionController::TestCase
       end
     end
 end
+
+end
diff --git a/actionpack/test/dispatch/header_test.rb b/actionpack/test/dispatch/header_test.rb
index 42432510c3..9e37b96951 100644
--- a/actionpack/test/dispatch/header_test.rb
+++ b/actionpack/test/dispatch/header_test.rb
@@ -1,41 +1,137 @@
-require 'abstract_unit'
+require "abstract_unit"
 
 class HeaderTest < ActiveSupport::TestCase
-  def setup
+  setup do
     @headers = ActionDispatch::Http::Headers.new(
-      "HTTP_CONTENT_TYPE" => "text/plain"
+      "CONTENT_TYPE" => "text/plain",
+      "HTTP_REFERER" => "/some/page"
     )
   end
 
-  def test_each
+  test "#new does not normalize the data" do
+    headers = ActionDispatch::Http::Headers.new(
+      "Content-Type" => "application/json",
+      "HTTP_REFERER" => "/some/page",
+      "Host" => "http://test.com")
+
+    assert_equal({"Content-Type" => "application/json",
+                  "HTTP_REFERER" => "/some/page",
+                  "Host" => "http://test.com"}, headers.env)
+  end
+
+  test "#env returns the headers as env variables" do
+    assert_equal({"CONTENT_TYPE" => "text/plain",
+                  "HTTP_REFERER" => "/some/page"}, @headers.env)
+  end
+
+  test "#each iterates through the env variables" do
     headers = []
     @headers.each { |pair| headers << pair }
-    assert_equal [["HTTP_CONTENT_TYPE", "text/plain"]], headers
+    assert_equal [["CONTENT_TYPE", "text/plain"],
+                  ["HTTP_REFERER", "/some/page"]], headers
+  end
+
+  test "set new headers" do
+    @headers["Host"] = "127.0.0.1"
+
+    assert_equal "127.0.0.1", @headers["Host"]
+    assert_equal "127.0.0.1", @headers["HTTP_HOST"]
+  end
+
+  test "headers can contain numbers" do
+    @headers["Content-MD5"] = "Q2hlY2sgSW50ZWdyaXR5IQ=="
+
+    assert_equal "Q2hlY2sgSW50ZWdyaXR5IQ==", @headers["Content-MD5"]
+    assert_equal "Q2hlY2sgSW50ZWdyaXR5IQ==", @headers["HTTP_CONTENT_MD5"]
+  end
+
+  test "set new env variables" do
+    @headers["HTTP_HOST"] = "127.0.0.1"
+
+    assert_equal "127.0.0.1", @headers["Host"]
+    assert_equal "127.0.0.1", @headers["HTTP_HOST"]
   end
 
-  def test_setter
-    @headers['foo'] = "bar"
-    assert_equal "bar", @headers['foo']
+  test "key?" do
+    assert @headers.key?("CONTENT_TYPE")
+    assert @headers.include?("CONTENT_TYPE")
   end
 
-  def test_key?
-    assert @headers.key?('HTTP_CONTENT_TYPE')
-    assert @headers.include?('HTTP_CONTENT_TYPE')
+  test "fetch with block" do
+    assert_equal "omg", @headers.fetch("notthere") { "omg" }
   end
 
-  def test_fetch_with_block
-    assert_equal 'omg', @headers.fetch('notthere') { 'omg' }
+  test "accessing http header" do
+    assert_equal "/some/page", @headers["Referer"]
+    assert_equal "/some/page", @headers["referer"]
+    assert_equal "/some/page", @headers["HTTP_REFERER"]
   end
 
-  test "content type" do
+  test "accessing special header" do
     assert_equal "text/plain", @headers["Content-Type"]
     assert_equal "text/plain", @headers["content-type"]
     assert_equal "text/plain", @headers["CONTENT_TYPE"]
-    assert_equal "text/plain", @headers["HTTP_CONTENT_TYPE"]
   end
 
