aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_dispatch/middleware
Commit message (Collapse)AuthorAgeFilesLines
* Enable `Layout/EmptyLinesAroundAccessModifier` copRyuta Kamizono2019-06-1310-13/+0
| | | | | | | | | | | We sometimes say "✂️ newline after `private`" in a code review (e.g. https://github.com/rails/rails/pull/18546#discussion_r23188776, https://github.com/rails/rails/pull/34832#discussion_r244847195). Now `Layout/EmptyLinesAroundAccessModifier` cop have new enforced style `EnforcedStyle: only_before` (https://github.com/rubocop-hq/rubocop/pull/7059). That cop and enforced style will reduce the our code review cost.
* remove unused requires from debug_exceptionsyaojie2019-05-281-2/+0
|
* Make rescues layout responsiveChris Seelus2019-05-201-4/+9
|
* Merge pull request #36122 from ↵Gannon McGibbon2019-05-182-0/+69
|\ | | | | | | | | cseelus/respect-operating-system-color-scheme-for-errors Regard operating system color scheme for rescues
| * Implement dark color scheme for rescues layoutChris Seelus2019-05-182-0/+69
| |
* | Rename `hash` to `jar` in CookieJar.buildshioimm2019-05-181-2/+2
|/ | | | | | | In CookieJar.build, the name `hash` is used as block parameter name for tap method. However, it is actually not hash but a CookieJar's instance. The name `hash` was confusing, so replace with `jar`.
* Only build middleware proxy when instrumentatingJohn Hawthorn2019-05-081-2/+13
| | | | | | | | | | | | | | | | | The instrumentation proxy adds three stack frames per-middleware, even when nothing is listening. This commit, when the middleware stack is built, only adds instrumentation when the `process_middleware.action_dispatch` event has already been subscribed to. The advantage to this is that we don't have any extra stack frames in apps which don't need middleware instrumentation. The disadvantage is that the subscriptions need to be in place when the middleware stack is built (during app boot). I think this is likely okay because temporary AS::Notifications subscriptions are strongly discouraged.
* Auto-correct `Style/RedundantBegin` offenceRyuta Kamizono2019-05-081-5/+3
| | | | | This offenced code is introduced from forward ported #36196, since looks like 6-0-stable branch isn't checked by CodeClimate.
* Merge pull request #36196 from st0012/fix-29947Eileen M. Uchitelle2019-05-075-4/+14
| | | | | | | Hide malformed parameters from error page Accidentally merged this to 6-0-stable so forward porting it to master here instead.
* Refactor after the most recent code reviewGenadi Samokovarov2019-04-191-2/+2
|
* Dispatch actions only if config.consider_all_requests_local is setGenadi Samokovarov2019-04-191-1/+1
|
* Drop the ambiguous `ActiveSupport::ActionableError#===` checkGenadi Samokovarov2019-04-191-13/+11
|
* Manage ActionDispatch::ActionableExceptions from the default middleware stackGenadi Samokovarov2019-04-191-1/+1
|
* Introduce Actionable ErrorsGenadi Samokovarov2019-04-197-2/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Actionable errors let's you dispatch actions from Rails' error pages. This can help you save time if you have a clear action for the resolution of common development errors. The de-facto example are pending migrations. Every time pending migrations are found, a middleware raises an error. With actionable errors, you can run the migrations right from the error page. Other examples include Rails plugins that need to run a rake task to setup themselves. They can now raise actionable errors to run the setup straight from the error pages. Here is how to define an actionable error: ```ruby class PendingMigrationError < MigrationError #:nodoc: include ActiveSupport::ActionableError action "Run pending migrations" do ActiveRecord::Tasks::DatabaseTasks.migrate end end ``` To make an error actionable, include the `ActiveSupport::ActionableError` module and invoke the `action` class macro to define the action. An action needs a name and a procedure to execute. The name is shown as the name of a button on the error pages. Once clicked, it will invoke the given procedure.
* Fix annotated typoPrathamesh Sonpatki2019-03-291-1/+1
|
* Add the `Mime::Type::InvalidMimeType` error in the default rescue_response:Edouard CHIN2019-03-263-3/+12
| | | | | | | | | | | | | | | - https://github.com/rails/rails/pull/35604 introduced a vulnerability fix to raise an error in case the `HTTP_ACCEPT` headers contains malformated mime type. This will cause applications to throw a 500 if a User Agent sends an invalid header. This PR adds the `InvalidMimeType` in the default `rescue_responses` from the ExceptionWrapper and will return a 406. I looked up the HTTP/1.1 RFC and it doesn't stand what should be returned when the UA sends malformated mime type. Decided to get 406 as it seemed to be the status the better suited for this.
