From b50e88ebdf375cf81ad63586ce4599979262f975 Mon Sep 17 00:00:00 2001
From: yui-knk <spiketeika@gmail.com>
Date: Sat, 28 Nov 2015 16:32:24 +0900
Subject: Make `assert_recognizes` to traverse mounted engines

Before this commit paths of mounted engines are not traversed
when `assert_recognizes` is called, causing strange test results.
This commit enable to traverse mounted paths.
---
 actionpack/lib/action_dispatch/routing/endpoint.rb  | 10 ++++++----
 actionpack/lib/action_dispatch/routing/inspector.rb |  4 ++--
 actionpack/lib/action_dispatch/routing/route_set.rb |  7 +++++++
 3 files changed, 15 insertions(+), 6 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/endpoint.rb b/actionpack/lib/action_dispatch/routing/endpoint.rb
index 88aa13c3e8..819305615e 100644
--- a/actionpack/lib/action_dispatch/routing/endpoint.rb
+++ b/actionpack/lib/action_dispatch/routing/endpoint.rb
@@ -1,10 +1,12 @@
 module ActionDispatch
   module Routing
     class Endpoint # :nodoc:
-      def dispatcher?;   false; end
-      def redirect?;     false; end
-      def matches?(req); true;  end
-      def app;           self;  end
+      def dispatcher?;                           false; end
+      def redirect?;                             false; end
+      def engine?;       rack_app.respond_to?(:routes); end
+      def matches?(req);                          true; end
+      def app;                                    self; end
+      def rack_app;                                app; end
     end
   end
 end
diff --git a/actionpack/lib/action_dispatch/routing/inspector.rb b/actionpack/lib/action_dispatch/routing/inspector.rb
index 5d30a545a2..4e859fbac3 100644
--- a/actionpack/lib/action_dispatch/routing/inspector.rb
+++ b/actionpack/lib/action_dispatch/routing/inspector.rb
@@ -13,7 +13,7 @@ module ActionDispatch
       end
 
       def rack_app
-        app.app
+        app.rack_app
       end
 
       def path
@@ -45,7 +45,7 @@ module ActionDispatch
       end
 
       def engine?
-        rack_app.respond_to?(:routes)
+        app.engine?
       end
     end
 
diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb
index 16237bd564..d8df247068 100644
--- a/actionpack/lib/action_dispatch/routing/route_set.rb
+++ b/actionpack/lib/action_dispatch/routing/route_set.rb
@@ -751,6 +751,10 @@ module ActionDispatch
         end
 
         req = make_request(env)
+        recognize_path_with_request(req, path, extras)
+      end
+
+      def recognize_path_with_request(req, path, extras)
         @router.recognize(req) do |route, params|
           params.merge!(extras)
           params.each do |key, value|
@@ -770,6 +774,9 @@ module ActionDispatch
             end
 
             return req.path_parameters
+          elsif app.matches?(req) && app.engine?
+            path_parameters = app.rack_app.routes.recognize_path_with_request(req, path, extras)
+            return path_parameters
           end
         end
 
-- 
cgit v1.2.3


From ba04b580c6e56e366b1b8e4ef003e9a0c1c419bb Mon Sep 17 00:00:00 2001
From: Thomas Walpole <twalpole@gmail.com>
Date: Sun, 17 Sep 2017 15:04:20 -0700
Subject: Use the default Capybara registered puma server configuration

---
 actionpack/lib/action_dispatch/system_testing/server.rb | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/server.rb b/actionpack/lib/action_dispatch/system_testing/server.rb
index 76bada8df1..32aa6a4dc4 100644
--- a/actionpack/lib/action_dispatch/system_testing/server.rb
+++ b/actionpack/lib/action_dispatch/system_testing/server.rb
@@ -12,29 +12,17 @@ module ActionDispatch
       self.silence_puma = false
 
       def run
-        register
         setup
       end
 
       private
-        def register
-          Capybara.register_server :rails_puma do |app, port, host|
-            Rack::Handler::Puma.run(
-              app,
-              Port: port,
-              Threads: "0:1",
-              Silent: self.class.silence_puma
-            )
-          end
-        end
-
         def setup
           set_server
           set_port
         end
 
         def set_server
-          Capybara.server = :rails_puma
+          Capybara.server = :puma, { Silent: self.class.silence_puma }
         end
 
         def set_port
-- 
cgit v1.2.3


From 8b0af54bbe5ab8b598e980013dd53a50d819b636 Mon Sep 17 00:00:00 2001
From: Michael Coyne <mikeycgto@gmail.com>
Date: Sat, 23 Sep 2017 17:18:01 -0400
Subject: Add key rotation cookies middleware

Using the action_dispatch.cookies_rotations interface, key rotation is
now possible with cookies. Thus the secret_key_base as well as salts,
ciphers, and digests, can be rotated without expiring sessions.
---
 .../lib/action_dispatch/middleware/cookies.rb      | 182 ++++++++++-----------
 actionpack/lib/action_dispatch/railtie.rb          |   6 +-
 2 files changed, 86 insertions(+), 102 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index 845df500d8..b3831649a8 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -49,6 +49,18 @@ module ActionDispatch
       get_header Cookies::AUTHENTICATED_ENCRYPTED_COOKIE_SALT
     end
 
+    def use_authenticated_cookie_encryption
+      get_header Cookies::USE_AUTHENTICATED_COOKIE_ENCRYPTION
+    end
+
+    def encrypted_cookie_cipher
+      get_header Cookies::ENCRYPTED_COOKIE_CIPHER
+    end
+
+    def signed_cookie_digest
+      get_header Cookies::SIGNED_COOKIE_DIGEST
+    end
+
     def secret_token
       get_header Cookies::SECRET_TOKEN
     end
@@ -64,6 +76,11 @@ module ActionDispatch
     def cookies_digest
       get_header Cookies::COOKIES_DIGEST
     end
+
+    def cookies_rotations
+      get_header Cookies::COOKIES_ROTATIONS
+    end
+
     # :startdoc:
   end
 
@@ -157,10 +174,14 @@ module ActionDispatch
     ENCRYPTED_COOKIE_SALT = "action_dispatch.encrypted_cookie_salt".freeze
     ENCRYPTED_SIGNED_COOKIE_SALT = "action_dispatch.encrypted_signed_cookie_salt".freeze
     AUTHENTICATED_ENCRYPTED_COOKIE_SALT = "action_dispatch.authenticated_encrypted_cookie_salt".freeze
+    USE_AUTHENTICATED_COOKIE_ENCRYPTION = "action_dispatch.use_authenticated_cookie_encryption".freeze
+    ENCRYPTED_COOKIE_CIPHER = "action_dispatch.encrypted_cookie_cipher".freeze
+    SIGNED_COOKIE_DIGEST = "action_dispatch.signed_cookie_digest".freeze
     SECRET_TOKEN = "action_dispatch.secret_token".freeze
     SECRET_KEY_BASE = "action_dispatch.secret_key_base".freeze
     COOKIES_SERIALIZER = "action_dispatch.cookies_serializer".freeze
     COOKIES_DIGEST = "action_dispatch.cookies_digest".freeze
+    COOKIES_ROTATIONS = "action_dispatch.cookies_rotations".freeze
 
     # Cookies can typically store 4096 bytes.
     MAX_COOKIE_SIZE = 4096
@@ -201,12 +222,7 @@ module ActionDispatch
       #
       #   cookies.signed[:discount] # => 45
       def signed
-        @signed ||=
-          if upgrade_legacy_signed_cookies?
-            UpgradeLegacySignedCookieJar.new(self)
-          else
-            SignedCookieJar.new(self)
-          end
+        @signed ||= SignedKeyRotatingCookieJar.new(self)
       end
 
       # Returns a jar that'll automatically encrypt cookie values before sending them to the client and will decrypt them for read.
@@ -223,18 +239,11 @@ module ActionDispatch
       # Example:
       #
       #   cookies.encrypted[:discount] = 45
-      #   # => Set-Cookie: discount=ZS9ZZ1R4cG1pcUJ1bm80anhQang3dz09LS1mbDZDSU5scGdOT3ltQ2dTdlhSdWpRPT0%3D--ab54663c9f4e3bc340c790d6d2b71e92f5b60315; path=/
+      #   # => Set-Cookie: discount=DIQ7fw==--K3n//8vvnSbGq9dA--7Xh91HfLpwzbj1czhBiwOg==; path=/
       #
       #   cookies.encrypted[:discount] # => 45
       def encrypted
-        @encrypted ||=
-          if upgrade_legacy_signed_cookies?
-            UpgradeLegacyEncryptedCookieJar.new(self)
-          elsif upgrade_legacy_hmac_aes_cbc_cookies?
-            UpgradeLegacyHmacAesCbcCookieJar.new(self)
-          else
-            EncryptedCookieJar.new(self)
-          end
+        @encrypted ||= EncryptedKeyRotatingCookieJar.new(self)
       end
 
       # Returns the +signed+ or +encrypted+ jar, preferring +encrypted+ if +secret_key_base+ is set.
@@ -256,33 +265,17 @@ module ActionDispatch
 
         def upgrade_legacy_hmac_aes_cbc_cookies?
           request.secret_key_base.present?                       &&
-            request.authenticated_encrypted_cookie_salt.present? &&
             request.encrypted_signed_cookie_salt.present?        &&
-            request.encrypted_cookie_salt.present?
+            request.encrypted_cookie_salt.present?               &&
+            request.use_authenticated_cookie_encryption
         end
-    end
-
-    # Passing the ActiveSupport::MessageEncryptor::NullSerializer downstream
-    # to the Message{Encryptor,Verifier} allows us to handle the
-    # (de)serialization step within the cookie jar, which gives us the
-    # opportunity to detect and migrate legacy cookies.
-    module VerifyAndUpgradeLegacySignedMessage # :nodoc:
-      def initialize(*args)
-        super
-        @legacy_verifier = ActiveSupport::MessageVerifier.new(request.secret_token, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
-      end
 
-      def verify_and_upgrade_legacy_signed_message(name, signed_message)
-        deserialize(name, @legacy_verifier.verify(signed_message)).tap do |value|
-          self[name] = { value: value }
+        def encrypted_cookie_cipher
+          request.encrypted_cookie_cipher || "aes-256-gcm"
         end
-      rescue ActiveSupport::MessageVerifier::InvalidSignature
-        nil
-      end
 
-      private
-        def parse(name, signed_message)
-          super || verify_and_upgrade_legacy_signed_message(name, signed_message)
+        def signed_cookie_digest
+          request.signed_cookie_digest || "SHA1"
         end
     end
 
@@ -524,6 +517,7 @@ module ActionDispatch
 
     module SerializedCookieJars # :nodoc:
       MARSHAL_SIGNATURE = "\x04\x08".freeze
+      SERIALIZER = ActiveSupport::MessageEncryptor::NullSerializer
 
       protected
         def needs_migration?(value)
@@ -534,12 +528,16 @@ module ActionDispatch
           serializer.dump(value)
         end
 
-        def deserialize(name, value)
+        def deserialize(name)
+          rotate = false
+          value  = yield -> { rotate = true }
+
           if value
-            if needs_migration?(value)
-              Marshal.load(value).tap do |v|
-                self[name] = { value: v }
-              end
+            case
+            when needs_migration?(value)
+              self[name] = Marshal.load(value)
+            when rotate
+              self[name] = serializer.load(value)
             else
               serializer.load(value)
             end
@@ -561,24 +559,31 @@ module ActionDispatch
         def digest
           request.cookies_digest || "SHA1"
         end
-
-        def key_generator
-          request.key_generator
-        end
     end
 
-    class SignedCookieJar < AbstractCookieJar # :nodoc:
+    class SignedKeyRotatingCookieJar < AbstractCookieJar # :nodoc:
       include SerializedCookieJars
 
       def initialize(parent_jar)
         super
-        secret = key_generator.generate_key(request.signed_cookie_salt)
-        @verifier = ActiveSupport::MessageVerifier.new(secret, digest: digest, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
+
+        secret = request.key_generator.generate_key(request.signed_cookie_salt)
+        @verifier = ActiveSupport::MessageVerifier.new(secret, digest: signed_cookie_digest, serializer: SERIALIZER)
+
+        request.cookies_rotations.signed.each do |rotation_options|
+          @verifier.rotate serializer: SERIALIZER, **rotation_options
+        end
+
+        if upgrade_legacy_signed_cookies?
+          @verifier.rotate raw_key: request.secret_token, serializer: SERIALIZER
+        end
       end
 
       private
         def parse(name, signed_message)
-          deserialize name, @verifier.verified(signed_message)
+          deserialize(name) do |rotate|
+            @verifier.verified(signed_message, on_rotation: rotate)
+          end
         end
 
         def commit(options)
@@ -588,37 +593,38 @@ module ActionDispatch
         end
     end
 
