aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_dispatch/middleware
Commit message (Collapse)AuthorAgeFilesLines
* Add the `Mime::Type::InvalidMimeType` error in the default rescue_response:Edouard CHIN2019-03-263-3/+12
| | | | | | | | | | | | | | | - https://github.com/rails/rails/pull/35604 introduced a vulnerability fix to raise an error in case the `HTTP_ACCEPT` headers contains malformated mime type. This will cause applications to throw a 500 if a User Agent sends an invalid header. This PR adds the `InvalidMimeType` in the default `rescue_responses` from the ExceptionWrapper and will return a 406. I looked up the HTTP/1.1 RFC and it doesn't stand what should be returned when the UA sends malformated mime type. Decided to get 406 as it seemed to be the status the better suited for this.
* Merge pull request #35649 from andrehjr/fix-override-of-cookies-controller-specsRafael França2019-03-191-1/+1
|\ | | | | Don't override @set_cookies on CookieJar#update_cookies_from_jar'
| * Don't override @set_cookies on CookieJar#update_cookies_from_jar'André Luis Leal Cardoso Junior2019-03-171-1/+1
| | | | | | | | | | | | When building the cookie_jar for the current test request. It was possible for this method to override keys currently being set on the test itself. In situations such as when making two requests mixing creating the cookie on the test and the controller.
* | Instrument middleware processingDaniel Schierbeck2019-03-191-1/+22
|/ | | | | Adds ActiveSupport::Notifications instrumentation of the processing of each middleware in the stack.
* Merge tag 'v6.0.0.beta3'eileencodes2019-03-131-3/+4
|\ | | | | | | v6.0.0.beta3 release
| * Fix possible dev mode RCEAaron Patterson2019-03-101-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | If the secret_key_base is nil in dev or test generate a key from random bytes and store it in a tmp file. This prevents the app developers from having to share / checkin the secret key for dev / test but also maintains a key between app restarts in dev/test. [CVE-2019-5420] Co-Authored-By: eileencodes <eileencodes@gmail.com> Co-Authored-By: John Hawthorn <john@hawthorn.email>
* | Show friendly message to install action mailbox if the related table does ↵Prathamesh Sonpatki2019-03-122-0/+5
| | | | | | | | | | | | not exist - This is similar to the work done in https://github.com/rails/rails/pull/31534
* | Merge pull request #35121 from utilum/warning_tried_to_create_proc_without_blockKasper Timm Hansen2019-03-101-2/+2
|\ \ | |/ |/| Ruby 2.7 warning: creating a Proc without a block
| * ActionPack Proc.new without a blockutilum2019-02-131-2/+2
| | | | | | | | | | | | This commit fixes cases that use pre Ruby [r66772](https://bugs.ruby-lang.org/projects/ruby-trunk/repository/trunk/revisions/66772) syntax that are not tickled by the test suite.
* | Turn lookup context in to a stack, push and pop if formats changeAaron Patterson2019-02-111-2/+2
|/ | | | | | | | | | | This commit keeps a stack of lookup contexts on the ActionView::Base instance. If a format is passed to render, we instantiate a new lookup context and push it on the stack, that way any child calls to "render" will use the same format information as the parent. This also isolates "sibling" calls to render (multiple calls to render in the same template). Fixes #35222 #34138
* Pull generated methods up in to the anonymous subclassAaron Patterson2019-02-061-6/+1
| | | | Then we don't need the extra module.
* Move templates to an anonymous subclass of AV::BaseAaron Patterson2019-02-061-0/+9
| | | | | Now we can throw away the subclass and the generated methods will get GC'd too
* Merge pull request #35139 from 7coAim/fix_debug_exceptionsGeorge Claghorn2019-02-052-2/+2
|\ | | | | Fix NameError : Make debug exceptions works in an environment where ActiveStorage is not loaded.