* Merge pull request #35649 from andrehjr/fix-override-of-cookies-controller-specsRafael França2019-03-191-1/+1
|\ | | | | Don't override @set_cookies on CookieJar#update_cookies_from_jar'
| * Don't override @set_cookies on CookieJar#update_cookies_from_jar'André Luis Leal Cardoso Junior2019-03-171-1/+1
| | | | | | | | | | | | When building the cookie_jar for the current test request. It was possible for this method to override keys currently being set on the test itself. In situations such as when making two requests mixing creating the cookie on the test and the controller.
* | Instrument middleware processingDaniel Schierbeck2019-03-191-1/+22
|/ | | | | Adds ActiveSupport::Notifications instrumentation of the processing of each middleware in the stack.
* Merge tag 'v6.0.0.beta3'eileencodes2019-03-131-3/+4
|\ | | | | | | v6.0.0.beta3 release
| * Fix possible dev mode RCEAaron Patterson2019-03-101-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | If the secret_key_base is nil in dev or test generate a key from random bytes and store it in a tmp file. This prevents the app developers from having to share / checkin the secret key for dev / test but also maintains a key between app restarts in dev/test. [CVE-2019-5420] Co-Authored-By: eileencodes <eileencodes@gmail.com> Co-Authored-By: John Hawthorn <john@hawthorn.email>
* | Show friendly message to install action mailbox if the related table does ↵Prathamesh Sonpatki2019-03-122-0/+5
| | | | | | | | | | | | not exist - This is similar to the work done in https://github.com/rails/rails/pull/31534
* | Merge pull request #35121 from utilum/warning_tried_to_create_proc_without_blockKasper Timm Hansen2019-03-101-2/+2
|\ \ | |/ |/| Ruby 2.7 warning: creating a Proc without a block
| * ActionPack Proc.new without a blockutilum2019-02-131-2/+2
| | | | | | | | | | | | This commit fixes cases that use pre Ruby [r66772](https://bugs.ruby-lang.org/projects/ruby-trunk/repository/trunk/revisions/66772) syntax that are not tickled by the test suite.
* | Turn lookup context in to a stack, push and pop if formats changeAaron Patterson2019-02-111-2/+2
|/ | | | | | | | | | | This commit keeps a stack of lookup contexts on the ActionView::Base instance. If a format is passed to render, we instantiate a new lookup context and push it on the stack, that way any child calls to "render" will use the same format information as the parent. This also isolates "sibling" calls to render (multiple calls to render in the same template). Fixes #35222 #34138
* Pull generated methods up in to the anonymous subclassAaron Patterson2019-02-061-6/+1
| | | | Then we don't need the extra module.
* Move templates to an anonymous subclass of AV::BaseAaron Patterson2019-02-061-0/+9
| | | | | Now we can throw away the subclass and the generated methods will get GC'd too
* Merge pull request #35139 from 7coAim/fix_debug_exceptionsGeorge Claghorn2019-02-052-2/+2
|\ | | | | Fix NameError : Make debug exceptions works in an environment where ActiveStorage is not loaded.
