Commit Graph

14849 Commits

Author SHA1 Message Date
KapilSachdev
dabece17ad fix: warning: instance variable @controller not initialized
Fixes #39937
2020-08-11 20:37:27 +05:30
Gannon McGibbon
8d4d0f3701 Fix assert_recognizes on mounted root routes.
Allow `assert_recognizes` routing assertions to work on mounted root routes.
2020-08-10 16:59:52 -04:00
Vipul A M
7246136234
Merge pull request #39860 from hahmed/docs/actiondispatch-cookies-improvements
Update wording for cookies [ci-skip]
2020-07-31 08:49:25 +05:30
Vinicius Stock
6e636e2336
Reduce allocations in transition_table (#39943)
* Reduce allocations in transition_table

* Use predicate symbol? instead of is_a?
2020-07-30 14:24:48 +09:00
Eugene Kenny
23229d2453
Merge pull request #39927 from composerinteralia/remove-test-methods-from-class
Move Path::Pattern factories into test helper
2020-07-27 20:08:07 +01:00
Daniel Colson
8eec6ee962
Move Path::Pattern factories into test helper
`Pattern#from_sting` was introduced in bb207ea7 to support creating
patterns from strings in tests (removing a conditional in the initialize
method that had been there only for the sake of those tests).

`Pattern#build` was introduced in 947ebe9a, and was similarly used only
in tests.

My understanding is that [`Mapping#path`][path] is the only place where
we initialize a `Path::Pattern` in library code.

Since these two methods appear to be used only in tests, this
commit moves them out of the class and into a test helper.

My reasoning for doing this is that I am doing some performance work
that may involve a modification to how `Path::Pattern`s get initialized,
and I will have more confidence in that work if I know for sure that
these methods are test helpers that can be modified freely.

[path]: https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/routing/mapper.rb#L192-L194
2020-07-27 12:23:33 -04:00
Vitalii Khustochka
5b6aa8c20a Path parameter keys should always be symbols.
If request format is JSON, keys are converted to Strings, so we have to convert them to Symbols.
2020-07-25 12:51:06 -05:00
Eugene Kenny
de2520718f
Merge pull request #39925 from composerinteralia/set-star-regexp-on-initialize
Build symbols descending from stars with regexp
2020-07-25 09:52:42 +01:00
Daniel Colson
185c4f2d11
Build symbols descending from stars with regexp
Before this commit we initialized all Symbols with the default regexp,
then later on reassigned any symbols descending from stars with either
their regexp from `@requirements` or the default greedy regexp.

With this commit we initialize all Symbols descending from Stars with
the greedy regexp at parse time. This allows us to get rid of the star
branch in path/pattern, since any regexps from `@requirements` will
already have been set in the symbol branch of this code.

This is essentially an alternate version of #38901. Getting rid of the
extra branch makes some performance work I am doing a bit easier, plus
it saves us a few method calls. Also the constant saves us from creating
the same regexp multiple times, and it is nice to give that regexp a
name.
2020-07-24 22:30:20 -04:00
Ryuta Kamizono
1db627b973
Merge pull request #39923 from marcrohloff/abstract-store-set-cookie-argument-naming
Fix argument naming in `AbstractStore#set_cookie`
2020-07-25 10:53:11 +09:00
Marc Rohloff
9cc8e51e0d
Fix argument naming in AbstractStore#set_cookie
The signature in Rack https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L415 expects a response as the second argument
2020-07-24 19:07:14 -06:00
Eugene Kenny
8a4192fa3d
Merge pull request #39916 from composerinteralia/remove-pass-from-build-path
Alter regexp on initialize to avoid extra ast pass
2020-07-24 00:11:03 +01:00
eileencodes
5f63c771f7
Refactor process method
Awhile back tenderlove and I worked to improve performance of
integration tests and remove controller tests. The second never
happened, we ended up soft deprecating them but never did that
completely.

Now that we're revisting that work we need a way to override these two
methods in tests so that we can convert tests in Rails to be integration
tests instead of controller tests. Splitting these two concerns into two
methods allows us to overwrite them to work for our needs while
refactoring the test harness code.

These methods are private because they should not be used by an
application or gems, they will be removed when the refactoring has been
completed.

Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>
2020-07-23 12:52:21 -04:00
Daniel Colson
4b01bdedd3
Alter regexp on initialize to avoid extra ast pass
Along the same lines as #38901, #39903, and #39914, this commit removes
one pass through the journey ast in an attempt to improve application
boot time.