-    # UpgradeLegacySignedCookieJar is used instead of SignedCookieJar if
-    # secrets.secret_token and secret_key_base are both set. It reads
-    # legacy cookies signed with the old dummy key generator and signs and
-    # re-saves them using the new key generator to provide a smooth upgrade path.
-    class UpgradeLegacySignedCookieJar < SignedCookieJar #:nodoc:
-      include VerifyAndUpgradeLegacySignedMessage
-    end
-
-    class EncryptedCookieJar < AbstractCookieJar # :nodoc:
+    class EncryptedKeyRotatingCookieJar < AbstractCookieJar # :nodoc:
       include SerializedCookieJars
 
       def initialize(parent_jar)
         super
 
-        if ActiveSupport::LegacyKeyGenerator === key_generator
-          raise "You didn't set secret_key_base, which is required for this cookie jar. " \
-            "Read the upgrade documentation to learn more about this new config option."
+        key_len = ActiveSupport::MessageEncryptor.key_len(encrypted_cookie_cipher)
+        secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, key_len)
+        @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: encrypted_cookie_cipher, serializer: SERIALIZER)
+
+        request.cookies_rotations.encrypted.each do |rotation_options|
+          @encryptor.rotate serializer: SERIALIZER, **rotation_options
         end
 
-        cipher = "aes-256-gcm"
-        key_len = ActiveSupport::MessageEncryptor.key_len(cipher)
-        secret = key_generator.generate_key(request.authenticated_encrypted_cookie_salt || "")[0, key_len]
+        if upgrade_legacy_hmac_aes_cbc_cookies?
+          @encryptor.rotate \
+            key_generator: request.key_generator, salt: request.encrypted_cookie_salt, signed_salt: request.encrypted_signed_cookie_salt,
+            cipher: "aes-256-cbc", digest: digest, serializer: SERIALIZER
+        end
 
-        @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: cipher, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
+        if upgrade_legacy_signed_cookies?
+          @legacy_verifier = ActiveSupport::MessageVerifier.new(request.secret_token, digest: digest, serializer: SERIALIZER)
+        end
       end
 
       private
         def parse(name, encrypted_message)
-          deserialize name, @encryptor.decrypt_and_verify(encrypted_message)
-        rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveSupport::MessageEncryptor::InvalidMessage
-          nil
+          deserialize(name) do |rotate|
+            @encryptor.decrypt_and_verify(encrypted_message, on_rotation: rotate)
+          end
+        rescue ActiveSupport::MessageEncryptor::InvalidMessage, ActiveSupport::MessageVerifier::InvalidSignature
+          parse_legacy_signed_message(name, encrypted_message)
         end
 
         def commit(options)
@@ -626,39 +632,15 @@ module ActionDispatch
 
           raise CookieOverflow if options[:value].bytesize > MAX_COOKIE_SIZE
         end
-    end
 
-    # UpgradeLegacyEncryptedCookieJar is used by ActionDispatch::Session::CookieStore
-    # instead of EncryptedCookieJar if secrets.secret_token and secret_key_base
-    # are both set. It reads legacy cookies signed with the old dummy key generator and
-    # encrypts and re-saves them using the new key generator to provide a smooth upgrade path.
-    class UpgradeLegacyEncryptedCookieJar < EncryptedCookieJar #:nodoc:
-      include VerifyAndUpgradeLegacySignedMessage
-    end
+        def parse_legacy_signed_message(name, legacy_signed_message)
+          if defined?(@legacy_verifier)
+            deserialize(name) do |rotate|
+              rotate.call
 
-    # UpgradeLegacyHmacAesCbcCookieJar is used by ActionDispatch::Session::CookieStore
-    # to upgrade cookies encrypted with AES-256-CBC with HMAC to AES-256-GCM
-    class UpgradeLegacyHmacAesCbcCookieJar < EncryptedCookieJar
-      def initialize(parent_jar)
-        super
-
-        secret = key_generator.generate_key(request.encrypted_cookie_salt || "")[0, ActiveSupport::MessageEncryptor.key_len]
-        sign_secret = key_generator.generate_key(request.encrypted_signed_cookie_salt || "")
-
-        @legacy_encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret, cipher: "aes-256-cbc", digest: digest, serializer: ActiveSupport::MessageEncryptor::NullSerializer)
-      end
-
-      def decrypt_and_verify_legacy_encrypted_message(name, signed_message)
-        deserialize(name, @legacy_encryptor.decrypt_and_verify(signed_message)).tap do |value|
-          self[name] = { value: value }
-        end
-      rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveSupport::MessageEncryptor::InvalidMessage
-        nil
-      end
-
-      private
-        def parse(name, signed_message)
-          super || decrypt_and_verify_legacy_encrypted_message(name, signed_message)
+              @legacy_verifier.verified(legacy_signed_message)
+            end
+          end
         end
     end
 
diff --git a/actionpack/lib/action_dispatch/railtie.rb b/actionpack/lib/action_dispatch/railtie.rb
index 4743a7ce61..855f2ffa47 100644
--- a/actionpack/lib/action_dispatch/railtie.rb
+++ b/actionpack/lib/action_dispatch/railtie.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "action_dispatch"
+require "active_support/messages/rotation_configuration"
 
 module ActionDispatch
   class Railtie < Rails::Railtie # :nodoc:
@@ -18,6 +19,7 @@ module ActionDispatch
     config.action_dispatch.signed_cookie_salt = "signed cookie"
     config.action_dispatch.encrypted_cookie_salt = "encrypted cookie"
     config.action_dispatch.encrypted_signed_cookie_salt = "signed encrypted cookie"
+    config.action_dispatch.authenticated_encrypted_cookie_salt = "authenticated encrypted cookie"
     config.action_dispatch.use_authenticated_cookie_encryption = false
     config.action_dispatch.perform_deep_munge = true
 
@@ -27,6 +29,8 @@ module ActionDispatch
       "X-Content-Type-Options" => "nosniff"
     }
 
+    config.action_dispatch.cookies_rotations = ActiveSupport::Messages::RotationConfiguration.new
+
     config.eager_load_namespaces << ActionDispatch
 
     initializer "action_dispatch.configure" do |app|
@@ -39,8 +43,6 @@ module ActionDispatch
       ActionDispatch::ExceptionWrapper.rescue_responses.merge!(config.action_dispatch.rescue_responses)
       ActionDispatch::ExceptionWrapper.rescue_templates.merge!(config.action_dispatch.rescue_templates)
 
-      config.action_dispatch.authenticated_encrypted_cookie_salt = "authenticated encrypted cookie" if config.action_dispatch.use_authenticated_cookie_encryption
-
       config.action_dispatch.always_write_cookie = Rails.env.development? if config.action_dispatch.always_write_cookie.nil?
       ActionDispatch::Cookies::CookieJar.always_write_cookie = config.action_dispatch.always_write_cookie
 
-- 
cgit v1.2.3


From 9d79d77813c3aca010a5b40cacbd6e68f42ce618 Mon Sep 17 00:00:00 2001
From: Kasper Timm Hansen <kaspth@gmail.com>
Date: Sun, 24 Sep 2017 21:25:59 +0200
Subject: Use new rotation signature in cookies.

[ Michael Coyne & Kasper Timm Hansen ]
---
 .../lib/action_dispatch/middleware/cookies.rb      | 23 +++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index b3831649a8..06ce0b22f4 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -264,9 +264,9 @@ module ActionDispatch
         end
 
         def upgrade_legacy_hmac_aes_cbc_cookies?
-          request.secret_key_base.present?                       &&
-            request.encrypted_signed_cookie_salt.present?        &&
-            request.encrypted_cookie_salt.present?               &&
+          request.secret_key_base.present? &&
+            request.encrypted_signed_cookie_salt.present? &&
+            request.encrypted_cookie_salt.present? &&
             request.use_authenticated_cookie_encryption
         end
 
@@ -570,12 +570,12 @@ module ActionDispatch
         secret = request.key_generator.generate_key(request.signed_cookie_salt)
         @verifier = ActiveSupport::MessageVerifier.new(secret, digest: signed_cookie_digest, serializer: SERIALIZER)
 
-        request.cookies_rotations.signed.each do |rotation_options|
-          @verifier.rotate serializer: SERIALIZER, **rotation_options
+        request.cookies_rotations.signed.each do |*secrets, **options|
+          @verifier.rotate *secrets, serializer: SERIALIZER, **options
         end
 
         if upgrade_legacy_signed_cookies?
-          @verifier.rotate raw_key: request.secret_token, serializer: SERIALIZER
+          @verifier.rotate request.secret_token, serializer: SERIALIZER
         end
       end
 
@@ -603,14 +603,15 @@ module ActionDispatch
         secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, key_len)
         @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: encrypted_cookie_cipher, serializer: SERIALIZER)
 
-        request.cookies_rotations.encrypted.each do |rotation_options|
-          @encryptor.rotate serializer: SERIALIZER, **rotation_options
+        request.cookies_rotations.encrypted.each do |*secrets, **options|
+          @encryptor.rotate *secrets, serializer: SERIALIZER, **options
         end
 
         if upgrade_legacy_hmac_aes_cbc_cookies?
-          @encryptor.rotate \
-            key_generator: request.key_generator, salt: request.encrypted_cookie_salt, signed_salt: request.encrypted_signed_cookie_salt,
-            cipher: "aes-256-cbc", digest: digest, serializer: SERIALIZER
+          secret = request.key_generator.generate_key(request.encrypted_cookie_salt)
+          sign_secret = request.key_generator.generate_key(request.encrypted_signed_cookie_salt)
+
+          @encryptor.rotate secret, sign_secret, cipher: "aes-256-cbc", digest: digest, serializer: SERIALIZER
         end
 
         if upgrade_legacy_signed_cookies?
-- 
cgit v1.2.3


From 8b1fe28017b264de770e15f2417e84ef57ae0571 Mon Sep 17 00:00:00 2001
From: Ryuta Kamizono <kamipo@gmail.com>
Date: Mon, 25 Sep 2017 05:31:08 +0900
Subject: Fix "warning: `*' interpreted as argument prefix"

---
 actionpack/lib/action_dispatch/middleware/cookies.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index 06ce0b22f4..baffe200bc 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -571,7 +571,7 @@ module ActionDispatch
         @verifier = ActiveSupport::MessageVerifier.new(secret, digest: signed_cookie_digest, serializer: SERIALIZER)
 
         request.cookies_rotations.signed.each do |*secrets, **options|
-          @verifier.rotate *secrets, serializer: SERIALIZER, **options
+          @verifier.rotate(*secrets, serializer: SERIALIZER, **options)
         end
 
         if upgrade_legacy_signed_cookies?
@@ -604,7 +604,7 @@ module ActionDispatch
         @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: encrypted_cookie_cipher, serializer: SERIALIZER)
 
         request.cookies_rotations.encrypted.each do |*secrets, **options|
-          @encryptor.rotate *secrets, serializer: SERIALIZER, **options
+          @encryptor.rotate(*secrets, serializer: SERIALIZER, **options)
         end
 
         if upgrade_legacy_hmac_aes_cbc_cookies?
-- 
cgit v1.2.3


From 1fa268bfa5667a0e9ddbfda243b5282c023ab9ad Mon Sep 17 00:00:00 2001
From: Kasper Timm Hansen <kaspth@gmail.com>
Date: Mon, 25 Sep 2017 20:28:26 +0200
Subject: Fix cookies/session tests broken after merging key rotation.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based on, yet closes https://github.com/rails/rails/pull/30708

Fix the session test by properly truncating the legacy encryption
key for cbc encryption. Borrowed straight from 👆.

Fix the cookies test a little differently than the PR. Basically
keep every config within the config block.

