RubyGems - actionpack - Versions diffs - 5.2.3 - Mend

actionpack 5.2.3

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (170) hide show

checksums.yaml +7 -0
data/CHANGELOG.md +429 -0
data/MIT-LICENSE +21 -0
data/README.rdoc +57 -0
data/lib/abstract_controller.rb +27 -0
data/lib/abstract_controller/asset_paths.rb +12 -0
data/lib/abstract_controller/base.rb +265 -0
data/lib/abstract_controller/caching.rb +66 -0
data/lib/abstract_controller/caching/fragments.rb +166 -0
data/lib/abstract_controller/callbacks.rb +212 -0
data/lib/abstract_controller/collector.rb +43 -0
data/lib/abstract_controller/error.rb +6 -0
data/lib/abstract_controller/helpers.rb +194 -0
data/lib/abstract_controller/logger.rb +14 -0
data/lib/abstract_controller/railties/routes_helpers.rb +20 -0
data/lib/abstract_controller/rendering.rb +127 -0
data/lib/abstract_controller/translation.rb +31 -0
data/lib/abstract_controller/url_for.rb +35 -0
data/lib/action_controller.rb +66 -0
data/lib/action_controller/api.rb +149 -0
data/lib/action_controller/api/api_rendering.rb +16 -0
data/lib/action_controller/base.rb +276 -0
data/lib/action_controller/caching.rb +46 -0
data/lib/action_controller/form_builder.rb +50 -0
data/lib/action_controller/log_subscriber.rb +78 -0
data/lib/action_controller/metal.rb +256 -0
data/lib/action_controller/metal/basic_implicit_render.rb +13 -0
data/lib/action_controller/metal/conditional_get.rb +274 -0
data/lib/action_controller/metal/content_security_policy.rb +52 -0
data/lib/action_controller/metal/cookies.rb +16 -0
data/lib/action_controller/metal/data_streaming.rb +152 -0
data/lib/action_controller/metal/etag_with_flash.rb +18 -0
data/lib/action_controller/metal/etag_with_template_digest.rb +57 -0
data/lib/action_controller/metal/exceptions.rb +53 -0
data/lib/action_controller/metal/flash.rb +61 -0
data/lib/action_controller/metal/force_ssl.rb +99 -0
data/lib/action_controller/metal/head.rb +60 -0
data/lib/action_controller/metal/helpers.rb +123 -0
data/lib/action_controller/metal/http_authentication.rb +519 -0
data/lib/action_controller/metal/implicit_render.rb +73 -0
data/lib/action_controller/metal/instrumentation.rb +107 -0
data/lib/action_controller/metal/live.rb +312 -0
data/lib/action_controller/metal/mime_responds.rb +313 -0
data/lib/action_controller/metal/parameter_encoding.rb +51 -0
data/lib/action_controller/metal/params_wrapper.rb +293 -0
data/lib/action_controller/metal/redirecting.rb +133 -0
data/lib/action_controller/metal/renderers.rb +181 -0
data/lib/action_controller/metal/rendering.rb +122 -0
data/lib/action_controller/metal/request_forgery_protection.rb +445 -0
data/lib/action_controller/metal/rescue.rb +28 -0
data/lib/action_controller/metal/streaming.rb +223 -0
data/lib/action_controller/metal/strong_parameters.rb +1086 -0
data/lib/action_controller/metal/testing.rb +16 -0
data/lib/action_controller/metal/url_for.rb +58 -0
data/lib/action_controller/railtie.rb +89 -0
data/lib/action_controller/railties/helpers.rb +24 -0
data/lib/action_controller/renderer.rb +117 -0
data/lib/action_controller/template_assertions.rb +11 -0
data/lib/action_controller/test_case.rb +629 -0
data/lib/action_dispatch.rb +112 -0
data/lib/action_dispatch/http/cache.rb +222 -0
data/lib/action_dispatch/http/content_security_policy.rb +272 -0
data/lib/action_dispatch/http/filter_parameters.rb +84 -0
data/lib/action_dispatch/http/filter_redirect.rb +37 -0
data/lib/action_dispatch/http/headers.rb +132 -0
data/lib/action_dispatch/http/mime_negotiation.rb +175 -0
data/lib/action_dispatch/http/mime_type.rb +342 -0
data/lib/action_dispatch/http/mime_types.rb +50 -0
data/lib/action_dispatch/http/parameter_filter.rb +86 -0
data/lib/action_dispatch/http/parameters.rb +126 -0
data/lib/action_dispatch/http/rack_cache.rb +63 -0
data/lib/action_dispatch/http/request.rb +430 -0
data/lib/action_dispatch/http/response.rb +519 -0
data/lib/action_dispatch/http/upload.rb +84 -0
data/lib/action_dispatch/http/url.rb +350 -0
data/lib/action_dispatch/journey.rb +7 -0
data/lib/action_dispatch/journey/formatter.rb +189 -0
data/lib/action_dispatch/journey/gtg/builder.rb +164 -0
data/lib/action_dispatch/journey/gtg/simulator.rb +41 -0
data/lib/action_dispatch/journey/gtg/transition_table.rb +158 -0
data/lib/action_dispatch/journey/nfa/builder.rb +78 -0
data/lib/action_dispatch/journey/nfa/dot.rb +36 -0
data/lib/action_dispatch/journey/nfa/simulator.rb +49 -0
data/lib/action_dispatch/journey/nfa/transition_table.rb +120 -0
data/lib/action_dispatch/journey/nodes/node.rb +140 -0
data/lib/action_dispatch/journey/parser.rb +199 -0
data/lib/action_dispatch/journey/parser.y +50 -0
data/lib/action_dispatch/journey/parser_extras.rb +31 -0
data/lib/action_dispatch/journey/path/pattern.rb +198 -0
data/lib/action_dispatch/journey/route.rb +203 -0
data/lib/action_dispatch/journey/router.rb +156 -0
data/lib/action_dispatch/journey/router/utils.rb +102 -0
data/lib/action_dispatch/journey/routes.rb +82 -0
data/lib/action_dispatch/journey/scanner.rb +64 -0
data/lib/action_dispatch/journey/visitors.rb +268 -0
