Commit Graph

15566 Commits

Author SHA1 Message Date
Samuel Williams
f63a5e7d16
Improve matching of cookie assertions.
The current implementation makes assumptions about the order and case
sensitivity of cookie attributes. Introduce methods to parse those fields
and compare them semantically. Update the existing tests to take advantage
of these new assertions.
2023-01-20 14:53:18 +13:00
Rafael Mendonça França
7c38258f70
Merge pull request #46327 from elliotcm/elliotcm/fix-stream-content-type
Fix content-type header with `send_stream`
2023-01-18 15:32:48 -05:00
Jean Boussier
66227e01e7 Improve Rails' Shape friendliness (third pass)
Followup: https://github.com/rails/rails/pull/47023

```
Shape Edges Report
-----------------------------------
snip...
       130  @_config
snip...
        99  @_url_options
```
2023-01-18 15:44:08 +01:00
Rafael Mendonça França
9ecc8785ef
Fix rubocop violations 2023-01-17 19:51:40 +00:00
John Hawthorn
13016ce16e Avoid regex backtracking on If-None-Match header
[CVE-2023-22795]
2023-01-17 11:38:11 -08:00
sabulikia
fbc24520a3 Use string#split instead of regex for domain parts
[CVE-2023-22792]
2023-01-17 11:38:11 -08:00
wonda-tea-coffee
f6cdce50d4 Fix sec issue with _url_host_allowed?
Disallow certain strings from `_url_host_allowed?` to avoid a redirect
to malicious sites.

[CVE-2023-22797]
2023-01-17 11:38:11 -08:00
Petrik de Heus
c975051746
Merge pull request #47029 from hahmed/ha/fix-routing-wording-in-doc [ci-skip]
Update docs in actionpack to use bin/rails
2023-01-17 16:34:50 +01:00
Jean Boussier
aa7d78d9b1 Improve Rails' Shape friendliness (second pass)
Followup: https://github.com/rails/rails/pull/47023

```
Shape Edges Report
-----------------------------------
snip...
       238  @errors
snip...
       219  @options
snip...
       129  @_request
       128  @type
       125  @virtual_path
       124  @_assigns
       123  @_config
       123  @_controller
       123  @output_buffer
       123  @view_flow
       122  @_default_form_builder
snip...
        89  @_already_called
        75  @validation_context
snip...
        65  @_new_record_before_last_commit
snip...
        58  @_url_options
snip...
```
2023-01-17 13:55:49 +01:00
Haroon Ahmed
2303628189 Update doc to use bin/rails which is the correct convention for invoking rails commands 2023-01-17 09:42:38 +00:00
Rafael Mendonça França
03a1da9c34
Merge pull request #46915 from joshuay03/update-action-pack-render-template-tests
Update `ActionPack` render template with locals tests
2023-01-16 18:40:27 -05:00
Jean Boussier
fc950324bd Improve Rails' Shape friendliness
Ruby 3.2 significantly changed how instance variables are store.
It now use shapes, and in short, it's important for performance
to define instance variables in a consistent order to limit the
amount of shapes.

Otherwise, the number of shapes will increase past a point where
MRI won't be able to cache instance variable access. The impact
is even more important when YJIT is enabled.

This PR is data driven. I dump the list of Shapes from Shopify's
monolith production environment, and Rails is very present among
the top offenders:

```
Shape Edges Report
-----------------------------------
       770  @default_graphql_name
       697  @own_fields
       661  @to_non_null_type
       555  @own_interface_type_memberships
       472  @description
       389  @errors
       348  @oseid
       316  @_view_runtime
       310  @_db_runtime
       292  @visibility
       286  @shop
       271  @attribute_method_patterns_cache
       264  @namespace_for_serializer
       254  @locking_column
       254  @primary_key
       253  @validation_context
       244  @quoted_primary_key
       238  @access_controls
       234  @_trigger_destroy_callback
       226  @_trigger_update_callback
       224  @finder_needs_type_condition
       215  @_committed_already_called
       214  @api_type
       203  @mutations_before_last_save
       202  @access_controls_overrides
       201  @options
       198  @mutations_from_database
       190  @_already_called
       183  @name
       179  @_request
       176  @own_arguments
       175  @_assigns
       175  @virtual_path
       174  @context
       173  @_controller
       173  @output_buffer
       173  @view_flow
       172  @_default_form_builder
       169  @cache
       159  @_touch_record
       151  @attribute_names
       151  @default_attributes
       150  @columns_hash
       149  @attribute_types
       148  @columns
       147  @marked_for_same_origin_verification
       146  @schema_loaded
       143  @_config
       143  @type
       141  @column_names
```

All the changes are of similar nature, the goal is to preset the instance
variable to nil when objects are allocated, or when classes are created.

