aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_controller/metal
Commit message (Collapse)AuthorAgeFilesLines
* Additional review of 6b31761.Kasper Timm Hansen2016-02-251-1/+1
| | | | | * Fixes typos in error message and release notes. * Removes unused template test file.
* Lock down new `ImplicitRender` behavior for 5.0 RCGodfrey Chan2016-02-252-18/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Conceptually revert #20276 The feature was implemented for the `responders` gem. In the end, they did not need that feature, and have found a better fix (see plataformatec/responders#131). `ImplicitRender` is the place where Rails specifies our default policies for the case where the user did not explicitly tell us what to render, essentially describing a set of heuristics. If the gem (or the user) knows exactly what they want, they could just perform the correct `render` to avoid falling through to here, as `responders` did (the user called `respond_with`). Reverting the patch allows us to avoid exploding the complexity and defining “the fallback for a fallback” policies. 2. `respond_to` and templates are considered exhaustive enumerations If the user specified a list of formats/variants in a `respond_to` block, anything that is not explicitly included should result in an `UnknownFormat` error (which is then caught upstream to mean “406 Not Acceptable” by default). This is already how it works before this commit. Same goes for templates – if the user defined a set of templates (usually in the file system), that set is now considered exhaustive, which means that “missing” templates are considered `UnknownFormat` errors (406). 3. To keep API endpoints simple, the implicit render behavior for actions with no templates defined at all (regardless of formats, locales, variants, etc) are defaulted to “204 No Content”. This is a strictly narrower version of the feature landed in #19036 and #19377. 4. To avoid confusion when interacting in the browser, these actions will raise an `UnknownFormat` error for “interactive” requests instead. (The precise definition of “interactive” requests might change – the spirit here is to give helpful messages and avoid confusions.) Closes #20666, #23062, #23077, #23564 [Godfrey Chan, Jon Moss, Kasper Timm Hansen, Mike Clark, Matthew Draper]
* Show permitted flag in the output of AC::Parameters#inspectPrathamesh Sonpatki2016-02-241-1/+1
| | | | - Fixes #23822.
* Merge pull request #23682 from ShikChen/fast_strxorSantiago Pastorino2016-02-211-1/+2
|\ | | | | Improve the performance of string xor operation
| * Improve the performance of string xor operationshik2016-02-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `each_byte` instead of `bytes` to speed up string xor operation and reduce object allocations. Inspired by commit 02c3867882d6d23b10df262a6db5f937ca69fb53. ``` ruby require 'benchmark/ips' require 'allocation_tracer' a = 32.times.map { rand(256) }.pack('C*') b = 32.times.map { rand(256) }.pack('C*') def xor_byte_strings1(s1, s2) s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*') end def xor_byte_strings2(s1, s2) s2_bytes = s2.bytes s1.bytes.map.with_index { |c1, i| c1 ^ s2_bytes[i] }.pack('c*') end def xor_byte_strings3(s1, s2) s2_bytes = s2.bytes s1.each_byte.with_index { |c1, i| s2_bytes[i] ^= c1 } s2_bytes.pack('C*') end fail if xor_byte_strings1(a, b) != xor_byte_strings2(a, b) fail if xor_byte_strings1(a, b) != xor_byte_strings3(a, b) Benchmark.ips do |x| x.report('xor_byte_strings1') { xor_byte_strings1(a, b) } x.report('xor_byte_strings2') { xor_byte_strings2(a, b) } x.report('xor_byte_strings3') { xor_byte_strings3(a, b) } x.compare! end Tracer = ObjectSpace::AllocationTracer Tracer.setup(%i{type}) p xor_byte_strings1: Tracer.trace { xor_byte_strings1(a, b) } p xor_byte_strings2: Tracer.trace { xor_byte_strings2(a, b) } p xor_byte_strings3: Tracer.trace { xor_byte_strings3(a, b) } ``` ``` Warming up -------------------------------------- xor_byte_strings1 10.668k i/100ms xor_byte_strings2 11.814k i/100ms xor_byte_strings3 13.139k i/100ms Calculating ------------------------------------- xor_byte_strings1 116.667k (± 3.1%) i/s - 586.740k xor_byte_strings2 129.932k (± 4.3%) i/s - 649.770k xor_byte_strings3 142.506k (± 4.2%) i/s - 722.645k Comparison: xor_byte_strings3: 142506.3 i/s xor_byte_strings2: 129932.4 i/s - 1.10x slower xor_byte_strings1: 116666.8 i/s - 1.22x slower {:xor_byte_strings1=>{[:T_ARRAY]=>[38, 0, 0, 0, 0, 0], [:T_STRING]=>[2, 0, 0, 0, 0, 0]}} {:xor_byte_strings2=>{[:T_ARRAY]=>[3, 0, 0, 0, 0, 0], [:T_DATA]=>[1, 0, 0, 0, 0, 0], [:T_IMEMO]=>[2, 0, 0, 0, 0, 0], [:T_STRING]=>[2, 0, 0, 0, 0, 0]}} {:xor_byte_strings3=>{[:T_ARRAY]=>[1, 0, 0, 0, 0, 0], [:T_DATA]=>[1, 0, 0, 0, 0, 0], [:T_IMEMO]=>[2, 0, 0, 0, 0, 0], [:T_STRING]=>[2, 0, 0, 0, 0, 0]}} ```
* | Deprecate AC::Parameters#== with a HashBenjamin Quorning2016-02-191-9/+14
| |
* | Fix AC::Parameters#== with other AC::ParametersBenjamin Quorning2016-02-191-3/+4
| | | | | | | | Creating a protected getter method for `@parameters`.