Before this commit, `Mapper#path` would iterate through the ast to alter
the regex for custom routes. With this commit we move the regex
alterations to initialize, where we were already iterating through the
ast.

The Benchmark for this change is similar to what we have been seeing in
the other PRs.

```
Warming up --------------------------------------
               after    13.121k i/100ms
              before     7.416k i/100ms
Calculating -------------------------------------
               after    128.469k (± 3.1%) i/s -    642.929k in 5.009391s
              before     76.561k (± 1.8%) i/s -    385.632k in 5.038677s

Comparison:
               after:   128469.4 i/s
              before:    76560.8 i/s - 1.68x  (± 0.00) slower

Calculating -------------------------------------
               after   160.000  memsize (     0.000  retained)
                         3.000  objects (     0.000  retained)
                         0.000  strings (     0.000  retained)
              before   360.000  memsize (     0.000  retained)
                         6.000  objects (     0.000  retained)
                         0.000  strings (     0.000  retained)

Comparison:
               after:        160 allocated
              before:        360 allocated - 2.25x more
```
2020-07-23 11:51:08 -04:00
Daniel Colson
6a2adeb394
Consolidate passes through path ast
Along the same lines as https://github.com/rails/rails/pull/38901,
this commit makes a small performance enhancement by iterating through
the ast once instead of twice when initializing a Mapping.

This stemmed from work to improve the boot time of an application with
3500+ routes. This patch only shaves off about 70ms from our boot time,
and about 25000 allocations, but every little bit counts!

Benchmark
---

```rb

require "bundler/inline"

gemfile(true) do
  source "https://rubygems.org"

  git_source(:github) { |repo| "https://github.com/#{repo}.git" }

  # Activate the gem you are reporting the issue against.
  gem "rails", path: "/Users/daniel/Desktop/oss/rails/rails"
  gem "benchmark-ips"
  gem "benchmark-memory", require: "benchmark/memory"
end

require "action_controller/railtie"

class TestApp < Rails::Application
  config.root = __dir__
  config.hosts << "example.org"
  config.session_store :cookie_store, key: "cookie_store_key"
  secrets.secret_key_base = "secret_key_base"

  config.logger = Logger.new($stdout)
  Rails.logger = config.logger

  routes.draw do
    get("/*wildcard", to: "controller#index")
  end
end
```

With the benchmarking code inserted into Mapper#initialize:

```rb
after = -> {
  path_params = []
  wildcard_options = {}
  ast.each do |node|
    if node.symbol?
      path_params << node.to_sym
    elsif node.star? && formatted != false
      # Add a constraint for wildcard route to make it non-greedy and match the
      # optional format part of the route by default.
      wildcard_options[node.name.to_sym] ||= /.+?/
    end
  end

  wildcard_options.merge(options)
}

before = -> {
  path_params = ast.find_all(&:symbol?).map(&:to_sym)

  add_wildcard_options(options, formatted, ast)
}

puts "IPS"

Benchmark.ips do |x|
  x.report("before") { before.call }
  x.report("after") { after.call }
  x.compare!
end

puts "MEMORY"

Benchmark.memory do |x|
  x.report("before") { before.call }
  x.report("after") { after.call }
  x.compare!
end
```

The results are:

```
IPS
Warming up --------------------------------------
              before    14.352k i/100ms
               after    30.852k i/100ms
Calculating -------------------------------------
              before    135.675k (± 3.7%) i/s -    688.896k in   5.084368s
               after    288.126k (± 3.3%) i/s -      1.450M in   5.038072s

Comparison:
               after:   288126.4 i/s
              before:   135675.1 i/s - 2.12x  (± 0.00) slower

MEMORY
Calculating -------------------------------------
              before   360.000  memsize (     0.000  retained)
                         7.000  objects (     0.000  retained)
                         0.000  strings (     0.000  retained)
               after   200.000  memsize (     0.000  retained)
                         4.000  objects (     0.000  retained)
                         0.000  strings (     0.000  retained)

comparison:
               after:        200 allocated
              before:        360 allocated - 1.80x more  end
```
2020-07-22 18:57:40 -04:00
Eugene Kenny
57daae230b Assert that DebugExceptions renders HTML by default
This would have made the correct implementation for
894ed87a7e0e1ba36b8ba8f8ead0a871550354e5 more obvious.
2020-07-20 22:37:35 +01:00
Loren Norman
894ed87a7e Fix InvalidMimeType errors not being caught, with tests.
Co-authored-by: Eugene Kenny <elkenny@gmail.com>
2020-07-20 11:45:57 -04:00
Haroon Ahmed
a653e6cd1d Update wording for cookies, adding information about the http request/response header. Also added the bytes to the cookie size limit 2020-07-19 21:44:30 +01:00
Vinicius Stock
4fb78a0b87
Switch regex for delete_suffix in normalize_path 2020-07-16 17:46:38 -04:00
eileencodes
6f04ec1ee1
Stop using a singleton for routes
This change ensures we're no longer using a singleton for routes because
we want to change the routing table based on the controller we're
testing. We don't want the routing table to be global for the Action
Pack tests.

Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>
2020-07-14 13:46:54 -04:00
Rafael França
d33a150ae0
Merge pull request #39815 from vinistock/save_allocations_in_visit_cat
Save an allocation in visit CAT
2020-07-09 14:45:05 -04:00
Vinicius Stock
bb611e59a6
Save an allocation in visit CAT 2020-07-09 13:49:50 -04:00
Eugene Kenny
9b6f7d7f54
Merge pull request #39725 from vinistock/save_allocation_in_visit_star
Save a string allocation in visit_STAR
2020-07-08 21:35:10 +01:00
Guo Xiang Tan
f1e53be508
Change default HTTP status to 308 for ActionDispatch::SSL.
308 status code introduced in https://tools.ietf.org/html/rfc7538
preserves the request method unlike 301 status code which would convert
POST requests to GET.
2020-07-06 14:51:24 +08:00
Jean Boussier
a55c57d0ef Deduplicate some routing data 2020-06-30 18:32:31 +02:00
Jean Boussier
12f3f11f61 Use URI::DEFAULT_PARSER rather than instantiate a new one 2020-06-29 23:06:34 +02:00
Vinicius Stock
79fcdab538
Save a string allocation in visit_STAR 2020-06-25 15:07:55 -04:00
Andrew White
36b44ca9f7
Merge pull request #39657 from tgxworld/update_follow_redirect_helper
Update `follow_redirect!` to reuse same HTTP verb for 308 redirections.
2020-06-20 12:06:41 +01:00
eileencodes
9540a7b119
Fix json encoded controller tests
The controller test case is trying to encode json parameters in the same
way it encodes query parameters. However we need to encode json
parameters as json.

This was broken in #39534 because `generate_extras` is encoding
everything into query parameters. But json parameters are in the post
body and need to be treated differently than the query parameters.

Followup to #39651

Aaron Patterson <tenderlove@ruby-lang.org>
2020-06-18 17:15:48 -04:00
Guo Xiang Tan
e84c43844d
Update follow_redirect! to reuse same HTTP verb for 308 redirections. 2020-06-18 10:24:20 +08:00
Rafael Mendonça França
661da266b9
Only allow ActionableErrors if show_detailed_exceptions is enabled
[CVE-2020-8185]
2020-06-17 07:59:57 -07:00
Edouard CHIN
7dc4c4365c Fix route params using reserved keywords:
- In #39534, `Routing::RouteSet#generate_extras` (which get called)
  by ActionController::TestCase now go through `path_for` which strips
  out all key in the options hash that have the same name as the ones
  defined in `RESERVED_OPTIONS`.
2020-06-15 22:10:54 +02:00
Ryuta Kamizono
528b62e386 Address to false negative for Performance/DeletePrefix,DeleteSuffix
Follow up to c07dff72278fb7f2a3c4c71212a0773a2b25c790.

Actually it is not the cop's fault, but we mistakenly use `^`, `$`, and
`\Z` in much places, the cop doesn't correct those conservatively.

I've checked all those usage and replaced all safe ones.
2020-06-14 13:04:47 +09:00
Étienne Barrié
cf3736dce8
Add application config for URL-safe Base64 CSRF tokens
This allows applications to safely upgrade to Rails 6.1 without
breaking tokens while the deploy is still being rolled out.
2020-06-11 11:39:37 -04:00
Eugene Kenny
186115180e
Merge pull request #39557 from jonathanhefner/cookie-domains-strict-match
Strict match when choosing cookie domain for host
2020-06-10 09:18:25 +01:00
Jonathan Hefner
1704be74ee Strict match when choosing cookie domain for host
Prior to this commit, when multiple cookie domains were specified, the
first domain that was a substring of the request host was chosen.  This
allowed, for example, the "example.com" domain to be chosen when the
request host was "example.com.au" or even "myexample.com".

