Commit Graph

15591 Commits

Author SHA1 Message Date
David Heinemeier Hansson
8b8ac378a9 Trailing whitespace 2023-01-25 21:27:16 +01:00
Rafael Mendonça França
1b44989521
Merge PR #46594 2023-01-25 20:13:18 +00:00
David Heinemeier Hansson
1da6f8c68e
Allow use of SSL-terminating reserve proxy that doesn't set headers (#47139)
* Allow use of SSL-terminating reserve proxy that doesn't set headers

NGINX and other SSL-terminating reverse proxies can use HTTP headers to include forwarding information. If your stack includes SSL-termination through a network load balancer, that won't happen. You can use config.assume_ssl to address that.

* I hate these warts

* Document the new setting

* Add autoload for AssumeSSL

* Add CHANGELOG notice
2023-01-25 21:02:02 +01:00
Rafael Mendonça França
859b526c5b
Remove upper bound of rack
Allow users to install any version and try to see if Rails is compatible.
2023-01-25 15:25:49 +00:00
zzak
896c7faedf Use Gemfile to manage Rack version for dev 2023-01-25 12:24:19 +09:00
John Hawthorn
f6e36c90aa
Merge pull request #47087 from jhawthorn/cookie_domain
Fix cookie domain for `domain: all` on two letter single level TLD
2023-01-24 13:56:38 -08:00
John Hawthorn
941e0cd212 Fix cookie domain calculation for two letter tld 2023-01-23 16:37:16 -08:00
Ron Shinall
189e4108c5 Address Selenium :capabilities deprecation warning 2023-01-23 21:40:01 +00:00
Rafael Mendonça França
72642bd74b
Merge pull request #47081 from ioquatix/rack-3-query-parser-utf8
Don't assume that invalid UTF-8 will raise an error.
2023-01-20 15:20:42 -05:00
Rafael Mendonça França
3adec8df0a
Merge pull request #47083 from ioquatix/rack-3-ssl_test-headers
Don't assume the existance of `Rack::Utils::HeaderHash`.
2023-01-20 15:14:19 -05:00
Rafael Mendonça França
4c7c69d1fe
Merge pull request #47082 from ioquatix/rack-3-env-fields
Don't assume these fields will be present in a rack env.
2023-01-20 15:03:52 -05:00
Rafael Mendonça França
8c11ae0440
Avoid redefining the response=.
In `6d5e0d2de2a8836e858962981c34aff2f76ffe3d` we added a `response=` method
that was redefining the already existed method generated by `attr_internal`.
2023-01-20 19:31:37 +00:00
Rafael Mendonça França
006d68eb8c
Merge pull request #47079 from ioquatix/actiondispatch-request-inspect
Fix `#inspect` failures when dealing with requests with `method=nil`.
2023-01-20 14:16:36 -05:00
Rafael Mendonça França
f43a088b78
Merge pull request #47077 from ioquatix/rack-3-rewindability
Don't assume Rack input supports rewindability.
2023-01-20 14:10:54 -05:00
Rafael Mendonça França
0e615275a6
Merge pull request #47085 from ioquatix/rack-3-compatible-cookies
Don't assume the existance of `add_cookie_to_header` and related methods.
2023-01-20 14:09:12 -05:00
Aaron Patterson
db2463f277
Merge pull request #47075 from ioquatix/rack-3-files
Rack deprecated `Rack::File` and replaced it with `Rack::Files`.
2023-01-20 09:49:41 -08:00
Samuel Williams
4c58755862
Add rack-session and rackup gems.
Rack 2 includes this code, but in Rack 3 it was extracted into gems. These
gems include a v1 release compatible with Rack 2, and a v2 release
compatible with Rack v3+.
2023-01-21 06:03:41 +13:00
Samuel Williams
706fb10ad5
Don't assume the existance of add_cookie_to_header and related methods.
Rack 3 deprecates some of these clunky methods, and the only compatible
methods between Rack 2 and Rack 3 is to use `Rack::Response` which
includes `set_cookie` and `delete_cookie`.
2023-01-21 05:59:22 +13:00
Samuel Williams
fc0ec10272
Don't assume the existance of Rack::Utils::HeaderHash.
In Rack 3, this was deprecated and replaced with `Rack::Headers`. Using a
hash instance here appars to be sufficient.
2023-01-21 05:56:15 +13:00
Samuel Williams
7981dce06c
Don't assume these fields will be present in a rack env.
Rack 3 drops several of these fields as mandatory.
2023-01-21 05:53:20 +13:00
Samuel Williams
fd48e72518
Don't assume that invalid UTF-8 will raise an error.
Rack 3 parses the query part of a URL as ASCII-8BIT and does not fail on
invalid UTF-8 code sequences. Limit the tests to Rack 2.
2023-01-21 05:51:29 +13:00
Samuel Williams
cc3f50702f
Fix #inspect failures when dealing with requests with method=nil.
When I was debugging `ActionDispatch::Request` instances in some tests, I
noticed IRB complaining that the object did not support `#inspect`, as
it was trying to print out the `method` which calls `check_method(nil)`
which fails. Don't try to validate `nil` method as it will always fail
and appears to be a valid state (when constructing an empty request as in
some tests).
2023-01-21 05:44:43 +13:00
Samuel Williams
911556fd81
Don't assume Rack input supports rewindability.
Rack 3 drops the requirement for a Rack input body to be rewindable. Limit
the related tests to run only on Rack < 3.
2023-01-21 05:38:54 +13:00
Samuel Williams
d4bf3ff6d1
Rack deprecated Rack::File and replaced it with Rack::Files. 2023-01-21 05:31:41 +13:00
Samuel Williams
08510b5437
Improve matching of headers assertions.
The current implementation makes assumptions about the case and format of
headers. Introduce methods to handle headers in a case insensitive manner
and reduce churn when comparing with multi-value headers.
2023-01-21 05:26:22 +13:00
Samuel Williams
f63a5e7d16
Improve matching of cookie assertions.
The current implementation makes assumptions about the order and case
sensitivity of cookie attributes. Introduce methods to parse those fields
and compare them semantically. Update the existing tests to take advantage
of these new assertions.
2023-01-20 14:53:18 +13:00
Rafael Mendonça França
7c38258f70
Merge pull request #46327 from elliotcm/elliotcm/fix-stream-content-type
Fix content-type header with `send_stream`
2023-01-18 15:32:48 -05:00
Jean Boussier
66227e01e7 Improve Rails' Shape friendliness (third pass)
Followup: https://github.com/rails/rails/pull/47023

```
Shape Edges Report
-----------------------------------
snip...
       130  @_config
snip...
        99  @_url_options
```
2023-01-18 15:44:08 +01:00
Rafael Mendonça França
9ecc8785ef
Fix rubocop violations 2023-01-17 19:51:40 +00:00
John Hawthorn
13016ce16e Avoid regex backtracking on If-None-Match header
[CVE-2023-22795]
2023-01-17 11:38:11 -08:00
sabulikia
fbc24520a3 Use string#split instead of regex for domain parts
[CVE-2023-22792]
2023-01-17 11:38:11 -08:00
wonda-tea-coffee
f6cdce50d4 Fix sec issue with _url_host_allowed?
Disallow certain strings from `_url_host_allowed?` to avoid a redirect
to malicious sites.

