| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
| |
If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.
|
|
|
|
|
|
|
|
| |
e.g:
class LegacyPagesController < ApplicationController
content_security_policy false, only: :index
end
|
|
|
|
|
| |
https://bugs.ruby-lang.org/issues/12752
https://ruby-doc.org/core-2.4.0/String.html#method-i-unpack1
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When using rails routes with small terminal or complicated routes it can be
very difficult to understand where is the element listed in header. psql
had the same issue, that's why they created "expanded mode" you can
switch using `\x` or by starting psql with
```
-x
--expanded
Turn on the expanded table formatting mode. This is equivalent to the \x command.
```
The output is similar to one implemented here for rails routes:
db_user-# \du
List of roles
-[ RECORD 1 ]----------------------------------------------
Role name | super
Attributes | Superuser, Create role, Create DB
Member of | {}
-[ RECORD 2 ]----------------------------------------------
Role name | role
Attributes | Superuser, Create role, Create DB, Replication
Member of | {}
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* When getting an error that generates a screenshot it would be helpful
to be able to ctrl+click it to quickly open it in the browser, which
does not work with relative paths
This change addresses the need by:
* Changing `image_path` to disregard the relative path and use the
absolute one instead
|
|\ |
|
| |\
| | |
| | | |
Add support for automatic nonce generation for Rails UJS
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Because the UJS library creates a script tag to process responses it
normally requires the script-src attribute of the content security
policy to include 'unsafe-inline'.
To work around this we generate a per-request nonce value that is
embedded in a meta tag in a similar fashion to how CSRF protection
embeds its token in a meta tag. The UJS library can then read the
nonce value and set it on the dynamically generated script tag to
enable it to execute without needing 'unsafe-inline' enabled.
Nonce generation isn't 100% safe - if your script tag is including
user generated content in someway then it may be possible to exploit
an XSS vulnerability which can take advantage of the nonce. It is
however an improvement on a blanket permission for inline scripts.
It is also possible to use the nonce within your own script tags by
using `nonce: true` to set the nonce value on the tag, e.g
<%= javascript_tag nonce: true do %>
alert('Hello, World!');
<% end %>
Fixes #31689.
|
| |/
| |
| |
| |
| |
| | |
Found several instances.
Follow up on 63d530c5e68a8cf53603744789f53ccbc7ac1a0e
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Although the spec[1] is defined in such a way that a trailing semi-colon
is valid it also doesn't allow a semi-colon by itself to indicate an
empty policy. Therefore it's easier (and valid) just to omit it rather
than to detect whether the policy is empty or not.
[1]: https://www.w3.org/TR/CSP2/#policy-syntax
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This reverts commit 86f7c269073a3a9e6ddec9b957deaa2716f2627d, reversing
changes made to 5ece2e4a4459065b5efd976aebd209bbf0cab89b.
If a policy is set then we should generate it even if it's empty.
However what is happening is that we're accidentally generating an
empty policy when the initializer is commented out by default.
|
| |
| |
| |
| |
| |
| |
| |
| | |
`Rails.application.config.content_security_policy` is configured with no
policies by default. In this case, Content-Security-Policy header should
not be generated instead of generating the header with no directives.
Firefox also warns "Content Security Policy: Couldn't process unknown
directive ''".
|
| |
| |
| |
| |
| |
| | |
Skipping over 2.4.0 to sidestep the `"symbol_from_string".to_sym.dup` bug.
References #32028
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Global ignores at toplevel .gitignore
* Component-specific ignores in each toplevel directory
* Remove `actionview/test/tmp/.keep` for JRuby
```
rm actionview/test/tmp/ -fr
cd actionview/
bundle exec jruby -Itest test/template/digestor_test.rb
```
Related to #11743, #30392.
