actionpack 2.0.2 → 2.0.4

data/lib/action_controller/request.rb

@@ -111,7 +111,7 @@ module ActionController
     #   end
     def format=(extension)
       parameters[:format] = extension.to_s
-      format
+      @format = Mime::Type.lookup_by_extension(parameters[:format])
     end
 
     # Returns true if the request's "X-Requested-With" header contains
@@ -122,26 +122,41 @@ module ActionController
     end
     alias xhr? :xml_http_request?
 
+    # Which IP addresses are "trusted proxies" that can be stripped from
+    # the right-hand-side of X-Forwarded-For
+    TRUSTED_PROXIES = /^127\.0\.0\.1$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
+
     # Determine originating IP address.  REMOTE_ADDR is the standard
     # but will fail if the user is behind a proxy.  HTTP_CLIENT_IP and/or
-    # HTTP_X_FORWARDED_FOR are set by proxies so check for these before
-    # falling back to REMOTE_ADDR.  HTTP_X_FORWARDED_FOR may be a comma-
-    # delimited list in the case of multiple chained proxies; the first is
-    # the originating IP.
-    #
-    # Security note: do not use if IP spoofing is a concern for your
-    # application. Since remote_ip checks HTTP headers for addresses forwarded
-    # by proxies, the client may send any IP. remote_addr can't be spoofed but
-    # also doesn't work behind a proxy, since it's always the proxy's IP.
+    # HTTP_X_FORWARDED_FOR are set by proxies so check for these if
+    # REMOTE_ADDR is a proxy.  HTTP_X_FORWARDED_FOR may be a comma-
+    # delimited list in the case of multiple chained proxies; the last
+    # address which is not trusted is the originating IP.
+
     def remote_ip
-      return @env['HTTP_CLIENT_IP'] if @env.include? 'HTTP_CLIENT_IP'
+      if TRUSTED_PROXIES !~ @env['REMOTE_ADDR']
+        return @env['REMOTE_ADDR']
+      end
+
+      if @env.include? 'HTTP_CLIENT_IP'
+        if @env.include? 'HTTP_X_FORWARDED_FOR'
+          # We don't know which came from the proxy, and which from the user
+          raise ActionControllerError.new(<<EOM)
+IP spoofing attack?!
+HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect}
+HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect}
+EOM
+        end
+        return @env['HTTP_CLIENT_IP']
+      end
 
       if @env.include? 'HTTP_X_FORWARDED_FOR' then
-        remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',').reject do |ip|
-          ip.strip =~ /^unknown$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
+        remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',')
+        while remote_ips.size > 1 && TRUSTED_PROXIES =~ remote_ips.last.strip
+          remote_ips.pop
         end
 
-        return remote_ips.first.strip unless remote_ips.empty?
+        return remote_ips.last.strip
       end
 
       @env['REMOTE_ADDR']

data/lib/action_controller/request_forgery_protection.rb

@@ -13,33 +13,46 @@ module ActionController #:nodoc:
       base.extend(ClassMethods)
     end
     
