Commit Graph

15459 Commits

Author SHA1 Message Date
Jean Boussier
971fa17502
Merge pull request #46279 from ghiculescu/query-tags-dupe 2022-10-23 01:22:41 +02:00
Alex Ghiculescu
f737b5ec13 Fix double logging in ActiveRecord::QueryLog
Fixes https://github.com/rails/rails/issues/46103

An issue exists if you set `config.active_record.query_log_tags` to an array that includes `:controller`, `:action`, or `:job`; the relevant item will get duplicated in the log line. This occured because the relevant railties would add the item to `config.active_record.query_log_tags` again during setup. This PR fixes that by only adding those items to the config if they aren't already set.

The issue proposed more documentation to work around this, but I think it's a bug and should be fixed directly.
2022-10-22 15:53:14 -05:00
Niklas Haeusele
be177e4566 Fix #46244 Remove innerHTML usage to avoid self-XSS 2022-10-21 21:18:48 +02:00
Jean Boussier
58e7fc18cb
Merge pull request #46223 from j-manu/screenshot-filename-whitelist-sanitizer 2022-10-12 16:56:15 +02:00
Aaron Patterson
2f36f0a2bb
Merge pull request #46171 from rails/refactor-errors
Add column information inside ERB templates
2022-10-11 15:10:40 -07:00
Manu J
bccf42baf8 Remove all non word characters from screenshot filenames
Screenshot filenames are derived from test names which can contain
special characters. These special characters may not be supported by
CI systems like Github Actions. Replacing all non word characters
ensures compatibility.
2022-10-11 19:13:01 +05:30
Jean Boussier
d917896f45 Enable verbose mode in test and report warnings as errors
We recently let a few very easy to avoid warnings get merged.
The root cause is that locally the test suite doesn't run in
verbose mode unless you explictly pass `-w`.

On CI warnings are enabled, but there is no reason to look at the
build output unless something is failing. And even if one wanted
to do that, that would be particularly work intensive since warnings
may be specific to a Ruby version etc.

Because of this I believe we should:

  - Always run the test suite with warnings enabled.
  - Raise an error if a warning is unexpected.

We've been using this pattern for a long time at Shopify both in private
and public repositories.
2022-10-11 09:25:18 +02:00
Guillaume CABANEL
ca11431647
Update CHANGELOG with PR #45427 changes (#46215)
* Update CHANGELOG with PR #45427 changes [ci skip]

Co-authored-by: Petrik de Heus <petrik@deheus.net>
2022-10-10 21:07:22 +02:00
Aaron Patterson
0c55a87ccf
Stop using a global for storing template info
This isn't as easy, but should eliminate any memory leaks in dev
2022-10-09 15:51:23 -07:00
Aaron Patterson
aa37b787ef
Use file path as the error lookup key
We have access to the path from the backtrace location object.  If we
use the path of the ERB as the key, then anytime the ERB changes it'll
just overwrite that template instance in the error handling hash
2022-10-09 14:55:50 -07:00
Aaron Patterson
c4c72ad0bb
remove sentinel object 2022-10-09 14:52:17 -07:00
Aaron Patterson
650e99ac5b
Map column information in to ERB templates
This commit maps the column information returned from ErrorHighlight in
to column information within the source ERB template.  ErrorHighlight
only understands the compiled Ruby code, so this commit adds a small
translation layer that converts the values from ErrorHighlight in to the
right values for the ERB source template
2022-10-09 14:52:17 -07:00
Aaron Patterson
e85edcc45d
Ask backtrace locations for their spot information
This way we can do special stuff when the exceptions come from special
locations
2022-10-09 14:52:17 -07:00
Aaron Patterson
343dba47e0
Only deal with backtrace locations in ExceptionWrapper
We should get out of the business of parsing backtraces and only use
backtrace locations.  Backtrace locations have the file and line number
information baked in, so we don't need to parse things anymore
2022-10-09 14:52:17 -07:00
Aaron Patterson
80a698d15c
Use a SyntaxError proxy object when displaying syntax error info
This commit adds a SyntaxErrorProxy object to active support and wraps
syntax error exceptions with that proxy object.  We want to enhance
syntax errors with information about the source location where they
actually happened (normally the backtrace doesn't contain such info).
Rather than mutating the original exception's backtrace, this wraps it
with a proxy object.