* | fields_for_style needs to test for AC::ParametersAaron Patterson2016-02-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | While iterating an AC::Parameters object, the object will mutate itself and stick AC::Parameters objects where there used to be hashes: https://github.com/rails/rails/blob/f57092ad728fa1de06c4f5fd9d09dcc2c4738fd9/actionpack/lib/action_controller/metal/strong_parameters.rb#L632 If you use `permit` after this iteration, the `fields_for_style` method wouldn't return true because the child objects are now AC::Parameters objects rather than Hashes. fixes #23701
* | Implement ActionController::Parameters#inspectBenjamin Quorning2016-02-171-1/+5
|/ | | | Now that AC::Parameters is no longer a Hash, it shouldn't look like a hash.
* Remove `const_missing` which fallback to deprecated `NEVER_UNPERMITTED_PARAMS`Ryuta Kamizono2016-02-151-10/+0
| | | | `NEVER_UNPERMITTED_PARAMS` is deprecated in Rails 4.2. See #15933.
* Request#fullpath should not raise an exception, so remove the rescueAaron Patterson2016-02-091-1/+1
|
* AC::Request#format always returns a value, so we do not need to tryAaron Patterson2016-02-091-1/+1
|
* speed up string xor operation and reduce object allocationsAaron Patterson2016-02-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ``` [aaron@TC rails (master)]$ cat xor.rb a = "\x14b\"\xB4P8\x05\x8D\xC74\xC3\xEC}\xFDf\x8E!h\xCF^\xBF\xA5%\xC6\xF0\xA9\xF9x\x04\xFA\xF1\x82" b = "O.\xF7\x01\xA9D\xA3\xE1D\x7FU\x85\xFC\x8Ak\e\x04\x8A\x97\x91\xD01\x02\xA4G\x1EIf:Y\x0F@" def xor_byte_strings(s1, s2) s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*') end def xor_byte_strings2(s1, s2) s2_bytes = s2.bytes s1.bytes.map.with_index { |c1, i| c1 ^ s2_bytes[i] }.pack('c*') end require 'benchmark/ips' require 'allocation_tracer' Benchmark.ips do |x| x.report 'xor_byte_strings' do xor_byte_strings a, b end x.report 'xor_byte_strings2' do xor_byte_strings2 a, b end end ObjectSpace::AllocationTracer.setup(%i{type}) result = ObjectSpace::AllocationTracer.trace do xor_byte_strings a, b end p :xor_byte_strings => result ObjectSpace::AllocationTracer.clear result = ObjectSpace::AllocationTracer.trace do xor_byte_strings2 a, b end p :xor_byte_strings2 => result [aaron@TC rails (master)]$ ruby -I~/git/allocation_tracer/lib xor.rb Calculating ------------------------------------- xor_byte_strings 10.087k i/100ms xor_byte_strings2 11.339k i/100ms ------------------------------------------------- xor_byte_strings 108.386k (± 5.8%) i/s - 544.698k xor_byte_strings2 122.239k (± 3.0%) i/s - 612.306k {:xor_byte_strings=>{[:T_ARRAY]=>[38, 0, 0, 0, 0, 0], [:T_STRING]=>[2, 0, 0, 0, 0, 0]}} {:xor_byte_strings2=>{[:T_ARRAY]=>[3, 0, 0, 0, 0, 0], [:T_DATA]=>[1, 0, 0, 0, 0, 0], [:T_IMEMO]=>[2, 0, 0, 0, 0, 0], [:T_STRING]=>[2, 0, 0, 0, 0, 0]}} ```
* Hand off the interlock to the new thread in AC::LiveMatthew Draper2016-02-071-23/+28
| | | | | | Most importantly, the original request thread must yield its share lock while waiting for the live thread to commit -- otherwise a request's base and live threads can deadlock against each other.