+    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a
+    # forged link from another site, is done by embedding a token based on the session (which an attacker wouldn't know) in all
+    # forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller.  Only
+    # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
+    # scheme there anyway).  Also, GET requests are not protected as these should be indempotent anyway.
+    #
+    # This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an
+    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the error message in
+    # production by editing public/422.html.  A call to this method in ApplicationController is generated by default in post-Rails 2.0
+    # applications.
+    #
+    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form manually (without the
+    # use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to include a hidden field named like that and
+    # set its value to what is returned by <tt>form_authenticity_token</tt>. Same applies to manually constructed Ajax requests. To
+    # make the token available through a global variable to scripts on a certain page, you could add something like this to a view:
+    #
+    #   <%= javascript_tag "window._token = '#{form_authenticity_token}'" %>
+    #
+    # Request forgery protection is disabled by default in test environment.  If you are upgrading from Rails 1.x, add this to
+    # config/environments/test.rb:
+    #
+    #   # Disable request forgery protection in test environment
+    #   config.action_controller.allow_forgery_protection = false
+    #
+    # == Learn more about CSRF (Cross-Site Request Forgery) attacks
+    #
+    # Here are some resources:
+    # * http://isc.sans.org/diary.html?storyid=1750
+    # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
+    #
+    # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
+    # There are a few guidelines you should follow:
+    #
+    # * Keep your GET requests safe and idempotent.  More reading material:
+    #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
+    #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
+    # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
+    #
     module ClassMethods
-      # Protect a controller's actions from CSRF attacks by ensuring that all forms are coming from the current web application, not 
-      # a forged link from another site. This is done by embedding a token based on the session (which an attacker wouldn't know) in 
-      # all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. Only
-      # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
-      # scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway.
-      #
-      # You turn this on with the #protect_from_forgery method, which will perform the check and raise 
-      # an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add 
-      # a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message 
-      # given through public/422.html.
-      #
-      # Learn more about CSRF (Cross-Site Request Forgery) attacks:
-      #
-      # * http://isc.sans.org/diary.html?storyid=1750
-      # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
-      #
-      # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
-      # There are a few guidelines you should follow:
-      # 
-      # * Keep your GET requests safe and idempotent.  More reading material:
-      #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
-      #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
-      # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
-      #
-      # If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the 
-      # authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself.
+      # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
       #
       # Example:
       #
@@ -54,16 +67,10 @@ module ActionController #:nodoc:
       #     skip_before_filter :verify_authenticity_token
       #   end
       #
-      # If you are upgrading from Rails 1.x, disable forgery protection to
-      # simplify your tests. Add this to config/environments/test.rb:
-      #
-      #   # Disable request forgery protection in test environment
-      #   config.action_controller.allow_forgery_protection = false
-      #
       # Valid Options:
       #
-      # * <tt>:only/:except</tt> - passed to the before_filter call.  Set which actions are verified.
-      # * <tt>:secret</tt> - Custom salt used to generate the form_authenticity_token.
+      # * <tt>:only/:except</tt> - passed to the <tt>before_filter</tt> call.  Set which actions are verified.
+      # * <tt>:secret</tt> - Custom salt used to generate the <tt>form_authenticity_token</tt>.
       #   Leave this off if you are using the cookie session store.
       # * <tt>:digest</tt> - Message digest used for hashing.  Defaults to 'SHA1'
       def protect_from_forgery(options = {})

data/lib/action_controller/request_profiler.rb

@@ -13,20 +13,21 @@ module ActionController
 
       def initialize(script_path)
         @quiet = false
-        define_run_method(File.read(script_path))
+        define_run_method(script_path)
         reset!
       end
 
       def benchmark(n)
         @quiet = true
         print '  '
+
         result = Benchmark.realtime do
           n.times do |i|
             run
-            print i % 10 == 0 ? 'x' : '.'
-            $stdout.flush
+            print_progress(i)
           end
         end
+
         puts
         result
       ensure
@@ -38,8 +39,17 @@ module ActionController
       end
 
       private
-        def define_run_method(script)
-          instance_eval "def run; #{script}; end", __FILE__, __LINE__
+        def define_run_method(script_path)
+          script = File.read(script_path)
+          source = "def run\n#{script}\nreset!\nend"
+          instance_eval source, script_path, 1
+        end
+
+        def print_progress(i)
+          print "\n  " if i % 60 == 0
+          print ' ' if i % 10 == 0
+          print '.'
+          $stdout.flush
         end
     end
 
@@ -98,7 +108,7 @@ module ActionController
       OptionParser.new do |opt|
         opt.banner = "USAGE: #{$0} [options] [session script path]"
 
-        opt.on('-n', '--times [0000]', 'How many requests to process. Defaults to 100.') { |v| options[:n] = v.to_i }
+        opt.on('-n', '--times [100]', 'How many requests to process. Defaults to 100.') { |v| options[:n] = v.to_i if v }
         opt.on('-b', '--benchmark', 'Benchmark instead of profiling') { |v| options[:benchmark] = v }
         opt.on('--open [CMD]', 'Command to open profile results. Defaults to "open %s &"') { |v| options[:open] = v }
         opt.on('-h', '--help', 'Show this help') { puts opt; exit }

data/lib/action_controller/routing.rb

@@ -306,8 +306,8 @@ module ActionController
             gsub(%r{(.)[\\/]$}, '\1')  # drop final / or \ if path ends with it
 