data/lib/action_dispatch/journey/visualizer/fsm.css +30 -0
data/lib/action_dispatch/journey/visualizer/fsm.js +134 -0
data/lib/action_dispatch/journey/visualizer/index.html.erb +52 -0
data/lib/action_dispatch/middleware/callbacks.rb +36 -0
data/lib/action_dispatch/middleware/cookies.rb +685 -0
data/lib/action_dispatch/middleware/debug_exceptions.rb +205 -0
data/lib/action_dispatch/middleware/debug_locks.rb +124 -0
data/lib/action_dispatch/middleware/exception_wrapper.rb +147 -0
data/lib/action_dispatch/middleware/executor.rb +21 -0
data/lib/action_dispatch/middleware/flash.rb +300 -0
data/lib/action_dispatch/middleware/public_exceptions.rb +57 -0
data/lib/action_dispatch/middleware/reloader.rb +12 -0
data/lib/action_dispatch/middleware/remote_ip.rb +183 -0
data/lib/action_dispatch/middleware/request_id.rb +43 -0
data/lib/action_dispatch/middleware/session/abstract_store.rb +92 -0
data/lib/action_dispatch/middleware/session/cache_store.rb +54 -0
data/lib/action_dispatch/middleware/session/cookie_store.rb +118 -0
data/lib/action_dispatch/middleware/session/mem_cache_store.rb +28 -0
data/lib/action_dispatch/middleware/show_exceptions.rb +62 -0
data/lib/action_dispatch/middleware/ssl.rb +150 -0
data/lib/action_dispatch/middleware/stack.rb +116 -0
data/lib/action_dispatch/middleware/static.rb +130 -0
data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb +22 -0
data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.text.erb +23 -0
data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +27 -0
data/lib/action_dispatch/middleware/templates/rescues/_source.text.erb +8 -0
data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +52 -0
data/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb +9 -0
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +16 -0
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb +9 -0
data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +21 -0
data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +13 -0
data/lib/action_dispatch/middleware/templates/rescues/layout.erb +161 -0
data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +11 -0
data/lib/action_dispatch/middleware/templates/rescues/missing_template.text.erb +3 -0
data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +32 -0
data/lib/action_dispatch/middleware/templates/rescues/routing_error.text.erb +11 -0
data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +20 -0
data/lib/action_dispatch/middleware/templates/rescues/template_error.text.erb +7 -0
data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb +6 -0
data/lib/action_dispatch/middleware/templates/rescues/unknown_action.text.erb +3 -0
data/lib/action_dispatch/middleware/templates/routes/_route.html.erb +16 -0
data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +200 -0
data/lib/action_dispatch/railtie.rb +55 -0
data/lib/action_dispatch/request/session.rb +234 -0
data/lib/action_dispatch/request/utils.rb +78 -0
data/lib/action_dispatch/routing.rb +260 -0
data/lib/action_dispatch/routing/endpoint.rb +17 -0
data/lib/action_dispatch/routing/inspector.rb +225 -0
data/lib/action_dispatch/routing/mapper.rb +2267 -0
data/lib/action_dispatch/routing/polymorphic_routes.rb +352 -0
data/lib/action_dispatch/routing/redirection.rb +201 -0
data/lib/action_dispatch/routing/route_set.rb +890 -0
data/lib/action_dispatch/routing/routes_proxy.rb +69 -0
data/lib/action_dispatch/routing/url_for.rb +236 -0
data/lib/action_dispatch/system_test_case.rb +147 -0
data/lib/action_dispatch/system_testing/browser.rb +49 -0
data/lib/action_dispatch/system_testing/driver.rb +59 -0
data/lib/action_dispatch/system_testing/server.rb +31 -0
data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +96 -0
data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb +31 -0
data/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb +26 -0
data/lib/action_dispatch/testing/assertion_response.rb +47 -0
data/lib/action_dispatch/testing/assertions.rb +24 -0
data/lib/action_dispatch/testing/assertions/response.rb +107 -0
data/lib/action_dispatch/testing/assertions/routing.rb +222 -0
data/lib/action_dispatch/testing/integration.rb +652 -0
data/lib/action_dispatch/testing/request_encoder.rb +55 -0
data/lib/action_dispatch/testing/test_process.rb +50 -0
data/lib/action_dispatch/testing/test_request.rb +71 -0
data/lib/action_dispatch/testing/test_response.rb +53 -0
data/lib/action_pack.rb +26 -0
data/lib/action_pack/gem_version.rb +17 -0
data/lib/action_pack/version.rb +10 -0
metadata +318 -0

data/lib/action_controller/metal/redirecting.rb ADDED

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+module ActionController
+  module Redirecting
+    extend ActiveSupport::Concern
+    include AbstractController::Logger
+    include ActionController::UrlFor
+    # Redirects the browser to the target specified in +options+. This parameter can be any one of:
+    #
+    # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
+    # * <tt>Record</tt> - The URL will be generated by calling url_for with the +options+, which will reference a named URL for that record.
