aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/controller/new_base
Commit message (Collapse)AuthorAgeFilesLines
* Always reject files external to appJohn Hawthorn2019-04-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when using `render file:`, it was possible to render files not only at an absolute path or relative to the current directory, but relative to ANY view paths. This was probably done for absolutely maximum compatibility when addressing CVE-2016-0752, but I think is unlikely to be used in practice. Tihs commit removes the ability to `render file:` with a path relative to a non-fallback view path. Make FallbackResolver.new private To ensure nobody is making FallbackResolvers other than "/" and "". Make reject_files_external_... no-op for fallbacks Because there are only two values used for path: "" and "/", and File.join("", "") == File.join("/", "") == "/", this method was only testing that the absolute paths started at "/" (which of course all do). This commit doesn't change any behaviour, but it makes it explicit that the FallbackFileSystemResolver works this way. Remove outside_app_allowed argument Deprecate find_all_anywhere This is now equivalent to find_all Remove outside_app argument Deprecate find_file for find Both LookupContext#find_file and PathSet#find_file are now equivalent to their respective #find methods.
* Introduce Template::File as new render file:John Hawthorn2019-03-271-6/+18
| | | | | | | | | | | | | | | | | | | | | | | The previous behaviour of render file: was essentially the same as render template:, except that templates can be specified as an absolute path on the filesystem. This makes sense for historic reasons, but now render file: is almost exclusively used to render raw files (not .erb) like public/404.html. In addition to complicating the code in template/resolver.rb, I think the current behaviour is surprising to developers. This commit deprecates the existing "lookup a template from anywhere" behaviour and replaces it with "render this file exactly as it is on disk". Handlers will no longer be used (it will render the same as if the :raw handler was used), but formats (.html, .xml, etc) will still be detected (and will default to :plain). The existing render file: behaviour was the path through which Rails apps were vulnerable in the recent CVE-2019-5418. Although the vulnerability has been patched in a fully backwards-compatible way, I think it's a strong hint that we should drop the existing previously-vulnerable behaviour if it isn't a benefit to developers.
* Address rubocop offencesRyuta Kamizono2019-03-211-1/+1
|
* Fix a ContentNegotiation test descriptionSharang Dashputre2019-03-191-1/+1
|
* Only accept formats from registered mime typesJohn Hawthorn2019-03-101-2/+12
| | | | | [CVE-2019-5418] [CVE-2019-5419]
* Templates should be eval'd in the context of an AV::Base objectAaron Patterson2019-01-171-55/+0
|
* Merge pull request #33949 from sjain1107/no-private-defKasper Timm Hansen2018-09-231-4/+5
|\ | | | | Remove private def
| * Remove private defSakshi Jain2018-09-231-4/+5
| |
* | Enable `Performance/UnfreezeString` copyuuji.yaginuma2018-09-231-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Ruby 2.3 or later, `String#+@` is available and `+@` is faster than `dup`. ```ruby # frozen_string_literal: true require "bundler/inline" gemfile(true) do source "https://rubygems.org" gem "benchmark-ips" end Benchmark.ips do |x| x.report('+@') { +"" } x.report('dup') { "".dup } x.compare! end ``` ``` $ ruby -v benchmark.rb ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux] Warming up -------------------------------------- +@ 282.289k i/100ms dup 187.638k i/100ms Calculating ------------------------------------- +@ 6.775M (± 3.6%) i/s - 33.875M in 5.006253s dup 3.320M (± 2.2%) i/s - 16.700M in 5.032125s Comparison: +@: 6775299.3 i/s dup: 3320400.7 i/s - 2.04x slower ```
* Remove `:api:` tag that has leaked on the doc directly [ci skip]Ryuta Kamizono2017-09-301-3/+0
| | | | | | | | | | | | Currently `:api:` tag has leaked on the doc directly since RDoc doesn't support `:api:` tag directive. http://api.rubyonrails.org/v5.1/classes/AbstractController/Rendering.html So `:api: private` doesn't work as expected. We are using `:nodoc:` for the purpose. Related #13989.