* disable controller / view thread spawning in testsAaron Patterson2016-02-051-2/+13
| | | | | | | | | | | | | | | | | | Tests can (and do) access the database from the main thread. In this case they were starting a transaction, then making a request. The request would create a new thread, which would allocate a new database connection. Since the main thread started a transaction that contains data that the new thread wants to see, the new thread would not see it due to data visibility from transactions. Spawning the new thread in production is fine because middleware should not be doing database manipulation similar to the test harness. Before 603fe20c it was possible to set the database connection id based on a thread local, but 603fe20c changes the connection lookup code to never look at the "connection id" but only at the thread object itself. Without that indirection, we can't force threads to use the same connection pool as another thread. Fixes #23483
* Fix typo in strong params hash deprecation messageMarek2016-01-271-2/+2
| | | and remove unecessary spaces in string interpolation.
* Merge branch '5-0-beta-sec'Aaron Patterson2016-01-251-1/+6
|\ | | | | | | | | | | | | | | | | | | | | * 5-0-beta-sec: bumping version fix version update task to deal with .beta1.1 Eliminate instance level writers for class accessors allow :file to be outside rails root, but anything else must be inside the rails view directory Don't short-circuit reject_if proc stop caching mime types globally use secure string comparisons for basic auth username / password
| * use secure string comparisons for basic auth username / passwordAaron Patterson2016-01-221-1/+6
| | | | | | | | | | | | this will avoid timing attacks against applications that use basic auth. CVE-2015-7576
* | Fix nodoc to internal class error document some of themVipul A M2016-01-251-1/+0
| | | | | | | | | | | | | | [ci skip] Fixes #20808 [Vipul A M & Julio Lopez]
* | Merge pull request #23167 from maclover7/fix-21032Rafael França2016-01-211-1/+5
|\ \ | | | | | | Fix `ActionController::Parameters#==` bug
| * | Fix `ActionController::Parameters#==` bugJon Moss2016-01-211-1/+5
| | | | | | | | | | | | See bug #21032.
* | | remove doc reference to ActionController::MimeResponds#respond_tosealocal2016-01-201-3/+0
| | |
* | | document simple example of ActionController::MimeResponds#respond_tosealocal2016-01-201-1/+9
|/ /
* | Link to docs instead of listing methodsschneems2016-01-191-5/+7
| |
* | Add methods to StrongParametersschneems2016-01-191-1/+1
| | | | | | It's reasonable to expose different value readers.
* | [close #23084] Deprecated StrongParametersschneems2016-01-191-0/+16
| | | | | | | | We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
* | AC::Parameters#at_json: restore Rails 4.2’s valueclaudiob2016-01-121-1/+2
| | | | | | | | | | | | Fixes #23026 See discussion at #23026
* | Unneeded &block parametersAkira Matsuda2016-01-121-2/+2
| |
* | [ci skip] Fix typo Renderering --> RenderingAkshay Vishnoi2016-01-091-1/+1
| |
* | Merge pull request #22275 from mastahyeti/per-form-csrfRafael França2016-01-061-11/+54
|\ \ | | | | | | Per-form CSRF tokens
| * | add option for per-form CSRF tokensBen Toews2016-01-041-11/+54
| | |
* | | Group related methods togetherBenjamin Fleischer2016-01-031-67/+67
| | |
* | | Add ActionController:Renderers testBenjamin Fleischer2016-01-031-0/+9
|/ / | | | | | | To complement actionpack/test/controller/metal/renderers_test.rb
* | Test ActionController::Renderers::use_renderersBenjamin Fleischer2015-12-311-0/+34
| |
* | Merge pull request #22850 from prathamesh-sonpatki/fix_ac_params_unsafe_h_2Kasper Timm Hansen2015-12-311-6/+6
|\ \ | | | | | | Fix AC::Parameters#to_unsafe_h to return all unfiltered values
| * | Fix AC::Parameters#to_unsafe_h to return all unfiltered valuesPrathamesh Sonpatki2015-12-311-6/+6
| | | | | | | | | | | | | | | | | | | | | - AC::Parameters#convert_parameters_to_hashes should return filtered or unfiltered values based on whether it is called from `to_h` or `to_unsafe_h` instead of always defaulting to `to_h`. - Fixes #22841
* | | Avoid `Time.parse` for static dateRafaël Blais Masson2015-12-301-1/+1
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | Benchmark.ips do |x| x.report('Time.parse') { Time.parse('2011-01-01') } x.report('Time.new') { Time.new(2011, 1, 1) } end Calculating ------------------------------------- Time.parse 6.640k i/100ms Time.new 15.082k i/100ms ------------------------------------------------- Time.parse 71.915k (± 3.1%) i/s - 365.200k Time.new 167.645k (± 3.3%) i/s - 844.592k
* / Add AC::Parameters#include?Justin Coyne2015-12-291-1/+1
|/ | | | Fixes #22818
* Merge pull request #20797 from byroot/prevent-url-for-ac-parametersRafael França2015-12-181-1/+0
|\ | | | | Prevent ActionController::Parameters in url_for
| * Prevent ActionController::Parameters from being passed to url_for directlyJean Boussier2015-12-151-1/+0
| |
* | Document when fallback_location is used [ci-skip]Derek Prior2015-12-171-2/+8
| | | | | | | | | | | | | | | | If you're not familiar with how the `Referer` header works, you likely won't understand why you need to provide a fallback or under what circumstances it would be used. Hopefully this clarifies things a bit.