           # eliminate .. paths where possible
-          re = %r{\w+[/\\]\.\.[/\\]}
-          path.gsub!(%r{\w+[/\\]\.\.[/\\]}, "") while path.match(re)
+          re = %r{[^/\\]+[/\\]\.\.[/\\]}
+          path.gsub!(re, "") while path.match(re)
           path
         end
 
@@ -1216,7 +1216,7 @@ module ActionController
                 opts = if args.empty? || Hash === args.first
                   args.first || {}
                 else
-                  options = args.last.is_a?(Hash) ? args.pop : {}
+                  options = args.extract_options!
                   args = args.zip(#{route.segment_keys.inspect}).inject({}) do |h, (v, k)|
                     h[k] = v
                     h

data/lib/action_controller/session/active_record_store.rb

@@ -1,7 +1,6 @@
 require 'cgi'
 require 'cgi/session'
 require 'digest/md5'
-require 'base64'
 
 class CGI
   class Session
@@ -80,8 +79,8 @@ class CGI
             find_by_session_id(session_id)
           end
 
-          def marshal(data)   Base64.encode64(Marshal.dump(data)) if data end
-          def unmarshal(data) Marshal.load(Base64.decode64(data)) if data end
+          def marshal(data)   ActiveSupport::Base64.encode64(Marshal.dump(data)) if data end
+          def unmarshal(data) Marshal.load(ActiveSupport::Base64.decode64(data)) if data end
 
           def create_table!
             connection.execute <<-end_sql
@@ -155,8 +154,8 @@ class CGI
       # The database connection, table name, and session id and data columns
       # are configurable class attributes.  Marshaling and unmarshaling
       # are implemented as class methods that you may override.  By default,
-      # marshaling data is +Base64.encode64(Marshal.dump(data))+ and
-      # unmarshaling data is +Marshal.load(Base64.decode64(data))+.
+      # marshaling data is +ActiveSupport::Base64.encode64(Marshal.dump(data))+ and
+      # unmarshaling data is +Marshal.load(ActiveSupport::Base64.decode64(data))+.
       #
       # This marshaling behavior is intended to store the widest range of
       # binary session data in a +text+ column.  For higher performance,
@@ -190,8 +189,8 @@ class CGI
             end
           end
 
-          def marshal(data)   Base64.encode64(Marshal.dump(data)) if data end
-          def unmarshal(data) Marshal.load(Base64.decode64(data)) if data end
+          def marshal(data)   ActiveSupport::Base64.encode64(Marshal.dump(data)) if data end
+          def unmarshal(data) Marshal.load(ActiveSupport::Base64.decode64(data)) if data end
 
           def create_table!
             @@connection.execute <<-end_sql
@@ -333,4 +332,4 @@ class CGI
         end
     end
   end
-end
+end

data/lib/action_controller/session/cookie_store.rb

@@ -1,6 +1,5 @@
 require 'cgi'
 require 'cgi/session'
-require 'base64'        # to convert Marshal.dump to ASCII
 require 'openssl'       # to generate the HMAC message digest
 
 # This cookie-based session store is the Rails default. Sessions typically
@@ -130,7 +129,7 @@ class CGI::Session::CookieStore
   private
     # Marshal a session hash into safe cookie data. Include an integrity hash.
     def marshal(session)
-      data = Base64.encode64(Marshal.dump(session)).chop
+      data = ActiveSupport::Base64.encode64(Marshal.dump(session)).chop
       CGI.escape "#{data}--#{generate_digest(data)}"
     end
 
@@ -142,7 +141,7 @@ class CGI::Session::CookieStore
           delete
           raise TamperedWithCookie
         end
-        Marshal.load(Base64.decode64(data))
+        Marshal.load(ActiveSupport::Base64.decode64(data))
       end
     end
 

data/lib/action_controller/templates/rescues/_trace.erb

@@ -10,17 +10,17 @@
 <p><code>RAILS_ROOT: <%= defined?(RAILS_ROOT) ? RAILS_ROOT : "unset" %></code></p>
 
