Merge branch 'master' into update_default_hsts_max_age

40 files changed, 186 insertions, 209 deletions

diff --git a/actionview/.gitignore b/actionview/.gitignore
index 0a04b29786..246aabbb7f 100644
--- a/actionview/.gitignore
+++ b/actionview/.gitignore
@@ -1,2 +1,5 @@
-/lib/assets/compiled
-/tmp
+/lib/assets/compiled/
+/log/
+/test/fixtures/public/absolute/
+/test/ujs/log/
+/tmp/
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md
index c38e11dc38..be0afe4198 100644
--- a/actionview/CHANGELOG.md
+++ b/actionview/CHANGELOG.md
@@ -1,79 +1,8 @@
-*   Allow the use of callable objects as group methods for grouped selects.
+## Rails 6.0.0.alpha (Unreleased) ##
 
-    Until now, the `option_groups_from_collection_for_select` method was only able to
-    handle method names as `group_method` and `group_label_method` parameters,
-    it is now able to receive procs and other callable objects too.
+*   Rails 6 requires Ruby 2.4.1 or newer.
 
-    *Jérémie Bonal*
+    *Jeremy Daer*
 
-*   Add `preload_link_tag` helper
 
-    This helper that allows to the browser to initiate early fetch of resources
-    (different to the specified in `javascript_include_tag` and `stylesheet_link_tag`).
-    Additionally, this sends Early Hints if supported by browser.
-
-    *Guillermo Iguaran*
-
-## Rails 5.2.0.beta2 (November 28, 2017) ##
-
-*   No changes.
-
-
-## Rails 5.2.0.beta1 (November 27, 2017) ##
-
-*   Change `form_with` to generates ids by default.
-
-    When `form_with` was introduced we disabled the automatic generation of ids
-    that was enabled in `form_for`. This usually is not an good idea since labels don't work
-    when the input doesn't have an id and it made harder to test with Capybara.
-
-    You can still disable the automatic generation of ids setting `config.action_view.form_with_generates_ids`
-    to `false.`
-
-    *Nick Pezza*
-
-*   Fix issues with `field_error_proc` wrapping `optgroup` and select divider `option`.
-
-    Fixes #31088
-
-    *Matthias Neumayr*
-
-*   Remove deprecated Erubis ERB handler.
-
-    *Rafael Mendonça França*
-
-*   Remove default `alt` text generation.
-
-    Fixes #30096
-
-    *Cameron Cundiff*
-
-*   Add `srcset` option to `image_tag` helper.
-
-    *Roberto Miranda*
-
-*   Fix issues with scopes and engine on `current_page?` method.
-
-    Fixes #29401.
-
-    *Nikita Savrov*
-
-*   Generate field ids in `collection_check_boxes` and `collection_radio_buttons`.
-
-    This makes sure that the labels are linked up with the fields.
-
-    Fixes #29014.
-
-    *Yuji Yaginuma*
-
-*   Add `:json` type to `auto_discovery_link_tag` to support [JSON Feeds](https://jsonfeed.org/version/1)
-
-    *Mike Gunderloy*
-
-*   Update `distance_of_time_in_words` helper to display better error messages
-    for bad input.
-
-    *Jay Hayes*
-
-
-Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionview/CHANGELOG.md) for previous changes.
diff --git a/actionview/actionview.gemspec b/actionview/actionview.gemspec
index b99137fcf6..49ee1a292b 100644
--- a/actionview/actionview.gemspec
+++ b/actionview/actionview.gemspec
@@ -9,7 +9,7 @@ Gem::Specification.new do |s|
   s.summary     = "Rendering framework putting the V in MVC (part of Rails)."
   s.description = "Simple, battle-tested conventions and helpers for building web pages."
 
-  s.required_ruby_version = ">= 2.2.2"
+  s.required_ruby_version = ">= 2.4.1"
 
   s.license = "MIT"
 
diff --git a/actionview/app/assets/javascripts/README.md b/actionview/app/assets/javascripts/README.md
index 8198011b02..185dddc7e5 100644
--- a/actionview/app/assets/javascripts/README.md
+++ b/actionview/app/assets/javascripts/README.md
@@ -50,6 +50,6 @@ Run `bundle exec rake ujs:server` first, and then run the web tests by visiting
 
 rails-ujs is released under the [MIT License](MIT-LICENSE).
 
-[data]: http://www.w3.org/TR/html5/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes "Embedding custom non-visible data with the data-* attributes"
+[data]: https://www.w3.org/TR/html5/dom.html#embedding-custom-non-visible-data-with-the-data-attributes "Embedding custom non-visible data with the data-* attributes"
 [validator]: http://validator.w3.org/
 [csrf]: http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html
diff --git a/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee b/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
index cc0e037428..2a8f5659e3 100644
--- a/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
+++ b/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
@@ -1,7 +1,8 @@
+#= require ./csp
 #= require ./csrf
 #= require ./event
 
-{ CSRFProtection, fire } = Rails
+{ cspNonce, CSRFProtection, fire } = Rails
 
 AcceptHeaders =
   '*': '*/*'
@@ -65,6 +66,7 @@ processResponse = (response, type) ->
       try response = JSON.parse(response)
     else if type.match(/\b(?:java|ecma)script\b/)
       script = document.createElement('script')
+      script.nonce = cspNonce()
       script.text = response
       document.head.appendChild(script).parentNode.removeChild(script)
     else if type.match(/\b(xml|html|svg)\b/)
diff --git a/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee b/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee
new file mode 100644
index 0000000000..8d2d6ce447
--- /dev/null
+++ b/actionview/app/assets/javascripts/rails-ujs/utils/csp.coffee
@@ -0,0 +1,4 @@
+# Content-Security-Policy nonce for inline scripts
+cspNonce = Rails.cspNonce = ->
+  meta = document.querySelector('meta[name=csp-nonce]')
+  meta and meta.content
diff --git a/actionview/lib/action_view/gem_version.rb b/actionview/lib/action_view/gem_version.rb
index ff7f2bb853..77ae444a58 100644
--- a/actionview/lib/action_view/gem_version.rb
+++ b/actionview/lib/action_view/gem_version.rb
@@ -7,10 +7,10 @@ module ActionView
   end
 
