Merge branch 'master' into activestorage-guide

19 files changed, 66 insertions, 29 deletions

diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index 753dd8589a..384546d7b4 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,13 @@
+*   Changed the system tests to set Puma as default server only when the
+    user haven't specified manually another server.
+
+    *Guillermo Iguaran*
+
+*   Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
+    default headers set.
+
+    *Guillermo Iguaran*
+
 *   Add headless firefox support to System Tests.
 
     *bogdanvlviv*
diff --git a/actionpack/lib/action_dispatch/http/cache.rb b/actionpack/lib/action_dispatch/http/cache.rb
index 3328ce17a0..a8febc32b3 100644
--- a/actionpack/lib/action_dispatch/http/cache.rb
+++ b/actionpack/lib/action_dispatch/http/cache.rb
@@ -133,7 +133,7 @@ module ActionDispatch
         end
 
         def generate_strong_etag(validators)
-          %("#{Digest::MD5.hexdigest(ActiveSupport::Cache.expand_cache_key(validators))}")
+          %("#{ActiveSupport::Digest.hexdigest(ActiveSupport::Cache.expand_cache_key(validators))}")
         end
 
         def cache_control_segments
diff --git a/actionpack/lib/action_dispatch/journey/nfa/dot.rb b/actionpack/lib/action_dispatch/journey/nfa/dot.rb
index bdb78d8d48..56e9e3c83d 100644
--- a/actionpack/lib/action_dispatch/journey/nfa/dot.rb
+++ b/actionpack/lib/action_dispatch/journey/nfa/dot.rb
@@ -9,16 +9,16 @@ module ActionDispatch
             "  #{from} -> #{to} [label=\"#{sym || 'ε'}\"];"
           }
 
-          #memo_nodes = memos.values.flatten.map { |n|
-          #  label = n
-          #  if Journey::Route === n
-          #    label = "#{n.verb.source} #{n.path.spec}"
-          #  end
-          #  "  #{n.object_id} [label=\"#{label}\", shape=box];"
-          #}
-          #memo_edges = memos.flat_map { |k, memos|
-          #  (memos || []).map { |v| "  #{k} -> #{v.object_id};" }
-          #}.uniq
+          # memo_nodes = memos.values.flatten.map { |n|
+          #   label = n
+          #   if Journey::Route === n
+          #     label = "#{n.verb.source} #{n.path.spec}"
+          #   end
+          #   "  #{n.object_id} [label=\"#{label}\", shape=box];"
+          # }
+          # memo_edges = memos.flat_map { |k, memos|
+          #   (memos || []).map { |v| "  #{k} -> #{v.object_id};" }
+          # }.uniq
 
           <<-eodot
 digraph nfa {
diff --git a/actionpack/lib/action_dispatch/railtie.rb b/actionpack/lib/action_dispatch/railtie.rb
index 855f2ffa47..95e99987a0 100644
--- a/actionpack/lib/action_dispatch/railtie.rb
+++ b/actionpack/lib/action_dispatch/railtie.rb
@@ -26,7 +26,9 @@ module ActionDispatch
     config.action_dispatch.default_headers = {
       "X-Frame-Options" => "SAMEORIGIN",
       "X-XSS-Protection" => "1; mode=block",
-      "X-Content-Type-Options" => "nosniff"
+      "X-Content-Type-Options" => "nosniff",
+      "X-Download-Options" => "noopen",
+      "X-Permitted-Cross-Domain-Policies" => "none"
     }
 
     config.action_dispatch.cookies_rotations = ActiveSupport::Messages::RotationConfiguration.new
diff --git a/actionpack/lib/action_dispatch/system_testing/server.rb b/actionpack/lib/action_dispatch/system_testing/server.rb
index 8f1b6725b1..4fc1f33767 100644
--- a/actionpack/lib/action_dispatch/system_testing/server.rb
+++ b/actionpack/lib/action_dispatch/system_testing/server.rb
@@ -20,7 +20,7 @@ module ActionDispatch
         end
 