[ Michael Coyne & Kasper Timm Hansen ]
---
 actionpack/lib/action_dispatch/middleware/cookies.rb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index baffe200bc..0213987c99 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -608,10 +608,11 @@ module ActionDispatch
         end
 
         if upgrade_legacy_hmac_aes_cbc_cookies?
-          secret = request.key_generator.generate_key(request.encrypted_cookie_salt)
+          legacy_cipher = "aes-256-cbc"
+          secret = request.key_generator.generate_key(request.encrypted_cookie_salt, ActiveSupport::MessageEncryptor.key_len(legacy_cipher))
           sign_secret = request.key_generator.generate_key(request.encrypted_signed_cookie_salt)
 
-          @encryptor.rotate secret, sign_secret, cipher: "aes-256-cbc", digest: digest, serializer: SERIALIZER
+          @encryptor.rotate(secret, sign_secret, cipher: legacy_cipher, digest: digest, serializer: SERIALIZER)
         end
 
         if upgrade_legacy_signed_cookies?
-- 
cgit v1.2.3


From 0fb6b2d572b50493e3d69cea17eb60d3c91a0dbd Mon Sep 17 00:00:00 2001
From: Michael Coyne <mikeycgto@gmail.com>
Date: Sun, 24 Sep 2017 13:38:27 -0400
Subject: Fixes for use_authenticated_cookie_encryption

Use CBC encryption is this configuration value is set to false
---
 actionpack/lib/action_dispatch/middleware/cookies.rb | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index baffe200bc..eb193fcbfb 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -599,9 +599,16 @@ module ActionDispatch
       def initialize(parent_jar)
         super
 
-        key_len = ActiveSupport::MessageEncryptor.key_len(encrypted_cookie_cipher)
-        secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, key_len)
-        @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: encrypted_cookie_cipher, serializer: SERIALIZER)
+        if request.use_authenticated_cookie_encryption
+          key_len = ActiveSupport::MessageEncryptor.key_len(encrypted_cookie_cipher)
+          secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, key_len)
+          @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: encrypted_cookie_cipher, serializer: SERIALIZER)
+        else
+          key_len = ActiveSupport::MessageEncryptor.key_len("aes-256-cbc")
+          secret = request.key_generator.generate_key(request.encrypted_cookie_salt, key_len)
+          sign_secret = request.key_generator.generate_key(request.encrypted_signed_cookie_salt)
+          @encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret, cipher: "aes-256-cbc", serializer: SERIALIZER)
+        end
 
         request.cookies_rotations.encrypted.each do |*secrets, **options|
           @encryptor.rotate(*secrets, serializer: SERIALIZER, **options)
-- 
cgit v1.2.3


From 41e2fabf6d569c17099e7c1e013f82073c4f63b8 Mon Sep 17 00:00:00 2001
From: "T.J. Schuck" <tj@tjschuck.com>
Date: Wed, 27 Sep 2017 14:44:03 -0400
Subject: Fix formatting in ActionDispatch::SSL middleware docs

Before: https://monosnap.com/file/J6xewF0tYpm6dC9nSTe82ddsHAOcM5.png

After: https://monosnap.com/file/0tCYicLXNqRHAEMDb81u0aLb3gH9Wf.png

[ci skip]
---
 actionpack/lib/action_dispatch/middleware/ssl.rb | 71 +++++++++++++-----------
 1 file changed, 38 insertions(+), 33 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/ssl.rb b/actionpack/lib/action_dispatch/middleware/ssl.rb
index 45290b6ac3..9e1684f689 100644
--- a/actionpack/lib/action_dispatch/middleware/ssl.rb
+++ b/actionpack/lib/action_dispatch/middleware/ssl.rb
@@ -1,50 +1,55 @@
 # frozen_string_literal: true
 
 module ActionDispatch
-  # This middleware is added to the stack when `config.force_ssl = true`, and is passed
-  # the options set in `config.ssl_options`. It does three jobs to enforce secure HTTP
+  # This middleware is added to the stack when <tt>config.force_ssl = true</tt>, and is passed
+  # the options set in +config.ssl_options+. It does three jobs to enforce secure HTTP
   # requests:
   #
-  #   1. TLS redirect: Permanently redirects http:// requests to https://
-  #      with the same URL host, path, etc. Enabled by default. Set `config.ssl_options`
-  #      to modify the destination URL
-  #      (e.g. `redirect: { host: "secure.widgets.com", port: 8080 }`), or set
-  #      `redirect: false` to disable this feature.
+  # 1. <b>TLS redirect</b>: Permanently redirects +http://+ requests to +https://+
+  #    with the same URL host, path, etc. Enabled by default. Set +config.ssl_options+
+  #    to modify the destination URL
+  #    (e.g. <tt>redirect: { host: "secure.widgets.com", port: 8080 }</tt>), or set
+  #    <tt>redirect: false</tt> to disable this feature.
   #
-  #   2. Secure cookies: Sets the `secure` flag on cookies to tell browsers they
-  #      mustn't be sent along with http:// requests. Enabled by default. Set
-  #      `config.ssl_options` with `secure_cookies: false` to disable this feature.
+  #    Requests can opt-out of redirection with +exclude+:
   #
-  #   3. HTTP Strict Transport Security (HSTS): Tells the browser to remember
-  #      this site as TLS-only and automatically redirect non-TLS requests.
-  #      Enabled by default. Configure `config.ssl_options` with `hsts: false` to disable.
+  #      config.ssl_options = { redirect: { exclude: -> request { request.path =~ /healthcheck/ } } }
   #
-  # Set `config.ssl_options` with `hsts: { … }` to configure HSTS:
-  #   * `expires`: How long, in seconds, these settings will stick. The minimum
-  #     required to qualify for browser preload lists is `18.weeks`. Defaults to
-  #     `180.days` (recommended).
-  #   * `subdomains`: Set to `true` to tell the browser to apply these settings
-  #     to all subdomains. This protects your cookies from interception by a
-  #     vulnerable site on a subdomain. Defaults to `true`.
-  #   * `preload`: Advertise that this site may be included in browsers'
-  #     preloaded HSTS lists. HSTS protects your site on every visit *except the
-  #     first visit* since it hasn't seen your HSTS header yet. To close this
-  #     gap, browser vendors include a baked-in list of HSTS-enabled sites.
-  #     Go to https://hstspreload.appspot.com to submit your site for inclusion.
-  #     Defaults to `false`.
+  # 2. <b>Secure cookies</b>: Sets the +secure+ flag on cookies to tell browsers they
+  #    must not be sent along with +http://+ requests. Enabled by default. Set
+  #    +config.ssl_options+ with <tt>secure_cookies: false</tt> to disable this feature.
   #
-  # To turn off HSTS, omitting the header is not enough. Browsers will remember the
-  # original HSTS directive until it expires. Instead, use the header to tell browsers to
-  # expire HSTS immediately. Setting `hsts: false` is a shortcut for
-  # `hsts: { expires: 0 }`.
+  # 3. <b>HTTP Strict Transport Security (HSTS)</b>: Tells the browser to remember
+  #    this site as TLS-only and automatically redirect non-TLS requests.
+  #    Enabled by default. Configure +config.ssl_options+ with <tt>hsts: false</tt> to disable.
   #
-  # Requests can opt-out of redirection with `exclude`:
+  #    Set +config.ssl_options+ with <tt>hsts: { ... }</tt> to configure HSTS:
   #
-  #    config.ssl_options = { redirect: { exclude: -> request { request.path =~ /healthcheck/ } } }
+  #    * +expires+: How long, in seconds, these settings will stick. The minimum
+  #      required to qualify for browser preload lists is 18 weeks. Defaults to
+  #      180 days (recommended).
+  #
+  #    * +subdomains+: Set to +true+ to tell the browser to apply these settings
+  #      to all subdomains. This protects your cookies from interception by a
+  #      vulnerable site on a subdomain. Defaults to +true+.
+  #
+  #    * +preload+: Advertise that this site may be included in browsers'
+  #      preloaded HSTS lists. HSTS protects your site on every visit <i>except the
+  #      first visit</i> since it hasn't seen your HSTS header yet. To close this
+  #      gap, browser vendors include a baked-in list of HSTS-enabled sites.
+  #      Go to https://hstspreload.org to submit your site for inclusion.
+  #      Defaults to +false+.
+  #
+  #    To turn off HSTS, omitting the header is not enough. Browsers will remember the
+  #    original HSTS directive until it expires. Instead, use the header to tell browsers to
+  #    expire HSTS immediately. Setting <tt>hsts: false</tt> is a shortcut for
+  #    <tt>hsts: { expires: 0 }</tt>.
   class SSL
+    # :stopdoc:
+
     # Default to 180 days, the low end for https://www.ssllabs.com/ssltest/
     # and greater than the 18-week requirement for browser preload lists.
-    HSTS_EXPIRES_IN = 15552000
+    HSTS_EXPIRES_IN = 180.days.to_i
 
     def self.default_hsts_options
       { expires: HSTS_EXPIRES_IN, subdomains: true, preload: false }
-- 
cgit v1.2.3


From 5d149048ffa56c8fa1c41d1ef3bcf9472052f369 Mon Sep 17 00:00:00 2001
From: "yuuji.yaginuma" <yuuji.yaginuma@gmail.com>
Date: Sat, 30 Sep 2017 09:06:48 +0900
Subject: Don't use Active Support where it is not needed.

This code has been changed with https://github.com/rails/rails/pull/30735/files#diff-8e5f6b33c191ad6dec07f3288345a13fL47.

However, `active_support/time` is not load automatically, so if use
Action Pack alone, `days` method can not use and an error occurs.
In this case, I think that there is no problem by specifying a value
with Integer.
---
 actionpack/lib/action_dispatch/middleware/ssl.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/ssl.rb b/actionpack/lib/action_dispatch/middleware/ssl.rb
index 9e1684f689..ef633aadc6 100644
--- a/actionpack/lib/action_dispatch/middleware/ssl.rb
+++ b/actionpack/lib/action_dispatch/middleware/ssl.rb
@@ -49,7 +49,7 @@ module ActionDispatch
 
     # Default to 180 days, the low end for https://www.ssllabs.com/ssltest/
     # and greater than the 18-week requirement for browser preload lists.
-    HSTS_EXPIRES_IN = 180.days.to_i
+    HSTS_EXPIRES_IN = 15552000
 
     def self.default_hsts_options
       { expires: HSTS_EXPIRES_IN, subdomains: true, preload: false }
-- 
cgit v1.2.3


From 59a02fb7bcbe68f26e1e7fdcec45c00c66e4a065 Mon Sep 17 00:00:00 2001
From: eileencodes <eileencodes@gmail.com>
Date: Tue, 26 Sep 2017 13:27:53 -0400
Subject: Implement H2 Early Hints for Rails

When puma/puma#1403 is merged Puma will support the Early Hints status
code for sending assets before a request has finished.

While the Early Hints spec is still in draft, this PR prepares Rails to
allowing this status code.

If the proxy server supports Early Hints, it will send H2 pushes to the
client.

This PR adds a method for setting Early Hints Link headers via Rails,
and also automatically sends Early Hints if supported from the
`stylesheet_link_tag` and the `javascript_include_tag`.

Once puma supports Early Hints the `--early-hints` argument can be
passed to the server to enable this or set in the puma config with
`early_hints(true)`. Note that for Early Hints to work
in the browser the requirements are 1) a proxy that can handle H2,
and 2) HTTPS.

To start the server with Early Hints enabled pass `--early-hints` to
`rails s`.

This has been verified to work with h2o, Puma, and Rails with Chrome.

The commit adds a new option to the rails server to enable early hints
for Puma.

Early Hints spec:
https://tools.ietf.org/html/draft-ietf-httpbis-early-hints-04

[Eileen M. Uchitelle, Aaron Patterson]
---
 actionpack/lib/action_dispatch/http/request.rb | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index dee7be184a..5c172aecad 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -199,6 +199,23 @@ module ActionDispatch
       @headers ||= Http::Headers.new(self)
     end
 
+    # Early Hints is an HTTP/2 status code that indicates hints to help a client start
+    # making preparations for processing the final response.
+    #
+    # If the env contains +rack.early_hints+ then the server accepts HTTP2 push for Link headers.
+    #
+    # The +send_early_hints+ method accepts an hash of links as follows:
+    #
+    #   send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
+    #
+    # If you are using +javascript_include_tag+ or +stylesheet_link_tag+ the
+    # Early Hints headers are included by default if supported.
+    def send_early_hints(links)
+      return unless env["rack.early_hints"]
+
+      env["rack.early_hints"].call(links)
+    end
+
     # Returns a +String+ with the last requested path including their params.
     #
     #    # get '/foo'
-- 
cgit v1.2.3


From 54b18a2149537afd516262fd8c4d4ad5e6f4e6d2 Mon Sep 17 00:00:00 2001
From: yalab <rudeboyjet@gmail.com>
Date: Fri, 6 Oct 2017 15:25:28 +0900
Subject: Exception message for SystemTestCase#get etc..