   module VERSION
-    MAJOR = 5
-    MINOR = 2
+    MAJOR = 6
+    MINOR = 0
     TINY  = 0
-    PRE   = "beta2"
+    PRE   = "alpha"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
diff --git a/actionview/lib/action_view/helpers.rb b/actionview/lib/action_view/helpers.rb
index 46f20c4277..8cc8013718 100644
--- a/actionview/lib/action_view/helpers.rb
+++ b/actionview/lib/action_view/helpers.rb
@@ -13,6 +13,7 @@ module ActionView #:nodoc:
     autoload :CacheHelper
     autoload :CaptureHelper
     autoload :ControllerHelper
+    autoload :CspHelper
     autoload :CsrfHelper
     autoload :DateHelper
     autoload :DebugHelper
@@ -46,6 +47,7 @@ module ActionView #:nodoc:
     include CacheHelper
     include CaptureHelper
     include ControllerHelper
+    include CspHelper
     include CsrfHelper
     include DateHelper
     include DebugHelper
diff --git a/actionview/lib/action_view/helpers/asset_tag_helper.rb b/actionview/lib/action_view/helpers/asset_tag_helper.rb
index 16def9837e..76b1c3fb6e 100644
--- a/actionview/lib/action_view/helpers/asset_tag_helper.rb
+++ b/actionview/lib/action_view/helpers/asset_tag_helper.rb
@@ -133,7 +133,7 @@ module ActionView
 
         sources_tags = sources.uniq.map { |source|
           href = path_to_stylesheet(source, path_options)
-          early_hints_links << "<#{href}>; rel=preload; as=stylesheet"
+          early_hints_links << "<#{href}>; rel=preload; as=style"
           tag_options = {
             "rel" => "stylesheet",
             "media" => "screen",
diff --git a/actionview/lib/action_view/helpers/csp_helper.rb b/actionview/lib/action_view/helpers/csp_helper.rb
new file mode 100644
index 0000000000..e2e065c218
--- /dev/null
+++ b/actionview/lib/action_view/helpers/csp_helper.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module ActionView
+  # = Action View CSP Helper
+  module Helpers #:nodoc:
+    module CspHelper
+      # Returns a meta tag "csp-nonce" with the per-session nonce value
+      # for allowing inline <script> tags.
+      #
+      #   <head>
+      #     <%= csp_meta_tag %>
+      #   </head>
+      #
+      # This is used by the Rails UJS helper to create dynamically
+      # loaded inline <script> elements.
+      #
+      def csp_meta_tag
+        if content_security_policy?
+          tag("meta", name: "csp-nonce", content: content_security_policy_nonce)
+        end
+      end
+    end
+  end
+end
diff --git a/actionview/lib/action_view/helpers/date_helper.rb b/actionview/lib/action_view/helpers/date_helper.rb
index 09040ccbc4..4c45f122fe 100644
--- a/actionview/lib/action_view/helpers/date_helper.rb
+++ b/actionview/lib/action_view/helpers/date_helper.rb
@@ -116,7 +116,7 @@ module ActionView
             when 10..19 then locale.t :less_than_x_seconds, count: 20
             when 20..39 then locale.t :half_a_minute
             when 40..59 then locale.t :less_than_x_minutes, count: 1
-              else             locale.t :x_minutes,           count: 1
+            else             locale.t :x_minutes,           count: 1
             end
 
           when 2...45           then locale.t :x_minutes,      count: distance_in_minutes
@@ -131,7 +131,7 @@ module ActionView
           when 43200...86400    then locale.t :about_x_months, count: (distance_in_minutes.to_f / 43200.0).round
             # 60 days up to 365 days
           when 86400...525600   then locale.t :x_months,       count: (distance_in_minutes.to_f / 43200.0).round
-            else
+          else
             from_year = from_time.year
             from_year += 1 if from_time.month >= 3
             to_year = to_time.year
diff --git a/actionview/lib/action_view/helpers/debug_helper.rb b/actionview/lib/action_view/helpers/debug_helper.rb
index 52dff1f750..88ceba414b 100644
--- a/actionview/lib/action_view/helpers/debug_helper.rb
+++ b/actionview/lib/action_view/helpers/debug_helper.rb
@@ -24,7 +24,7 @@ module ActionView
       #     created_at:
       #   </pre>
       def debug(object)
-        Marshal::dump(object)
+        Marshal.dump(object)
         object = ERB::Util.html_escape(object.to_yaml)
         content_tag(:pre, object, class: "debug_dump")
       rescue # errors from Marshal or YAML
diff --git a/actionview/lib/action_view/helpers/form_helper.rb b/actionview/lib/action_view/helpers/form_helper.rb
index 1df1694325..15aa9ec2dd 100644
--- a/actionview/lib/action_view/helpers/form_helper.rb
+++ b/actionview/lib/action_view/helpers/form_helper.rb
@@ -1014,14 +1014,13 @@ module ActionView
       #   <%= fields :comment do |fields| %>
       #     <%= fields.text_field :body %>
       #   <% end %>
-      #   # => <input type="text" name="comment[body]>
+      #   # => <input type="text" name="comment[body]">
       #
       #   # Using a model infers the scope and assigns field values:
-      #   <%= fields model: Comment.new(body: "full bodied") do |fields| %<
+      #   <%= fields model: Comment.new(body: "full bodied") do |fields| %>
       #     <%= fields.text_field :body %>
       #   <% end %>
-      #   # =>
-      #   <input type="text" name="comment[body] value="full bodied">
+      #   # => <input type="text" name="comment[body]" value="full bodied">
       #
       #   # Using +fields+ with +form_with+:
       #   <%= form_with model: @post do |form| %>
diff --git a/actionview/lib/action_view/helpers/javascript_helper.rb b/actionview/lib/action_view/helpers/javascript_helper.rb
index dd2cd57ac3..acc50f8a62 100644
--- a/actionview/lib/action_view/helpers/javascript_helper.rb
+++ b/actionview/lib/action_view/helpers/javascript_helper.rb
@@ -63,6 +63,13 @@ module ActionView
       #   <%= javascript_tag defer: 'defer' do -%>
       #     alert('All is good')
       #   <% end -%>
+      #
+      # If you have a content security policy enabled then you can add an automatic
+      # nonce value by passing +nonce: true+ as part of +html_options+. Example:
+      #
+      #   <%= javascript_tag nonce: true do -%>
+      #     alert('All is good')
+      #   <% end -%>
       def javascript_tag(content_or_options_with_block = nil, html_options = {}, &block)
         content =
           if block_given?
@@ -72,6 +79,10 @@ module ActionView
             content_or_options_with_block
           end
 
