| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
| |
This bug affects `wss://` requests when running Action Cable in-app.
Fixes #23620.
|
|
|
|
|
| |
This will keep our current API working without having the users to
change their codebases.
|
|
|
|
|
|
| |
After registering new `:json` mime type `parsers.fetch` can't find the mime type because new mime type is not equal to old one. Using symbol of the mime type as key on parsers hash solves the problem.
Closes #23766
|
|\
| |
| |
| |
| | |
bf4/incorrect_to_accept_json_api_and_not_render_spec
The JSON API media type should only work wih a JSON API handler
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Since the media type 'application/vnd.api+json' is a spec,
it is inappropriate to handle it with the JSON renderer.
This PR removes support for a JSON API media type.
I would recommend the media type be registered on its own as `jsonapi`
when a jsonapi Renderer and deserializer (Http::Parameters::DEFAULT_PARSERS) are added.
Is related to work in https://github.com/rails/rails/pull/21496
|
|/ |
|
| |
|
| |
|
|
|
|
|
|
| |
Fixes some parts of #23148.
[ci skip]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Issue #16519 covers confusion potentially caused by how HTTP
headers, that contain underscores in their names, are retrieved
through `ActionDispatch::Http::Headers#[]`.
This confusion has its origin in how a CGI maps HTTP header names
to variable names. Even though underscores in header names
are rarely encountered, they are valid according to RFC822 [1].
Nonetheless CGI like variable names, as requested by the Rack
specfication, will only contain underscores and therefore the
original header name cannot be recovered after the Rack server passed
on the environemnt hash. Please, see also the disscussion on
StackOverflow [2], which also links to an explaination in the
nginx documentation [3].
[1] http://www.ietf.org/rfc/rfc822.txt
[2] http://stackoverflow.com/questions/22856136/why-underscores-are-forbidden-in-http-header-names
[3] https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#missing-disappearing-http-headers
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Accept header is taken from what Safari on El Capitan sends:
```ruby
require 'benchmark/ips'
require 'action_dispatch/http/mime_type'
require 'active_support/all'
accept = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
Benchmark.ips do |x|
x.report "omg" do
Mime::Type.parse(accept)
end
end
```
Before:
```
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 3.181k i/100ms
-------------------------------------------------
omg 35.062k (±12.8%) i/s - 174.955k
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 3.153k i/100ms
-------------------------------------------------
omg 33.724k (±12.4%) i/s - 167.109k
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 3.575k i/100ms
-------------------------------------------------
omg 37.251k (±10.4%) i/s - 185.900k
```
After:
```
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 3.365k i/100ms
-------------------------------------------------
omg 40.069k (±16.1%) i/s - 198.535k
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 4.168k i/100ms
-------------------------------------------------
omg 47.596k (± 7.7%) i/s - 237.576k
[aaron@TC actionpack (master)]$ be ruby ../x.rb
Calculating -------------------------------------
omg 4.282k i/100ms
-------------------------------------------------
omg 43.626k (±17.7%) i/s - 209.818k
```
|
|
|
|
|
|
|
| |
we never use this custom array outside the mime type `parse` method. We
can reduce the interaction to just a regular array, so we should use
that instead (IOW, there was nothing special about AcceptList so we
should remove it).
|
|
|
|
|
|
|
|
| |
Remove nonsense definition of == from `AcceptItem`. The definition only
compared names and not `q` values or even object identity. The only use
was in the `assort!` method that really just wanted the index of the
item given the item's name. Instead we just change the caller to use
`index` with the block form.
|
|
|
|
|
| |
This commit refactors the private methods that were just aliases to []
to just directly use [] and cache the return values on the stack.
|
|
|
|
|
| |
same strategy as `@text_xml_idx`: cache it on the stack to avoid ivar
lookups and the `||=` call.
|
|
|
|
|
| |
this eliminates the ivar lookup and also eliminates the `||=`
conditional that happens every time we called the `text_xml_idx` method.
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
|
| |
| |
| |
| |
| |
| |
| | |
Unknown mime types should not be cached globally. This global cache
leads to a memory leak and a denial of service vulnerability.
CVE-2016-0751
|
| |
| |
| |
| | |
ActionDispatch::Http::Cache::Response#etag= such that etags set in fresh_when and stale? are weak. For #17556.
|
| |
| |
| |
| |
| | |
Converting nbsp(\u{00A0}) to the normal ASCII space(\u{0020})
[ci skip]
|
| |
| |
| |
| |
| | |
This shouldn't generally come up: under a standard flow, we don't start
sending until after the commit. But application code always finds a way.
|
| | |
|
| |
| |
| |
| |
| |
| | |
is not a valid type
Closes #22747
|
|/
|
|
| |
Callers expect to be able to manipulate it.
|
| |
|
|
|
|
|
|
|
|
|
| |
I did this change but it is affecting how the request params end up
after being processed by the router.