---
 .../lib/action_dispatch/system_testing/test_helpers/undef_methods.rb    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb b/actionpack/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb
index ef680cafed..d64be3b3d9 100644
--- a/actionpack/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb
+++ b/actionpack/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb
@@ -14,7 +14,7 @@ module ActionDispatch
 
           def method_missing(method, *args, &block)
             if METHODS.include?(method)
-              raise NoMethodError
+              raise NoMethodError, "System tests cannot make direct requests via ##{method}; use #visit and #click_on instead. See http://www.rubydoc.info/github/teamcapybara/capybara/master#The_DSL for more information."
             else
               super
             end
-- 
cgit v1.2.3


From d79e102bfaefc0dce843a73a48456831bd7848b7 Mon Sep 17 00:00:00 2001
From: willnet <netwillnet@gmail.com>
Date: Thu, 12 Oct 2017 16:45:21 +0900
Subject: [ci skip]Enable link to ActionDispatch::Integration::Session#process
 in rdoc

---
 .../lib/action_dispatch/testing/integration.rb     | 24 +++++++++++-----------
 1 file changed, 12 insertions(+), 12 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/testing/integration.rb b/actionpack/lib/action_dispatch/testing/integration.rb
index ae1f368e8b..8caa71199e 100644
--- a/actionpack/lib/action_dispatch/testing/integration.rb
+++ b/actionpack/lib/action_dispatch/testing/integration.rb
@@ -12,38 +12,38 @@ require_relative "request_encoder"
 module ActionDispatch
   module Integration #:nodoc:
     module RequestHelpers
-      # Performs a GET request with the given parameters. See +#process+ for more
-      # details.
+      # Performs a GET request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def get(path, **args)
         process(:get, path, **args)
       end
 
-      # Performs a POST request with the given parameters. See +#process+ for more
-      # details.
+      # Performs a POST request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def post(path, **args)
         process(:post, path, **args)
       end
 
-      # Performs a PATCH request with the given parameters. See +#process+ for more
-      # details.
+      # Performs a PATCH request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def patch(path, **args)
         process(:patch, path, **args)
       end
 
-      # Performs a PUT request with the given parameters. See +#process+ for more
-      # details.
+      # Performs a PUT request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def put(path, **args)
         process(:put, path, **args)
       end
 
-      # Performs a DELETE request with the given parameters. See +#process+ for
-      # more details.
+      # Performs a DELETE request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def delete(path, **args)
         process(:delete, path, **args)
       end
 
-      # Performs a HEAD request with the given parameters. See +#process+ for more
-      # details.
+      # Performs a HEAD request with the given parameters. See ActionDispatch::Integration::Session#process
+      # for more details.
       def head(path, *args)
         process(:head, path, *args)
       end
-- 
cgit v1.2.3


From ada05850f84ee0eef5413950333e5b5332a64b48 Mon Sep 17 00:00:00 2001
From: "yuuji.yaginuma" <yuuji.yaginuma@gmail.com>
Date: Fri, 13 Oct 2017 15:17:17 +0900
Subject: Add headless chrome driver to System Tests

---
 actionpack/lib/action_dispatch/system_test_case.rb     |  2 ++
 .../lib/action_dispatch/system_testing/driver.rb       | 18 +++++++++++++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index ae4aeac59d..3f8481ad48 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -121,6 +121,8 @@ module ActionDispatch
     #
     #   driven_by :selenium, using: :firefox
     #
+    #   driven_by :selenium, using: :headless_chrome
+    #
     #   driven_by :selenium, screen_size: [800, 800]
     def self.driven_by(driver, using: :chrome, screen_size: [1400, 1400], options: {})
       self.driver = SystemTesting::Driver.new(driver, using: using, screen_size: screen_size, options: options)
diff --git a/actionpack/lib/action_dispatch/system_testing/driver.rb b/actionpack/lib/action_dispatch/system_testing/driver.rb
index 4279336f2f..770fbde74e 100644
--- a/actionpack/lib/action_dispatch/system_testing/driver.rb
+++ b/actionpack/lib/action_dispatch/system_testing/driver.rb
@@ -31,8 +31,24 @@ module ActionDispatch
           end
         end
 
+        def browser_options
+          if @browser == :headless_chrome
+            browser_options = Selenium::WebDriver::Chrome::Options.new
+            browser_options.args << "--headless"
+            browser_options.args << "--disable-gpu"
+
+            @options.merge(options: browser_options)
+          else
+            @options
+          end
+        end
+
+        def browser
+          @browser == :headless_chrome ? :chrome : @browser
+        end
+
         def register_selenium(app)
-          Capybara::Selenium::Driver.new(app, { browser: @browser }.merge(@options)).tap do |driver|
+          Capybara::Selenium::Driver.new(app, { browser: browser }.merge(browser_options)).tap do |driver|
             driver.browser.manage.window.size = Selenium::WebDriver::Dimension.new(*@screen_size)
           end
         end
-- 
cgit v1.2.3


From b0d0c9f40df3bee73d3f36005238d7d0227579d2 Mon Sep 17 00:00:00 2001
From: Akira Matsuda <ronnie@dio.jp>
Date: Sat, 21 Oct 2017 22:18:17 +0900
Subject: [Action Pack] require => require_relative

This basically reverts e9fca7668b9eba82bcc832cb0061459703368397, d08da958b9ae17d4bbe4c9d7db497ece2450db5f,
d1fe1dcf8ab1c0210a37c2a78c1ee52cf199a66d, and 68eaf7b4d5f2bb56d939f71c5ece2d61cf6680a3
---
 actionpack/lib/action_dispatch/http/filter_parameters.rb   |  2 +-
 actionpack/lib/action_dispatch/http/mime_type.rb           |  2 +-
 actionpack/lib/action_dispatch/http/request.rb             | 14 +++++++-------
 actionpack/lib/action_dispatch/http/response.rb            |  4 ++--
 actionpack/lib/action_dispatch/journey.rb                  | 10 +++++-----
 actionpack/lib/action_dispatch/journey/gtg/builder.rb      |  2 +-
 .../lib/action_dispatch/journey/gtg/transition_table.rb    |  2 +-
 actionpack/lib/action_dispatch/journey/nfa/builder.rb      |  4 ++--
 .../lib/action_dispatch/journey/nfa/transition_table.rb    |  2 +-
 actionpack/lib/action_dispatch/journey/nodes/node.rb       |  2 +-
 actionpack/lib/action_dispatch/journey/parser.rb           |  2 +-
 actionpack/lib/action_dispatch/journey/parser.y            |  2 +-
 actionpack/lib/action_dispatch/journey/parser_extras.rb    |  4 ++--
 actionpack/lib/action_dispatch/journey/router.rb           | 12 ++++++------
 .../lib/action_dispatch/middleware/debug_exceptions.rb     |  6 +++---
 .../action_dispatch/middleware/session/abstract_store.rb   |  4 ++--
 .../lib/action_dispatch/middleware/session/cache_store.rb  |  2 +-
 .../lib/action_dispatch/middleware/session/cookie_store.rb |  2 +-
 .../action_dispatch/middleware/session/mem_cache_store.rb  |  2 +-
 .../lib/action_dispatch/middleware/show_exceptions.rb      |  4 ++--
 actionpack/lib/action_dispatch/routing/mapper.rb           |  4 ++--
 actionpack/lib/action_dispatch/routing/redirection.rb      |  4 ++--
 actionpack/lib/action_dispatch/routing/route_set.rb        |  6 +++---
 actionpack/lib/action_dispatch/system_test_case.rb         | 10 +++++-----
 actionpack/lib/action_dispatch/testing/integration.rb      |  2 +-
 actionpack/lib/action_dispatch/testing/test_process.rb     |  4 ++--
 actionpack/lib/action_dispatch/testing/test_response.rb    |  2 +-
 27 files changed, 58 insertions(+), 58 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/filter_parameters.rb b/actionpack/lib/action_dispatch/http/filter_parameters.rb
index b7141cc1b9..41a47f2c82 100644
--- a/actionpack/lib/action_dispatch/http/filter_parameters.rb
+++ b/actionpack/lib/action_dispatch/http/filter_parameters.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "parameter_filter"
+require "action_dispatch/http/parameter_filter"
 
 module ActionDispatch
   module Http
diff --git a/actionpack/lib/action_dispatch/http/mime_type.rb b/actionpack/lib/action_dispatch/http/mime_type.rb
index d797e90e52..d2b2106845 100644
--- a/actionpack/lib/action_dispatch/http/mime_type.rb
+++ b/actionpack/lib/action_dispatch/http/mime_type.rb
@@ -339,4 +339,4 @@ module Mime
   end
 end
 
-require_relative "mime_types"
+require "action_dispatch/http/mime_types"
diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index 5c172aecad..60aa1d4e8a 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -3,15 +3,15 @@
 require "stringio"
 
 require "active_support/inflector"
-require_relative "headers"
+require "action_dispatch/http/headers"
 require "action_controller/metal/exceptions"
 require "rack/request"
-require_relative "cache"
-require_relative "mime_negotiation"
-require_relative "parameters"
-require_relative "filter_parameters"
-require_relative "upload"
-require_relative "url"
+require "action_dispatch/http/cache"
+require "action_dispatch/http/mime_negotiation"
+require "action_dispatch/http/parameters"
+require "action_dispatch/http/filter_parameters"
+require "action_dispatch/http/upload"
+require "action_dispatch/http/url"
 require "active_support/core_ext/array/conversions"
 
 module ActionDispatch
diff --git a/actionpack/lib/action_dispatch/http/response.rb b/actionpack/lib/action_dispatch/http/response.rb
index 0c7b153420..7e50cb6d23 100644
--- a/actionpack/lib/action_dispatch/http/response.rb
+++ b/actionpack/lib/action_dispatch/http/response.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 require "active_support/core_ext/module/attribute_accessors"
-require_relative "filter_redirect"
-require_relative "cache"
+require "action_dispatch/http/filter_redirect"
+require "action_dispatch/http/cache"
 require "monitor"
 
 module ActionDispatch # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey.rb b/actionpack/lib/action_dispatch/journey.rb
index 903063d00f..2852efa6ae 100644
--- a/actionpack/lib/action_dispatch/journey.rb
+++ b/actionpack/lib/action_dispatch/journey.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "journey/router"
-require_relative "journey/gtg/builder"
-require_relative "journey/gtg/simulator"
-require_relative "journey/nfa/builder"
-require_relative "journey/nfa/simulator"
+require "action_dispatch/journey/router"
+require "action_dispatch/journey/gtg/builder"
+require "action_dispatch/journey/gtg/simulator"
+require "action_dispatch/journey/nfa/builder"
+require "action_dispatch/journey/nfa/simulator"
diff --git a/actionpack/lib/action_dispatch/journey/gtg/builder.rb b/actionpack/lib/action_dispatch/journey/gtg/builder.rb
index 7e3d957baa..44c31053cb 100644
--- a/actionpack/lib/action_dispatch/journey/gtg/builder.rb
+++ b/actionpack/lib/action_dispatch/journey/gtg/builder.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "transition_table"
+require "action_dispatch/journey/gtg/transition_table"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey/gtg/transition_table.rb b/actionpack/lib/action_dispatch/journey/gtg/transition_table.rb
index 6ed478f816..ea647e051a 100644
--- a/actionpack/lib/action_dispatch/journey/gtg/transition_table.rb
+++ b/actionpack/lib/action_dispatch/journey/gtg/transition_table.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../nfa/dot"
+require "action_dispatch/journey/nfa/dot"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey/nfa/builder.rb b/actionpack/lib/action_dispatch/journey/nfa/builder.rb
index 3135c05ffa..d22302e101 100644
--- a/actionpack/lib/action_dispatch/journey/nfa/builder.rb
+++ b/actionpack/lib/action_dispatch/journey/nfa/builder.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "transition_table"
-require_relative "../gtg/transition_table"
+require "action_dispatch/journey/nfa/transition_table"
+require "action_dispatch/journey/gtg/transition_table"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey/nfa/transition_table.rb b/actionpack/lib/action_dispatch/journey/nfa/transition_table.rb
index bfd929357b..fe55861507 100644
--- a/actionpack/lib/action_dispatch/journey/nfa/transition_table.rb
+++ b/actionpack/lib/action_dispatch/journey/nfa/transition_table.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "dot"
+require "action_dispatch/journey/nfa/dot"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey/nodes/node.rb b/actionpack/lib/action_dispatch/journey/nodes/node.rb
index 0a84f28c1a..08b931a3cd 100644
--- a/actionpack/lib/action_dispatch/journey/nodes/node.rb
+++ b/actionpack/lib/action_dispatch/journey/nodes/node.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../visitors"
+require "action_dispatch/journey/visitors"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/journey/parser.rb b/actionpack/lib/action_dispatch/journey/parser.rb
index 6ddfe96098..e002755bcf 100644
--- a/actionpack/lib/action_dispatch/journey/parser.rb
+++ b/actionpack/lib/action_dispatch/journey/parser.rb
@@ -8,7 +8,7 @@ require 'racc/parser.rb'
 
 # :stopdoc:
 
-require_relative "parser_extras"
+require "action_dispatch/journey/parser_extras"
 module ActionDispatch
   module Journey
     class Parser < Racc::Parser
diff --git a/actionpack/lib/action_dispatch/journey/parser.y b/actionpack/lib/action_dispatch/journey/parser.y
index 850c84ea1a..f9b1a7a958 100644
--- a/actionpack/lib/action_dispatch/journey/parser.y
+++ b/actionpack/lib/action_dispatch/journey/parser.y
@@ -47,4 +47,4 @@ end
 ---- header
 # :stopdoc:
 