+        if html_options[:nonce] == true
+          html_options[:nonce] = content_security_policy_nonce
+        end
+
         content_tag("script".freeze, javascript_cdata_section(content), html_options)
       end
 
diff --git a/actionview/lib/action_view/helpers/tags/translator.rb b/actionview/lib/action_view/helpers/tags/translator.rb
index fcf96d2c9c..e81ca3aef0 100644
--- a/actionview/lib/action_view/helpers/tags/translator.rb
+++ b/actionview/lib/action_view/helpers/tags/translator.rb
@@ -16,13 +16,8 @@ module ActionView
           translated_attribute || human_attribute_name
         end
 
-        # TODO Change this to private once we've dropped Ruby 2.2 support.
-        # Workaround for Ruby 2.2 "private attribute?" warning.
-        protected
-
-          attr_reader :object_name, :method_and_value, :scope, :model
-
         private
+          attr_reader :object_name, :method_and_value, :scope, :model
 
           def i18n_default
             if model
diff --git a/actionview/lib/action_view/helpers/text_helper.rb b/actionview/lib/action_view/helpers/text_helper.rb
index 84d38aa416..34138de00e 100644
--- a/actionview/lib/action_view/helpers/text_helper.rb
+++ b/actionview/lib/action_view/helpers/text_helper.rb
@@ -13,9 +13,9 @@ module ActionView
     #
     # ==== Sanitization
     #
-    # Most text helpers by default sanitize the given content, but do not escape it.
-    # This means HTML tags will appear in the page but all malicious code will be removed.
-    # Let's look at some examples using the +simple_format+ method:
+    # Most text helpers that generate HTML output sanitize the given input by default,
+    # but do not escape it. This means HTML tags will appear in the page but all malicious
+    # code will be removed. Let's look at some examples using the +simple_format+ method:
     #
     #   simple_format('<a href="http://example.com/">Example</a>')
     #   # => "<p><a href=\"http://example.com/\">Example</a></p>"
@@ -128,7 +128,7 @@ module ActionView
       #   # => You searched for: <a href="search?q=rails">rails</a>
       #
       #   highlight('<a href="javascript:alert(\'no!\')">ruby</a> on rails', 'rails', sanitize: false)
-      #   # => "<a>ruby</a> on <mark>rails</mark>"
+      #   # => <a href="javascript:alert('no!')">ruby</a> on <mark>rails</mark>
       def highlight(text, phrases, options = {})
         text = sanitize(text) if options.fetch(:sanitize, true)
 
diff --git a/actionview/package.json b/actionview/package.json
index 787ae06208..624eb5de93 100644
--- a/actionview/package.json
+++ b/actionview/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rails-ujs",
-  "version": "5.2.0-beta2",
+  "version": "6.0.0-alpha",
   "description": "Ruby on Rails unobtrusive scripting adapter",
   "main": "lib/assets/compiled/rails-ujs.js",
   "files": [
diff --git a/actionview/test/fixtures/public/.gitignore b/actionview/test/fixtures/public/.gitignore
deleted file mode 100644
index 312e635ee6..0000000000
--- a/actionview/test/fixtures/public/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-absolute/*
diff --git a/actionview/test/template/asset_tag_helper_test.rb b/actionview/test/template/asset_tag_helper_test.rb
index 284dacf2d4..6d98eacfb8 100644
--- a/actionview/test/template/asset_tag_helper_test.rb
+++ b/actionview/test/template/asset_tag_helper_test.rb
@@ -407,7 +407,7 @@ class AssetTagHelperTest < ActionView::TestCase
   end
 
   def test_javascript_include_tag_is_html_safe
-    assert javascript_include_tag("prototype").html_safe?
+    assert_predicate javascript_include_tag("prototype"), :html_safe?
   end
 
   def test_javascript_include_tag_relative_protocol
@@ -460,8 +460,8 @@ class AssetTagHelperTest < ActionView::TestCase
   end
 
   def test_stylesheet_link_tag_is_html_safe
-    assert stylesheet_link_tag("dir/file").html_safe?
-    assert stylesheet_link_tag("dir/other/file", "dir/file2").html_safe?
+    assert_predicate stylesheet_link_tag("dir/file"), :html_safe?
+    assert_predicate stylesheet_link_tag("dir/other/file", "dir/file2"), :html_safe?
   end
 
   def test_stylesheet_link_tag_escapes_options
diff --git a/actionview/test/template/atom_feed_helper_test.rb b/actionview/test/template/atom_feed_helper_test.rb
index 1be20dcaae..8e683cb48a 100644
--- a/actionview/test/template/atom_feed_helper_test.rb
+++ b/actionview/test/template/atom_feed_helper_test.rb
@@ -257,7 +257,7 @@ class AtomFeedTest < ActionController::TestCase
       get :index, params: { id: "provide_builder" }
       # because we pass in the non-default builder, the content generated by the
       # helper should go 'nowhere'.  Leaving the response body blank.
-      assert @response.body.blank?
+      assert_predicate @response.body, :blank?
     end
   end
 