+    # * <tt>String</tt> starting with <tt>protocol://</tt> (like <tt>http://</tt>) or a protocol relative reference (like <tt>//</tt>) - Is passed straight through as the target for redirection.
+    # * <tt>String</tt> not containing a protocol - The current protocol and host is prepended to the string.
+    # * <tt>Proc</tt> - A block that will be executed in the controller's context. Should return any option accepted by +redirect_to+.
+    #
+    # === Examples:
+    #
+    #   redirect_to action: "show", id: 5
+    #   redirect_to @post
+    #   redirect_to "http://www.rubyonrails.org"
+    #   redirect_to "/images/screenshot.jpg"
+    #   redirect_to posts_url
+    #   redirect_to proc { edit_post_url(@post) }
+    #
+    # The redirection happens as a <tt>302 Found</tt> header unless otherwise specified using the <tt>:status</tt> option:
+    #
+    #   redirect_to post_url(@post), status: :found
+    #   redirect_to action: 'atom', status: :moved_permanently
+    #   redirect_to post_url(@post), status: 301
+    #   redirect_to action: 'atom', status: 302
+    #
+    # The status code can either be a standard {HTTP Status code}[https://www.iana.org/assignments/http-status-codes] as an
+    # integer, or a symbol representing the downcased, underscored and symbolized description.
+    # Note that the status code must be a 3xx HTTP code, or redirection will not occur.
+    #
+    # If you are using XHR requests other than GET or POST and redirecting after the
+    # request then some browsers will follow the redirect using the original request
+    # method. This may lead to undesirable behavior such as a double DELETE. To work
+    # around this you can return a <tt>303 See Other</tt> status code which will be
+    # followed using a GET request.
+    #
+    #   redirect_to posts_url, status: :see_other
+    #   redirect_to action: 'index', status: 303
+    #
+    # It is also possible to assign a flash message as part of the redirection. There are two special accessors for the commonly used flash names
+    # +alert+ and +notice+ as well as a general purpose +flash+ bucket.
+    #
+    #   redirect_to post_url(@post), alert: "Watch it, mister!"
+    #   redirect_to post_url(@post), status: :found, notice: "Pay attention to the road"
+    #   redirect_to post_url(@post), status: 301, flash: { updated_post_id: @post.id }
+    #   redirect_to({ action: 'atom' }, alert: "Something serious happened")
+    #
+    # Statements after +redirect_to+ in our controller get executed, so +redirect_to+ doesn't stop the execution of the function.
+    # To terminate the execution of the function immediately after the +redirect_to+, use return.
+    #   redirect_to post_url(@post) and return
+    def redirect_to(options = {}, response_status = {})
+      raise ActionControllerError.new("Cannot redirect to nil!") unless options
+      raise AbstractController::DoubleRenderError if response_body
+      self.status        = _extract_redirect_to_status(options, response_status)
+      self.location      = _compute_redirect_to_location(request, options)
+      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
+    end
+    # Redirects the browser to the page that issued the request (the referrer)
+    # if possible, otherwise redirects to the provided default fallback
+    # location.
+    #
+    # The referrer information is pulled from the HTTP +Referer+ (sic) header on
+    # the request. This is an optional header and its presence on the request is
+    # subject to browser security settings and user preferences. If the request
+    # is missing this header, the <tt>fallback_location</tt> will be used.
+    #
+    #   redirect_back fallback_location: { action: "show", id: 5 }
+    #   redirect_back fallback_location: @post
+    #   redirect_back fallback_location: "http://www.rubyonrails.org"
+    #   redirect_back fallback_location: "/images/screenshot.jpg"
+    #   redirect_back fallback_location: posts_url
+    #   redirect_back fallback_location: proc { edit_post_url(@post) }
+    #   redirect_back fallback_location: '/', allow_other_host: false
+    #
+    # ==== Options
+    # * <tt>:fallback_location</tt> - The default fallback location that will be used on missing +Referer+ header.
+    # * <tt>:allow_other_host</tt> - Allow or disallow redirection to the host that is different to the current host, defaults to true.
+    #
+    # All other options that can be passed to <tt>redirect_to</tt> are accepted as
+    # options and the behavior is identical.
+    def redirect_back(fallback_location:, allow_other_host: true, **args)
+      referer = request.headers["Referer"]
+      redirect_to_referer = referer && (allow_other_host || _url_host_allowed?(referer))
+      redirect_to redirect_to_referer ? referer : fallback_location, **args
+    end
+    def _compute_redirect_to_location(request, options) #:nodoc:
+      case options
+      # The scheme name consist of a letter followed by any combination of
+      # letters, digits, and the plus ("+"), period ("."), or hyphen ("-")
+      # characters; and is terminated by a colon (":").
