From 37423e4ff883ad5584bab983aceb4b2b759a1fd8 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Fri, 2 Oct 2015 14:45:31 -0700 Subject: removing Rack::Runtime from the default stack. The runtime header is a potential target for timing attacks since it returns the amount of time spent on the server (eliminating network speed). Total time is also not accurate for streaming responses. The middleware can be added back via: ```ruby config.middleware.ues ::Rack::Runtime ``` --- railties/test/application/middleware_test.rb | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) (limited to 'railties/test/application') diff --git a/railties/test/application/middleware_test.rb b/railties/test/application/middleware_test.rb index 138c63266e..490f0ba822 100644 --- a/railties/test/application/middleware_test.rb +++ b/railties/test/application/middleware_test.rb @@ -27,9 +27,8 @@ module ApplicationTests "Rack::Sendfile", "ActionDispatch::Static", "ActionDispatch::LoadInterlock", - "ActiveSupport::Cache::Strategy::LocalCache", - "Rack::Runtime", "Rack::MethodOverride", + "ActiveSupport::Cache::Strategy::LocalCache", "ActionDispatch::RequestId", "Rails::Rack::Logger", # must come after Rack::MethodOverride to properly log overridden methods "ActionDispatch::ShowExceptions", @@ -59,7 +58,6 @@ module ApplicationTests "ActionDispatch::Static", "ActionDispatch::LoadInterlock", "ActiveSupport::Cache::Strategy::LocalCache", - "Rack::Runtime", "ActionDispatch::RequestId", "Rails::Rack::Logger", # must come after Rack::MethodOverride to properly log overridden methods "ActionDispatch::ShowExceptions", @@ -168,19 +166,19 @@ module ApplicationTests end test "can delete a middleware from the stack even if insert_before is added after delete" do - add_to_config "config.middleware.delete Rack::Runtime" - add_to_config "config.middleware.insert_before(Rack::Runtime, Rack::Config)" + add_to_config "config.middleware.delete ActionDispatch::ShowExceptions" + add_to_config "config.middleware.insert_before(ActionDispatch::ShowExceptions, Rack::Config)" boot! assert middleware.include?("Rack::Config") - assert_not middleware.include?("Rack::Runtime") + assert_not middleware.include?("ActionDispatch::ShowExceptions") end test "can delete a middleware from the stack even if insert_after is added after delete" do - add_to_config "config.middleware.delete Rack::Runtime" - add_to_config "config.middleware.insert_after(Rack::Runtime, Rack::Config)" + add_to_config "config.middleware.delete ActionDispatch::ShowExceptions" + add_to_config "config.middleware.insert_after(ActionDispatch::ShowExceptions, Rack::Config)" boot! assert middleware.include?("Rack::Config") - assert_not middleware.include?("Rack::Runtime") + assert_not middleware.include?("ActionDispatch::ShowExceptions") end test "includes exceptions middlewares even if action_dispatch.show_exceptions is disabled" do @@ -218,12 +216,12 @@ module ApplicationTests test "Rails.cache does not respond to middleware" do add_to_config "config.cache_store = :memory_store" boot! - assert_equal "Rack::Runtime", middleware.fourth + assert_equal "Rack::MethodOverride", middleware.fourth end test "Rails.cache does respond to middleware" do boot! - assert_equal "Rack::Runtime", middleware.fifth + assert_equal "ActiveSupport::Cache::Strategy::LocalCache", middleware.fifth end test "insert middleware before" do -- cgit v1.2.3