diff --git a/actionview/test/template/capture_helper_test.rb b/actionview/test/template/capture_helper_test.rb
index 8a1c00fd00..31c280a91c 100644
--- a/actionview/test/template/capture_helper_test.rb
+++ b/actionview/test/template/capture_helper_test.rb
@@ -155,12 +155,12 @@ class CaptureHelperTest < ActionView::TestCase
     content_for :title do
       content_tag(:p, "title")
     end
-    assert content_for(:title).html_safe?
+    assert_predicate content_for(:title), :html_safe?
     content_for :title, "", flush: true
     content_for(:title) do
       content_tag(:p, "title")
     end
-    assert content_for(:title).html_safe?
+    assert_predicate content_for(:title), :html_safe?
   end
 
   def test_provide
diff --git a/actionview/test/template/date_helper_test.rb b/actionview/test/template/date_helper_test.rb
index 97cfd754be..94357d5f90 100644
--- a/actionview/test/template/date_helper_test.rb
+++ b/actionview/test/template/date_helper_test.rb
@@ -144,15 +144,13 @@ class DateHelperTest < ActionView::TestCase
     rubinius_skip "Date is written in Ruby and relies on Fixnum#/"
     jruby_skip "Date is written in Ruby and relies on Fixnum#/"
 
-    klass = RUBY_VERSION > "2.4" ? Integer : Fixnum
-
     # Make sure that we avoid {Integer,Fixnum}#/ (redefined by mathn)
-    klass.send :private, :/
+    Integer.send :private, :/
 
     from = Time.utc(2004, 6, 6, 21, 45, 0)
     assert_distance_of_time_in_words(from)
   ensure
-    klass.send :public, :/
+    Integer.send :public, :/
   end
 
   def test_time_ago_in_words_passes_include_seconds
@@ -3593,25 +3591,25 @@ class DateHelperTest < ActionView::TestCase
   end
 
   def test_select_html_safety
-    assert select_day(16).html_safe?
-    assert select_month(8).html_safe?
-    assert select_year(Time.mktime(2003, 8, 16, 8, 4, 18)).html_safe?
-    assert select_minute(Time.mktime(2003, 8, 16, 8, 4, 18)).html_safe?
-    assert select_second(Time.mktime(2003, 8, 16, 8, 4, 18)).html_safe?
+    assert_predicate select_day(16), :html_safe?
+    assert_predicate select_month(8), :html_safe?
+    assert_predicate select_year(Time.mktime(2003, 8, 16, 8, 4, 18)), :html_safe?
+    assert_predicate select_minute(Time.mktime(2003, 8, 16, 8, 4, 18)), :html_safe?
+    assert_predicate select_second(Time.mktime(2003, 8, 16, 8, 4, 18)), :html_safe?
 
-    assert select_minute(8, use_hidden: true).html_safe?
-    assert select_month(8, prompt: "Choose month").html_safe?
+    assert_predicate select_minute(8, use_hidden: true), :html_safe?
+    assert_predicate select_month(8, prompt: "Choose month"), :html_safe?
 
-    assert select_time(Time.mktime(2003, 8, 16, 8, 4, 18), {}, { class: "selector" }).html_safe?
-    assert select_date(Time.mktime(2003, 8, 16), date_separator: " / ", start_year: 2003, end_year: 2005, prefix: "date[first]").html_safe?
+    assert_predicate select_time(Time.mktime(2003, 8, 16, 8, 4, 18), {}, { class: "selector" }), :html_safe?
+    assert_predicate select_date(Time.mktime(2003, 8, 16), date_separator: " / ", start_year: 2003, end_year: 2005, prefix: "date[first]"), :html_safe?
   end
 
   def test_object_select_html_safety
     @post = Post.new
     @post.written_on = Date.new(2004, 6, 15)
 
-    assert date_select("post", "written_on", default: Time.local(2006, 9, 19, 15, 16, 35), include_blank: true).html_safe?
-    assert time_select("post", "written_on", ignore_date: true).html_safe?
+    assert_predicate date_select("post", "written_on", default: Time.local(2006, 9, 19, 15, 16, 35), include_blank: true), :html_safe?
+    assert_predicate time_select("post", "written_on", ignore_date: true), :html_safe?
   end
 
   def test_time_tag_with_date
diff --git a/actionview/test/template/erb_util_test.rb b/actionview/test/template/erb_util_test.rb
index 8b804105f4..bd702dbe94 100644
--- a/actionview/test/template/erb_util_test.rb
+++ b/actionview/test/template/erb_util_test.rb
@@ -70,24 +70,24 @@ class ErbUtilTest < ActiveSupport::TestCase
 
   def test_json_escape_returns_unsafe_strings_when_passed_unsafe_strings
     value = json_escape("asdf")
-    assert !value.html_safe?
+    assert_not_predicate value, :html_safe?
   end
 
   def test_json_escape_returns_safe_strings_when_passed_safe_strings
     value = json_escape("asdf".html_safe)
-    assert value.html_safe?
+    assert_predicate value, :html_safe?
   end
 
   def test_html_escape_is_html_safe
     escaped = h("<p>")
     assert_equal "&lt;p&gt;", escaped
-    assert escaped.html_safe?
+    assert_predicate escaped, :html_safe?
   end
 
   def test_html_escape_passes_html_escape_unmodified
     escaped = h("<p>".html_safe)
     assert_equal "<p>", escaped
-    assert escaped.html_safe?
+    assert_predicate escaped, :html_safe?
   end
 