| * fix NameErrorkurosawat2019-02-052-2/+2
| | | | | | | | NameError: uninitialized constant ActionView::CompiledTemplates::ActiveStorage
* | Merge pull request #35134 from Edouard-chin/ec-cookie-expiry-regressionRafael França2019-02-041-7/+2
|\ \ | | | | | | Cookie doesn't expire anymore unless a flag is set:
| * | Cookie doesn't expire anymore unless a flag is set:Edouard CHIN2019-02-041-7/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - There is a regression in 6.0 introduced by #32937 where cookie doesn't expire anymore unless the new `use_cookies_with_metadata` configuration is set to `true`. This causes issue for app migration from 5.2 to 6.0 because the `use_cookies_with_metadata` flag can't be set to true until all servers are running on 6.0. Here is a small reproduction script that you can run in the console ```ruby ActionDispatch::Cookies request = ActionDispatch::Request.empty request.env["action_dispatch.key_generator"] = ActiveSupport::KeyGenerator.new('1234567890') request.env["action_dispatch.signed_cookie_salt"] = 'signed cookie' request.env["action_dispatch.cookies_rotations"] = ActiveSupport::Messages::RotationConfiguration.new request.env["action_dispatch.use_authenticated_cookie_encryption"] = true signed_cookie = request.cookie_jar.signed signed_cookie[:foobar] = { value: '123', expires: 1.day.ago } p signed_cookie[:foobar] ```
* | Merge pull request #35086 from gsamokovarov/cleanup-whitelisting-refsGannon McGibbon2019-02-041-2/+2
|\ \ | |/ |/| Cleanup the whitelisting references after #33145
| * Cleanup the whitelisting references after #33145Genadi Samokovarov2019-02-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | During the development of #33145, I have named a few concepts in the code as `whitelisted`. We decided to stay away from the term and I adjusted most of the code afterwards, but here are the cases I forgot to change. I also found a case in the API guide that we could have cleaned up as well. [ci skip]
* | Tighten up the AV::Base constructorAaron Patterson2019-01-291-1/+3
|/ | | | | | | | | | | | | | | The AV::Base constructor was too complicated, and this commit tightens up the parameters it will take. At runtime, AV::Base is most commonly constructed here: https://github.com/rails/rails/blob/94d54fa4ab641a0ddeb173409cb41cc5becc02a9/actionview/lib/action_view/rendering.rb#L72-L74 This provides an AV::Renderer instance, a hash of assignments, and a controller instance. Since this is the common case for construction, we should remove logic from the constructor that handles other cases. This commit introduces special constructors for those other cases. Interestingly, most code paths that construct AV::Base "strangely" are tests.
* Fixed a bug where the debug view does not show the error page properlyYuki Nishijima2019-01-242-11/+15
| | | | | | | | | | | | | | | | | | | | | There are two cases where the debug view does not show the error details properly: * When the cause is mapped to an HTTP status code the last exception is unexpectedly uwrapped * When the last error is thrown from a view template the debug view is not using the `rescues/template_error.html.erb` to generate the view Both the cases could be fixed by not unwrapping the exception. The only case where the exception should be unwrapped is when the last error is an `ActionView::Template::Error` object. In this case the HTTP status code is determined based on the cause. There are actually more wrapper exceptions that are intentionally thrown. However, there is a consistent pattern of setting the original message and original backtrace to the wrapper exception implemented, so the debug view will not lose the information about what went wrong eariler.
* Recommend adding the requested domain to hosts whitelist only in developmentMarc Schütz2019-01-232-4/+4
|
* Remove secret_token rack env and cookie upgrade codeRafael Mendonça França2019-01-172-39/+1
| | | | Now that secret_token was removed all this code is now dead.
* Enable `Style/RedundantBegin` cop to avoid newly adding redundant begin blockRyuta Kamizono2018-12-214-24/+16
| | | | | | | | | | Currently we sometimes find a redundant begin block in code review (e.g. https://github.com/rails/rails/pull/33604#discussion_r209784205). I'd like to enable `Style/RedundantBegin` cop to avoid that, since rescue/else/ensure are allowed inside do/end blocks in Ruby 2.5 (https://bugs.ruby-lang.org/issues/12906), so we'd probably meets with that situation than before.
* Introduce a guard against DNS rebinding attacksGenadi Samokovarov2018-12-155-41/+169
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ActionDispatch::HostAuthorization is a new middleware that prevent against DNS rebinding and other Host header attacks. By default it is included only in the development environment with the following configuration: Rails.application.config.hosts = [ IPAddr.new("0.0.0.0/0"), # All IPv4 addresses. IPAddr.new("::/0"), # All IPv6 addresses. "localhost" # The localhost reserved domain. ] In other environments, `Rails.application.config.hosts` is empty and no Host header checks will be done. If you want to guard against header attacks on production, you have to manually permit the allowed hosts with: Rails.application.config.hosts << "product.com" The host of a request is checked against the hosts entries with the case operator (#===), which lets hosts support entries of type RegExp, Proc and IPAddr to name a few. Here is an example with a regexp. # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << /.*\.product\.com/ A special case is supported that allows you to permit all sub-domains: # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << ".product.com"
* Avoid extra array allocationsSamuel Cochran2018-11-291-2/+2
|
* Log exceptions atomicallySamuel Cochran2018-11-281-5/+8
| | | | | | When distributed over multiple logger calls the lines can become intermixed with other log statements. Combining them into a single logger call makes sure they always get logged together.