Closes #29978.
|
| | |
|
| | |
|
| |
| |
| |
| |
| | |
Some places we can't remove because Ruby still don't have a method
equivalent to strip_heredoc to be called in an already existent string.
|
| |
| |
| |
| |
| | |
Before, if the application defined after an engine this method would not
recognize the route since it was not defined insdie the engine.
|
| | |
|
| |
| |
| |
| |
| |
| |
| | |
It makes sense to be as strict as possible
with headers from the outside world,
but allowing @ to support Apache's mod_unique_id
(see #31644) seems OK to me
|
| | |
|
| | |
|
| | |
|
| | |
|
| |\
| | |
| | | |
Move browser config to its own class
|
| | | |
|
|/ /
| |
| |
| |
| | |
- Update the default HSTS max-age value to 31536000 seconds (1 year)
to meet the minimum max-age requirement for https://hstspreload.org/.
|
| | |
|
|\ \
| | |
| | | |
Refactor tests for request parameters to use more realistic setup
|
| |/
| |
| |
| |
| |
| |
| |
| |
| |
| | |
These assertions did matter due to the inconsistent behavior of
[the #parameters method][1]. Today, it behaves consistently and they
could be removed. Also, one of the methods was stubbed somewhat
incorrectly, so it is better not to stub and instead, make them close
to more realistic use cases.
[1]: https://github.com/rails/rails/pull/13999#issuecomment-34601746
|
|/ |
|
|
|
|
|
|
|
| |
`make_tmpname` was removed by https://github.com/ruby/ruby/commit/25d56ea7b7b52dc81af30c92a9a0e2d2dab6ff27.
In this case, we want a file name, not a `File`. So cannot use `Tempfile`.
Fixes #31458
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
`BigDecimal.new` has been deprecated in BigDecimal 1.3.3
which will be a default for Ruby 2.5.
Refer
https://github.com/ruby/bigdecimal/commit/533737338db915b00dc7168c3602e4b462b23503
* This commit has been made as follows:
```
cd rails
git grep -l BigDecimal.new | grep -v guides/source/5_0_release_notes.md | grep -v activesupport/test/xml_mini_test.rb | xargs sed -i -e "s/BigDecimal.new/BigDecimal/g"
```
- `activesupport/test/xml_mini_test.rb`
Editmanually to remove `.new` and `::`
- guides/source/5_0_release_notes.md
This is a Rails 5.0 release notes.
|
|\
| |
| | |
Initial support for running Rails on FIPS-certified systems
|
| |
| |
| |
| |
| |
| |
| |
| | |
implementation
and defaults to `Digest::MD5`.
Replaced calls to `::Digest::MD5.hexdigest` with calls to `ActiveSupport::Digest.hexdigest`.
|
| |
| |
| |
| | |
Follow up of #31432.
|
| |
| |
| |
| | |
Follow up of #31390.
|
| |
| |
| |
| | |
haven't specified manually another server.
|
| |
| |
| |
| | |
default headers set.
|
|\ \
| | |
| | |
| | |
| | | |
JackMc/fix-chrome-referrer-invalidauthenticitytoken
Fix issue #30658 by checking explicitly for 'null' referrer
|
| | | |
|
| | | |
|
| | | |
|
| | |
| | |
| | |
| | | |
Matches Hash#each behaviour as used in Rails 4.
|
| | |
| | |
| | | |
Use Object#deep_dup to safely duplicate policy values
|
| | | |
|
|\ \ \
| |_|/
|/| |
| | |
| | | |
mikeycgto/actiondispatch-cookie-store-test-updates
Update cookie_store_test to use encrypted cookies
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This now modernizes these tests to use encrypted cookies instead of
using secret_token HMACs. This commit also adds a tests to ensure
session cookies with :expires_after set are invalidated and no longer
accepted when the time has elapsed.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Not everyone uses iTerm2 and whereas Terminal.app on a mac just ignores
that and outputs the path, other terminals like those on Ubuntu do not.
A friendlier default is one that works by default.
Closes #31159
Closes #30957
|
| | | |
|