* | Only dup Ruby's Hash and Array.Kasper Timm Hansen2015-12-171-2/+18
| | | | | | | | | | | | | | | | When calling `to_h` on an `ActionController::Parameters` instance it would `deep_dup` its internal parameters. This inadvertently called `dup` on a passed Active Record model which would create new models. Fix by only dupping Ruby's Arrays and Hashes.
* | Deprecate `redirect_to :back`Derek Prior2015-12-161-10/+6
| | | | | | | | | | | | | | Applications that use `redirect_to :back` can be forced to 500 by clients that do not send the HTTP `Referer` (sic) header. `redirect_back` requires the user to consider this possibility up front and avoids this trivially-caused application error.
* | Add `redirect_back` for safer referrer redirectsDerek Prior2015-12-161-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `redirect_to :back` is a somewhat common pattern in Rails apps, but it is not completely safe. There are a number of circumstances where HTTP referrer information is not available on the request. This happens often with bot traffic and occasionally to user traffic depending on browser security settings. When there is no referrer available on the request, `redirect_to :back` will raise `ActionController::RedirectBackError`, usually resulting in an application error. `redirect_back` takes a required `fallback_location` keyword argument that specifies the redirect when the referrer information is not available. This prevents 500 errors caused by `ActionController::RedirectBackError`.
* | Merge pull request #14212 from tylerhunt/fix-token-regexSean Griffin2015-12-151-1/+1
|\ \ | | | | | | | | | Handle tab in token authentication header.
| * | Handle tab in token authentication header.Tyler Hunt2014-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The HTTP spec allows for LWS to precede the header content, which could include multiple SP and HT characters. Update the regex used to match the Token authorization header to account for this, instead of matching on a single SP. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant parts of the specification.
* | | Make Parameters#to_h and #to_unsafe_h return HWIAPrem Sichanugrist2015-12-141-5/+7
| |/ |/| | | | | | | | | | | This makes these two methods to be more inline with the previous behavior of Parameters as Parameters used to be inherited from HWIA. Fixes #21391
* | Fix `make_response!` when called by `serve` in `RouteSet`eileencodes2015-12-091-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All of our tests were testing the `ActionController::Live` behavior in a standalone environment, without going through the router or behaving like a real application. This resulted in `ActionController::Live` throwing the exception `undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>` because `make_response!` was expecting a response instead of a request. The expectation of a response came from `set_response!` in non-router tests setting the response and passing it to `make_response!`. In the case of an application we would hit `serve` in `RouteSet` first which would send us to `make_response!` with a request sent instead of a response. The changes here remove `set_response!` so `make_response!` always receives a request. Thanks to KalabiYau for help with the investigation and solution. Fixes #22524 [Eileen M. Uchitelle & KalabiYau]
* | Change the `protect_from_forgery` prepend default to `false`eileencodes2015-12-071-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per this comment https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want `protect_from_forgery` to default to `prepend: false`. `protect_from_forgery` will now be insterted into the callback chain at the point it is called in your application. This is useful for cases where you want to `protect_from_forgery` after you perform required authentication callbacks or other callbacks that are required to run after forgery protection. If you want `protect_from_forgery` callbacks to always run first, regardless of position they are called in your application, then you can add `prepend: true` to your `protect_from_forgery` call. Example: ```ruby protect_from_forgery prepend: true ```
* | Merge pull request #22475 from claudiob/missing-requireMatthew Draper2015-12-081-0/+1
|\ \ | | | | | | Add missing require to strong_parameters.rb
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 15:48:19 +0000