         def set_server
-          Capybara.server = :puma, { Silent: self.class.silence_puma }
+          Capybara.server = :puma, { Silent: self.class.silence_puma } if Capybara.server == Capybara.servers[:default]
         end
 
         def set_port
diff --git a/actionpack/test/abstract_unit.rb b/actionpack/test/abstract_unit.rb
index 55ad9c245e..deffa63e12 100644
--- a/actionpack/test/abstract_unit.rb
+++ b/actionpack/test/abstract_unit.rb
@@ -380,7 +380,7 @@ class ForkingExecutor
   def initialize(size)
     @size  = size
     @queue = Server.new
-    file   = File.join Dir.tmpdir, Dir::Tmpname.make_tmpname("rails-tests", "fd")
+    file   = File.join Dir.tmpdir, tmpname
     @url   = "drbunix://#{file}"
     @pool  = nil
     DRb.start_service @url, @queue
@@ -422,6 +422,11 @@ class ForkingExecutor
         end
       }
     end
+
+    def tmpname
+      t = Time.now.strftime("%Y%m%d")
+      "rails-tests-#{t}-#{$$}-#{rand(0x100000000).to_s(36)}-fd"
+    end
 end
 
 if RUBY_ENGINE == "ruby" && PROCESS_COUNT > 0
diff --git a/actionpack/test/controller/live_stream_test.rb b/actionpack/test/controller/live_stream_test.rb
index 8cfb43a6bc..431fe90b23 100644
--- a/actionpack/test/controller/live_stream_test.rb
+++ b/actionpack/test/controller/live_stream_test.rb
@@ -464,7 +464,7 @@ module ActionController
     end
 
     def test_stale_with_etag
-      @request.if_none_match = %(W/"#{Digest::MD5.hexdigest('123')}")
+      @request.if_none_match = %(W/"#{ActiveSupport::Digest.hexdigest('123')}")
       get :with_stale
       assert_equal 304, response.status.to_i
     end
diff --git a/actionpack/test/controller/metal_test.rb b/actionpack/test/controller/metal_test.rb
index c235c9df86..c3ebcb22b8 100644
--- a/actionpack/test/controller/metal_test.rb
+++ b/actionpack/test/controller/metal_test.rb
@@ -9,7 +9,7 @@ class MetalControllerInstanceTests < ActiveSupport::TestCase
     end
   end
 
-  def test_response_has_default_headers
+  def test_response_does_not_have_default_headers
     original_default_headers = ActionDispatch::Response.default_headers
 
     ActionDispatch::Response.default_headers = {
diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index ebdaca0162..e9b94b056b 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -59,7 +59,7 @@ class ParametersPermitTest < ActiveSupport::TestCase
 
   test "key: permitted scalar values" do
     values  = ["a", :a, nil]
-    values += [0, 1.0, 2**128, BigDecimal.new(1)]
+    values += [0, 1.0, 2**128, BigDecimal(1)]
     values += [true, false]
     values += [Date.today, Time.now, DateTime.now]
     values += [STDOUT, StringIO.new, ActionDispatch::Http::UploadedFile.new(tempfile: __FILE__),
diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb
index 37a62edc15..7c5101f993 100644
--- a/actionpack/test/controller/render_test.rb
+++ b/actionpack/test/controller/render_test.rb
@@ -592,7 +592,7 @@ class EtagRenderTest < ActionController::TestCase
     end
 
     def strong_etag(record)
-      %("#{Digest::MD5.hexdigest(ActiveSupport::Cache.expand_cache_key(record))}")
+      %("#{ActiveSupport::Digest.hexdigest(ActiveSupport::Cache.expand_cache_key(record))}")
     end
 end
 