   def test_rest_in_ascii
@@ -104,11 +104,11 @@ class ErbUtilTest < ActiveSupport::TestCase
 
   def test_html_escape_once_returns_unsafe_strings_when_passed_unsafe_strings
     value = html_escape_once("1 < 2 &amp; 3")
-    assert !value.html_safe?
+    assert_not_predicate value, :html_safe?
   end
 
   def test_html_escape_once_returns_safe_strings_when_passed_safe_strings
     value = html_escape_once("1 < 2 &amp; 3".html_safe)
-    assert value.html_safe?
+    assert_predicate value, :html_safe?
   end
 end
diff --git a/actionview/test/template/form_helper/form_with_test.rb b/actionview/test/template/form_helper/form_with_test.rb
index 0295ff627d..0d224d0c46 100644
--- a/actionview/test/template/form_helper/form_with_test.rb
+++ b/actionview/test/template/form_helper/form_with_test.rb
@@ -108,7 +108,7 @@ class FormWithActsLikeFormTagTest < FormWithTest
     actual = form_with(skip_enforcing_utf8: true)
     expected = whole_form("http://www.example.com", skip_enforcing_utf8: true)
     assert_dom_equal expected, actual
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
   end
 
   def test_form_with_with_block_in_erb
diff --git a/actionview/test/template/form_helper_test.rb b/actionview/test/template/form_helper_test.rb
index 6a317e1a12..b8fad090c5 100644
--- a/actionview/test/template/form_helper_test.rb
+++ b/actionview/test/template/form_helper_test.rb
@@ -612,7 +612,7 @@ class FormHelperTest < ActionView::TestCase
   end
 
   def test_check_box_is_html_safe
-    assert check_box("post", "secret").html_safe?
+    assert_predicate check_box("post", "secret"), :html_safe?
   end
 
   def test_check_box_checked_if_object_value_is_same_that_check_value
@@ -775,7 +775,7 @@ class FormHelperTest < ActionView::TestCase
   end
 
   def test_check_box_with_nil_unchecked_value_is_html_safe
-    assert check_box("post", "secret", {}, "on", nil).html_safe?
+    assert_predicate check_box("post", "secret", {}, "on", nil), :html_safe?
   end
 
   def test_check_box_with_multiple_behavior
diff --git a/actionview/test/template/form_options_helper_test.rb b/actionview/test/template/form_options_helper_test.rb
index 642f450f91..f82eada869 100644
--- a/actionview/test/template/form_options_helper_test.rb
+++ b/actionview/test/template/form_options_helper_test.rb
@@ -354,7 +354,7 @@ class FormOptionsHelperTest < ActionView::TestCase
   end
 
   def test_option_groups_from_collection_for_select_returns_html_safe_string
-    assert option_groups_from_collection_for_select(dummy_continents, "countries", "continent_name", "country_id", "country_name", "dk").html_safe?
+    assert_predicate option_groups_from_collection_for_select(dummy_continents, "countries", "continent_name", "country_id", "country_name", "dk"), :html_safe?
   end
 
   def test_grouped_options_for_select_with_array
@@ -402,7 +402,7 @@ class FormOptionsHelperTest < ActionView::TestCase
   end
 
   def test_grouped_options_for_select_returns_html_safe_string
-    assert grouped_options_for_select([["Hats", ["Baseball Cap", "Cowboy Hat"]]]).html_safe?
+    assert_predicate grouped_options_for_select([["Hats", ["Baseball Cap", "Cowboy Hat"]]]), :html_safe?
   end
 
   def test_grouped_options_for_select_with_prompt_returns_html_escaped_string
@@ -492,7 +492,7 @@ class FormOptionsHelperTest < ActionView::TestCase
   end
 
   def test_time_zone_options_returns_html_safe_string
-    assert time_zone_options_for_select.html_safe?
+    assert_predicate time_zone_options_for_select, :html_safe?
   end
 
   def test_select
diff --git a/actionview/test/template/form_tag_helper_test.rb b/actionview/test/template/form_tag_helper_test.rb
index 5e328ebf53..0d9bf77f98 100644
--- a/actionview/test/template/form_tag_helper_test.rb
+++ b/actionview/test/template/form_tag_helper_test.rb
@@ -142,14 +142,14 @@ class FormTagHelperTest < ActionView::TestCase
     actual = form_tag({}, { enforce_utf8: true })
     expected = whole_form("http://www.example.com", enforce_utf8: true)
     assert_dom_equal expected, actual
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
   end
 
   def test_form_tag_enforce_utf8_false
     actual = form_tag({}, { enforce_utf8: false })
     expected = whole_form("http://www.example.com", enforce_utf8: false)
     assert_dom_equal expected, actual
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
   end
 
   def test_form_tag_with_block_in_erb
diff --git a/actionview/test/template/lookup_context_test.rb b/actionview/test/template/lookup_context_test.rb
index 402ee9b6ae..beee76f711 100644
--- a/actionview/test/template/lookup_context_test.rb
+++ b/actionview/test/template/lookup_context_test.rb
@@ -35,7 +35,7 @@ class LookupContextTest < ActiveSupport::TestCase
 
   test "allows me to freeze and retrieve frozen formats" do
     @lookup_context.formats.freeze
-    assert @lookup_context.formats.frozen?
+    assert_predicate @lookup_context.formats, :frozen?
   end
 
   test "provides getters and setters for variants" do
diff --git a/actionview/test/template/number_helper_test.rb b/actionview/test/template/number_helper_test.rb
index e92bf66203..357ae1326a 100644
--- a/actionview/test/template/number_helper_test.rb
+++ b/actionview/test/template/number_helper_test.rb
@@ -126,43 +126,43 @@ class NumberHelperTest < ActionView::TestCase
   end
 