-require_relative "parser_extras"
+require "action_dispatch/journey/parser_extras"
diff --git a/actionpack/lib/action_dispatch/journey/parser_extras.rb b/actionpack/lib/action_dispatch/journey/parser_extras.rb
index dfbc6c4529..18ec6c9b9b 100644
--- a/actionpack/lib/action_dispatch/journey/parser_extras.rb
+++ b/actionpack/lib/action_dispatch/journey/parser_extras.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "scanner"
-require_relative "nodes/node"
+require "action_dispatch/journey/scanner"
+require "action_dispatch/journey/nodes/node"
 
 module ActionDispatch
   # :stopdoc:
diff --git a/actionpack/lib/action_dispatch/journey/router.rb b/actionpack/lib/action_dispatch/journey/router.rb
index 9987a9bfa1..b8fdde5475 100644
--- a/actionpack/lib/action_dispatch/journey/router.rb
+++ b/actionpack/lib/action_dispatch/journey/router.rb
@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require_relative "router/utils"
-require_relative "routes"
-require_relative "formatter"
+require "action_dispatch/journey/router/utils"
+require "action_dispatch/journey/routes"
+require "action_dispatch/journey/formatter"
 
 before = $-w
 $-w = false
-require_relative "parser"
+require "action_dispatch/journey/parser"
 $-w = before
 
-require_relative "route"
-require_relative "path/pattern"
+require "action_dispatch/journey/route"
+require "action_dispatch/journey/path/pattern"
 
 module ActionDispatch
   module Journey # :nodoc:
diff --git a/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb b/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb
index 3006cd97ce..511306eb0e 100644
--- a/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb
+++ b/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative "../http/request"
-require_relative "exception_wrapper"
-require_relative "../routing/inspector"
+require "action_dispatch/http/request"
+require "action_dispatch/middleware/exception_wrapper"
+require "action_dispatch/routing/inspector"
 require "action_view"
 require "action_view/base"
 
diff --git a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
index e054fefc9b..5b0be96223 100644
--- a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
@@ -3,8 +3,8 @@
 require "rack/utils"
 require "rack/request"
 require "rack/session/abstract/id"
-require_relative "../cookies"
-require_relative "../../request/session"
+require "action_dispatch/middleware/cookies"
+require "action_dispatch/request/session"
 
 module ActionDispatch
   module Session
diff --git a/actionpack/lib/action_dispatch/middleware/session/cache_store.rb b/actionpack/lib/action_dispatch/middleware/session/cache_store.rb
index c84bc8bfad..a6d965a644 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cache_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cache_store.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "abstract_store"
+require "action_dispatch/middleware/session/abstract_store"
 
 module ActionDispatch
   module Session
diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
index b0514a96d8..4ea96196d3 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "active_support/core_ext/hash/keys"
-require_relative "abstract_store"
+require "action_dispatch/middleware/session/abstract_store"
 require "rack/session/cookie"
 
 module ActionDispatch
diff --git a/actionpack/lib/action_dispatch/middleware/session/mem_cache_store.rb b/actionpack/lib/action_dispatch/middleware/session/mem_cache_store.rb
index f0aec39c9c..914df3a2b1 100644
--- a/actionpack/lib/action_dispatch/middleware/session/mem_cache_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/mem_cache_store.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "abstract_store"
+require "action_dispatch/middleware/session/abstract_store"
 begin
   require "rack/session/dalli"
 rescue LoadError => e
diff --git a/actionpack/lib/action_dispatch/middleware/show_exceptions.rb b/actionpack/lib/action_dispatch/middleware/show_exceptions.rb
index d2e739d27f..3c88afd4d3 100644
--- a/actionpack/lib/action_dispatch/middleware/show_exceptions.rb
+++ b/actionpack/lib/action_dispatch/middleware/show_exceptions.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "../http/request"
-require_relative "exception_wrapper"
+require "action_dispatch/http/request"
+require "action_dispatch/middleware/exception_wrapper"
 
 module ActionDispatch
   # This middleware rescues any exception returned by the application
diff --git a/actionpack/lib/action_dispatch/routing/mapper.rb b/actionpack/lib/action_dispatch/routing/mapper.rb
index 2b43ade081..dea8387c3d 100644
--- a/actionpack/lib/action_dispatch/routing/mapper.rb
+++ b/actionpack/lib/action_dispatch/routing/mapper.rb
@@ -4,8 +4,8 @@ require "active_support/core_ext/hash/slice"
 require "active_support/core_ext/enumerable"
 require "active_support/core_ext/array/extract_options"
 require "active_support/core_ext/regexp"
-require_relative "redirection"
-require_relative "endpoint"
+require "action_dispatch/routing/redirection"
+require "action_dispatch/routing/endpoint"
 
 module ActionDispatch
   module Routing
diff --git a/actionpack/lib/action_dispatch/routing/redirection.rb b/actionpack/lib/action_dispatch/routing/redirection.rb
index 2e2bc87b57..143a4b3d62 100644
--- a/actionpack/lib/action_dispatch/routing/redirection.rb
+++ b/actionpack/lib/action_dispatch/routing/redirection.rb
@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative "../http/request"
+require "action_dispatch/http/request"
 require "active_support/core_ext/uri"
 require "active_support/core_ext/array/extract_options"
 require "rack/utils"
 require "action_controller/metal/exceptions"
-require_relative "endpoint"
+require "action_dispatch/routing/endpoint"
 
 module ActionDispatch
   module Routing
diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb
index 445e86b13c..18862d819f 100644
--- a/actionpack/lib/action_dispatch/routing/route_set.rb
+++ b/actionpack/lib/action_dispatch/routing/route_set.rb
@@ -1,14 +1,14 @@
 # frozen_string_literal: true
 
-require_relative "../journey"
+require "action_dispatch/journey"
 require "active_support/core_ext/object/to_query"
 require "active_support/core_ext/hash/slice"
 require "active_support/core_ext/module/redefine_method"
 require "active_support/core_ext/module/remove_method"
 require "active_support/core_ext/array/extract_options"
 require "action_controller/metal/exceptions"
-require_relative "../http/request"
-require_relative "endpoint"
+require "action_dispatch/http/request"
+require "action_dispatch/routing/endpoint"
 
 module ActionDispatch
   module Routing
diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index 3f8481ad48..496328bd1d 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -3,11 +3,11 @@
 require "capybara/dsl"
 require "capybara/minitest"
 require "action_controller"
-require_relative "system_testing/driver"
-require_relative "system_testing/server"
-require_relative "system_testing/test_helpers/screenshot_helper"
-require_relative "system_testing/test_helpers/setup_and_teardown"
-require_relative "system_testing/test_helpers/undef_methods"
+require "action_dispatch/system_testing/driver"
+require "action_dispatch/system_testing/server"
+require "action_dispatch/system_testing/test_helpers/screenshot_helper"
+require "action_dispatch/system_testing/test_helpers/setup_and_teardown"
+require "action_dispatch/system_testing/test_helpers/undef_methods"
 
 module ActionDispatch
   # = System Testing
diff --git a/actionpack/lib/action_dispatch/testing/integration.rb b/actionpack/lib/action_dispatch/testing/integration.rb
index 8caa71199e..7171b6942c 100644
--- a/actionpack/lib/action_dispatch/testing/integration.rb
+++ b/actionpack/lib/action_dispatch/testing/integration.rb
@@ -7,7 +7,7 @@ require "active_support/core_ext/object/try"
 require "rack/test"
 require "minitest"
 
-require_relative "request_encoder"
+require "action_dispatch/testing/request_encoder"
 
 module ActionDispatch
   module Integration #:nodoc:
diff --git a/actionpack/lib/action_dispatch/testing/test_process.rb b/actionpack/lib/action_dispatch/testing/test_process.rb
index 3b63706aaa..8ac50c730d 100644
--- a/actionpack/lib/action_dispatch/testing/test_process.rb
+++ b/actionpack/lib/action_dispatch/testing/test_process.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "../middleware/cookies"
-require_relative "../middleware/flash"
+require "action_dispatch/middleware/cookies"
+require "action_dispatch/middleware/flash"
 
 module ActionDispatch
   module TestProcess
diff --git a/actionpack/lib/action_dispatch/testing/test_response.rb b/actionpack/lib/action_dispatch/testing/test_response.rb
index b23ea7479c..1e6b21f235 100644
--- a/actionpack/lib/action_dispatch/testing/test_response.rb
+++ b/actionpack/lib/action_dispatch/testing/test_response.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "request_encoder"
+require "action_dispatch/testing/request_encoder"
 
 module ActionDispatch
   # Integration test methods such as ActionDispatch::Integration::Session#get
-- 
cgit v1.2.3


From e16c765ac6dcff068ff2e5554d69ff345c003de1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=
 <rafaelmfranca@gmail.com>
Date: Mon, 17 Jul 2017 16:51:51 -0400
Subject: Remove deprecated `ActionController::ParamsParser::ParseError`

---
 actionpack/lib/action_dispatch/http/parameters.rb | 5 -----
 1 file changed, 5 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/parameters.rb b/actionpack/lib/action_dispatch/http/parameters.rb
index ae875eb830..8d7431fd6b 100644
--- a/actionpack/lib/action_dispatch/http/parameters.rb
+++ b/actionpack/lib/action_dispatch/http/parameters.rb
@@ -123,9 +123,4 @@ module ActionDispatch
         end
     end
   end
-
-  module ParamsParser
-    include ActiveSupport::Deprecation::DeprecatedConstantAccessor
-    deprecate_constant "ParseError", "ActionDispatch::Http::Parameters::ParseError"
-  end
 end
-- 
cgit v1.2.3


From 216965e926d30863a6338351fd13e939c3e72dde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=
 <rafaelmfranca@gmail.com>
Date: Thu, 19 Oct 2017 15:52:44 -0400
Subject: Change the deprecation horizon of the dynamic routes segment to 6.0

---
 actionpack/lib/action_dispatch/routing/route_set.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb
index 18862d819f..71cb458112 100644
--- a/actionpack/lib/action_dispatch/routing/route_set.rb
+++ b/actionpack/lib/action_dispatch/routing/route_set.rb
@@ -584,14 +584,14 @@ module ActionDispatch
         if route.segment_keys.include?(:controller)
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
             Using a dynamic :controller segment in a route is deprecated and
-            will be removed in Rails 5.2.
+            will be removed in Rails 6.0.
           MSG
         end
 
         if route.segment_keys.include?(:action)
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
             Using a dynamic :action segment in a route is deprecated and
-            will be removed in Rails 5.2.
+            will be removed in Rails 6.0.
           MSG
         end
 
-- 
cgit v1.2.3


From b6a0e43216653f1ed1dcd3c6ac8cb7f73297c6da Mon Sep 17 00:00:00 2001
From: Joe Francis <joe@lostapathy.com>
Date: Mon, 23 Oct 2017 13:01:42 -0500
Subject: specify minimum capybara version for system tests

Upgraded rails applications may have a Gemfile without a new enough
capybara to run system tests. Setting a version here gives the user a
more direct error message than they get otherwise.  Resolves #30952
---
 actionpack/lib/action_dispatch/system_test_case.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index 496328bd1d..58cea7b779 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+gem "capybara", "~> 2.13"
+
 require "capybara/dsl"
 require "capybara/minitest"
 require "action_controller"
-- 
cgit v1.2.3


From 7e6cdc1c2f3c06f2829b74afd956aca04632025b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=
 <rafaelmfranca@gmail.com>
Date: Mon, 23 Oct 2017 15:58:01 -0400
Subject: Require capybara 2.15 because we depend on the new puma integration

---
 actionpack/lib/action_dispatch/system_test_case.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index 58cea7b779..78efba9eee 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-gem "capybara", "~> 2.13"
+gem "capybara", "~> 2.15"
 
 require "capybara/dsl"
 require "capybara/minitest"
-- 
cgit v1.2.3


From d898f9e55cc294d5f4338c443e76220349f9093b Mon Sep 17 00:00:00 2001
From: Eugene Kenny <elkenny@gmail.com>
Date: Sat, 28 Oct 2017 00:39:00 +0100
Subject: Remove mention of X-Post-Data-Format header [ci skip]

Support for this header was removed when `actionpack-xml_parser` was
extracted, and has since been dropped from the gem.
---
 actionpack/lib/action_dispatch/http/mime_negotiation.rb | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/mime_negotiation.rb b/actionpack/lib/action_dispatch/http/mime_negotiation.rb
index 0ca18d98a1..d7435fa8df 100644
--- a/actionpack/lib/action_dispatch/http/mime_negotiation.rb
+++ b/actionpack/lib/action_dispatch/http/mime_negotiation.rb
@@ -12,9 +12,6 @@ module ActionDispatch
       end
 
       # The MIME type of the HTTP request, such as Mime[:xml].
-      #
-      # For backward compatibility, the post \format is extracted from the
-      # X-Post-Data-Format HTTP header if present.
       def content_mime_type
         fetch_header("action_dispatch.request.content_type") do |k|
           v = if get_header("CONTENT_TYPE") =~ /^([^,\;]*)/
-- 
cgit v1.2.3


From 65e08da68f6b344243f3c7bba0aee68342ee2228 Mon Sep 17 00:00:00 2001
From: "yuuji.yaginuma" <yuuji.yaginuma@gmail.com>
Date: Sat, 28 Oct 2017 12:42:21 +0900
Subject: Add load hook for `ActionDispatch::SystemTestCase`

This is useful to extend `SystemTestCase`.
Also, since other test classes already have load hooks, should also be
in `SystemTestCase`.