   test "fetch" do
     assert_equal "text/plain", @headers.fetch("content-type", nil)
-    assert_equal "not found", @headers.fetch('not-found', 'not found')
+    assert_equal "not found", @headers.fetch("not-found", "not found")
+  end
+
+  test "#merge! headers with mutation" do
+    @headers.merge!("Host" => "http://example.test",
+                    "Content-Type" => "text/html")
+    assert_equal({"HTTP_HOST" => "http://example.test",
+                  "CONTENT_TYPE" => "text/html",
+                  "HTTP_REFERER" => "/some/page"}, @headers.env)
+  end
+
+  test "#merge! env with mutation" do
+    @headers.merge!("HTTP_HOST" => "http://first.com",
+                    "CONTENT_TYPE" => "text/html")
+    assert_equal({"HTTP_HOST" => "http://first.com",
+                  "CONTENT_TYPE" => "text/html",
+                  "HTTP_REFERER" => "/some/page"}, @headers.env)
+  end
+
+  test "merge without mutation" do
+    combined = @headers.merge("HTTP_HOST" => "http://example.com",
+                              "CONTENT_TYPE" => "text/html")
+    assert_equal({"HTTP_HOST" => "http://example.com",
+                  "CONTENT_TYPE" => "text/html",
+                  "HTTP_REFERER" => "/some/page"}, combined.env)
+
+    assert_equal({"CONTENT_TYPE" => "text/plain",
+                  "HTTP_REFERER" => "/some/page"}, @headers.env)
+  end
+
+  test "env variables with . are not modified" do
+    headers = ActionDispatch::Http::Headers.new
+    headers.merge! "rack.input" => "",
+     "rack.request.cookie_hash" => "",
+     "action_dispatch.logger" => ""
+
+    assert_equal(["action_dispatch.logger",
+                  "rack.input",
+                  "rack.request.cookie_hash"], headers.env.keys.sort)
+  end
+
+  test "symbols are treated as strings" do
+    headers = ActionDispatch::Http::Headers.new
+    headers.merge!(:SERVER_NAME => "example.com",
+                   "HTTP_REFERER" => "/",
+                   :Host => "test.com")
+    assert_equal "example.com", headers["SERVER_NAME"]
+    assert_equal "/", headers[:HTTP_REFERER]
+    assert_equal "test.com", headers["HTTP_HOST"]
+  end
+
+  test "headers directly modifies the passed environment" do
+    env = {"HTTP_REFERER" => "/"}
+    headers = ActionDispatch::Http::Headers.new(env)
+    headers['Referer'] = "http://example.com/"
+    headers.merge! "CONTENT_TYPE" => "text/plain"
+    assert_equal({"HTTP_REFERER"=>"http://example.com/",
+                  "CONTENT_TYPE"=>"text/plain"}, env)
   end
 end
diff --git a/actionpack/test/dispatch/mount_test.rb b/actionpack/test/dispatch/mount_test.rb
index 3b008fdff0..e5e28c28be 100644
--- a/actionpack/test/dispatch/mount_test.rb
+++ b/actionpack/test/dispatch/mount_test.rb
@@ -21,7 +21,7 @@ class TestRoutingMount < ActionDispatch::IntegrationTest
     mount SprocketsApp, :at => "/sprockets"
     mount SprocketsApp => "/shorthand"
 
-    mount FakeEngine, :at => "/fakeengine"
+    mount FakeEngine, :at => "/fakeengine", :as => :fake
     mount FakeEngine, :at => "/getfake", :via => :get
 
     scope "/its_a" do
diff --git a/actionpack/test/dispatch/request/multipart_params_parsing_test.rb b/actionpack/test/dispatch/request/multipart_params_parsing_test.rb
index 399f15199c..3c30a705e9 100644
--- a/actionpack/test/dispatch/request/multipart_params_parsing_test.rb
+++ b/actionpack/test/dispatch/request/multipart_params_parsing_test.rb
@@ -1,13 +1,15 @@
+# encoding: utf-8
 require 'abstract_unit'
 
 class MultipartParamsParsingTest < ActionDispatch::IntegrationTest
   class TestController < ActionController::Base
     class << self
-      attr_accessor :last_request_parameters
+      attr_accessor :last_request_parameters, :last_parameters
     end
 
     def parse
       self.class.last_request_parameters = request.request_parameters
+      self.class.last_parameters = request.parameters
       head :ok
     end
 
@@ -30,6 +32,23 @@ class MultipartParamsParsingTest < ActionDispatch::IntegrationTest
     assert_equal({ 'foo' => { 'baz' => 'bar'}}, parse_multipart('bracketed_param'))
   end
 