* Use frozen string literal in actionpack/Kir Shatrov2017-07-2916-0/+32
|
* Make actionpack frozen string friendlyKir Shatrov2017-07-242-2/+6
|
* Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"Matthew Draper2017-07-0218-18/+0
| | | | | This reverts commit 3420a14590c0e6915d8b6c242887f74adb4120f9, reversing changes made to afb66a5a598ce4ac74ad84b125a5abf046dcf5aa.
* Enforce frozen string in RubocopKir Shatrov2017-07-0118-0/+18
|
* Define path with __dir__bogdanvlviv2017-05-232-6/+6
| | | | | | ".. with __dir__ we can restore order in the Universe." - by @fxn Related to 5b8738c2df003a96f0e490c43559747618d10f5f
* "Use assert_nil if expecting nil. This will fail in minitest 6."Akira Matsuda2016-12-252-3/+3
|
* Privatize unneededly protected methods in Action Pack testsAkira Matsuda2016-12-232-10/+8
|
* Add more rubocop rules about whitespacesRafael Mendonça França2016-10-291-1/+1
|
* Remove deprecated support to :text in renderRafael Mendonça França2016-10-101-188/+0
|
* Fix broken comments indentation caused by rubocop auto-correct [ci skip]Ryuta Kamizono2016-09-141-1/+1
| | | | | | All indentation was normalized by rubocop auto-correct at 80e66cc4d90bf8c15d1a5f6e3152e90147f00772. But comments was still kept absolute position. This commit aligns comments with method definitions for consistency.
* Add three new rubocop rulesRafael Mendonça França2016-08-161-1/+1
| | | | | | | | Style/SpaceBeforeBlockBraces Style/SpaceInsideBlockBraces Style/SpaceInsideHashLiteralBraces Fix all violations in the repository.
* Fix broken alignments caused by auto-correct commit 411ccbdRyuta Kamizono2016-08-101-1/+2
| | | | Hash syntax auto-correcting breaks alignments. 411ccbdab2608c62aabdb320d52cb02d446bb39c
* code gardening: removes redundant selfsXavier Noria2016-08-081-1/+1
| | | | | | | | | A few have been left for aesthetic reasons, but have made a pass and removed most of them. Note that if the method `foo` returns an array, `foo << 1` is a regular push, nothing to do with assignments, so no self required.
* applies remaining conventions across the projectXavier Noria2016-08-066-9/+0
|
* normalizes indentation and whitespace across the projectXavier Noria2016-08-063-12/+12
|
* remove redundant curlies from hash argumentsXavier Noria2016-08-061-4/+2
|
* modernizes hash syntax in actionpackXavier Noria2016-08-0610-68/+68
|
* applies new string literal convention in actionpack/testXavier Noria2016-08-0619-74/+74
| | | | | The current code base is not uniform. After some discussion, we have chosen to go with double quotes by default.
* Deprecate :controller and :action path parametersAndrew White2016-03-017-12/+18
| | | | | | | | Allowing :controller and :action values to be specified via the path in config/routes.rb has been an underlying cause of a number of issues in Rails that have resulted in security releases. In light of this it's better that controllers and actions are explicitly whitelisted rather than trying to blacklist or sanitize 'bad' values.
* Handle response_body= when body is nileileencodes2016-01-301-0/+16
| | | | | | | | | There are some cases when the `body` in `response_body=` can be set to nil. One of those cases is in `actionpack-action_caching` which I found while upgrading it for Rails 5. It's not possible to run `body.each` on a `nil` body so we have to return after we run `response.reset_body!`.
* Push `before_sending` to super classeileencodes2015-12-061-1/+1
| | | | | | | | | | | | We want to get rid of the `Live::Response` so we are consolidating methods from `Live::Response` and `Response` by merging them together. This adds an `#empty` method to the request so we don't need to hard-code the empty array each time we call an empty `ActionDispatch::Request`. The work here is a continuation on combining controller and integration test code bases into one.
* Delete needless `require 'active_support/deprecation'`yui-knk2015-10-201-1/+0
| | | | | When `require 'active_support/rails'`, 'active_support/deprecation' is automatically loaded.