[CVE-2023-22797]
2023-01-17 11:38:11 -08:00
Petrik de Heus
c975051746
Merge pull request #47029 from hahmed/ha/fix-routing-wording-in-doc [ci-skip]
Update docs in actionpack to use bin/rails
2023-01-17 16:34:50 +01:00
Jean Boussier
aa7d78d9b1 Improve Rails' Shape friendliness (second pass)
Followup: https://github.com/rails/rails/pull/47023

```
Shape Edges Report
-----------------------------------
snip...
       238  @errors
snip...
       219  @options
snip...
       129  @_request
       128  @type
       125  @virtual_path
       124  @_assigns
       123  @_config
       123  @_controller
       123  @output_buffer
       123  @view_flow
       122  @_default_form_builder
snip...
        89  @_already_called
        75  @validation_context
snip...
        65  @_new_record_before_last_commit
snip...
        58  @_url_options
snip...
```
2023-01-17 13:55:49 +01:00
Haroon Ahmed
2303628189 Update doc to use bin/rails which is the correct convention for invoking rails commands 2023-01-17 09:42:38 +00:00
Rafael Mendonça França
03a1da9c34
Merge pull request #46915 from joshuay03/update-action-pack-render-template-tests
Update `ActionPack` render template with locals tests
2023-01-16 18:40:27 -05:00
Jean Boussier
fc950324bd Improve Rails' Shape friendliness
Ruby 3.2 significantly changed how instance variables are store.
It now use shapes, and in short, it's important for performance
to define instance variables in a consistent order to limit the
amount of shapes.