For classes I leverage the `inherited` hook. If the patern becomes common enough
it might make sense to add a helper for this in `ActiveSupport::Concern`.
2023-01-16 12:31:37 +01:00
eileencodes
d9dd1c59d0
Implement spot and don't use keep_script_lines in Ruby 3.2
We want to use error highlight with eval'd code, specifically ERB
templates.

Previously we could only get the information we needed by setting
`keep_script_lines` to true. In Ruby 3.2 and error_highlight we added
the ability to get this information without setting `keep_script_lines`.

This change implements that new behavior for Rails.

I removed the script line changes to support this in 3.1 because it is
not in any released version.

Ruby change: https://github.com/ruby/ruby/pull/6593
Erorr highlight change: https://github.com/ruby/error_highlight/pull/26

Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>
2023-01-13 16:20:09 -05:00
Lachlan Sylvester
0a77b32042 discard marshal dumped values when reading a signed cookie 2023-01-13 10:47:01 +11:00
Fabian Mersch
e768fc8ab8 Scope generated route helpers to an instance of RoutesProxy 2023-01-12 15:03:57 +01:00
Roman Sokhan
b7d7376df1 Fix rare conflict of default_render with Minitest::Mock 2023-01-11 18:24:15 +02:00
Samuel Williams
28c8e2229f
Be more explicit when wrapping in an enumerable body. 2023-01-09 13:26:53 +13:00
Samuel Williams
36e2cb9abb
Test body proc detection. 2023-01-09 13:26:53 +13:00
Samuel Williams
5af76309ef
Close previous response if any. 2023-01-09 13:26:53 +13:00
Samuel Williams
dc9c0859c0
Allow assigning streaming response body. 2023-01-09 13:26:53 +13:00
Samuel Williams
8e8695ea57
Fix comment. 2023-01-09 13:26:53 +13:00
Samuel Williams
6d5e0d2de2
Limit changes to new interface, response=. 2023-01-09 13:26:53 +13:00
Samuel Williams
d8256ff62f
Fix test name. 2023-01-09 13:26:53 +13:00
Samuel Williams
c239d6d79c
Spaces inside brackets. 2023-01-09 13:26:53 +13:00
Samuel Williams
ec3830d54a
Add some tests. 2023-01-09 13:26:52 +13:00
Samuel Williams
49053fe8c0
Direct support for assigning to self.response. 2023-01-09 13:26:52 +13:00
Jonathan Hefner
aaf7bed003 Document ActionController::Rendering#render [ci-skip]
In #33418, documentation from `ActionView::Helpers::RenderingHelper#render`
was copied to `ActionController::Renderer#render` with the intention of
documenting `ActionController::Rendering#render`.  Since then, further
documentation has been added to `ActionController::Renderer#render`, and
`ActionController::Renderer#render` has been mistaken for
`ActionController::Rendering#render` (for example, in #46045).

This commit adds documentation to `ActionController::Rendering#render`
(which was previously `:nodoc:` because it is a simple override of
`AbstractController::Rendering#render`), and updates related
documentation to point to `ActionController::Rendering#render`.
2023-01-08 15:47:31 -06:00
Jonathan Hefner
6969cdc969 Revise ConditionalGet#expires_in doc [ci-skip] 2023-01-08 15:47:31 -06:00
Jonathan Hefner
2cb419f220 Clean up ConditionalGet#stale? doc [ci-skip] 2023-01-08 15:47:31 -06:00
Jonathan Hefner
657f214f25 Clean up ConditionalGet#fresh_when doc [ci-skip] 2023-01-08 15:47:31 -06:00
Jonathan Hefner
9a82d9585c Replace RFC 2616 links [ci-skip]
The w3.org RFC 2616 page displays an obtrusive "This document has been
superseded" overlay.  In regard to the `Cache-Control` header, RFC 2616
has been superseded by RFC 7234, which, in turn, has been superseded by
RFC 9111.

Therefore, this commit replaces links to RFC 2616 with links to either
MDN or RFC 9111.
2023-01-08 15:47:31 -06:00
Jonathan Hefner
ce23110829 Coordinate FilterParameters and ParameterFilter docs [ci-skip]
This clarifies the `ActiveSupport::ParameterFilter` documentation, and
tweaks the example code to be more friendly to the syntax highlighter
(similar to the tweaks made for `ActionDispatch::Http::FilterParameters`
in 782bed5d450363b302e0e6aa28b7ea0aef306d9f).