To be in the safe side, I just take the format from the extension in the
URL when is not present in those params and it's being used only for the
`Request#formats` method
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
We don't want to commit the cookie jar more than once because then we
will be attempting to modify a frozen hash.
Fixes Railties test failure caused by 492b134.
|
|
|
|
|
|
|
|
|
|
|
| |
This adds a new method to request and response so we don't need to
violate the law of demeter.
We are changing `Request` and `Response` so that they always have a
`cookie_jar`
This is a continuation on work to combine integration and controller
test code bases in Rails.
|
|
|
|
|
|
|
|
|
|
|
|
| |
We want to get rid of the `Live::Response` so we are consolidating methods
from `Live::Response` and `Response` by merging them together.
This adds an `#empty` method to the request so we don't need to
hard-code the empty array each time we call an empty
`ActionDispatch::Request`.
The work here is a continuation on combining controller and integration
test code bases into one.
|
|
|
|
|
| |
The previous spelling seemed a bit too generous with the whitespace, and
looked out of place when amongst others.
|
|\
| |
| | |
In url_for, never append ? when the query string is empty anyway.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
It used to behave like this:
url_for(controller: 'x', action: 'y', q: {})
# -> "/x/y?"
We previously avoided empty query strings in most cases by removing
nil values, then checking whether params was empty. But as you can
see above, even non-empty params can yield an empty query string. So
I changed the code to just directly check whether the query string
ended up empty.
(To make everything more consistent, the "removing nil values"
functionality should probably move to ActionPack's Hash#to_query, the
place where empty hashes and arrays get removed. However, this would
change a lot more behavior.)
|
|\ \
| | |
| | |
| | |
| | | |
Add option to verify Origin header in CSRF checks
[Jeremy Daer + Rafael Mendonça França]
|
| | | |
|
|\ \ \
| |/ /
|/| | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The initial attempt was to remove the method at all in
https://github.com/sergey-alekseev/rails/commit/4926aa68c98673e7be88a2d2b57d72dc490bc71c.
The method overrides Rack's `#form_data?`
https://github.com/rack/rack/blob/6f8808d4201e68e4bd780441b3b7bb3ee6d1f43e/lib/rack/request.rb#L172-L184.
Which may have some incorrect implementation actually. `type.nil?` isn't possible I suppose. I'll check.
|
| |/
|/| |
|
| |
| |
| |
| | |
This is leftover from when `render nothing: true` rendered blank string.
|
| | |
|
|\ \
| | |
| | | |
Delete needless `require 'active_support/deprecation'`
|
| | |
| | |
| | |
| | |
| | | |
When `require 'active_support/rails'`, 'active_support/deprecation'
is automatically loaded.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Prior to this change, given a route:
# config/routes.rb
get ':a' => "foo#bar"
If one pointed to http://example.com/%BE (param `a` has invalid encoding),
a `BadRequest` would be raised with the following non-informative message:
ActionController::BadRequest
From now on the message displayed is:
Invalid parameter encoding: hi => "\xBE"
Fixes #21923.
|
| |
| |
| |
| |
| | |
Use the methods rack provides so we don't have to worry about the exact
header key.
|
| |
| |
| |
| |
| | |
Rack implements the Etag header manipulation methods, so we can use
those instead of ours.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Rails 4.x and earlier didn't support `Mime::Type[:FOO]`, so libraries
that support multiple Rails versions would've had to feature-detect
whether to use `Mime::Type[:FOO]` or `Mime::FOO`.
`Mime[:foo]` has been around for ages to look up registered MIME types
by symbol / extension, though, so libraries and plugins can safely
switch to that without breaking backward- or forward-compatibility.
Note: `Mime::ALL` isn't a real MIME type and isn't registered for lookup
by type or extension, so it's not available as `Mime[:all]`. We use it
internally as a wildcard for `respond_to` negotiation. If you use this
internal constant, continue to reference it with `Mime::ALL`.
Ref. efc6dd550ee49e7e443f9d72785caa0f240def53
|
| |
| |
| |
| |
| |
| |
| | |
Just a slight refactor that delegates file sending to the response
object. This gives us the advantage that if a webserver (in the future)
provides a response object that knows how to do accelerated file
serving, it can implement this method.
|
|\ \ |
|