| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
| |
This merges in the code from the breach-mitigation-rails gem that masks
authenticity tokens on each request by XORing them with a random set of
bytes. The masking is used to make it impossible for an attacker to
steal a CSRF token from an SSL session by using techniques like the
BREACH attack.
The patch is pretty simple - I've copied over the [relevant
code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb)
and updated the tests to pass, mostly by adjusting stubs and mocks.
|
|\
| |
| | |
Fixes to ActionController::TemplateAssertions
|
| |
| |
| |
| |
| | |
The test was not failing for `assert_template file: nil` when a file
has been rendered.
|
| |
| |
| |
| |
| | |
since we pass `as` down, then we won't have to do an insert / delete
dance with the options hash
|
|/
|
|
|
|
| |
UnexpectedError exceptions wrap the original exception, and the original
exception may contain a reference to something that can't be marshal
dumped which will cause the process to die.
|
|\
| |
| | |
[ci skip] fix spelling of overridden
|
| | |
|
|/ |
|
| |
|
|
|
|
|
| |
Calling ActiveSupport::TestCase.i_suck_and_my_tests_are_order_dependent! in AS::TestCase makes
everyone's tests order dependent, which should never be done by the framework.
|
|
|
|
|
|
|
| |
This reverts commit 705977620539e2be6548027042f33175ebdc2505, reversing
changes made to dde91e9bf5ab246f0f684b40288b272f4ba9a699.
IT BROKE THE BUILD!!!
|
|
|
|
|
|
| |
You can now configure custom digest for cookies in the same way as `serializer`:
config.action_dispatch.cookies_digest = \SHA256'
|
| |
|
| |
|
|
|
|
| |
if we access the instance, we can free up lots of codes
|
| |
|
|
|
|
|
| |
especially if you're just going to add a call two lines down that
populates the cache. common.
|
| |
|
|
|
|
|
|
| |
Fixed broken test.
Thanks Stephen Richards for reporting.
|
|
|
|
|
| |
This is not storying the RouteSet instance anywhere as the other
examples in the file, so no need to use #tap.
|
|
|
|
|
|
|
|
|
|
|
| |
Email does not support relative links since there is no implicit host. Therefore all links inside of emails must be fully qualified URLs. All path helpers are now deprecated. When removed, the error will give early indication to developers to use `*_url` methods instead.
Currently if a developer uses a `*_path` helper, their tests and `mail_view` will not catch the mistake. The only way to see the error is by sending emails in production. Preventing sending out emails with non-working path's is the desired end goal of this PR.
Currently path helpers are mixed-in to controllers (the ActionMailer::Base acts as a controller). All `*_url` and `*_path` helpers are made available through the same module. This PR separates this behavior into two modules so we can extend the `*_path` methods to add a Deprecation to them. Once deprecated we can use this same area to raise a NoMethodError and add an informative message directing the developer to use `*_url` instead.
The module with warnings is only mixed in when a controller returns false from the newly added `supports_relative_path?`.
Paired @sgrif & @schneems
|
|\
| |
| |
| | |
remove empty unused method
|
|/ |
|
| |
|
|
|
|
| |
See https://github.com/rails/rails/pull/16234#commitcomment-7115670.
|
| |
|
| |
|
|
|
|
| |
Fixes https://github.com/rails/rails/issues/16119.
|
|\
| |
| |
| |
| | |
Conflicts:
actionpack/test/abstract_unit.rb
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
We are planning to remove mocha from our test suite because of
performance problems. To make this possible we should stop require mocha
on ActionSupport::TestCase.
This should not affect applications since users still need to add mocha
to Gemfile and this already load mocha.
Added FIXME notes to place that still need mocha removal
|
|\ \
| | |
| | | |
Fixes to request method test.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Since we're stubbing the request, the test is actually just asserting
that `@method = env['REQUEST_METHOD']`. In order to the test against
the methodoverride middleware, we should test it against an actual
request. However, Rack is already covering this scenario so we can
remove this test.
|
| | |
| | |
| | |
| | |
| | | |
There is already another test covering Request#request_method. This
test should cover Request#method.
|
| | | |
|
| |/
| |
| |
| |
| | |
The current test is asserting against an outdated version of
Request#method where HEAD requests are treated as GET requests.
|
| |
| |
| |
| |
| |
| |
| | |
Also cleanup test a bit
[related #14886]
[related #14743]
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The entire 127.0.0.0/8 range is assigned to the loopback address, not
only 127.0.0.0/24. This patch allows ActionDispatch::Request::LOCALHOST
to match any IPv4 127.0.0.0/8 loopback address.
The only place that the #local? method was previously under test was
in the show_expectations_test.rb file. I don't particularly like that
that's implicitly where this code is under test, and I feel like I
should move some of that testing code into the
test/dispatch/request_test.rb file, but I wanted some feedback first.
Credit goes to @sriedel for discovering the issue and adding the
patch.
|
| |
| |
| |
| | |
(I think)
|
| |
| |
| |
| |
| |
| | |
this prevents the array from being dumped as a DRbObject so we can
reduce communication with the server. the reporter should always exist
on the server side, so we don't have to worry about GC
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| |
| | |
only on forking systems though. Feel free to revert this if it causes
problems.
|
| |
| |
| |
| |
| | |
this allows us to avoid 2 hash allocations per named helper definition,
also we can avoid a `merge` and `delete`.
|
| |
| |
| |
| |
| | |
also if you want a path from a named helper, you should call
helper_path, not helper_url(:only_path => true).
|
| |
| |
| |
| |
| | |
Use an is_a check to ensure it's a Railsish app so we can avoid
respond_to calls everywhere.
|
| |
| |
| |
| |
| |
| | |
people may be passing filenames to the constructor that are not utf-8,
but they will assome that calling `original_filename` returns utf-8
(because that's what it used to do).
|
| |
| |
| |
| | |
These fixtures are not used in actionpack tests.
|
| |
| |
| |
| | |
Closes #16170
|
| | |
|