   def test_number_helpers_outputs_are_html_safe
-    assert number_to_human(1).html_safe?
-    assert !number_to_human("<script></script>").html_safe?
-    assert number_to_human("asdf".html_safe).html_safe?
-    assert number_to_human("1".html_safe).html_safe?
-
-    assert number_to_human_size(1).html_safe?
-    assert number_to_human_size(1000000).html_safe?
-    assert !number_to_human_size("<script></script>").html_safe?
-    assert number_to_human_size("asdf".html_safe).html_safe?
-    assert number_to_human_size("1".html_safe).html_safe?
-
-    assert number_with_precision(1, strip_insignificant_zeros: false).html_safe?
-    assert number_with_precision(1, strip_insignificant_zeros: true).html_safe?
-    assert !number_with_precision("<script></script>").html_safe?
-    assert number_with_precision("asdf".html_safe).html_safe?
-    assert number_with_precision("1".html_safe).html_safe?
-
-    assert number_to_currency(1).html_safe?
-    assert !number_to_currency("<script></script>").html_safe?
-    assert number_to_currency("asdf".html_safe).html_safe?
-    assert number_to_currency("1".html_safe).html_safe?
-
-    assert number_to_percentage(1).html_safe?
-    assert !number_to_percentage("<script></script>").html_safe?
-    assert number_to_percentage("asdf".html_safe).html_safe?
-    assert number_to_percentage("1".html_safe).html_safe?
-
-    assert number_to_phone(1).html_safe?
+    assert_predicate number_to_human(1), :html_safe?
+    assert_not_predicate number_to_human("<script></script>"), :html_safe?
+    assert_predicate number_to_human("asdf".html_safe), :html_safe?
+    assert_predicate number_to_human("1".html_safe), :html_safe?
+
+    assert_predicate number_to_human_size(1), :html_safe?
+    assert_predicate number_to_human_size(1000000), :html_safe?
+    assert_not_predicate number_to_human_size("<script></script>"), :html_safe?
+    assert_predicate number_to_human_size("asdf".html_safe), :html_safe?
+    assert_predicate number_to_human_size("1".html_safe), :html_safe?
+
+    assert_predicate number_with_precision(1, strip_insignificant_zeros: false), :html_safe?
+    assert_predicate number_with_precision(1, strip_insignificant_zeros: true), :html_safe?
+    assert_not_predicate number_with_precision("<script></script>"), :html_safe?
+    assert_predicate number_with_precision("asdf".html_safe), :html_safe?
+    assert_predicate number_with_precision("1".html_safe), :html_safe?
+
+    assert_predicate number_to_currency(1), :html_safe?
+    assert_not_predicate number_to_currency("<script></script>"), :html_safe?
+    assert_predicate number_to_currency("asdf".html_safe), :html_safe?
+    assert_predicate number_to_currency("1".html_safe), :html_safe?
+
+    assert_predicate number_to_percentage(1), :html_safe?
+    assert_not_predicate number_to_percentage("<script></script>"), :html_safe?
+    assert_predicate number_to_percentage("asdf".html_safe), :html_safe?
+    assert_predicate number_to_percentage("1".html_safe), :html_safe?
+
+    assert_predicate number_to_phone(1), :html_safe?
     assert_equal "&lt;script&gt;&lt;/script&gt;", number_to_phone("<script></script>")
-    assert number_to_phone("<script></script>").html_safe?
-    assert number_to_phone("asdf".html_safe).html_safe?
-    assert number_to_phone("1".html_safe).html_safe?
-
-    assert number_with_delimiter(1).html_safe?
-    assert !number_with_delimiter("<script></script>").html_safe?
-    assert number_with_delimiter("asdf".html_safe).html_safe?
-    assert number_with_delimiter("1".html_safe).html_safe?
+    assert_predicate number_to_phone("<script></script>"), :html_safe?
+    assert_predicate number_to_phone("asdf".html_safe), :html_safe?
+    assert_predicate number_to_phone("1".html_safe), :html_safe?
+
+    assert_predicate number_with_delimiter(1), :html_safe?
+    assert_not_predicate number_with_delimiter("<script></script>"), :html_safe?
+    assert_predicate number_with_delimiter("asdf".html_safe), :html_safe?
+    assert_predicate number_with_delimiter("1".html_safe), :html_safe?
   end
 
   def test_number_helpers_should_raise_error_if_invalid_when_specified
diff --git a/actionview/test/template/output_safety_helper_test.rb b/actionview/test/template/output_safety_helper_test.rb
index b5e9a77105..faeeded1c8 100644
--- a/actionview/test/template/output_safety_helper_test.rb
+++ b/actionview/test/template/output_safety_helper_test.rb
@@ -12,7 +12,7 @@ class OutputSafetyHelperTest < ActionView::TestCase
   test "raw returns the safe string" do
     result = raw(@string)
     assert_equal @string, result
-    assert result.html_safe?
+    assert_predicate result, :html_safe?
   end
 
   test "raw handles nil values correctly" do
@@ -53,11 +53,11 @@ class OutputSafetyHelperTest < ActionView::TestCase
 
   test "to_sentence should escape non-html_safe values" do
     actual = to_sentence(%w(< > & ' "))
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
     assert_equal("&lt;, &gt;, &amp;, &#39;, and &quot;", actual)
 
     actual = to_sentence(%w(<script>))
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
     assert_equal("&lt;script&gt;", actual)
   end
 