+  test "parse single utf8 parameter" do
+    assert_equal({ 'Iñtërnâtiônàlizætiøn_name' => 'Iñtërnâtiônàlizætiøn_value'}, 
+                 parse_multipart('single_utf8_param'), "request.request_parameters")
+    assert_equal(
+      'Iñtërnâtiônàlizætiøn_value',
+      TestController.last_parameters['Iñtërnâtiônàlizætiøn_name'], "request.parameters")
+  end
+
+  test "parse bracketed utf8 parameter" do
+    assert_equal({ 'Iñtërnâtiônàlizætiøn_name' => { 
+      'Iñtërnâtiônàlizætiøn_nested_name' => 'Iñtërnâtiônàlizætiøn_value'} }, 
+      parse_multipart('bracketed_utf8_param'), "request.request_parameters")
+    assert_equal(
+      {'Iñtërnâtiônàlizætiøn_nested_name' => 'Iñtërnâtiônàlizætiøn_value'},
+      TestController.last_parameters['Iñtërnâtiônàlizætiøn_name'], "request.parameters")
+  end
+
   test "parses text file" do
     params = parse_multipart('text_file')
     assert_equal %w(file foo), params.keys.sort
diff --git a/actionpack/test/dispatch/request/url_encoded_params_parsing_test.rb b/actionpack/test/dispatch/request/url_encoded_params_parsing_test.rb
index e9b59f55a7..9169658c22 100644
--- a/actionpack/test/dispatch/request/url_encoded_params_parsing_test.rb
+++ b/actionpack/test/dispatch/request/url_encoded_params_parsing_test.rb
@@ -164,7 +164,7 @@ class UrlEncodedParamsParsingTest < ActionDispatch::IntegrationTest
         return
       end
 
-      object.each do |k,v|
+      object.each_value do |v|
         case v
         when Hash
           assert_utf8(v)
diff --git a/actionpack/test/dispatch/routing_test.rb b/actionpack/test/dispatch/routing_test.rb
index 2bf7056ff7..df359ba77d 100644
--- a/actionpack/test/dispatch/routing_test.rb
+++ b/actionpack/test/dispatch/routing_test.rb
@@ -2577,22 +2577,6 @@ class TestRoutingMapper < ActionDispatch::IntegrationTest
     assert_raises(ActionController::UrlGenerationError){ list_todo_path(:list_id => '2', :id => '1') }
   end
 
-  def test_named_routes_collision_is_avoided_unless_explicitly_given_as
-    draw do
-      scope :as => "routes" do
-        get "/c/:id", :as => :collision, :to => "collision#show"
-        get "/collision", :to => "collision#show"
-        get "/no_collision", :to => "collision#show", :as => nil
-
-        get "/fc/:id", :as => :forced_collision, :to => "forced_collision#show"
-        get "/forced_collision", :as => :forced_collision, :to => "forced_collision#show"
-      end
-    end
-
-    assert_equal "/c/1", routes_collision_path(1)
-    assert_equal "/fc/1", routes_forced_collision_path(1)
-  end
-
   def test_redirect_argument_error
     routes = Class.new { include ActionDispatch::Routing::Redirection }.new
     assert_raises(ArgumentError) { routes.redirect Object.new }
@@ -2604,9 +2588,6 @@ class TestRoutingMapper < ActionDispatch::IntegrationTest
         get "/c/:id", :as => :collision, :to => "collision#show"
         get "/collision", :to => "collision#show"
         get "/no_collision", :to => "collision#show", :as => nil
-
-        get "/fc/:id", :as => :forced_collision, :to => "forced_collision#show"
-        get "/forced_collision", :as => :forced_collision, :to => "forced_collision#show"
       end
     end
 
@@ -2657,6 +2638,24 @@ class TestRoutingMapper < ActionDispatch::IntegrationTest
     end
   end
 
+  def test_duplicate_route_name_raises_error
+    assert_raise(ArgumentError) do
+      draw do
+        get '/collision', :to => 'collision#show', :as => 'collision'
+        get '/duplicate', :to => 'duplicate#show', :as => 'collision'
+      end
+    end
+  end
+
+  def test_duplicate_route_name_via_resources_raises_error
+    assert_raise(ArgumentError) do
+      draw do
+        resources :collisions
+        get '/collision', :to => 'collision#show', :as => 'collision'
+      end
+    end
+  end
+
   def test_nested_route_in_nested_resource
     draw do
       resources :posts, :only => [:index, :show] do
diff --git a/actionpack/test/dispatch/url_generation_test.rb b/actionpack/test/dispatch/url_generation_test.rb
index e56e8ddc57..4123529092 100644
--- a/actionpack/test/dispatch/url_generation_test.rb
+++ b/actionpack/test/dispatch/url_generation_test.rb
@@ -48,6 +48,14 @@ module TestUrlGeneration
       https!
       assert_equal "http://www.example.com/foo", foo_url(:protocol => "http")
     end
+
+    test "extracting protocol from host when protocol not present" do
+      assert_equal "httpz://www.example.com/foo", foo_url(host: "httpz://www.example.com", protocol: nil)
+    end
+
+    test "formatting host when protocol is present" do
+      assert_equal "http://www.example.com/foo", foo_url(host: "httpz://www.example.com", protocol: "http://")
+    end
   end
 end
 
diff --git a/actionpack/test/fixtures/multipart/bracketed_utf8_param b/actionpack/test/fixtures/multipart/bracketed_utf8_param
new file mode 100644
index 0000000000..976ca44a45
--- /dev/null
+++ b/actionpack/test/fixtures/multipart/bracketed_utf8_param
@@ -0,0 +1,5 @@
+--AaB03x