| * fix NameErrorkurosawat2019-02-052-2/+2
| | | | | | | | NameError: uninitialized constant ActionView::CompiledTemplates::ActiveStorage
* | Merge pull request #35134 from Edouard-chin/ec-cookie-expiry-regressionRafael França2019-02-041-7/+2
|\ \ | | | | | | Cookie doesn't expire anymore unless a flag is set:
| * | Cookie doesn't expire anymore unless a flag is set:Edouard CHIN2019-02-041-7/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - There is a regression in 6.0 introduced by #32937 where cookie doesn't expire anymore unless the new `use_cookies_with_metadata` configuration is set to `true`. This causes issue for app migration from 5.2 to 6.0 because the `use_cookies_with_metadata` flag can't be set to true until all servers are running on 6.0. Here is a small reproduction script that you can run in the console ```ruby ActionDispatch::Cookies request = ActionDispatch::Request.empty request.env["action_dispatch.key_generator"] = ActiveSupport::KeyGenerator.new('1234567890') request.env["action_dispatch.signed_cookie_salt"] = 'signed cookie' request.env["action_dispatch.cookies_rotations"] = ActiveSupport::Messages::RotationConfiguration.new request.env["action_dispatch.use_authenticated_cookie_encryption"] = true signed_cookie = request.cookie_jar.signed signed_cookie[:foobar] = { value: '123', expires: 1.day.ago } p signed_cookie[:foobar] ```
* | Merge pull request #35086 from gsamokovarov/cleanup-whitelisting-refsGannon McGibbon2019-02-041-2/+2
|\ \ | |/ |/| Cleanup the whitelisting references after #33145
| * Cleanup the whitelisting references after #33145Genadi Samokovarov2019-02-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | During the development of #33145, I have named a few concepts in the code as `whitelisted`. We decided to stay away from the term and I adjusted most of the code afterwards, but here are the cases I forgot to change. I also found a case in the API guide that we could have cleaned up as well. [ci skip]
* | Tighten up the AV::Base constructorAaron Patterson2019-01-291-1/+3
|/ | | | | | | | | | | | | | | The AV::Base constructor was too complicated, and this commit tightens up the parameters it will take. At runtime, AV::Base is most commonly constructed here: https://github.com/rails/rails/blob/94d54fa4ab641a0ddeb173409cb41cc5becc02a9/actionview/lib/action_view/rendering.rb#L72-L74 This provides an AV::Renderer instance, a hash of assignments, and a controller instance. Since this is the common case for construction, we should remove logic from the constructor that handles other cases. This commit introduces special constructors for those other cases. Interestingly, most code paths that construct AV::Base "strangely" are tests.
* Fixed a bug where the debug view does not show the error page properlyYuki Nishijima2019-01-242-11/+15
| | | | | | | | | | | | | | | | | | | | | There are two cases where the debug view does not show the error details properly: * When the cause is mapped to an HTTP status code the last exception is unexpectedly uwrapped * When the last error is thrown from a view template the debug view is not using the `rescues/template_error.html.erb` to generate the view Both the cases could be fixed by not unwrapping the exception. The only case where the exception should be unwrapped is when the last error is an `ActionView::Template::Error` object. In this case the HTTP status code is determined based on the cause. There are actually more wrapper exceptions that are intentionally thrown. However, there is a consistent pattern of setting the original message and original backtrace to the wrapper exception implemented, so the debug view will not lose the information about what went wrong eariler.
* Recommend adding the requested domain to hosts whitelist only in developmentMarc Schütz2019-01-232-4/+4
|
* Remove secret_token rack env and cookie upgrade codeRafael Mendonça França2019-01-172-39/+1
| | | | Now that secret_token was removed all this code is now dead.
* Enable `Style/RedundantBegin` cop to avoid newly adding redundant begin blockRyuta Kamizono2018-12-214-24/+16
| | | | | | | | | | Currently we sometimes find a redundant begin block in code review (e.g. https://github.com/rails/rails/pull/33604#discussion_r209784205). I'd like to enable `Style/RedundantBegin` cop to avoid that, since rescue/else/ensure are allowed inside do/end blocks in Ruby 2.5 (https://bugs.ruby-lang.org/issues/12906), so we'd probably meets with that situation than before.
* Introduce a guard against DNS rebinding attacksGenadi Samokovarov2018-12-155-41/+169
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ActionDispatch::HostAuthorization is a new middleware that prevent against DNS rebinding and other Host header attacks. By default it is included only in the development environment with the following configuration: Rails.application.config.hosts = [ IPAddr.new("0.0.0.0/0"), # All IPv4 addresses. IPAddr.new("::/0"), # All IPv6 addresses. "localhost" # The localhost reserved domain. ] In other environments, `Rails.application.config.hosts` is empty and no Host header checks will be done. If you want to guard against header attacks on production, you have to manually permit the allowed hosts with: Rails.application.config.hosts << "product.com" The host of a request is checked against the hosts entries with the case operator (#===), which lets hosts support entries of type RegExp, Proc and IPAddr to name a few. Here is an example with a regexp. # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << /.*\.product\.com/ A special case is supported that allows you to permit all sub-domains: # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << ".product.com"
* Avoid extra array allocationsSamuel Cochran2018-11-291-2/+2
|
* Log exceptions atomicallySamuel Cochran2018-11-281-5/+8
| | | | | | When distributed over multiple logger calls the lines can become intermixed with other log statements. Combining them into a single logger call makes sure they always get logged together.