Ref: 0510208dd1ff23baa619884c0abcae4d141fae53
---
 actionpack/lib/action_dispatch/system_test_case.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index 78efba9eee..7246e01cff 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -131,6 +131,8 @@ module ActionDispatch
     end
 
     driven_by :selenium
+
+    ActiveSupport.run_load_hooks(:action_dispatch_system_test_case, self)
   end
 
   SystemTestCase.start_application
-- 
cgit v1.2.3


From 50f697664edf0d2deff22f3f1a1c8e01d54a74ca Mon Sep 17 00:00:00 2001
From: Guillermo Iguaran <guilleiguaran@gmail.com>
Date: Sat, 28 Oct 2017 00:41:14 -0500
Subject: Puma Rack handler is required by Capybara

See: https://github.com/teamcapybara/capybara/blob/7d693f068c44f6a460336da70fb6e9e5f94f3db9/lib/capybara.rb#L450
---
 actionpack/lib/action_dispatch/system_testing/server.rb | 2 --
 1 file changed, 2 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/server.rb b/actionpack/lib/action_dispatch/system_testing/server.rb
index 32aa6a4dc4..8f1b6725b1 100644
--- a/actionpack/lib/action_dispatch/system_testing/server.rb
+++ b/actionpack/lib/action_dispatch/system_testing/server.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "rack/handler/puma"
-
 module ActionDispatch
   module SystemTesting
     class Server # :nodoc:
-- 
cgit v1.2.3


From c40b4428e6d3885a8adc0ceba3aeac7599c14879 Mon Sep 17 00:00:00 2001
From: Shuhei Kitagawa <shuhei.kitagawa@c-fo.com>
Date: Sat, 28 Oct 2017 17:20:38 +0900
Subject: removed unnecessary returns

---
 actionpack/lib/action_dispatch/journey/router.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/journey/router.rb b/actionpack/lib/action_dispatch/journey/router.rb
index b8fdde5475..30af3ff930 100644
--- a/actionpack/lib/action_dispatch/journey/router.rb
+++ b/actionpack/lib/action_dispatch/journey/router.rb
@@ -61,7 +61,7 @@ module ActionDispatch
           return [status, headers, body]
         end
 
-        return [404, { "X-Cascade" => "pass" }, ["Not Found"]]
+        [404, { "X-Cascade" => "pass" }, ["Not Found"]]
       end
 
       def recognize(rails_req)
-- 
cgit v1.2.3


From 19610f7b3abbc6f5a8d18472104d4799a9795336 Mon Sep 17 00:00:00 2001
From: Dave Gynn <davegynn@gmail.com>
Date: Tue, 31 Oct 2017 02:13:53 -0700
Subject: Prevent source line wrapping in rescue layout

Long source lines cause line wrapping in the extracted
source section of the rescue handler page which can make
the line numbers not match up with the source lines.
---
 actionpack/lib/action_dispatch/middleware/templates/rescues/layout.erb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/templates/rescues/layout.erb b/actionpack/lib/action_dispatch/middleware/templates/rescues/layout.erb
index e0509f56f4..39ea25bdfc 100644
--- a/actionpack/lib/action_dispatch/middleware/templates/rescues/layout.erb
+++ b/actionpack/lib/action_dispatch/middleware/templates/rescues/layout.erb
@@ -106,6 +106,7 @@
 
     .line {
       padding-left: 10px;
+      white-space: pre;
     }
 
     .line:hover {
-- 
cgit v1.2.3


From b0c9f0c8deb4a224609f5673dc850599e126535e Mon Sep 17 00:00:00 2001
From: haneru <haneru3@gmail.com>
Date: Fri, 3 Nov 2017 00:38:44 +0900
Subject: Edited comment from request.rb

---
 actionpack/lib/action_dispatch/http/request.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index 60aa1d4e8a..d631281e4b 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -204,7 +204,7 @@ module ActionDispatch
     #
     # If the env contains +rack.early_hints+ then the server accepts HTTP2 push for Link headers.
     #
-    # The +send_early_hints+ method accepts an hash of links as follows:
+    # The +send_early_hints+ method accepts a hash of links as follows:
     #
     #   send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
     #
-- 
cgit v1.2.3


From 3812353845fa91bb500691aced10533730c07801 Mon Sep 17 00:00:00 2001
From: Nihad Abbasov <nihad@42na.in>
Date: Sat, 4 Nov 2017 00:38:44 +0400
Subject: Fix Capybara::Webkit::Driver#resize_window deprecation warning

  >[DEPRECATION] Capybara::Webkit::Driver#resize_window is
  deprecated. Please use Capybara::Window#resize_to instead.
---
 actionpack/lib/action_dispatch/system_testing/driver.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/driver.rb b/actionpack/lib/action_dispatch/system_testing/driver.rb
index 770fbde74e..7577d3e68a 100644
--- a/actionpack/lib/action_dispatch/system_testing/driver.rb
+++ b/actionpack/lib/action_dispatch/system_testing/driver.rb
@@ -59,7 +59,7 @@ module ActionDispatch
 
         def register_webkit(app)
           Capybara::Webkit::Driver.new(app, Capybara::Webkit::Configuration.to_hash.merge(@options)).tap do |driver|
-            driver.resize_window(*@screen_size)
+            driver.resize_window_to(*@screen_size)
           end
         end
 
-- 
cgit v1.2.3


From 11f3f0377ba392c15a7fa6130be16db6318a2575 Mon Sep 17 00:00:00 2001
From: bogdanvlviv <bogdanvlviv@gmail.com>
Date: Fri, 3 Nov 2017 23:33:55 +0000
Subject: Improve docs of ActionDispatch::Routing::Mapper

---
 actionpack/lib/action_dispatch/routing/mapper.rb | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/mapper.rb b/actionpack/lib/action_dispatch/routing/mapper.rb
index dea8387c3d..ded42adee9 100644
--- a/actionpack/lib/action_dispatch/routing/mapper.rb
+++ b/actionpack/lib/action_dispatch/routing/mapper.rb
@@ -475,6 +475,16 @@ module ActionDispatch
         #
         #      resources :users, param: :name
         #
+        #   The +users+ resource here will have the following routes generated for it:
+        #
+        #      GET       /users(.:format)
+        #      POST      /users(.:format)
+        #      GET       /users/new(.:format)
+        #      GET       /users/:name/edit(.:format)
+        #      GET       /users/:name(.:format)
+        #      PATCH/PUT /users/:name(.:format)
+        #      DELETE    /users/:name(.:format)
+        #
         #   You can override <tt>ActiveRecord::Base#to_param</tt> of a related
         #   model to construct a URL:
         #
@@ -484,8 +494,8 @@ module ActionDispatch
         #        end
         #      end
         #
-        #   user = User.find_by(name: 'Phusion')
-        #   user_path(user)  # => "/users/Phusion"
+        #      user = User.find_by(name: 'Phusion')
+        #      user_path(user)  # => "/users/Phusion"
         #
         # [:path]
         #   The path prefix for the routes.
@@ -1265,7 +1275,7 @@ module ActionDispatch
         #   POST      /profile
         #
         # === Options
-        # Takes same options as +resources+.
+        # Takes same options as resources[rdoc-ref:#resources]
         def resource(*resources, &block)
           options = resources.extract_options!.dup
 
@@ -1330,7 +1340,7 @@ module ActionDispatch
         #   DELETE    /photos/:photo_id/comments/:id
         #
         # === Options
-        # Takes same options as <tt>Base#match</tt> as well as:
+        # Takes same options as match[rdoc-ref:Base#match] as well as:
         #
         # [:path_names]
         #   Allows you to change the segment component of the +edit+ and +new+ actions.
-- 
cgit v1.2.3


From 8847e608b9a0f7a3f8d65832e1815b4ab1f021f3 Mon Sep 17 00:00:00 2001
From: "yuuji.yaginuma" <yuuji.yaginuma@gmail.com>
Date: Mon, 6 Nov 2017 13:11:04 +0900
Subject: Explicitly pass window handle to `resize_window_to`

Unlike `resize_window`, `resize_window_to` has three arguments.
https://github.com/thoughtbot/capybara-webkit/blob/d63c3c8e3ae844f0c59359532a6dcb50f4a64d0a/lib/capybara/webkit/driver.rb#L135-L143

Therefore, if pass only width and height just like `resize_window`,
`ArgumentError`will be raised.
To prevent this, explicitly pass window handler.

Follow up of #31046
---
 actionpack/lib/action_dispatch/system_testing/driver.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/driver.rb b/actionpack/lib/action_dispatch/system_testing/driver.rb
index 7577d3e68a..2687772b4b 100644
--- a/actionpack/lib/action_dispatch/system_testing/driver.rb
+++ b/actionpack/lib/action_dispatch/system_testing/driver.rb
@@ -59,7 +59,7 @@ module ActionDispatch
 
         def register_webkit(app)
           Capybara::Webkit::Driver.new(app, Capybara::Webkit::Configuration.to_hash.merge(@options)).tap do |driver|
-            driver.resize_window_to(*@screen_size)
+            driver.resize_window_to(driver.current_window_handle, *@screen_size)
           end
         end
 
-- 
cgit v1.2.3


From 5bbe6924529bc510d104b8bc3756a1e2f0a451dd Mon Sep 17 00:00:00 2001
From: Takumasa Ochi <4468155+aeroastro@users.noreply.github.com>
Date: Tue, 7 Nov 2017 18:15:07 +0900
Subject: Fix typo on ActionDispatc::HTTP::FilterParameters

---
 actionpack/lib/action_dispatch/http/filter_parameters.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/filter_parameters.rb b/actionpack/lib/action_dispatch/http/filter_parameters.rb
index b7141cc1b9..e50672e191 100644
--- a/actionpack/lib/action_dispatch/http/filter_parameters.rb
+++ b/actionpack/lib/action_dispatch/http/filter_parameters.rb
@@ -9,7 +9,7 @@ module ActionDispatch
     # sub-hashes of the params hash to filter. Filtering only certain sub-keys
     # from a hash is possible by using the dot notation: 'credit_card.number'.
     # If a block is given, each key and value of the params hash and all
-    # sub-hashes is passed to it, the value or key can be replaced using
+    # sub-hashes is passed to it, where the value or the key can be replaced using
     # String#replace or similar method.
     #
     #   env["action_dispatch.parameter_filter"] = [:password]
@@ -48,7 +48,7 @@ module ActionDispatch
         @filtered_env ||= env_filter.filter(@env)
       end
 
-      # Reconstructed a path with all sensitive GET parameters replaced.
+      # Reconstructs a path with all sensitive GET parameters replaced.
       def filtered_path
         @filtered_path ||= query_string.empty? ? path : "#{path}?#{filtered_query_string}"
       end
-- 
cgit v1.2.3


From 516c63a71e632c862841cbcb3f9b7ecfc05d9675 Mon Sep 17 00:00:00 2001
From: Joe Marty <josephmarty@gmail.com>
Date: Tue, 21 Nov 2017 12:27:25 -0600
Subject: Fix tld_length documentation

Change recommendation for tld_length (for sharing cookies across subdomains of a 2-token TLD), to 2 instead of 1.
---
 actionpack/lib/action_dispatch/middleware/cookies.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/middleware/cookies.rb b/actionpack/lib/action_dispatch/middleware/cookies.rb
index 86a070c6ad..ea4156c972 100644
--- a/actionpack/lib/action_dispatch/middleware/cookies.rb
+++ b/actionpack/lib/action_dispatch/middleware/cookies.rb
@@ -161,7 +161,7 @@ module ActionDispatch
   #
   # * <tt>:tld_length</tt> - When using <tt>:domain => :all</tt>, this option can be used to explicitly
   #   set the TLD length when using a short (<= 3 character) domain that is being interpreted as part of a TLD.
-  #   For example, to share cookies between user1.lvh.me and user2.lvh.me, set <tt>:tld_length</tt> to 1.
+  #   For example, to share cookies between user1.lvh.me and user2.lvh.me, set <tt>:tld_length</tt> to 2.
   # * <tt>:expires</tt> - The time at which this cookie expires, as a \Time or ActiveSupport::Duration object.
   # * <tt>:secure</tt> - Whether this cookie is only transmitted to HTTPS servers.
   #   Default is +false+.
-- 
cgit v1.2.3


From 3063ace1070e4ddb8d0cc09fbd23049e7b21617a Mon Sep 17 00:00:00 2001
From: "T.J. Schuck" <tj@tjschuck.com>
Date: Wed, 22 Nov 2017 14:45:51 -0500
Subject: Update incorrect backtick usage in RDoc to teletype

[ci skip]
---
 actionpack/lib/action_dispatch/routing/url_for.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/url_for.rb b/actionpack/lib/action_dispatch/routing/url_for.rb
index 3ae533dd37..fa345dccdf 100644
--- a/actionpack/lib/action_dispatch/routing/url_for.rb
+++ b/actionpack/lib/action_dispatch/routing/url_for.rb
@@ -155,7 +155,7 @@ module ActionDispatch
       # Missing routes keys may be filled in from the current request's parameters
       # (e.g. +:controller+, +:action+, +:id+ and any other parameters that are
       # placed in the path). Given that the current action has been reached
-      # through `GET /users/1`:
+      # through <tt>GET /users/1</tt>:
       #
       #   url_for(only_path: true)                        # => '/users/1'
       #   url_for(only_path: true, action: 'edit')        # => '/users/1/edit'
-- 
cgit v1.2.3


From f7f7a08fa8593a014a6b91027eee28548a3d2102 Mon Sep 17 00:00:00 2001
From: "T.J. Schuck" <tj@tjschuck.com>
Date: Wed, 22 Nov 2017 15:11:54 -0500
Subject: Fix CustomUrls#direct doc formatting

Particularly, the bulleted list was getting formatted as a code block because of the extra level of indentation.  Pulling it back to the left makes it render properly as a list instead.

