aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack
diff options
context:
space:
mode:
Diffstat (limited to 'actionpack')
-rw-r--r--actionpack/CHANGELOG.md6
-rw-r--r--actionpack/actionpack.gemspec2
-rw-r--r--actionpack/lib/action_controller/caching/actions.rb4
-rw-r--r--actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb2
-rw-r--r--actionpack/lib/action_dispatch/http/url.rb8
-rw-r--r--actionpack/lib/sprockets/assets.rake12
-rw-r--r--actionpack/test/template/html-scanner/sanitizer_test.rb9
7 files changed, 29 insertions, 14 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index 6e609e6c7e..8f5e45e602 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -161,14 +161,14 @@
* Assets should use the request protocol by default or default to
relative if no request is available *Jonathan del Strother*
-## Rails 3.1.3 (unreleased) ##
+## Rails 3.1.3 (November 20, 2011) ##
* Fix using `translate` helper with a html translation which uses the `:count` option for
pluralization.
*Jon Leighton*
-## Rails 3.1.2 (unreleased) ##
+## Rails 3.1.2 (November 18, 2011) ##
* Fix XSS security vulnerability in the `translate` helper method. When using interpolation
in combination with HTML-safe translations, the interpolated input would not get HTML
@@ -209,7 +209,7 @@
* Ensure users upgrading from 3.0.x to 3.1.x will properly upgrade their flash object in session (issues #3298 and #2509)
-## Rails 3.1.1 (unreleased) ##
+## Rails 3.1.1 (October 07, 2011) ##
* javascript_path and stylesheet_path now refer to /assets if asset pipelining
is on. *Santiago Pastorino*
diff --git a/actionpack/actionpack.gemspec b/actionpack/actionpack.gemspec
index dbf78a6d94..7a328e0438 100644
--- a/actionpack/actionpack.gemspec
+++ b/actionpack/actionpack.gemspec
@@ -22,7 +22,7 @@ Gem::Specification.new do |s|
s.add_dependency('builder', '~> 3.0.0')
s.add_dependency('rack', '~> 1.4.0')
s.add_dependency('rack-test', '~> 0.6.1')
- s.add_dependency('journey', '~> 1.0.0.rc1')
+ s.add_dependency('journey', '~> 1.0.0')
s.add_dependency('sprockets', '~> 2.1.2')
s.add_dependency('erubis', '~> 2.7.0')
diff --git a/actionpack/lib/action_controller/caching/actions.rb b/actionpack/lib/action_controller/caching/actions.rb
index 3b86a9a93a..e76a79f710 100644
--- a/actionpack/lib/action_controller/caching/actions.rb
+++ b/actionpack/lib/action_controller/caching/actions.rb
@@ -56,14 +56,14 @@ module ActionController #:nodoc:
#
# caches_page :public
#
- # caches_action :index, :if => proc do
+ # caches_action :index, :if => Proc.new do
# !request.format.json? # cache if is not a JSON request
# end
#
# caches_action :show, :cache_path => { :project => 1 },
# :expires_in => 1.hour
#
- # caches_action :feed, :cache_path => proc do
+ # caches_action :feed, :cache_path => Proc.new do
# if params[:user_id]
# user_list_url(params[:user_id, params[:id])
# else
diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
index af06bffa16..24ffc28710 100644
--- a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
+++ b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
@@ -171,7 +171,7 @@ module HTML
def contains_bad_protocols?(attr_name, value)
uri_attributes.include?(attr_name) &&
- (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase))
+ (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
end
end
end
diff --git a/actionpack/lib/action_dispatch/http/url.rb b/actionpack/lib/action_dispatch/http/url.rb
index 64459836b5..80ffbe575b 100644
--- a/actionpack/lib/action_dispatch/http/url.rb
+++ b/actionpack/lib/action_dispatch/http/url.rb
@@ -1,6 +1,8 @@
module ActionDispatch
module Http
module URL
+ IP_HOST_REGEXP = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
+
mattr_accessor :tld_length
self.tld_length = 1
@@ -21,7 +23,7 @@ module ActionDispatch
end
def url_for(options = {})
- unless options[:host].present? || options[:only_path].present?
+ if options[:host].blank? && options[:only_path].blank?
raise ArgumentError, 'Missing host to link to! Please provide the :host parameter, set default_url_options[:host], or set :only_path to true'
end
@@ -52,7 +54,7 @@ module ActionDispatch
private
def named_host?(host)
- !(host.nil? || /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.match(host))
+ host && IP_HOST_REGEXP !~ host
end
def rewrite_authentication(options)
@@ -167,7 +169,7 @@ module ActionDispatch
# such as 2 to catch <tt>"www"</tt> instead of <tt>"www.rubyonrails"</tt>
# in "www.rubyonrails.co.uk".
def subdomain(tld_length = @@tld_length)
- subdomains(tld_length).join(".")
+ ActionDispatch::Http::URL.extract_subdomain(host, tld_length)
end
end
end
diff --git a/actionpack/lib/sprockets/assets.rake b/actionpack/lib/sprockets/assets.rake
index 43405f3db9..f3547359cd 100644
--- a/actionpack/lib/sprockets/assets.rake
+++ b/actionpack/lib/sprockets/assets.rake
@@ -62,11 +62,11 @@ namespace :assets do
ruby_rake_task("assets:precompile:nondigest", false) if Rails.application.config.assets.digest
end
- task :primary => ["assets:environment", "tmp:cache:clear"] do
+ task :primary => ["assets:cache:clean"] do
internal_precompile
end
- task :nondigest => ["assets:environment", "tmp:cache:clear"] do
+ task :nondigest => ["assets:cache:clean"] do
internal_precompile(false)
end
end
@@ -77,13 +77,19 @@ namespace :assets do
end
namespace :clean do
- task :all => ["assets:environment", "tmp:cache:clear"] do
+ task :all => ["assets:cache:clean"] do
config = Rails.application.config
public_asset_path = File.join(Rails.public_path, config.assets.prefix)
rm_rf public_asset_path, :secure => true
end
end
+ namespace :cache do
+ task :clean => ["assets:environment"] do
+ Rails.application.assets.cache.clear
+ end
+ end
+
task :environment do
if Rails.application.config.assets.initialize_on_precompile
Rake::Task["environment"].invoke
diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb
index 62ad6be680..b4d751e405 100644
--- a/actionpack/test/template/html-scanner/sanitizer_test.rb
+++ b/actionpack/test/template/html-scanner/sanitizer_test.rb
@@ -138,7 +138,7 @@ class SanitizerTest < ActionController::TestCase
assert sanitizer.send(:contains_bad_protocols?, 'src', "#{proto}://bad")
end
end
-
+
def test_should_accept_good_protocols_ignoring_case
sanitizer = HTML::WhiteListSanitizer.new
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
@@ -146,6 +146,13 @@ class SanitizerTest < ActionController::TestCase
end
end
+ def test_should_accept_good_protocols_ignoring_space
+ sanitizer = HTML::WhiteListSanitizer.new
+ HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
+ assert !sanitizer.send(:contains_bad_protocols?, 'src', " #{proto}://good")
+ end
+ end
+
def test_should_accept_good_protocols
sanitizer = HTML::WhiteListSanitizer.new
HTML::WhiteListSanitizer.allowed_protocols.each do |proto|
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-04 01:06:24 +0000