This commit ensures a domain is chosen only if it is equal to or is a
superdomain of the request host.

Fixes #37760.
2020-06-10 02:17:39 -05:00
Rafael Mendonça França
2c5c452d8c
Remove more references to white list 2020-06-09 13:47:12 -04:00
Étienne Barrié
f1cef4c9ca Remove invalid autoloads in top-level Rails modules 2020-06-08 17:21:26 -04:00
Ryuta Kamizono
cfb7c16ac4 Fixup CHANGELOGs [ci skip] 2020-06-07 12:58:22 +09:00
eileencodes
437ab2031e
Convert route params array into object
This PR converts the route params array into an object and moves the
error generation code into its own object as well. This is a refactoring
of internal code to make it easier to change and simplier for internals
to interface with. We have two new objects:

1) `RouteWithParams`

Previously `#generate` returned an array of parameterized parts for a
route. We have now turned this into an object with a `path` and a
`params methods` to be able to access the parts we need.

2) `MissingRoute`

`#generate` was also responsible for constructing the message for the
error. We've moved this code into the new `MissingRoute` object so it
does that work instead.

This change makes these methods reusable throughout the code and easier
for future refactoring we plan to do.

Co-authored-by: Aaron Patterson <aaron.patterson@gmail.com>
2020-06-05 13:18:49 -04:00
Akira Matsuda
1eafed13e3 Revert "No need to synchronize for just reading an ivar, at least in MRI"
This reverts commit ea791e53f9edbe1e2d2ca779f5ce20b27320581f.

reason: these ivars are modified within other synchronize blocks,
        and so need to be blocked from other threads for ensuring therad safety.

Co-authored-by: Ryuta Kamizono <kamipo@gmail.com>
2020-06-04 19:07:51 +09:00
Aaron Patterson
35fe9bc0aa
Merge pull request #39477 from p8/improve-inspect
Make custom inspect methods more consistent
2020-06-03 10:43:35 -07:00
Eugene Kenny
a9c27de2c2
Merge pull request #39488 from eugeneius/recommend_null_session
Don't recommend disabling CSRF protection [ci skip]
2020-06-02 00:25:55 +01:00
Eugene Kenny
ac846614c6 Don't recommend disabling CSRF protection [ci skip]
The previous example disables CSRF protection for JSON format requests,
which allows any request to bypass it by adding the right Accept header.

Accept is one of the few headers that doesn't trigger a CORS preflight:
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Examples_of_access_control_scenarios

Instead of disabling it entirely, the simple case where authentication
is handled without a session (e.g. when using API keys) can be solved by
switching to the `:null_session` strategy.

For more complex cases (e.g. an API that uses session authentication),
I don't think a copy-and-paste-able example is appropriate; the user
needs to understand CSRF protection in order to make an informed choice.
2020-06-01 23:36:11 +01:00
Jeremy Daer
e3ef5911a1 Precompressed static file refactor 2020-06-01 08:57:05 -07:00
Ryan Hall
3d9a98b474 Allow rails to serve brotli encoded assets
When using an external build process (webpack, grunt) it's helpful for
rails to be able to serve those assets. Brotli has better compression
than gzip and should eventually replace it for static assets.

When using an external build process (webpack, grunt) it's helpful for
rails to be able to serve those assets. Brotli has better compression
than gzip and will eventually replace it for static assets.
2020-06-01 08:57:02 -07:00
Petrik
74cb9a6f38 Make inspect look more like regular Object#inspect
Move the # outside the < > just like regular Object#inspect
2020-05-29 21:53:35 +02:00
Kyle Zhao
bf512f6f4b Add missing # in wrap_parameters RDoc
[ci skip]
2020-05-29 14:57:24 -04:00
Eugene Kenny
f3f86be7b4
Merge pull request #39452 from rolandasb/fix-nil-encrypted-cookie-value
Fix nil encrypted/signed cookie value when value is stored as `false`
2020-05-28 08:49:45 +01:00
Rolandas Barysas
29d59c4823 Fix nil signed/encrypted cookie value when value is stored as false 2020-05-28 08:11:19 +01:00