[ci skip]
---
 actionpack/lib/action_dispatch/routing/mapper.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/mapper.rb b/actionpack/lib/action_dispatch/routing/mapper.rb
index ded42adee9..d87a23a58c 100644
--- a/actionpack/lib/action_dispatch/routing/mapper.rb
+++ b/actionpack/lib/action_dispatch/routing/mapper.rb
@@ -2046,7 +2046,7 @@ module ActionDispatch
       end
 
       module CustomUrls
-        # Define custom url helpers that will be added to the application's
+        # Define custom URL helpers that will be added to the application's
         # routes. This allows you to override and/or replace the default behavior
         # of routing helpers, e.g:
         #
@@ -2066,11 +2066,11 @@ module ActionDispatch
         # arguments for +url_for+ which will actually build the URL string. This can
         # be one of the following:
         #
-        #   * A string, which is treated as a generated URL
-        #   * A hash, e.g. { controller: "pages", action: "index" }
-        #   * An array, which is passed to `polymorphic_url`
-        #   * An Active Model instance
-        #   * An Active Model class
+        # * A string, which is treated as a generated URL
+        # * A hash, e.g. <tt>{ controller: "pages", action: "index" }</tt>
+        # * An array, which is passed to +polymorphic_url+
+        # * An Active Model instance
+        # * An Active Model class
         #
         # NOTE: Other URL helpers can be called in the block but be careful not to invoke
         # your custom URL helper again otherwise it will result in a stack overflow error.
-- 
cgit v1.2.3


From 456c3ffdbe37d430c12ad269514674cc89f38c11 Mon Sep 17 00:00:00 2001
From: Andrew White <andrew.white@unboxed.co>
Date: Wed, 15 Nov 2017 21:07:28 +0000
Subject: Add DSL for configuring Content-Security-Policy header

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
---
 .../http/content_security_policy.rb                | 233 +++++++++++++++++++++
 actionpack/lib/action_dispatch/http/request.rb     |   1 +
 2 files changed, 234 insertions(+)
 create mode 100644 actionpack/lib/action_dispatch/http/content_security_policy.rb

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb
new file mode 100644
index 0000000000..d10d4faf3d
--- /dev/null
+++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb
@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+module ActionDispatch #:nodoc:
+  class ContentSecurityPolicy
+    class Middleware
+      CONTENT_TYPE = "Content-Type".freeze
+      POLICY = "Content-Security-Policy".freeze
+      POLICY_REPORT_ONLY = "Content-Security-Policy-Report-Only".freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        request = ActionDispatch::Request.new env
+        _, headers, _ = response = @app.call(env)
+
+        return response unless html_response?(headers)
+        return response if policy_present?(headers)
+
+        if policy = request.content_security_policy
+          headers[header_name(request)] = policy.build(request.controller_instance)
+        end
+
+        response
+      end
+
+      private
+
+        def html_response?(headers)
+          if content_type = headers[CONTENT_TYPE]
+            content_type =~ /html/
+          end
+        end
+
+        def header_name(request)
+          if request.content_security_policy_report_only
+            POLICY_REPORT_ONLY
+          else
+            POLICY
+          end
+        end
+
+        def policy_present?(headers)
+          headers[POLICY] || headers[POLICY_REPORT_ONLY]
+        end
+    end
+
+    module Request
+      POLICY = "action_dispatch.content_security_policy".freeze
+      POLICY_REPORT_ONLY = "action_dispatch.content_security_policy_report_only".freeze
+
+      def content_security_policy
+        get_header(POLICY)
+      end
+
+      def content_security_policy=(policy)
+        set_header(POLICY, policy)
+      end
+
+      def content_security_policy_report_only
+        get_header(POLICY_REPORT_ONLY)
+      end
+
+      def content_security_policy_report_only=(value)
+        set_header(POLICY_REPORT_ONLY, value)
+      end
+    end
+
+    MAPPINGS = {
+      self:           "'self'",
+      unsafe_eval:    "'unsafe-eval'",
+      unsafe_inline:  "'unsafe-inline'",
+      none:           "'none'",
+      http:           "http:",
+      https:          "https:",
+      data:           "data:",
+      mediastream:    "mediastream:",
+      blob:           "blob:",
+      filesystem:     "filesystem:",
+      report_sample:  "'report-sample'",
+      strict_dynamic: "'strict-dynamic'"
+    }.freeze
+
+    DIRECTIVES = {
+      base_uri:        "base-uri",
+      child_src:       "child-src",
+      connect_src:     "connect-src",
+      default_src:     "default-src",
+      font_src:        "font-src",
+      form_action:     "form-action",
+      frame_ancestors: "frame-ancestors",
+      frame_src:       "frame-src",
+      img_src:         "img-src",
+      manifest_src:    "manifest-src",
+      media_src:       "media-src",
+      object_src:      "object-src",
+      script_src:      "script-src",
+      style_src:       "style-src",
+      worker_src:      "worker-src"
+    }.freeze
+
+    private_constant :MAPPINGS, :DIRECTIVES
+
+    attr_reader :directives
+
+    def initialize
+      @directives = {}
+      yield self if block_given?
+    end
+
+    def initialize_copy(other)
+      @directives = copy_directives(other.directives)
+    end
+
+    DIRECTIVES.each do |name, directive|
+      define_method(name) do |*sources|
+        if sources.first
+          @directives[directive] = apply_mappings(sources)
+        else
+          @directives.delete(directive)
+        end
+      end
+    end
+
+    def block_all_mixed_content(enabled = true)
+      if enabled
+        @directives["block-all-mixed-content"] = true
+      else
+        @directives.delete("block-all-mixed-content")
+      end
+    end
+
+    def plugin_types(*types)
+      if types.first
+        @directives["plugin-types"] = types
+      else
+        @directives.delete("plugin-types")
+      end
+    end
+
+    def report_uri(uri)
+      @directives["report-uri"] = [uri]
+    end
+
+    def require_sri_for(*types)
+      if types.first
+        @directives["require-sri-for"] = types
+      else
+        @directives.delete("require-sri-for")
+      end
+    end
+
+    def sandbox(*values)
+      if values.empty?
+        @directives["sandbox"] = true
+      elsif values.first
+        @directives["sandbox"] = values
+      else
+        @directives.delete("sandbox")
+      end
+    end
+
+    def upgrade_insecure_requests(enabled = true)
+      if enabled
+        @directives["upgrade-insecure-requests"] = true
+      else
+        @directives.delete("upgrade-insecure-requests")
+      end
+    end
+
+    def build(context = nil)
+      build_directives(context).compact.join("; ") + ";"
+    end
+
+    private
+      def copy_directives(directives)
+        directives.transform_values { |sources| sources.map(&:dup) }
+      end
+
+      def apply_mappings(sources)
+        sources.map do |source|
+          case source
+          when Symbol
+            apply_mapping(source)
+          when String, Proc
+            source
+          else
+            raise ArgumentError, "Invalid content security policy source: #{source.inspect}"
+          end
+        end
+      end
+
+      def apply_mapping(source)
+        MAPPINGS.fetch(source) do
+          raise ArgumentError, "Unknown content security policy source mapping: #{source.inspect}"
+        end
+      end
+
+      def build_directives(context)
+        @directives.map do |directive, sources|
+          if sources.is_a?(Array)
+            "#{directive} #{build_directive(sources, context).join(' ')}"
+          elsif sources
+            directive
+          else
+            nil
+          end
+        end
+      end
+
+      def build_directive(sources, context)
+        sources.map { |source| resolve_source(source, context) }
+      end
+
+      def resolve_source(source, context)
+        case source
+        when String
+          source
+        when Symbol
+          source.to_s
+        when Proc
+          if context.nil?
+            raise RuntimeError, "Missing context for the dynamic content security policy source: #{source.inspect}"
+          else
+            context.instance_exec(&source)
+          end
+        else
+          raise RuntimeError, "Unexpected content security policy source: #{source.inspect}"
+        end
+      end
+  end
+end
diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index d631281e4b..3838b84a7a 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -22,6 +22,7 @@ module ActionDispatch
     include ActionDispatch::Http::Parameters
     include ActionDispatch::Http::FilterParameters
     include ActionDispatch::Http::URL
+    include ActionDispatch::ContentSecurityPolicy::Request
     include Rack::Request::Env
 
     autoload :Session, "action_dispatch/request/session"
-- 
cgit v1.2.3


From 00c0e4001cc875a51938a3086129b4dc275eef93 Mon Sep 17 00:00:00 2001
From: Andrew White <andrew.white@unboxed.co>
Date: Tue, 28 Nov 2017 15:58:18 +0000
Subject: Fix optimized url helpers when using relative url root

Fixes #31220.
---
 actionpack/lib/action_dispatch/routing/route_set.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb
index 987e709f6f..9eff30fa53 100644
--- a/actionpack/lib/action_dispatch/routing/route_set.rb
+++ b/actionpack/lib/action_dispatch/routing/route_set.rb
@@ -199,6 +199,16 @@ module ActionDispatch
               if args.size == arg_size && !inner_options && optimize_routes_generation?(t)
                 options = t.url_options.merge @options
                 options[:path] = optimized_helper(args)
+
+                original_script_name = options.delete(:original_script_name)
+                script_name = t._routes.find_script_name(options)
+
+                if original_script_name
+                  script_name = original_script_name + script_name
+                end
+
+                options[:script_name] = script_name
+
                 url_strategy.call options
               else
                 super
-- 
cgit v1.2.3


From 729a3da0bb5993a4464ebdebcce8be3635b7f765 Mon Sep 17 00:00:00 2001
From: Guillermo Iguaran <guilleiguaran@gmail.com>
Date: Tue, 28 Nov 2017 01:09:06 -0500
Subject: Register most popular audio/video/font mime types supported by modern
 browsers

---
 actionpack/lib/action_dispatch/http/mime_types.rb | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/mime_types.rb b/actionpack/lib/action_dispatch/http/mime_types.rb
index f8e6fca36d..9f8db397fd 100644
--- a/actionpack/lib/action_dispatch/http/mime_types.rb
+++ b/actionpack/lib/action_dispatch/http/mime_types.rb
@@ -10,6 +10,7 @@ Mime::Type.register "text/css", :css
 Mime::Type.register "text/calendar", :ics
 Mime::Type.register "text/csv", :csv
 Mime::Type.register "text/vcard", :vcf
+Mime::Type.register "text/vtt", :vtt, %w(vtt)
 
 Mime::Type.register "image/png", :png, [], %w(png)
 Mime::Type.register "image/jpeg", :jpeg, [], %w(jpg jpeg jpe pjpeg)
@@ -17,8 +18,25 @@ Mime::Type.register "image/gif", :gif, [], %w(gif)
 Mime::Type.register "image/bmp", :bmp, [], %w(bmp)
 Mime::Type.register "image/tiff", :tiff, [], %w(tif tiff)
 Mime::Type.register "image/svg+xml", :svg
+Mime::Type.register "image/webp", :webp, [], %w(webp)
 