+      # See https://tools.ietf.org/html/rfc3986#section-3.1
+      # The protocol relative scheme starts with a double slash "//".
+      when /\A([a-z][a-z\d\-+\.]*:|\/\/).*/i
+        options
+      when String
+        request.protocol + request.host_with_port + options
+      when Proc
+        _compute_redirect_to_location request, instance_eval(&options)
+      else
+        url_for(options)
+      end.delete("\0\r\n")
+    end
+    module_function :_compute_redirect_to_location
+    public :_compute_redirect_to_location
+    private
+      def _extract_redirect_to_status(options, response_status)
+        if options.is_a?(Hash) && options.key?(:status)
+          Rack::Utils.status_code(options.delete(:status))
+        elsif response_status.key?(:status)
+          Rack::Utils.status_code(response_status[:status])
+        else
+          302
+        end
+      end
+      def _url_host_allowed?(url)
+        URI(url.to_s).host == request.host
+      rescue ArgumentError, URI::Error
+        false
+      end
+  end
+end

data/lib/action_controller/metal/renderers.rb ADDED

@@ -0,0 +1,181 @@
+# frozen_string_literal: true
+require "set"
+module ActionController
+  # See <tt>Renderers.add</tt>
+  def self.add_renderer(key, &block)
+    Renderers.add(key, &block)
+  end
+  # See <tt>Renderers.remove</tt>
+  def self.remove_renderer(key)
+    Renderers.remove(key)
+  end
+  # See <tt>Responder#api_behavior</tt>
+  class MissingRenderer < LoadError
+    def initialize(format)
+      super "No renderer defined for format: #{format}"
+    end
+  end
+  module Renderers
+    extend ActiveSupport::Concern
+    # A Set containing renderer names that correspond to available renderer procs.
+    # Default values are <tt>:json</tt>, <tt>:js</tt>, <tt>:xml</tt>.
+    RENDERERS = Set.new
+    included do
+      class_attribute :_renderers, default: Set.new.freeze
+    end
+    # Used in <tt>ActionController::Base</tt>
+    # and <tt>ActionController::API</tt> to include all
+    # renderers by default.
+    module All
+      extend ActiveSupport::Concern
+      include Renderers
+      included do
+        self._renderers = RENDERERS
+      end
+    end
+    # Adds a new renderer to call within controller actions.
+    # A renderer is invoked by passing its name as an option to
+    # <tt>AbstractController::Rendering#render</tt>. To create a renderer
+    # pass it a name and a block. The block takes two arguments, the first
+    # is the value paired with its key and the second is the remaining
+    # hash of options passed to +render+.
+    #
+    # Create a csv renderer:
+    #
+    #   ActionController::Renderers.add :csv do |obj, options|
+    #     filename = options[:filename] || 'data'
+    #     str = obj.respond_to?(:to_csv) ? obj.to_csv : obj.to_s
+    #     send_data str, type: Mime[:csv],
+    #       disposition: "attachment; filename=#{filename}.csv"
+    #   end
+    #
+    # Note that we used Mime[:csv] for the csv mime type as it comes with Rails.
+    # For a custom renderer, you'll need to register a mime type with
+    # <tt>Mime::Type.register</tt>.
+    #
+    # To use the csv renderer in a controller action:
+    #
+    #   def show
+    #     @csvable = Csvable.find(params[:id])
+    #     respond_to do |format|
+    #       format.html
+    #       format.csv { render csv: @csvable, filename: @csvable.name }
+    #     end
+    #   end
+    def self.add(key, &block)
+      define_method(_render_with_renderer_method_name(key), &block)
+      RENDERERS << key.to_sym
+    end
+    # This method is the opposite of add method.
+    #
+    # To remove a csv renderer:
+    #
+    #   ActionController::Renderers.remove(:csv)
+    def self.remove(key)
+      RENDERERS.delete(key.to_sym)
+      method_name = _render_with_renderer_method_name(key)
+      remove_possible_method(method_name)
+    end
+    def self._render_with_renderer_method_name(key)
+      "_render_with_renderer_#{key}"
+    end
+    module ClassMethods
+      # Adds, by name, a renderer or renderers to the +_renderers+ available
+      # to call within controller actions.
+      #
+      # It is useful when rendering from an <tt>ActionController::Metal</tt> controller or
+      # otherwise to add an available renderer proc to a specific controller.
+      #
+      # Both <tt>ActionController::Base</tt> and <tt>ActionController::API</tt>
+      # include <tt>ActionController::Renderers::All</tt>, making all renderers
+      # available in the controller. See <tt>Renderers::RENDERERS</tt> and <tt>Renderers.add</tt>.
+      #
+      # Since <tt>ActionController::Metal</tt> controllers cannot render, the controller
+      # must include <tt>AbstractController::Rendering</tt>, <tt>ActionController::Rendering</tt>,
+      # and <tt>ActionController::Renderers</tt>, and have at least one renderer.