Eventually we will implement backtrace_locations on the proxy object so
that the exception handling middleware can be updated to _only_ deal
with backtrace_locations and never deal with raw `backtrace`
2022-10-09 14:52:17 -07:00
Aaron Patterson
c066440b92
only wrap exception once 2022-10-09 14:52:17 -07:00
Aaron Patterson
894acf9588
Wrapping the cause should do the "SyntaxError" magic 2022-10-09 14:52:16 -07:00
Aaron Patterson
bff868d56f
stop exposing the exception class 2022-10-09 14:52:16 -07:00
Aaron Patterson
7b2f9328a6
make the exceptiom method private so we can catch callers 2022-10-09 14:52:16 -07:00
Aaron Patterson
dec39e3961
Start hiding the exception object from the views
We are currently mutating exception objects and I would like to stop
doing that.  Unfortunately the views are calling many methods directly
on the exception and expecting that the mutations exist.

This patch refactors the templates so that they ask the ExceptionWrapper
class for information about the exception rather than directly asking
the exception object itself
2022-10-09 14:52:16 -07:00
Jonathan Hefner
1466b44299 Deprecate obsolete permissions policy directives
`speaker`, `vibrate`, and `vr` were [listed as policy-controlled features][1]
around the time when #33439 was first written (2018-07-25).  However,
`vibrate` was removed in w3c/webappsec-permissions-policy@b7271ac0f2,
`vr` was changed to `xr` in w3c/webappsec-permissions-policy@bec5ce6547,
and `speaker` was removed in w3c/webappsec-permissions-policy@18707d396e.
(And `xr` was later changed to `xr-spatial-tracking`, and still only has
[experimental support][2].)

Therefore, this commit deprecates these permissions policy directives.

[1]: 6d8bbbe738/features.md (policy-controlled-features)
[2]: 432a1532c9/features.md (standardized-features)
2022-10-05 12:18:55 -05:00
Jonathan Hefner
2a9f8aeb24
Merge pull request #45427 from guillaumecabanel/update-permissions-policy
Update permissions policy list
2022-10-05 12:17:15 -05:00
Jonathan Hefner
6a0ec0e54e Fix tests for selenium-webdriver v4.5.0
`selenium-webdriver` v4.5.0 adds more entries ("acceptInsecureCerts" and
"moz:debuggerAddress") to the `as_json` output for
`Selenium::WebDriver::Firefox::Options`, causing an exact comparison of
the Hash to fail.

See SeleniumHQ/selenium@58f5833ba0.
2022-09-29 11:13:06 -05:00
Aaron Patterson
08ef43ed5e
Merge pull request #46120 from rails/rescue-template-paths
Keep rescue template paths in an array
2022-09-27 15:15:06 -07:00
Nikita Vasilevsky
e7a1740114 Keep assert_redirected_to backwards compatible 2022-09-26 15:30:09 +00:00
Nikita Vasilevsky
28eb8b4818 Add assert_redirected_to test with custom message 2022-09-26 15:30:02 +00:00
Aaron Patterson
5c6e9d48e1
Keep rescue template paths in an array
Gotta be honest, this is so I can make some hacks.  Basically I would
like an engine to specify where to find rescue templates, and currently
there's no way to add search paths to the debug view lookup context.
This commit turns the template path in to an array (that I plan to
mutate, but nobody should do that besides me until we make an actual
good API).