* Add `Style/RedundantFreeze` to remove redudant `.freeze`Yasuo Honda2018-09-296-30/+30
| | | | | | | | | | | | | | | | | | | | | Since Rails 6.0 will support Ruby 2.4.1 or higher `# frozen_string_literal: true` magic comment is enough to make string object frozen. This magic comment is enabled by `Style/FrozenStringLiteralComment` cop. * Exclude these files not to auto correct false positive `Regexp#freeze` - 'actionpack/lib/action_dispatch/journey/router/utils.rb' - 'activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb' It has been fixed by https://github.com/rubocop-hq/rubocop/pull/6333 Once the newer version of RuboCop released and available at Code Climate these exclude entries should be removed. * Replace `String#freeze` with `String#-@` manually if explicit frozen string objects are required - 'actionpack/test/controller/test_case_test.rb' - 'activemodel/test/cases/type/string_test.rb' - 'activesupport/lib/active_support/core_ext/string/strip.rb' - 'activesupport/test/core_ext/string_ext_test.rb' - 'railties/test/generators/actions_test.rb'
* Enable `Performance/UnfreezeString` copyuuji.yaginuma2018-09-233-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Ruby 2.3 or later, `String#+@` is available and `+@` is faster than `dup`. ```ruby # frozen_string_literal: true require "bundler/inline" gemfile(true) do source "https://rubygems.org" gem "benchmark-ips" end Benchmark.ips do |x| x.report('+@') { +"" } x.report('dup') { "".dup } x.compare! end ``` ``` $ ruby -v benchmark.rb ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux] Warming up -------------------------------------- +@ 282.289k i/100ms dup 187.638k i/100ms Calculating ------------------------------------- +@ 6.775M (± 3.6%) i/s - 33.875M in 5.006253s dup 3.320M (± 2.2%) i/s - 16.700M in 5.032125s Comparison: +@: 6775299.3 i/s dup: 3320400.7 i/s - 2.04x slower ```
* Focus search input after page load on /rails/info/routes (#33683)James Brooks2018-08-281-0/+3
|
* Purpose Metadata For Signed And Encrypted CookiesAssain2018-08-121-13/+29
| | | | | | | | | | | | | | | | Purpose metadata prevents cookie values from being copy-pasted and ensures that the cookie is used only for its originally intended purpose. The Purpose and Expiry metadata are embedded inside signed/encrypted cookies and will not be readable on previous versions of Rails. We can switch off purpose and expiry metadata embedded in signed and encrypted cookies using config.action_dispatch.use_cookies_with_metadata = false if you want your cookies to be readable on older versions of Rails.
* Enable Start/EndWith and RegexpMatch copsBart de Water2018-07-281-1/+1
| | | | | In cases where the MatchData object is not used, this provides a speed-up: https://github.com/JuanitoFatas/fast-ruby/#stringmatch-vs-stringmatch-vs-stringstart_withstringend_with-code-start-code-end
* Merge pull request #33229 from ↵Matthew Draper2018-07-252-2/+2
|\ | | | | | | | | albertoalmagro/albertoalmagro/prefer-rails-command-over-bin-rails Prefer rails command over bin/rails
| * Recommend use of rails over bin/railsAlberto Almagro2018-07-062-2/+2
| | | | | | | | | | | | | | | | | | As discussed in #33203 rails command already looks for, and runs, bin/rails if it is present. We were mixing recommendations within guides and USAGE guidelines, in some files we recommended using rails, in others bin/rails and in some cases we even had both options mixed together.
* | Show nested exceptions on the debug viewYuki Nishijima2018-07-159-62/+109
| |
* | Enable `Layout/EmptyLinesAroundBlockBody` to reduce review cost in the futureRyuta Kamizono2018-07-121-1/+0
|/ | | | | | | We sometimes ask "✂️ extra blank lines" to a contributor in reviews like https://github.com/rails/rails/pull/33337#discussion_r201509738. It is preferable to deal automatically without depending on manpower.