diff --git a/actionpack/test/controller/resources_test.rb b/actionpack/test/controller/resources_test.rb
index 3d98237003..30bea64c55 100644
--- a/actionpack/test/controller/resources_test.rb
+++ b/actionpack/test/controller/resources_test.rb
@@ -307,7 +307,7 @@ class ResourcesTest < ActionController::TestCase
         set.draw do
           resources :messages do
             member do
-              match :mark  , via: method
+              match :mark, via: method
               match :unmark, via: method
             end
           end
diff --git a/actionpack/test/controller/routing_test.rb b/actionpack/test/controller/routing_test.rb
index 71b01c36a7..ec939e946a 100644
--- a/actionpack/test/controller/routing_test.rb
+++ b/actionpack/test/controller/routing_test.rb
@@ -1687,7 +1687,7 @@ class RouteSetTest < ActiveSupport::TestCase
   def test_routes_with_symbols
     set.draw do
       get "unnamed", controller: :pages, action: :show, name: :as_symbol
-      get "named"  , controller: :pages, action: :show, name: :as_symbol, as: :named
+      get "named", controller: :pages, action: :show, name: :as_symbol, as: :named
     end
     assert_equal({ controller: "pages", action: "show", name: :as_symbol }, set.recognize_path("/unnamed"))
     assert_equal({ controller: "pages", action: "show", name: :as_symbol }, set.recognize_path("/named"))
@@ -1893,7 +1893,7 @@ class RouteSetTest < ActiveSupport::TestCase
     assert_equal({ controller: "blog",  action: "show_date", year: "2006", month: "07", day: "28" }, controller.request.path_parameters)
     assert_equal("/blog/2006/07/25", controller.url_for(day: 25, only_path: true))
     assert_equal("/blog/2005",       controller.url_for(year: 2005, only_path: true))
-    assert_equal("/blog/show/123",   controller.url_for(action: "show" , id: 123, only_path: true))
+    assert_equal("/blog/show/123",   controller.url_for(action: "show", id: 123, only_path: true))
     assert_equal("/blog/2006",       controller.url_for(year: 2006, only_path: true))
     assert_equal("/blog/2006",       controller.url_for(year: 2006, month: nil, only_path: true))
   end
diff --git a/actionpack/test/controller/url_for_integration_test.rb b/actionpack/test/controller/url_for_integration_test.rb
index a7c7356921..a1521da702 100644
--- a/actionpack/test/controller/url_for_integration_test.rb
+++ b/actionpack/test/controller/url_for_integration_test.rb
@@ -35,7 +35,6 @@ module ActionPack
         as: "blog"
 
       resources :people
-      #match 'legacy/people' => "people#index", :legacy => "true"
 
       get "symbols", controller: :symbols, action: :show, name: :as_symbol
       get "id_default(/:id)" => "foo#id_default", :id => 1
diff --git a/actionpack/test/controller/url_rewriter_test.rb b/actionpack/test/controller/url_rewriter_test.rb
index 0f79c83b6d..ca83b850d5 100644
--- a/actionpack/test/controller/url_rewriter_test.rb
+++ b/actionpack/test/controller/url_rewriter_test.rb
@@ -19,7 +19,7 @@ class UrlRewriterTests < ActionController::TestCase
 
   def setup
     @params = {}
-    @rewriter = Rewriter.new(@request) #.new(@request, @params)
+    @rewriter = Rewriter.new(@request)
     @routes = ActionDispatch::Routing::RouteSet.new.tap do |r|
       r.draw do
         ActiveSupport::Deprecation.silence do
diff --git a/actionpack/test/dispatch/response_test.rb b/actionpack/test/dispatch/response_test.rb
index c4ee3add2a..4e350162c9 100644
--- a/actionpack/test/dispatch/response_test.rb
+++ b/actionpack/test/dispatch/response_test.rb
@@ -311,13 +311,15 @@ class ResponseTest < ActiveSupport::TestCase
     end
   end
 