I added the `dup` in `initialize` so in case the array is accidentally
mutated we don't leak memory.
2022-09-23 15:25:40 -07:00
Jon Dufresne
021113927a Allow specifying the HTTP status code in assert_redirected_to
Previously, the method always asserts the status is `:redirect` which
allows for any kind of 3XX response. However, sometimes it is worthwhile
to precise the status code of the redirect. For example, a Rails
application may want to verify the redirect is a 301 (Moved Permanently)
and not the default 302 (Found). The new method argument makes this
convenient to do in one assertion.
2022-09-19 13:51:14 -04:00
John Bampton
2f699c51ce Fix word case. html -> HTML 2022-09-18 04:21:22 +10:00
John Bampton
3a32915bbc Fix word case. json -> JSON 2022-09-17 04:11:36 +10:00
Sreeram Venkitesh
9c751a1b05 Added status in API documentation for ActionController::Renderer#render 2022-09-16 18:48:14 +05:30
Yasuo Honda
349a66ebed Drop Rubinius code
Rubinius has not been maintained since May 2020 and based on the
discussion at https://github.com/rails/rails/pull/44984 ,
I think we can remove Rubinius specific code from Rails.
2022-09-15 23:43:51 +09:00
Rafael Mendonça França
46bfabcfd4
Merge pull request #44547 from skipkayhil/fix-incorrect-assertions
fix remaining asserts that should be assert_equal
2022-09-12 20:32:42 -04:00
Josef Šimánek
b0fdca4fbc Rescue Rack::QueryParser::ParamsTooDeepError in HTTP request.
- render HTTP 400
- needs Rack 2.2.4+
2022-09-11 01:40:28 +02:00
Hartley McGuire
c62dcf54eb
fix remaining asserts that should be assert_equal
Found using Minitest/AssertWithExpectedArgument.

Also enabled the rule per feedback and fixed 29 additional violations
2022-09-09 19:22:21 -04:00
Rafael Mendonça França
977868b338
Merge PR #45956 2022-09-09 22:13:08 +00:00
Rafael Mendonça França
e3b9671e67
Copy-edit 8e65c22 2022-09-09 21:05:13 +00:00
Rafael Mendonça França
8e65c22e40
Merge pull request #40051 from fsateler/feature/redirect-referer
Add HTTP_REFERER when following redirects on integration tests
2022-09-09 17:03:13 -04:00
Rafael Mendonça França
37492e2569
Merge pull request #45887 from ianneub/add-exclude-to-action_controller-parameters
Add exclude? method to ActionController::Parameters
2022-09-09 16:46:03 -04:00
Rafael Mendonça França
4f212ef212
Merge pull request #41517 from brunoarueira/fix/issue-38080-encoding-uploaded-file-headers
Encodes the uploaded file's headers
2022-09-09 16:05:41 -04:00
John Hawthorn
fc3c077f6b Round server timing to two decimal places 2022-09-08 21:23:25 -07:00
John Hawthorn
368275f157 Don't measure server timing for "!" topics
These are not intended for user consumption
2022-09-08 21:05:33 -07:00
John Hawthorn
384a479159 Fix ServerTiming in Threads, use single subscriber
Previously ActionDispatch::ServerTiming would subscribe and unsubscribe
on each request. This could cause issues with the internal stacks of
ActiveSupport::Notifications, particlularly under the previous AS::N
implementation which used thread-local stacks for every subscriber
(the new implementation has mostly mitigated this).

Additionally, the previous ServerTiming implementation did not report
metrics correctly in a multi-threaded environment.

This commit works around both of these issues by using a single global
subscription, which collects events into a per-thread Array.
2022-09-08 21:05:33 -07:00
Nathan Bardoux
e38ea1aeaa
ActionDispatch::Cookies json deserializer discards marshal dumps
Without this change if action_dispatch.cookies_serializer is set to
json and the app tries to read a marshal-serialized cookie, it will
raise a JSON::ParserError which won't clear the cookie and force app
users to manually clear the cookie in their browser.
(See #45127 for original bug discussion)
2022-09-07 13:09:07 -07:00
Ryo Nakamura
a5065d4abc Avoid using render(...) and return in example code 2022-09-02 06:33:43 +09:00
Jonathan Hefner
40dc22f715 Add :request to redirect.action_dispatch payload
Follow-up to #43755.

This adds the request object to the `redirect.action_dispatch` payload,
for parity with `redirect_to.action_controller`.
2022-08-31 13:53:48 -05:00
fatkodima
3158bbb9f6 Update rubocop-performance and enable more performance-related cops 2022-08-26 15:07:11 +03:00
Ian Neubert
ca29fca4c8 Add exclude? method to ActionController::Parameters 2022-08-25 13:44:12 -04:00
Orhan Toy
930e36f10b Extend routes --grep to also filter routes by matching against path 2022-08-25 08:33:51 +00:00
Jonathan Hefner
2045cef03b
Merge pull request #45859 from kratob/no-csp-response-for-304
Do not return CSP headers for 304 Not Modified responses
2022-08-23 15:13:09 -05:00