-Mime::Type.register "video/mpeg", :mpeg, [], %w(mpg mpeg mpe)
+Mime::Type.register "audio/mpeg", :mpg, [], %w(mp1 mp2 mp3)
+Mime::Type.register "audio/webm", :weba, [], %w(weba)
+Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
+Mime::Type.register "audio/aac", :acc, [], %w(aac)
+Mime::Type.register "audio/mp4", :mp4, [], %w(m4a mpg4)
+Mime::Type.register "audio/flac", :flac, [], %w(flac)
+
+Mime::Type.register "video/webm", :webm, [], %w(webm)
+Mime::Type.register "video/mp4", :mp4, [], %w(mp4 m4v)
+Mime::Type.register "video/ogg", :ogv, [], %w(ogv)
+
+Mime::Type.register "application/ogx", :ogx, [], %w(ogx)
+
+Mime::Type.register "font/otf", :otf, [], %w(otf)
+Mime::Type.register "font/ttf", :ttf, [], %w(ttf)
+Mime::Type.register "font/woff", :woff, [], %w(woff)
+Mime::Type.register "font/woff2", :woff2, [], %w(woff2)
 
 Mime::Type.register "application/xml", :xml, %w( text/xml application/x-xml )
 Mime::Type.register "application/rss+xml", :rss
-- 
cgit v1.2.3


From f128177eb701373326a3ae91651bf291d0fd245c Mon Sep 17 00:00:00 2001
From: Guillermo Iguaran <guilleiguaran@gmail.com>
Date: Wed, 29 Nov 2017 01:37:48 -0500
Subject: Register "audio/mp4" mime type with :m4a symbol

---
 actionpack/lib/action_dispatch/http/mime_types.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/mime_types.rb b/actionpack/lib/action_dispatch/http/mime_types.rb
index 9f8db397fd..cc41bdda5a 100644
--- a/actionpack/lib/action_dispatch/http/mime_types.rb
+++ b/actionpack/lib/action_dispatch/http/mime_types.rb
@@ -24,7 +24,7 @@ Mime::Type.register "audio/mpeg", :mpg, [], %w(mp1 mp2 mp3)
 Mime::Type.register "audio/webm", :weba, [], %w(weba)
 Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
 Mime::Type.register "audio/aac", :acc, [], %w(aac)
-Mime::Type.register "audio/mp4", :mp4, [], %w(m4a mpg4)
+Mime::Type.register "audio/mp4", :m4a, [], %w(m4a mpg4)
 Mime::Type.register "audio/flac", :flac, [], %w(flac)
 
 Mime::Type.register "video/webm", :webm, [], %w(webm)
-- 
cgit v1.2.3


From 0061e0cd28438f4f3f334c5a75eb292e5f110262 Mon Sep 17 00:00:00 2001
From: Guillermo Iguaran <guilleiguaran@gmail.com>
Date: Wed, 29 Nov 2017 02:29:33 -0500
Subject: Restore mpeg mime type, delete less common mime types

See discussion in #31251
---
 actionpack/lib/action_dispatch/http/mime_types.rb | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/mime_types.rb b/actionpack/lib/action_dispatch/http/mime_types.rb
index cc41bdda5a..6d703cb6b1 100644
--- a/actionpack/lib/action_dispatch/http/mime_types.rb
+++ b/actionpack/lib/action_dispatch/http/mime_types.rb
@@ -18,20 +18,15 @@ Mime::Type.register "image/gif", :gif, [], %w(gif)
 Mime::Type.register "image/bmp", :bmp, [], %w(bmp)
 Mime::Type.register "image/tiff", :tiff, [], %w(tif tiff)
 Mime::Type.register "image/svg+xml", :svg
-Mime::Type.register "image/webp", :webp, [], %w(webp)
 
-Mime::Type.register "audio/mpeg", :mpg, [], %w(mp1 mp2 mp3)
-Mime::Type.register "audio/webm", :weba, [], %w(weba)
+Mime::Type.register "video/mpeg", :mpeg, [], %w(mpg mpeg mpe)
+
+Mime::Type.register "audio/mpeg", :mp3, [], %w(mp1 mp2 mp3)
 Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
-Mime::Type.register "audio/aac", :acc, [], %w(aac)
-Mime::Type.register "audio/mp4", :m4a, [], %w(m4a mpg4)
-Mime::Type.register "audio/flac", :flac, [], %w(flac)
+Mime::Type.register "audio/aac", :m4a, %( audio/mp4 ), %w(m4a mpg4 aac)
 
 Mime::Type.register "video/webm", :webm, [], %w(webm)
 Mime::Type.register "video/mp4", :mp4, [], %w(mp4 m4v)
-Mime::Type.register "video/ogg", :ogv, [], %w(ogv)
-
-Mime::Type.register "application/ogx", :ogx, [], %w(ogx)
 
 Mime::Type.register "font/otf", :otf, [], %w(otf)
 Mime::Type.register "font/ttf", :ttf, [], %w(ttf)
-- 
cgit v1.2.3


From d41d586e4e00990a8b5e1e62b75857fea0effaf4 Mon Sep 17 00:00:00 2001
From: Guillermo Iguaran <guilleiguaran@gmail.com>
Date: Wed, 29 Nov 2017 02:37:39 -0500
Subject: Fix typo in mime type registering

---
 actionpack/lib/action_dispatch/http/mime_types.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/mime_types.rb b/actionpack/lib/action_dispatch/http/mime_types.rb
index 6d703cb6b1..342e6de312 100644
--- a/actionpack/lib/action_dispatch/http/mime_types.rb
+++ b/actionpack/lib/action_dispatch/http/mime_types.rb
@@ -23,7 +23,7 @@ Mime::Type.register "video/mpeg", :mpeg, [], %w(mpg mpeg mpe)
 
 Mime::Type.register "audio/mpeg", :mp3, [], %w(mp1 mp2 mp3)
 Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
-Mime::Type.register "audio/aac", :m4a, %( audio/mp4 ), %w(m4a mpg4 aac)
+Mime::Type.register "audio/aac", :m4a, %w( audio/mp4 ), %w(m4a mpg4 aac)
 
 Mime::Type.register "video/webm", :webm, [], %w(webm)
 Mime::Type.register "video/mp4", :mp4, [], %w(mp4 m4v)
-- 
cgit v1.2.3


From 9d6e288ee96d6241f864dbf90211c37b14a57632 Mon Sep 17 00:00:00 2001
From: eileencodes <eileencodes@gmail.com>
Date: Wed, 29 Nov 2017 10:54:56 -0500
Subject: Make screenshots default to "simple" format

Not everyone uses iTerm2 and whereas Terminal.app on a mac just ignores
that and outputs the path, other terminals like those on Ubuntu do not.
A friendlier default is one that works by default.

Closes #31159
Closes #30957
---
 .../system_testing/test_helpers/screenshot_helper.rb     | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb b/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
index 6c337cdc31..df0c5d3f0e 100644
--- a/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
+++ b/actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb
@@ -15,12 +15,11 @@ module ActionDispatch
         #
         # You can set the +RAILS_SYSTEM_TESTING_SCREENSHOT+ environment variable to
         # control the output. Possible values are:
-        # * [+inline+ (default)]    display the screenshot in the terminal using the
+        # * [+simple+ (default)]    Only displays the screenshot path.
+        #                           This is the default value.
+        # * [+inline+]              Display the screenshot in the terminal using the
         #                           iTerm image protocol (https://iterm2.com/documentation-images.html).
-        # * [+simple+]              only display the screenshot path.
-        #                           This is the default value if the +CI+ environment variables
-        #                           is defined.
-        # * [+artifact+]            display the screenshot in the terminal, using the terminal
+        # * [+artifact+]            Display the screenshot in the terminal, using the terminal
         #                           artifact format (https://buildkite.github.io/terminal/inline-images/).
         def take_screenshot
           save_image
@@ -59,11 +58,8 @@ module ActionDispatch
             # Environment variables have priority
             output_type = ENV["RAILS_SYSTEM_TESTING_SCREENSHOT"] || ENV["CAPYBARA_INLINE_SCREENSHOT"]
 
-            # If running in a CI environment, default to simple
-            output_type ||= "simple" if ENV["CI"]
-
-            # Default
-            output_type ||= "inline"
+            # Default to outputting a path to the screenshot
+            output_type ||= "simple"
 
             output_type
           end
-- 
cgit v1.2.3


From 3c442b6df91e291ebbf17f37444414bf5f10fbe6 Mon Sep 17 00:00:00 2001
From: Simon Dawson <spdawson@gmail.com>
Date: Tue, 5 Dec 2017 07:13:48 +0000
Subject: Fix CSP copy boolean directives (#31326)

Use Object#deep_dup to safely duplicate policy values
---
 actionpack/lib/action_dispatch/http/content_security_policy.rb | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb
index d10d4faf3d..c888a27720 100644
--- a/actionpack/lib/action_dispatch/http/content_security_policy.rb
+++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb
@@ -110,7 +110,7 @@ module ActionDispatch #:nodoc:
     end
 
     def initialize_copy(other)
-      @directives = copy_directives(other.directives)
+      @directives = other.directives.deep_dup
     end
 
     DIRECTIVES.each do |name, directive|
@@ -174,10 +174,6 @@ module ActionDispatch #:nodoc:
     end
 
     private
-      def copy_directives(directives)
-        directives.transform_values { |sources| sources.map(&:dup) }
-      end
-
       def apply_mappings(sources)
         sources.map do |source|
           case source
-- 
cgit v1.2.3


From 7efb4d23c1022108319add6218ae9d9284936ac5 Mon Sep 17 00:00:00 2001
From: "yuuji.yaginuma" <yuuji.yaginuma@gmail.com>
Date: Tue, 5 Dec 2017 18:16:41 +0900
Subject: Add missing require

Follow up of 3c442b6df91e291ebbf17f37444414bf5f10fbe6

Without this require, it will fail when run CSP test alone.
Ref: https://travis-ci.org/rails/rails/jobs/311715758#L2976
---
 actionpack/lib/action_dispatch/http/content_security_policy.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb
index c888a27720..4883e23d24 100644
--- a/actionpack/lib/action_dispatch/http/content_security_policy.rb
+++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb
@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/object/deep_dup"
+
 module ActionDispatch #:nodoc:
   class ContentSecurityPolicy
     class Middleware
-- 
cgit v1.2.3


From 82b974813b28748e5affcff1d8c4ad60ab2971be Mon Sep 17 00:00:00 2001
From: bogdanvlviv <bogdanvlviv@gmail.com>
Date: Thu, 7 Dec 2017 20:02:34 +0200
Subject: Add headless firefox driver to System Tests

---
 actionpack/lib/action_dispatch/system_test_case.rb      |  8 ++++++--
 actionpack/lib/action_dispatch/system_testing/driver.rb | 13 ++++++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

(limited to 'actionpack/lib/action_dispatch')

diff --git a/actionpack/lib/action_dispatch/system_test_case.rb b/actionpack/lib/action_dispatch/system_test_case.rb
index 7246e01cff..99d0c06751 100644
--- a/actionpack/lib/action_dispatch/system_test_case.rb
+++ b/actionpack/lib/action_dispatch/system_test_case.rb
@@ -121,11 +121,15 @@ module ActionDispatch
     #
     #   driven_by :poltergeist
     #
-    #   driven_by :selenium, using: :firefox
+    #   driven_by :selenium, screen_size: [800, 800]
+    #
+    #   driven_by :selenium, using: :chrome
     #
     #   driven_by :selenium, using: :headless_chrome
     #
-    #   driven_by :selenium, screen_size: [800, 800]
+    #   driven_by :selenium, using: :firefox
+    #
+    #   driven_by :selenium, using: :headless_firefox
     def self.driven_by(driver, using: :chrome, screen_size: [1400, 1400], options: {})
       self.driver = SystemTesting::Driver.new(driver, using: using, screen_size: screen_size, options: options)
     end
diff --git a/actionpack/lib/action_dispatch/system_testing/driver.rb b/actionpack/lib/action_dispatch/system_testing/driver.rb
index 2687772b4b..280989a146 100644
--- a/actionpack/lib/action_dispatch/system_testing/driver.rb
+++ b/actionpack/lib/action_dispatch/system_testing/driver.rb
@@ -37,6 +37,11 @@ module ActionDispatch
             browser_options.args << "--headless"
             browser_options.args << "--disable-gpu"
 
+            @options.merge(options: browser_options)
+          elsif @browser == :headless_firefox
+            browser_options = Selenium::WebDriver::Firefox::Options.new
+            browser_options.args << "-headless"
+
             @options.merge(options: browser_options)
           else
             @options
@@ -44,7 +49,13 @@ module ActionDispatch
         end
 
         def browser
-          @browser == :headless_chrome ? :chrome : @browser
+          if @browser == :headless_chrome
+            :chrome
+          elsif @browser == :headless_firefox
+            :firefox
+          else
+            @browser
+          end
         end
 
         def register_selenium(app)
-- 
cgit v1.2.3