Otherwise, the number of shapes will increase past a point where
MRI won't be able to cache instance variable access. The impact
is even more important when YJIT is enabled.

This PR is data driven. I dump the list of Shapes from Shopify's
monolith production environment, and Rails is very present among
the top offenders:

```
Shape Edges Report
-----------------------------------
       770  @default_graphql_name
       697  @own_fields
       661  @to_non_null_type
       555  @own_interface_type_memberships
       472  @description
       389  @errors
       348  @oseid
       316  @_view_runtime
       310  @_db_runtime
       292  @visibility
       286  @shop
       271  @attribute_method_patterns_cache
       264  @namespace_for_serializer
       254  @locking_column
       254  @primary_key
       253  @validation_context
       244  @quoted_primary_key
       238  @access_controls
       234  @_trigger_destroy_callback
       226  @_trigger_update_callback
       224  @finder_needs_type_condition
       215  @_committed_already_called
       214  @api_type
       203  @mutations_before_last_save
       202  @access_controls_overrides
       201  @options
       198  @mutations_from_database
       190  @_already_called
       183  @name
       179  @_request
       176  @own_arguments
       175  @_assigns
       175  @virtual_path
       174  @context
       173  @_controller
       173  @output_buffer
       173  @view_flow
       172  @_default_form_builder
       169  @cache
       159  @_touch_record
       151  @attribute_names
       151  @default_attributes
       150  @columns_hash
       149  @attribute_types
       148  @columns
       147  @marked_for_same_origin_verification
       146  @schema_loaded
       143  @_config
       143  @type
       141  @column_names
```

All the changes are of similar nature, the goal is to preset the instance
variable to nil when objects are allocated, or when classes are created.

For classes I leverage the `inherited` hook. If the patern becomes common enough
it might make sense to add a helper for this in `ActiveSupport::Concern`.
2023-01-16 12:31:37 +01:00
eileencodes
d9dd1c59d0
Implement spot and don't use keep_script_lines in Ruby 3.2
We want to use error highlight with eval'd code, specifically ERB
templates.

Previously we could only get the information we needed by setting
`keep_script_lines` to true. In Ruby 3.2 and error_highlight we added
the ability to get this information without setting `keep_script_lines`.

This change implements that new behavior for Rails.

I removed the script line changes to support this in 3.1 because it is
not in any released version.

Ruby change: https://github.com/ruby/ruby/pull/6593
Erorr highlight change: https://github.com/ruby/error_highlight/pull/26

Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>
2023-01-13 16:20:09 -05:00
Lachlan Sylvester
0a77b32042 discard marshal dumped values when reading a signed cookie 2023-01-13 10:47:01 +11:00
Fabian Mersch
e768fc8ab8 Scope generated route helpers to an instance of RoutesProxy 2023-01-12 15:03:57 +01:00
Roman Sokhan
b7d7376df1 Fix rare conflict of default_render with Minitest::Mock 2023-01-11 18:24:15 +02:00
Samuel Williams
28c8e2229f
Be more explicit when wrapping in an enumerable body. 2023-01-09 13:26:53 +13:00
Samuel Williams
36e2cb9abb
Test body proc detection. 2023-01-09 13:26:53 +13:00
Samuel Williams
5af76309ef
Close previous response if any. 2023-01-09 13:26:53 +13:00
Samuel Williams
dc9c0859c0
Allow assigning streaming response body. 2023-01-09 13:26:53 +13:00
Samuel Williams
8e8695ea57
Fix comment. 2023-01-09 13:26:53 +13:00
Samuel Williams
6d5e0d2de2
Limit changes to new interface, response=. 2023-01-09 13:26:53 +13:00
Samuel Williams
d8256ff62f
Fix test name. 2023-01-09 13:26:53 +13:00
Samuel Williams
c239d6d79c
Spaces inside brackets. 2023-01-09 13:26:53 +13:00
Samuel Williams
ec3830d54a
Add some tests. 2023-01-09 13:26:52 +13:00