-  test "read x_frame_options, x_content_type_options and x_xss_protection" do
+  test "read x_frame_options, x_content_type_options, x_xss_protection, x_download_options and x_permitted_cross_domain_policies" do
     original_default_headers = ActionDispatch::Response.default_headers
     begin
       ActionDispatch::Response.default_headers = {
         "X-Frame-Options" => "DENY",
         "X-Content-Type-Options" => "nosniff",
-        "X-XSS-Protection" => "1;"
+        "X-XSS-Protection" => "1;",
+        "X-Download-Options" => "noopen",
+        "X-Permitted-Cross-Domain-Policies" => "none"
       }
       resp = ActionDispatch::Response.create.tap { |response|
         response.body = "Hello"
@@ -327,6 +329,8 @@ class ResponseTest < ActiveSupport::TestCase
       assert_equal("DENY", resp.headers["X-Frame-Options"])
       assert_equal("nosniff", resp.headers["X-Content-Type-Options"])
       assert_equal("1;", resp.headers["X-XSS-Protection"])
+      assert_equal("noopen", resp.headers["X-Download-Options"])
+      assert_equal("none", resp.headers["X-Permitted-Cross-Domain-Policies"])
     ensure
       ActionDispatch::Response.default_headers = original_default_headers
     end
diff --git a/actionpack/test/dispatch/routing_test.rb b/actionpack/test/dispatch/routing_test.rb
index b2d2bf0416..8f4e7c96a9 100644
--- a/actionpack/test/dispatch/routing_test.rb
+++ b/actionpack/test/dispatch/routing_test.rb
@@ -4225,7 +4225,7 @@ class TestGlobRoutingMapper < ActionDispatch::IntegrationTest
     end
   end
 
-  #include Routes.url_helpers
+  # include Routes.url_helpers
   APP = build_app Routes
   def app; APP end
 
diff --git a/actionpack/test/dispatch/system_testing/server_test.rb b/actionpack/test/dispatch/system_testing/server_test.rb
index 1866225fc1..95e411faf4 100644
--- a/actionpack/test/dispatch/system_testing/server_test.rb
+++ b/actionpack/test/dispatch/system_testing/server_test.rb
@@ -6,10 +6,27 @@ require "action_dispatch/system_testing/server"
 
 class ServerTest < ActiveSupport::TestCase
   setup do
-    ActionDispatch::SystemTesting::Server.new.run
+    @old_capybara_server = Capybara.server
   end
 
   test "port is always included" do
+    ActionDispatch::SystemTesting::Server.new.run
     assert Capybara.always_include_port, "expected Capybara.always_include_port to be true"
   end
+
+  test "server is changed from `default` to `puma`" do
+    Capybara.server = :default
+    ActionDispatch::SystemTesting::Server.new.run
+    refute_equal Capybara.server, Capybara.servers[:default]
+  end
+
+  test "server is not changed to `puma` when is different than default" do
+    Capybara.server = :webrick
+    ActionDispatch::SystemTesting::Server.new.run
+    assert_equal Capybara.server, Capybara.servers[:webrick]
+  end
+
+  teardown do
+    Capybara.server = @old_capybara_server
+  end
 end
diff --git a/actionpack/test/dispatch/uploaded_file_test.rb b/actionpack/test/dispatch/uploaded_file_test.rb
index 4673d7cc11..24c7135c7e 100644
--- a/actionpack/test/dispatch/uploaded_file_test.rb
+++ b/actionpack/test/dispatch/uploaded_file_test.rb
@@ -18,7 +18,7 @@ module ActionDispatch
     def test_filename_is_different_object
       file_str = "foo"
       uf = Http::UploadedFile.new(filename: file_str, tempfile: Object.new)
-      assert_not_equal file_str.object_id , uf.original_filename.object_id
+      assert_not_equal file_str.object_id, uf.original_filename.object_id
     end
 
     def test_filename_should_be_in_utf_8
diff --git a/actionpack/test/journey/router_test.rb b/actionpack/test/journey/router_test.rb
index 29cc74471d..183f421bcf 100644
--- a/actionpack/test/journey/router_test.rb
+++ b/actionpack/test/journey/router_test.rb
@@ -30,7 +30,7 @@ module ActionDispatch
       def test_unicode
         get "/ほげ", to: "foo#bar"
 
-        #match the escaped version of /ほげ
+        # match the escaped version of /ほげ
         env = rails_env "PATH_INFO" => "/%E3%81%BB%E3%81%92"
         called = false
         router.recognize(env) do |r, params|