* Add `Style/RedundantFreeze` to remove redudant `.freeze`Yasuo Honda2018-09-296-30/+30
| | | | | | | | | | | | | | | | | | | | | Since Rails 6.0 will support Ruby 2.4.1 or higher `# frozen_string_literal: true` magic comment is enough to make string object frozen. This magic comment is enabled by `Style/FrozenStringLiteralComment` cop. * Exclude these files not to auto correct false positive `Regexp#freeze` - 'actionpack/lib/action_dispatch/journey/router/utils.rb' - 'activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb' It has been fixed by https://github.com/rubocop-hq/rubocop/pull/6333 Once the newer version of RuboCop released and available at Code Climate these exclude entries should be removed. * Replace `String#freeze` with `String#-@` manually if explicit frozen string objects are required - 'actionpack/test/controller/test_case_test.rb' - 'activemodel/test/cases/type/string_test.rb' - 'activesupport/lib/active_support/core_ext/string/strip.rb' - 'activesupport/test/core_ext/string_ext_test.rb' - 'railties/test/generators/actions_test.rb'
* Enable `Performance/UnfreezeString` copyuuji.yaginuma2018-09-233-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Ruby 2.3 or later, `String#+@` is available and `+@` is faster than `dup`. ```ruby # frozen_string_literal: true require "bundler/inline" gemfile(true) do source "https://rubygems.org" gem "benchmark-ips" end Benchmark.ips do |x| x.report('+@') { +"" } x.report('dup') { "".dup } x.compare! end ``` ``` $ ruby -v benchmark.rb ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux] Warming up -------------------------------------- +@ 282.289k i/100ms dup 187.638k i/100ms Calculating ------------------------------------- +@ 6.775M (± 3.6%) i/s - 33.875M in 5.006253s dup 3.320M (± 2.2%) i/s - 16.700M in 5.032125s Comparison: +@: 6775299.3 i/s dup: 3320400.7 i/s - 2.04x slower ```
* Focus search input after page load on /rails/info/routes (#33683)James Brooks2018-08-281-0/+3
|
* Purpose Metadata For Signed And Encrypted CookiesAssain2018-08-121-13/+29
| | | | | | | | | | | | | | | | Purpose metadata prevents cookie values from being copy-pasted and ensures that the cookie is used only for its originally intended purpose. The Purpose and Expiry metadata are embedded inside signed/encrypted cookies and will not be readable on previous versions of Rails. We can switch off purpose and expiry metadata embedded in signed and encrypted cookies using config.action_dispatch.use_cookies_with_metadata = false if you want your cookies to be readable on older versions of Rails.
* Enable Start/EndWith and RegexpMatch copsBart de Water2018-07-281-1/+1
| | | | | In cases where the MatchData object is not used, this provides a speed-up: https://github.com/JuanitoFatas/fast-ruby/#stringmatch-vs-stringmatch-vs-stringstart_withstringend_with-code-start-code-end
* Merge pull request #33229 from ↵Matthew Draper2018-07-252-2/+2
|\ | | | | | | | | albertoalmagro/albertoalmagro/prefer-rails-command-over-bin-rails Prefer rails command over bin/rails
| * Recommend use of rails over bin/railsAlberto Almagro2018-07-062-2/+2
| | | | | | | | | | | | | | | | | | As discussed in #33203 rails command already looks for, and runs, bin/rails if it is present. We were mixing recommendations within guides and USAGE guidelines, in some files we recommended using rails, in others bin/rails and in some cases we even had both options mixed together.
* | Show nested exceptions on the debug viewYuki Nishijima2018-07-159-62/+109
| |
* | Enable `Layout/EmptyLinesAroundBlockBody` to reduce review cost in the futureRyuta Kamizono2018-07-121-1/+0
|/ | | | | | | We sometimes ask "✂️ extra blank lines" to a contributor in reviews like https://github.com/rails/rails/pull/33337#discussion_r201509738. It is preferable to deal automatically without depending on manpower.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 02:58:57 +0000