@@ -80,19 +80,19 @@ class OutputSafetyHelperTest < ActionView::TestCase
     url = "https://example.com"
     expected = %(<a href="#{url}">#{url}</a> and <p>&lt;marquee&gt;shady stuff&lt;/marquee&gt;<br /></p>)
     actual = to_sentence([link_to(url, url), ptag])
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
     assert_equal(expected, actual)
   end
 
   test "to_sentence handles blank strings" do
     actual = to_sentence(["", "two", "three"])
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
     assert_equal ", two, and three", actual
   end
 
   test "to_sentence handles nil values" do
     actual = to_sentence([nil, "two", "three"])
-    assert actual.html_safe?
+    assert_predicate actual, :html_safe?
     assert_equal ", two, and three", actual
   end
 
diff --git a/actionview/test/template/sanitize_helper_test.rb b/actionview/test/template/sanitize_helper_test.rb
index 0e690c82cb..181f09ab65 100644
--- a/actionview/test/template/sanitize_helper_test.rb
+++ b/actionview/test/template/sanitize_helper_test.rb
@@ -38,6 +38,6 @@ class SanitizeHelperTest < ActionView::TestCase
   end
 
   def test_sanitize_is_marked_safe
-    assert sanitize("<html><script></script></html>").html_safe?
+    assert_predicate sanitize("<html><script></script></html>"), :html_safe?
   end
 end
diff --git a/actionview/test/template/tag_helper_test.rb b/actionview/test/template/tag_helper_test.rb
index a746b9c1b5..9a6226fd04 100644
--- a/actionview/test/template/tag_helper_test.rb
+++ b/actionview/test/template/tag_helper_test.rb
@@ -81,7 +81,7 @@ class TagHelperTest < ActionView::TestCase
 
   def test_content_tag
     assert_equal "<a href=\"create\">Create</a>", content_tag("a", "Create", "href" => "create")
-    assert content_tag("a", "Create", "href" => "create").html_safe?
+    assert_predicate content_tag("a", "Create", "href" => "create"), :html_safe?
     assert_equal content_tag("a", "Create", "href" => "create"),
                  content_tag("a", "Create", href: "create")
     assert_equal "<p>&lt;script&gt;evil_js&lt;/script&gt;</p>",
@@ -92,7 +92,7 @@ class TagHelperTest < ActionView::TestCase
 
   def test_tag_builder_with_content
     assert_equal "<div id=\"post_1\">Content</div>", tag.div("Content", id: "post_1")
-    assert tag.div("Content", id: "post_1").html_safe?
+    assert_predicate tag.div("Content", id: "post_1"), :html_safe?
     assert_equal tag.div("Content", id: "post_1"),
                  tag.div("Content", "id": "post_1")
     assert_equal "<p>&lt;script&gt;evil_js&lt;/script&gt;</p>",
diff --git a/actionview/test/template/text_helper_test.rb b/actionview/test/template/text_helper_test.rb
index f247de066f..45edfe18be 100644
--- a/actionview/test/template/text_helper_test.rb
+++ b/actionview/test/template/text_helper_test.rb
@@ -19,12 +19,12 @@ class TextHelperTest < ActionView::TestCase
   end
 
   def test_simple_format_should_be_html_safe
-    assert simple_format("<b> test with html tags </b>").html_safe?
+    assert_predicate simple_format("<b> test with html tags </b>"), :html_safe?
   end
 
   def test_simple_format_included_in_isolation
     helper_klass = Class.new { include ActionView::Helpers::TextHelper }
-    assert helper_klass.new.simple_format("<b> test with html tags </b>").html_safe?
+    assert_predicate helper_klass.new.simple_format("<b> test with html tags </b>"), :html_safe?
   end
 
   def test_simple_format
@@ -123,7 +123,7 @@ class TextHelperTest < ActionView::TestCase
   end
 
   def test_truncate_should_be_html_safe
-    assert truncate("Hello World!", length: 12).html_safe?
+    assert_predicate truncate("Hello World!", length: 12), :html_safe?
   end
 
   def test_truncate_should_escape_the_input
@@ -136,12 +136,12 @@ class TextHelperTest < ActionView::TestCase
 
   def test_truncate_with_escape_false_should_be_html_safe
     truncated = truncate("Hello <script>code!</script>World!!", length: 12, escape: false)
-    assert truncated.html_safe?
+    assert_predicate truncated, :html_safe?
   end
 
   def test_truncate_with_block_should_be_html_safe
     truncated = truncate("Here's a long test and I need a continue to read link", length: 27) { link_to "Continue", "#" }
-    assert truncated.html_safe?
+    assert_predicate truncated, :html_safe?
   end
 
   def test_truncate_with_block_should_escape_the_input
@@ -156,7 +156,7 @@ class TextHelperTest < ActionView::TestCase
 
   def test_truncate_with_block_with_escape_false_should_be_html_safe
     truncated = truncate("<script>code!</script>Here's a long test and I need a continue to read link", length: 27, escape: false) { link_to "Continue", "#" }
-    assert truncated.html_safe?
+    assert_predicate truncated, :html_safe?
   end
 
   def test_truncate_with_block_should_escape_the_block
@@ -165,7 +165,7 @@ class TextHelperTest < ActionView::TestCase
   end
 
   def test_highlight_should_be_html_safe
-    assert highlight("This is a beautiful morning", "beautiful").html_safe?
+    assert_predicate highlight("This is a beautiful morning", "beautiful"), :html_safe?
   end
 
   def test_highlight
@@ -297,7 +297,7 @@ class TextHelperTest < ActionView::TestCase
   end
 
   def test_excerpt_should_not_be_html_safe
-    assert !excerpt("This is a beautiful! morning", "beautiful", radius: 5).html_safe?
+    assert_not_predicate excerpt("This is a beautiful! morning", "beautiful", radius: 5), :html_safe?
   end
 
   def test_excerpt_in_borderline_cases
diff --git a/actionview/test/template/translation_helper_test.rb b/actionview/test/template/translation_helper_test.rb
index 8956a584ff..f40595bf4d 100644
--- a/actionview/test/template/translation_helper_test.rb
+++ b/actionview/test/template/translation_helper_test.rb
@@ -75,7 +75,7 @@ class TranslationHelperTest < ActiveSupport::TestCase
   def test_returns_missing_translation_message_with_unescaped_interpolation
     expected = '<span class="translation_missing" title="translation missing: en.translations.missing, name: Kir, year: 2015, vulnerable: &amp;quot; onclick=&amp;quot;alert()&amp;quot;">Missing</span>'
     assert_equal expected, translate(:"translations.missing", name: "Kir", year: "2015", vulnerable: %{" onclick="alert()"})
-    assert translate(:"translations.missing").html_safe?
+    assert_predicate translate(:"translations.missing"), :html_safe?
   end
 