+      #
+      # Rather than including <tt>ActionController::Renderers::All</tt> and including all renderers,
+      # you may specify which renderers to include by passing the renderer name or names to
+      # +use_renderers+. For example, a controller that includes only the <tt>:json</tt> renderer
+      # (+_render_with_renderer_json+) might look like:
+      #
+      #   class MetalRenderingController < ActionController::Metal
+      #     include AbstractController::Rendering
+      #     include ActionController::Rendering
+      #     include ActionController::Renderers
+      #
+      #     use_renderers :json
+      #
+      #     def show
+      #       render json: record
+      #     end
+      #   end
+      #
+      # You must specify a +use_renderer+, else the +controller.renderer+ and
+      # +controller._renderers+ will be <tt>nil</tt>, and the action will fail.
+      def use_renderers(*args)
+        renderers = _renderers + args
+        self._renderers = renderers.freeze
+      end
+      alias use_renderer use_renderers
+    end
+    # Called by +render+ in <tt>AbstractController::Rendering</tt>
+    # which sets the return value as the +response_body+.
+    #
+    # If no renderer is found, +super+ returns control to
+    # <tt>ActionView::Rendering.render_to_body</tt>, if present.
+    def render_to_body(options)
+      _render_to_body_with_renderer(options) || super
+    end
+    def _render_to_body_with_renderer(options)
+      _renderers.each do |name|
+        if options.key?(name)
+          _process_options(options)
+          method_name = Renderers._render_with_renderer_method_name(name)
+          return send(method_name, options.delete(name), options)
+        end
+      end
+      nil
+    end
+    add :json do |json, options|
+      json = json.to_json(options) unless json.kind_of?(String)
+      if options[:callback].present?
+        if content_type.nil? || content_type == Mime[:json]
+          self.content_type = Mime[:js]
+        end
+        "/**/#{options[:callback]}(#{json})"
+      else
+        self.content_type ||= Mime[:json]
+        json
+      end
+    end
+    add :js do |js, options|
+      self.content_type ||= Mime[:js]
+      js.respond_to?(:to_js) ? js.to_js(options) : js
+    end
+    add :xml do |xml, options|
+      self.content_type ||= Mime[:xml]
+      xml.respond_to?(:to_xml) ? xml.to_xml(options) : xml
+    end
+  end
+end

data/lib/action_controller/metal/rendering.rb ADDED

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+module ActionController
+  module Rendering
+    extend ActiveSupport::Concern
+    RENDER_FORMATS_IN_PRIORITY = [:body, :plain, :html]
+    module ClassMethods
+      # Documentation at ActionController::Renderer#render
+      delegate :render, to: :renderer
+      # Returns a renderer instance (inherited from ActionController::Renderer)
+      # for the controller.
+      attr_reader :renderer
+      def setup_renderer! # :nodoc:
+        @renderer = Renderer.for(self)
+      end
+      def inherited(klass)
+        klass.setup_renderer!
+        super
+      end
+    end
+    # Before processing, set the request formats in current controller formats.
+    def process_action(*) #:nodoc:
+      self.formats = request.formats.map(&:ref).compact
+      super
+    end
+    # Check for double render errors and set the content_type after rendering.
+    def render(*args) #:nodoc:
+      raise ::AbstractController::DoubleRenderError if response_body
+      super
+    end
+    # Overwrite render_to_string because body can now be set to a Rack body.
+    def render_to_string(*)
+      result = super
+      if result.respond_to?(:each)
+        string = "".dup
+        result.each { |r| string << r }
+        string
+      else
+        result
+      end
+    end
+    def render_to_body(options = {})
+      super || _render_in_priorities(options) || " "
+    end
+    private
+      def _process_variant(options)
+        if defined?(request) && !request.nil? && request.variant.present?
+          options[:variant] = request.variant
+        end
+      end
+      def _render_in_priorities(options)
+        RENDER_FORMATS_IN_PRIORITY.each do |format|
+          return options[format] if options.key?(format)
+        end
+        nil
+      end
+      def _set_html_content_type
+        self.content_type = Mime[:html].to_s
+      end
+      def _set_rendered_content_type(format)
+        if format && !response.content_type
+          self.content_type = format.to_s
+        end
+      end
+      # Normalize arguments by catching blocks and setting them on :update.
+      def _normalize_args(action = nil, options = {}, &blk)
+        options = super
+        options[:update] = blk if block_given?
+        options
+      end
+      # Normalize both text and status options.
+      def _normalize_options(options)
+        _normalize_text(options)
+        if options[:html]
+          options[:html] = ERB::Util.html_escape(options[:html])
+        end
+        if options[:status]
+          options[:status] = Rack::Utils.status_code(options[:status])
+        end
+        super
+      end
+      def _normalize_text(options)
+        RENDER_FORMATS_IN_PRIORITY.each do |format|
+          if options.key?(format) && options[format].respond_to?(:to_text)
+            options[format] = options[format].to_text
+          end
+        end
+      end
+      # Process controller specific options, as status, content-type and location.