* Use `Mime[:foo]` instead of `Mime::Type[:FOO]` for back compatJeremy Daer2015-10-061-2/+2
| | | | | | | | | | | | | | | | | Rails 4.x and earlier didn't support `Mime::Type[:FOO]`, so libraries that support multiple Rails versions would've had to feature-detect whether to use `Mime::Type[:FOO]` or `Mime::FOO`. `Mime[:foo]` has been around for ages to look up registered MIME types by symbol / extension, though, so libraries and plugins can safely switch to that without breaking backward- or forward-compatibility. Note: `Mime::ALL` isn't a real MIME type and isn't registered for lookup by type or extension, so it's not available as `Mime[:all]`. We use it internally as a wildcard for `respond_to` negotiation. If you use this internal constant, continue to reference it with `Mime::ALL`. Ref. efc6dd550ee49e7e443f9d72785caa0f240def53
* stop calling deprecated methodsAaron Patterson2015-09-211-2/+2
| | | | | We should be asking the mime type method for the mime objects rather than via const lookup
* Set the content-type to `text/html` if the options[:html] is trueakihiro172015-08-291-1/+0
| | | | | | In this commit, we set the content-type to `text/html` in AbstractController if the `options[:html]` is true so that we don't include ActionView::Rendering into ActionController::Metal to set it properly. I removed the if `options[:plain]` statement because `AbstractController#rendered_format` returns `Mime::TEXT` by default.
* remove RackDelegation moduleAaron Patterson2015-08-261-2/+0
| | | | | | Since all controller instances are required to have a request and response object, RackDelegation is no longer needed (we always have to delegate to the response)
* include ActionView::Rendering in the minimal controllerAaron Patterson2015-08-261-0/+1
| | | | without this module, the content type is not set correctly
* provide a request and response to all controllersAaron Patterson2015-08-253-2/+4
| | | | | | | | | | Controllers should always have a request and response when responding. Since we make this The Rule(tm), then controllers don't need to be somewhere in limbo between "asking a response object for a rack response" or "I, myself contain a rack response". This duality leads to conditionals spread through the codebase that we can delete: * https://github.com/rails/rails/blob/85a78d9358aa728298cd020cdc842b55c16f9549/actionpack/lib/action_controller/metal.rb#L221-L223
* Fix another rack SPEC violationAaron Patterson2015-08-251-1/+1
|
* rack SPEC doesn't allow `first` on the bodyAaron Patterson2015-08-251-8/+12
| | | | collect the body and make assert against the collected body
* remove vestigial codeAaron Patterson2015-08-071-43/+0
| | | | | Looks like this was left over from converting Rails to Rack. I think it's safe to remove now.
* Stop using deprecated `render :text` in testPrem Sichanugrist2015-07-174-16/+16
| | | | | | | | | This will silence deprecation warnings. Most of the test can be changed from `render :text` to render `:plain` or `render :body` right away. However, there are some tests that needed to be fixed by hand as they actually assert the default Content-Type returned from `render :body`.
* Add deprecation warning for `render :text`Prem Sichanugrist2015-07-171-11/+42
| | | | | | We've started on discouraging the usage of `render :text` in #12374. This is a follow-up commit to make sure that we print out the deprecation warning.
* Fix test messages use directly true, false and nil instead of their symbolAkshay Vishnoi2015-03-191-3/+3
|
* Removing old helper that was necessary for compatibility with Ruby 1.8.xThiago Pradi2015-02-222-5/+3
|
* Consistent usage of spaces in hashes across our codebaseRafael Mendonça França2015-01-297-15/+15
|
* Switch to kwargs in ActionController::TestCase and ActionDispatch::IntegrationKir Shatrov2015-01-297-15/+15
| | | | | | | | Non-kwargs requests are deprecated now. Guides are updated as well. `post url, nil, nil, { a: 'b' }` doesn't make sense. `post url, params: { y: x }, session: { a: 'b' }` would be an explicit way to do the same
* Add `ActionController::Metal#set_request!`brainopia2015-01-211-0/+9
| | | | | Add `ActionController::Metal#set_request!` to set a request on controller instance without calling dispatch.
* Fix actionpack test cases broken by #16888Godfrey Chan2014-09-262-29/+9
|
* Fix typos like `a html` to `an html` and 'an mail' to 'an email'. [ci skip]Santosh Wadghule2014-07-141-2/+2
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 14:40:37 +0000