   def test_returns_missing_translation_message_does_filters_out_i18n_options
@@ -145,11 +145,11 @@ class TranslationHelperTest < ActiveSupport::TestCase
   end
 
   def test_translate_marks_translations_named_html_as_safe_html
-    assert translate(:'translations.html').html_safe?
+    assert_predicate translate(:'translations.html'), :html_safe?
   end
 
   def test_translate_marks_translations_with_a_html_suffix_as_safe_html
-    assert translate(:'translations.hello_html').html_safe?
+    assert_predicate translate(:'translations.hello_html'), :html_safe?
   end
 
   def test_translate_escapes_interpolations_in_translations_with_a_html_suffix
diff --git a/actionview/test/template/url_helper_test.rb b/actionview/test/template/url_helper_test.rb
index 0cd0386cac..8bccda481b 100644
--- a/actionview/test/template/url_helper_test.rb
+++ b/actionview/test/template/url_helper_test.rb
@@ -663,7 +663,7 @@ class UrlHelperTest < ActiveSupport::TestCase
   end
 
   def test_mail_to_returns_html_safe_string
-    assert mail_to("david@loudthinking.com").html_safe?
+    assert_predicate mail_to("david@loudthinking.com"), :html_safe?
   end
 
   def test_mail_to_with_block
diff --git a/actionview/test/tmp/.keep b/actionview/test/tmp/.keep
deleted file mode 100644
index e69de29bb2..0000000000
--- a/actionview/test/tmp/.keep
+++ /dev/null
diff --git a/actionview/test/ujs/.gitignore b/actionview/test/ujs/.gitignore
deleted file mode 100644
index 31dbbff57c..0000000000
--- a/actionview/test/ujs/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/log
diff --git a/actionview/test/ujs/public/test/call-ajax.js b/actionview/test/ujs/public/test/call-ajax.js
index 49e64cad5c..4d0bfb0806 100644
--- a/actionview/test/ujs/public/test/call-ajax.js
+++ b/actionview/test/ujs/public/test/call-ajax.js
@@ -8,7 +8,6 @@ module('call-ajax', {
 })
 
 asyncTest('call ajax without "ajax:beforeSend"', 1, function() {
-
   var link = $('#qunit-fixture a')
   link.bindNative('click', function() {
     Rails.ajax({
@@ -21,7 +20,7 @@ asyncTest('call ajax without "ajax:beforeSend"', 1, function() {
   })
 
   link.triggerNative('click')
-  setTimeout(function() { start() }, 13)
+  setTimeout(function() { start() }, 50)
 })
 
 })()
diff --git a/actionview/test/ujs/server.rb b/actionview/test/ujs/server.rb
index 7d1bab4b2a..48e9bcb65f 100644
--- a/actionview/test/ujs/server.rb
+++ b/actionview/test/ujs/server.rb
@@ -23,18 +23,30 @@ module UJS
     config.public_file_server.enabled = true
     config.logger = Logger.new(STDOUT)
     config.log_level = :error
+
+    config.content_security_policy do |policy|
+      policy.default_src :self, :https
+      policy.font_src    :self, :https, :data
+      policy.img_src     :self, :https, :data
+      policy.object_src  :none
+      policy.script_src  :self, :https
+      policy.style_src   :self, :https
+    end
+
+    config.content_security_policy_nonce_generator = ->(req) { SecureRandom.base64(16) }
   end
 end
 
 module TestsHelper
   def test_to(*names)
-    names = ["/vendor/qunit.js", "settings"] + names
-    names.map { |name| script_tag name }.join("\n").html_safe
-  end
+    names = names.map { |name| "/test/#{name}.js" }
+    names = %w[/vendor/qunit.js /test/settings.js] + names
 
-  def script_tag(src)
-    src = "/test/#{src}.js" unless src.index("/")
-    %(<script src="#{src}" type="text/javascript"></script>).html_safe
+    capture do
+      names.each do |name|
+        concat(javascript_include_tag(name))
+      end
+    end
   end
 end
 
@@ -56,7 +68,7 @@ class TestsController < ActionController::Base
     elsif params[:iframe]
       payload = JSON.generate(data).gsub("<", "&lt;").gsub(">", "&gt;")
       html = <<-HTML
-        <script>
+        <script nonce="#{request.content_security_policy_nonce}">
           if (window.top && window.top !== window)
             window.top.jQuery.event.trigger('iframe:loaded', #{payload})
         </script>
diff --git a/actionview/test/ujs/views/layouts/application.html.erb b/actionview/test/ujs/views/layouts/application.html.erb
index c787e77b84..8f6f6fc17f 100644
--- a/actionview/test/ujs/views/layouts/application.html.erb
+++ b/actionview/test/ujs/views/layouts/application.html.erb
@@ -2,9 +2,10 @@
 <html id="html">
   <head>
     <title><%= @title %></title>
+    <%= csp_meta_tag %>
     <link href="/vendor/qunit.css" media="screen" rel="stylesheet" type="text/css" media="screen, projection" />
     <script src="/vendor/jquery-2.2.0.js" type="text/javascript"></script>
-    <script>
+    <%= javascript_tag nonce: true do %>
       // This is for test in override.js.
       // Must go before rails-ujs.
       document.addEventListener('rails:attachBindings', function() {
@@ -15,8 +16,8 @@
           e.preventDefault();
         });
       });
-    </script>
-    <%= script_tag "/rails-ujs.js" %>
+    <% end %>
+    <%= javascript_include_tag "/rails-ujs.js" %>
   </head>
 
   <body id="body">