+Content-Disposition: form-data; name="Iñtërnâtiônàlizætiøn_name[Iñtërnâtiônàlizætiøn_nested_name]"

+

+Iñtërnâtiônàlizætiøn_value

+--AaB03x--

diff --git a/actionpack/test/fixtures/multipart/single_utf8_param b/actionpack/test/fixtures/multipart/single_utf8_param
new file mode 100644
index 0000000000..b86f62d1e1
--- /dev/null
+++ b/actionpack/test/fixtures/multipart/single_utf8_param
@@ -0,0 +1,5 @@
+--AaB03x

+Content-Disposition: form-data; name="Iñtërnâtiônàlizætiøn_name"

+

+Iñtërnâtiônàlizætiøn_value

+--AaB03x--

diff --git a/actionpack/test/template/form_helper_test.rb b/actionpack/test/template/form_helper_test.rb
index 268bab6ad2..dff0b8bdc2 100644
--- a/actionpack/test/template/form_helper_test.rb
+++ b/actionpack/test/template/form_helper_test.rb
@@ -2791,8 +2791,8 @@ class FormHelperTest < ActionView::TestCase
   end
 
   def test_form_for_with_html_options_adds_options_to_form_tag
-    form_for(@post, html: { id: 'some_form', class: 'some_class' }) do |f| end
-    expected = whole_form("/posts/123", "some_form", "some_class", method: "patch")
+    form_for(@post, html: { id: 'some_form', class: 'some_class', multipart: true }) do |f| end
+    expected = whole_form("/posts/123", "some_form", "some_class", method: "patch", multipart: "multipart/form-data")
 
     assert_dom_equal expected, output_buffer
   end
diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb
index d9b57776c9..b1c1b83807 100644
--- a/actionpack/test/template/html-scanner/sanitizer_test.rb
+++ b/actionpack/test/template/html-scanner/sanitizer_test.rb
@@ -200,6 +200,7 @@ class SanitizerTest < ActionController::TestCase
    %(<IMG SRC="jav&#x0A;ascript:alert('XSS');">),
    %(<IMG SRC="jav&#x0D;ascript:alert('XSS');">),
    %(<IMG SRC=" &#14;  javascript:alert('XSS');">),
+   %(<IMG SRC="javascript&#x3a;alert('XSS');">),
    %(<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>)].each_with_index do |img_hack, i|
     define_method "test_should_not_fall_for_xss_image_hack_#{i+1}" do
       assert_sanitized img_hack, "<img>"
@@ -279,6 +280,11 @@ class SanitizerTest < ActionController::TestCase
     assert_equal '', sanitize_css(raw)
   end
 
+  def test_should_sanitize_across_newlines
+    raw = %(\nwidth:\nexpression(alert('XSS'));\n)
+    assert_equal '', sanitize_css(raw)
+  end
+
   def test_should_sanitize_img_vbscript
     assert_sanitized %(<img src='vbscript:msgbox("XSS")' />), '<img />'
   end
@@ -299,6 +305,15 @@ class SanitizerTest < ActionController::TestCase
     assert_sanitized "<span class=\"\\", "<span class=\"\\\">"
   end
 
+  def test_x03a
+    assert_sanitized %(<a href="javascript&#x3a;alert('XSS');">), "<a>"
+    assert_sanitized %(<a href="javascript&#x003a;alert('XSS');">), "<a>"
+    assert_sanitized %(<a href="http&#x3a;//legit">), %(<a href="http://legit">)
+    assert_sanitized %(<a href="javascript&#x3A;alert('XSS');">), "<a>"
+    assert_sanitized %(<a href="javascript&#x003A;alert('XSS');">), "<a>"
+    assert_sanitized %(<a href="http&#x3A;//legit">), %(<a href="http://legit">)
+  end
+
 protected
   def assert_sanitized(input, expected = nil)
     @sanitizer ||= HTML::WhiteListSanitizer.new
diff --git a/actionpack/test/template/url_helper_test.rb b/actionpack/test/template/url_helper_test.rb
index 5d87c96605..e359f47975 100644
--- a/actionpack/test/template/url_helper_test.rb
+++ b/actionpack/test/template/url_helper_test.rb
@@ -51,7 +51,6 @@ class UrlHelperTest < ActiveSupport::TestCase
     assert_equal 'javascript:history.back()', url_for(:back)
   end
 
-  # TODO: missing test cases
   def test_button_to_with_straight_url
     assert_dom_equal %{<form method="post" action="http://www.example.com" class="button_to"><div><input type="submit" value="Hello" /></div></form>}, button_to("Hello", "http://www.example.com")
   end