+      def _process_options(options)
+        status, content_type, location = options.values_at(:status, :content_type, :location)
+        self.status = status if status
+        self.content_type = content_type if content_type
+        headers["Location"] = url_for(location) if location
+        super
+      end
+  end
+end

data/lib/action_controller/metal/request_forgery_protection.rb ADDED

@@ -0,0 +1,445 @@
+# frozen_string_literal: true
+require "rack/session/abstract/id"
+require "action_controller/metal/exceptions"
+require "active_support/security_utils"
+require "active_support/core_ext/string/strip"
+module ActionController #:nodoc:
+  class InvalidAuthenticityToken < ActionControllerError #:nodoc:
+  end
+  class InvalidCrossOriginRequest < ActionControllerError #:nodoc:
+  end
+  # Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks
+  # by including a token in the rendered HTML for your application. This token is
+  # stored as a random string in the session, to which an attacker does not have
+  # access. When a request reaches your application, \Rails verifies the received
+  # token with the token in the session. All requests are checked except GET requests
+  # as these should be idempotent. Keep in mind that all session-oriented requests
+  # should be CSRF protected, including JavaScript and HTML requests.
+  #
+  # Since HTML and JavaScript requests are typically made from the browser, we
+  # need to ensure to verify request authenticity for the web browser. We can
+  # use session-oriented authentication for these types of requests, by using
+  # the <tt>protect_from_forgery</tt> method in our controllers.
+  #
+  # GET requests are not protected since they don't have side effects like writing
+  # to the database and don't leak sensitive information. JavaScript requests are
+  # an exception: a third-party site can use a <script> tag to reference a JavaScript
+  # URL on your site. When your JavaScript response loads on their site, it executes.
+  # With carefully crafted JavaScript on their end, sensitive data in your JavaScript
+  # response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or
+  # Ajax) requests are allowed to make GET requests for JavaScript responses.
+  #
+  # It's important to remember that XML or JSON requests are also affected and if
+  # you're building an API you should change forgery protection method in
+  # <tt>ApplicationController</tt> (by default: <tt>:exception</tt>):
+  #
+  #   class ApplicationController < ActionController::Base
+  #     protect_from_forgery unless: -> { request.format.json? }
+  #   end
+  #
+  # CSRF protection is turned on with the <tt>protect_from_forgery</tt> method.
+  # By default <tt>protect_from_forgery</tt> protects your session with
+  # <tt>:null_session</tt> method, which provides an empty session
+  # during request.
+  #
+  # We may want to disable CSRF protection for APIs since they are typically
+  # designed to be state-less. That is, the request API client will handle
+  # the session for you instead of Rails.
+  #
+  # The token parameter is named <tt>authenticity_token</tt> by default. The name and
+  # value of this token must be added to every layout that renders forms by including
+  # <tt>csrf_meta_tags</tt> in the HTML +head+.
+  #
+  # Learn more about CSRF attacks and securing your application in the
+  # {Ruby on Rails Security Guide}[http://guides.rubyonrails.org/security.html].
+  module RequestForgeryProtection
+    extend ActiveSupport::Concern
+    include AbstractController::Helpers
+    include AbstractController::Callbacks
+    included do
+      # Sets the token parameter name for RequestForgery. Calling +protect_from_forgery+
+      # sets it to <tt>:authenticity_token</tt> by default.
+      config_accessor :request_forgery_protection_token
+      self.request_forgery_protection_token ||= :authenticity_token
+      # Holds the class which implements the request forgery protection.
+      config_accessor :forgery_protection_strategy
+      self.forgery_protection_strategy = nil
+      # Controls whether request forgery protection is turned on or not. Turned off by default only in test mode.
+      config_accessor :allow_forgery_protection
+      self.allow_forgery_protection = true if allow_forgery_protection.nil?
+      # Controls whether a CSRF failure logs a warning. On by default.
+      config_accessor :log_warning_on_csrf_failure
+      self.log_warning_on_csrf_failure = true
+      # Controls whether the Origin header is checked in addition to the CSRF token.
+      config_accessor :forgery_protection_origin_check
+      self.forgery_protection_origin_check = false
+      # Controls whether form-action/method specific CSRF tokens are used.
+      config_accessor :per_form_csrf_tokens
+      self.per_form_csrf_tokens = false
+      # Controls whether forgery protection is enabled by default.
+      config_accessor :default_protect_from_forgery
+      self.default_protect_from_forgery = false
+      helper_method :form_authenticity_token
+      helper_method :protect_against_forgery?
+    end
+    module ClassMethods
+      # Turn on request forgery protection. Bear in mind that GET and HEAD requests are not checked.
+      #
+      #   class ApplicationController < ActionController::Base
+      #     protect_from_forgery
+      #   end
+      #
+      #   class FooController < ApplicationController
+      #     protect_from_forgery except: :index
+      #   end
+      #
+      # You can disable forgery protection on controller by skipping the verification before_action:
+      #
+      #   skip_before_action :verify_authenticity_token
+      #
+      # Valid Options:
+      #
+      # * <tt>:only/:except</tt> - Only apply forgery protection to a subset of actions. For example <tt>only: [ :create, :create_all ]</tt>.
+      # * <tt>:if/:unless</tt> - Turn off the forgery protection entirely depending on the passed Proc or method reference.
+      # * <tt>:prepend</tt> - By default, the verification of the authentication token will be added at the position of the
+      #   protect_from_forgery call in your application. This means any callbacks added before are run first. This is useful
+      #   when you want your forgery protection to depend on other callbacks, like authentication methods (Oauth vs Cookie auth).