* Remove reference to session_store.rb initializerJustin Searls2018-06-121-1/+1
| | | | | | | | Rails no longer generates this file, but Google is still packed with results suggesting it should exist, so that the doc still pointed me to it threw me off (had I deleted it or something?). Probably be better to be vague and prompt the user to stick it in a config file they own. #33124
* Use the same tag as other views to display the error messageyuuji.yaginuma2018-04-231-1/+1
| | | | | | | | | Since other views use the `h2` tag, should also use `h2` on `missing_exact_template.html.erb`. https://github.com/rails/rails/blob/76acaf6eb9ef3635e4c6f2ca9dba34edb50f541d/actionpack/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb#L5 https://github.com/rails/rails/blob/76acaf6eb9ef3635e4c6f2ca9dba34edb50f541d/actionpack/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb#L11 https://github.com/rails/rails/blob/76acaf6eb9ef3635e4c6f2ca9dba34edb50f541d/actionpack/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb#L5
* Fix Style/RedundantReturn offensesBart de Water2018-04-211-1/+1
|
* Merge pull request #29286 from vinistock/create_missing_exact_template_exceptionRafael Mendonça França2018-04-203-5/+29
|\ | | | | | | Create MissingExactTemplate exception with separate template
| * Create MissingExactTemplate exception with separate templateVinicius Stock2018-04-203-5/+29
| |
* | Introduce ActionDispatch::DebugExceptions interceptorsGenadi Samokovarov2018-04-201-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Plugins interacting with the exceptions caught and displayed by ActionDispatch::DebugExceptions currently have to monkey patch it to get the much needed exception for their calculation. With DebugExceptions.register_interceptor, plugin authors can hook into DebugExceptions and process the exception, before being rendered. They can store it into the request and process it on the way back of the middleware chain execution or act on it straight in the interceptor. The interceptors can be play blocks, procs, lambdas or any object that responds to `#call`.
* | Fix broken nodocsChris Arcand2018-04-131-1/+1
| | | | | | | | | | This commit fixes all references in the codebase missing a trailing :, which causes the nodoc not to actually work :) [skip ci]
* | Use ASCII-8BIT paths in ActionDispatch::StaticAndrew White2018-03-221-3/+3
| | | | | | | | | | | | | | | | | | | | The rack gem returns PATH_INFO as an ASCII-8BIT encoded string but it was being converted to US-ASCII by the match? method because it was calling Rack::Utils.escape_path. To prevent incompatibile encoding warnings use ASCII-8BIT strings for the root path and let Ruby handle any filename encoding conversion. Fixes #32294, Closes #32314.
* | Check exclude before flagging cookies as secure in ActionDispatch::SSL (#32262)Catherine Khuu2018-03-151-1/+3
| | | | | | | | | | | | | | * Check exclude before flagging cookies as secure. * Update comments in ActionDispatch::SSL. [Catherine Khuu + Rafael Mendonça França]
* | Merge branch 'master' into update_default_hsts_max_ageGuillermo Iguaran2018-02-242-1/+4
|\|
| * Consistent behavior for session and cookies with to_h and to_hash methodIgor Kasyanchuk2018-01-311-0/+3
| |
| * Allow @ in X-Request-Id headerDaniel Colson2018-01-291-1/+1
| | | | | | | | | | | | | | It makes sense to be as strict as possible with headers from the outside world, but allowing @ to support Apache's mod_unique_id (see #31644) seems OK to me
* | Update default HSTS max-age value to 1 yearGrant Bourque2018-01-161-5/+4
|/ | | | | - Update the default HSTS max-age value to 31536000 seconds (1 year) to meet the minimum max-age requirement for https://hstspreload.org/.
* Help if Active Storage tables are missingClaudio B2017-12-213-0/+35
| | | | | | When a user tries to create a new attachment or blog and the matching table is missing from the database (`active_storage_attachments` and `active_storage_blobs` by default), an informative error is displayed that invites users to run the `active_storage:install` task.
* Fix tld_length documentationJoe Marty2017-11-211-1/+1
| | | Change recommendation for tld_length (for sharing cookies across subdomains of a 2-token TLD), to 2 instead of 1.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 05:31:40 +0000