This also trims the `ActionDispatch::Http::FilterParameters`
documentation, and links it to `ActiveSupport::ParameterFilter`, since
`ActiveSupport::ParameterFilter` is responsible for filter behavior.
2023-01-08 15:47:20 -06:00
Jonathan Hefner
1aba8f64bf Document AD::Request::RFC* constants individually [ci-skip]
Prior to this commit, the list of RFCs and URLs was jumbled in a single
paragraph (with no delimiters) that was associated with the `RFC2616`
constant.

This commit splits up the list, associating each RFC with its respective
constant, and incorporating each URL into a link.
2023-01-08 15:47:20 -06:00
Jonathan Hefner
cfe300ceb1 Format inline code [ci-skip] 2023-01-08 15:47:20 -06:00
Jonathan Hefner
3eadf057db Fix typos in API docs [ci-skip] 2023-01-08 15:47:20 -06:00
Jonathan Hefner
33557c5dca Indent private methods in code examples [ci-skip]
This matches the indentation used in generated code, such as code from
`railties/lib/rails/generators/rails/scaffold_controller/templates/controller.rb.tt`.
2023-01-08 15:47:20 -06:00
Jean Boussier
481c169aa5
Merge pull request #46910 from skipkayhil/more-string-include
Fix Performance/StringInclude that RuboCop can't
2023-01-07 14:32:49 +01:00
Joshua Young
7e351255c0 [Closes #46724] Update ActionPack render template with locals tests 2023-01-07 12:04:37 +10:00
Akira Matsuda
e0936d99a3
Revert "One less String allocation for event.allocations"
This reverts commit ae569eaef86fb5f74e1d6150cb6945ec700d26a9.

Seems like this broke Action View CI
2023-01-07 06:00:21 +09:00
Hartley McGuire
583ce94c22
Fix Performance/StringInclude that RuboCop can't
This replaces two instances of /html/.match?(<string>) with the more
performant <string>.include?("html").

Performance/StringInclude was enabled in 3158bbb, however RuboCop does
not flag these two because it is unable to determine that the variable
passed to #match? is a string. In both these cases we know that the
variable must be a string (Mime::Type must be initialized with a string,
and Content-Type must be a string if present per Rack SPEC)

These were found by `rg '/\[\w ]+/\.match\?'`, and while this search
returns other entries they are either comments or in test files.
2023-01-06 15:52:32 -05:00
Akira Matsuda
ae569eaef8
One less String allocation for event.allocations 2023-01-07 04:54:32 +09:00
Jean Boussier
dcb4f4d557
Merge pull request #46862 from skipkayhil/lint-ad-integration
Fix IntegrationTest not following Rack SPEC
2023-01-06 16:36:32 +01:00
Hartley McGuire
eef4e755e0
Changelog for 0019dea
As this is a user facing change, it should have a changelog entry
2023-01-05 17:43:15 -05:00
Junichi Sato
6f1f2d74e6
Tweak doc to show helper methods need not be public [ci-skip] 2023-01-05 16:19:36 +09:00
Akira Matsuda
bfb0a6c211
require active_support/test_case instead of minitest
because this file references AS::TestCase which already loads minitest.
2023-01-05 02:15:10 +09:00
eileencodes
04e1a0d2e1
Add documentation for #43487
In #43487 we missed adding a changelog so that's been added here. In
addition, since this isn't a new framework default unless you are
creating a new application (and only in dev and test environments by
default) it can be easy to miss this new option. I've updated the
message to mention the option following DHH's suggestion on the original
PR.
2023-01-03 13:40:28 -05:00
Hartley McGuire
060887d4c5
Fix IntegrationTest not following Rack SPEC
Previously, ActionDispatch::IntegrationTest would always set
CONTENT_TYPE on the request whether or not the value being set was a
string or nil. However, Rack SPEC requires that if CONTENT_TYPE is set,
it must be a string.

Since the request_encoder can return nil for #content_type (and the
IdentityEncoder always will), IntegrationTest must check before it sets
the CONTENT_TYPE value.

A Rack::Lint test has been added to prevent regressions. Additionally,
it will make changes needed for Rack 3 more obvious when the time comes.
2022-12-30 16:19:25 -05:00
Matthew Draper
0f0ec9908e
Merge pull request #46792 from codeminator/fix-flaky-tests
Increase `socket_timeout` for Memcached inside memcached tests
2022-12-27 17:45:33 +10:30
Yasuo Honda
15576ddedb
Merge pull request #46800 from the-spectator/prefer_local_env
Prefer using new Rails.env.local?
2022-12-24 08:40:42 +09:00
Akira Matsuda
a790203408
Use Kernel#Array to avoid an extra Array allocation when nil was given 2022-12-23 23:34:34 +09:00