+      #
+      #   If you need to add verification to the beginning of the callback chain, use <tt>prepend: true</tt>.
+      # * <tt>:with</tt> - Set the method to handle unverified request.
+      #
+      # Valid unverified request handling methods are:
+      # * <tt>:exception</tt> - Raises ActionController::InvalidAuthenticityToken exception.
+      # * <tt>:reset_session</tt> - Resets the session.
+      # * <tt>:null_session</tt> - Provides an empty session during request but doesn't reset it completely. Used as default if <tt>:with</tt> option is not specified.
+      def protect_from_forgery(options = {})
+        options = options.reverse_merge(prepend: false)
+        self.forgery_protection_strategy = protection_method_class(options[:with] || :null_session)
+        self.request_forgery_protection_token ||= :authenticity_token
+        before_action :verify_authenticity_token, options
+        append_after_action :verify_same_origin_request
+      end
+      # Turn off request forgery protection. This is a wrapper for:
+      #
+      #   skip_before_action :verify_authenticity_token
+      #
+      # See +skip_before_action+ for allowed options.
+      def skip_forgery_protection(options = {})
+        skip_before_action :verify_authenticity_token, options
+      end
+      private
+        def protection_method_class(name)
+          ActionController::RequestForgeryProtection::ProtectionMethods.const_get(name.to_s.classify)
+        rescue NameError
+          raise ArgumentError, "Invalid request forgery protection method, use :null_session, :exception, or :reset_session"
+        end
+    end
+    module ProtectionMethods
+      class NullSession
+        def initialize(controller)
+          @controller = controller
+        end
+        # This is the method that defines the application behavior when a request is found to be unverified.
+        def handle_unverified_request
+          request = @controller.request
+          request.session = NullSessionHash.new(request)
+          request.flash = nil
+          request.session_options = { skip: true }
+          request.cookie_jar = NullCookieJar.build(request, {})
+        end
+        private
+          class NullSessionHash < Rack::Session::Abstract::SessionHash #:nodoc:
+            def initialize(req)
+              super(nil, req)
+              @data = {}
+              @loaded = true
+            end
+            # no-op
+            def destroy; end
+            def exists?
+              true
+            end
+          end
+          class NullCookieJar < ActionDispatch::Cookies::CookieJar #:nodoc:
+            def write(*)
+              # nothing
+            end
+          end
+      end
+      class ResetSession
+        def initialize(controller)
+          @controller = controller
+        end
+        def handle_unverified_request
+          @controller.reset_session
+        end
+      end
+      class Exception
+        def initialize(controller)
+          @controller = controller
+        end
+        def handle_unverified_request
+          raise ActionController::InvalidAuthenticityToken
+        end
+      end
+    end
+    private
+      # The actual before_action that is used to verify the CSRF token.
+      # Don't override this directly. Provide your own forgery protection
+      # strategy instead. If you override, you'll disable same-origin
+      # <tt><script></tt> verification.
+      #
+      # Lean on the protect_from_forgery declaration to mark which actions are
+      # due for same-origin request verification. If protect_from_forgery is
+      # enabled on an action, this before_action flags its after_action to
+      # verify that JavaScript responses are for XHR requests, ensuring they
+      # follow the browser's same-origin policy.
+      def verify_authenticity_token # :doc:
+        mark_for_same_origin_verification!
+        if !verified_request?
+          if logger && log_warning_on_csrf_failure
+            if valid_request_origin?
+              logger.warn "Can't verify CSRF token authenticity."
+            else
+              logger.warn "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})"
+            end
+          end
+          handle_unverified_request
+        end
+      end
+      def handle_unverified_request # :doc:
+        forgery_protection_strategy.new(self).handle_unverified_request
+      end
+      #:nodoc:
+      CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \
+        "<script> tag on another site requested protected JavaScript. " \
+        "If you know what you're doing, go ahead and disable forgery " \
+        "protection on this action to permit cross-origin JavaScript embedding."
+      private_constant :CROSS_ORIGIN_JAVASCRIPT_WARNING
+      # :startdoc:
+      # If +verify_authenticity_token+ was run (indicating that we have
+      # forgery protection enabled for this request) then also verify that
+      # we aren't serving an unauthorized cross-origin response.
+      def verify_same_origin_request # :doc:
+        if marked_for_same_origin_verification? && non_xhr_javascript_response?
+          if logger && log_warning_on_csrf_failure
+            logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING
+          end
+          raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING
+        end
+      end
+      # GET requests are checked for cross-origin JavaScript after rendering.
+      def mark_for_same_origin_verification! # :doc:
+        @marked_for_same_origin_verification = request.get?
+      end
+      # If the +verify_authenticity_token+ before_action ran, verify that
+      # JavaScript responses are only served to same-origin GET requests.
+      def marked_for_same_origin_verification? # :doc:
+        @marked_for_same_origin_verification ||= false
+      end
+      # Check for cross-origin JavaScript responses.
+      def non_xhr_javascript_response? # :doc:
+        content_type =~ %r(\Atext/javascript) && !request.xhr?
+      end
+      AUTHENTICITY_TOKEN_LENGTH = 32
+      # Returns true or false if a request is verified. Checks:
+      #
+      # * Is it a GET or HEAD request? GETs should be safe and idempotent
+      # * Does the form_authenticity_token match the given token value from the params?
+      # * Does the X-CSRF-Token header match the form_authenticity_token?
+      def verified_request? # :doc:
+        !protect_against_forgery? || request.get? || request.head? ||
+          (valid_request_origin? && any_authenticity_token_valid?)
+      end
+      # Checks if any of the authenticity tokens from the request are valid.
+      def any_authenticity_token_valid? # :doc:
+        request_authenticity_tokens.any? do |token|
+          valid_authenticity_token?(session, token)
+        end
+      end
+      # Possible authenticity tokens sent in the request.
+      def request_authenticity_tokens # :doc:
+        [form_authenticity_param, request.x_csrf_token]
+      end
+      # Sets the token value for the current session.
+      def form_authenticity_token(form_options: {})
+        masked_authenticity_token(session, form_options: form_options)
+      end
+      # Creates a masked version of the authenticity token that varies
+      # on each request. The masking is used to mitigate SSL attacks
+      # like BREACH.
+      def masked_authenticity_token(session, form_options: {}) # :doc:
+        action, method = form_options.values_at(:action, :method)
+        raw_token = if per_form_csrf_tokens && action && method
+          action_path = normalize_action_path(action)
+          per_form_csrf_token(session, action_path, method)
+        else
+          real_csrf_token(session)
+        end
+        one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
+        encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
+        masked_token = one_time_pad + encrypted_csrf_token
+        Base64.strict_encode64(masked_token)
+      end
+      # Checks the client's masked token to see if it matches the
+      # session token. Essentially the inverse of
+      # +masked_authenticity_token+.
+      def valid_authenticity_token?(session, encoded_masked_token) # :doc:
+        if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String)
+          return false
+        end
+        begin
+          masked_token = Base64.strict_decode64(encoded_masked_token)
+        rescue ArgumentError # encoded_masked_token is invalid Base64
+          return false
+        end
+        # See if it's actually a masked token or not. In order to
+        # deploy this code, we should be able to handle any unmasked
+        # tokens that we've issued without error.
+        if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
+          # This is actually an unmasked token. This is expected if
+          # you have just upgraded to masked tokens, but should stop
+          # happening shortly after installing this gem.
+          compare_with_real_token masked_token, session
+        elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
+          csrf_token = unmask_token(masked_token)
+          compare_with_real_token(csrf_token, session) ||
+            valid_per_form_csrf_token?(csrf_token, session)
+        else
+          false # Token is malformed.
+        end
+      end
+      def unmask_token(masked_token) # :doc:
+        # Split the token into the one-time pad and the encrypted
+        # value and decrypt it.
+        one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH]
+        encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
+        xor_byte_strings(one_time_pad, encrypted_csrf_token)
+      end
+      def compare_with_real_token(token, session) # :doc:
+        ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, real_csrf_token(session))
+      end
+      def valid_per_form_csrf_token?(token, session) # :doc:
+        if per_form_csrf_tokens
+          correct_token = per_form_csrf_token(
+            session,
+            normalize_action_path(request.fullpath),
+            request.request_method
+          )
+          ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, correct_token)
+        else
+          false
+        end
+      end
+      def real_csrf_token(session) # :doc:
+        session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
+        Base64.strict_decode64(session[:_csrf_token])
+      end
+      def per_form_csrf_token(session, action_path, method) # :doc:
+        OpenSSL::HMAC.digest(
+          OpenSSL::Digest::SHA256.new,
+          real_csrf_token(session),
+          [action_path, method.downcase].join("#")
+        )
+      end
+      def xor_byte_strings(s1, s2) # :doc:
+        s2_bytes = s2.bytes
+        s1.each_byte.with_index { |c1, i| s2_bytes[i] ^= c1 }
+        s2_bytes.pack("C*")
+      end
+      # The form's authenticity parameter. Override to provide your own.
+      def form_authenticity_param # :doc:
+        params[request_forgery_protection_token]
+      end
+      # Checks if the controller allows forgery protection.
+      def protect_against_forgery? # :doc:
+        allow_forgery_protection
+      end
+      NULL_ORIGIN_MESSAGE = <<-MSG.strip_heredoc
+        The browser returned a 'null' origin for a request with origin-based forgery protection turned on. This usually
+        means you have the 'no-referrer' Referrer-Policy header enabled, or that the request came from a site that
+        refused to give its origin. This makes it impossible for Rails to verify the source of the requests. Likely the
+        best solution is to change your referrer policy to something less strict like same-origin or strict-same-origin.
+        If you cannot change the referrer policy, you can disable origin checking with the
+        Rails.application.config.action_controller.forgery_protection_origin_check setting.
+      MSG
+      # Checks if the request originated from the same origin by looking at the
+      # Origin header.
+      def valid_request_origin? # :doc:
+        if forgery_protection_origin_check
+          # We accept blank origin headers because some user agents don't send it.
+          raise InvalidAuthenticityToken, NULL_ORIGIN_MESSAGE if request.origin == "null"
+          request.origin.nil? || request.origin == request.base_url
+        else
+          true
+        end
+      end
+      def normalize_action_path(action_path) # :doc:
+        uri = URI.parse(action_path)
+        uri.path.chomp("/")
+      end
+  end
+end