 <div id="traces">
-  <% names.each do |name| -%>
+  <% names.each do |name| %>
     <%
       show = "document.getElementById('#{name.gsub /\s/, '-'}').style.display='block';"
       hide = (names - [name]).collect {|hide_name| "document.getElementById('#{hide_name.gsub /\s/, '-'}').style.display='none';"}
     %>
     <a href="#" onclick="<%= hide %><%= show %>; return false;"><%= name %></a> <%= '|' unless names.last == name %>
-  <% end -%>
+  <% end %>
 
-  <% traces.each do |name, trace| -%>
+  <% traces.each do |name, trace| %>
     <div id="<%= name.gsub /\s/, '-' %>" style="display: <%= name == "Application Trace" ? 'block' : 'none' %>;">
       <pre><code><%= trace.join "\n" %></code></pre>
     </div>
-  <% end -%>
-</div>
+  <% end %>
+</div>

data/lib/action_controller/test_case.rb

@@ -3,9 +3,15 @@ require 'active_support/test_case'
 module ActionController
   class NonInferrableControllerError < ActionControllerError
     def initialize(name)
+      @name = name
       super "Unable to determine the controller to test from #{name}. " +
         "You'll need to specify it using 'tests YourController' in your " +
-        "test case definition"
+        "test case definition. This could mean that #{inferred_controller_name} does not exist " +
+        "or it contains syntax errors"
+    end
+
+    def inferred_controller_name
+      @name.sub(/Test$/, '')
     end
   end
 
@@ -44,10 +50,24 @@ module ActionController
       end
     end
 
-    def setup
+    def setup_with_controller
       @controller = self.class.controller_class.new
       @request    = TestRequest.new
       @response   = TestResponse.new
     end
-  end
-end
+    alias_method :setup, :setup_with_controller
+
+    def self.method_added(method)
+      if method.to_s == 'setup'
+        unless method_defined?(:setup_without_controller)
+          alias_method :setup_without_controller, :setup
+          define_method(:setup) do
+            setup_with_fixtures if respond_to?(:setup_with_fixtures)
+            setup_with_controller
+            setup_without_controller
+          end
+        end
+      end
+    end
+ end
+end

data/lib/action_controller/test_process.rb

@@ -286,7 +286,7 @@ module ActionController #:nodoc:
 
     def initialize(attributes = nil)
       @session_id = ''
-      @attributes = attributes
+      @attributes = attributes.nil? ? nil : attributes.stringify_keys
       @saved_attributes = nil
     end
 
@@ -295,11 +295,11 @@ module ActionController #:nodoc:
     end
 
     def [](key)
-      data[key]
+      data[key.to_s]
     end
 
     def []=(key, value)
-      data[key] = value
+      data[key.to_s] = value
     end
 
     def update

data/lib/action_controller/url_rewriter.rb

@@ -1,17 +1,17 @@
-module ActionController  
+module ActionController
   # Write URLs from arbitrary places in your codebase, such as your mailers.
-  # 
+  #
   # Example:
-  # 
+  #
   #   class MyMailer
   #     include ActionController::UrlWriter
   #     default_url_options[:host] = 'www.basecamphq.com'
-  #     
+  #
   #     def signup_url(token)
   #       url_for(:controller => 'signup', action => 'index', :token => token)
   #     end
   #  end
-  # 
+  #
   # In addition to providing +url_for+, named routes are also accessible after
   # including UrlWriter.
   module UrlWriter
@@ -19,64 +19,65 @@ module ActionController
     # is provided.
     mattr_accessor :default_url_options
     self.default_url_options = {}
-    
+
     def self.included(base) #:nodoc:
-      ActionController::Routing::Routes.install_helpers base 
+      ActionController::Routing::Routes.install_helpers(base)
       base.mattr_accessor :default_url_options
       base.default_url_options ||= default_url_options
     end
-    
-    # Generate a url based on the options provided, default_url_options and the 
+
+    # Generate a url based on the options provided, default_url_options and the
     # routes defined in routes.rb.  The following options are supported:
-    # 
+    #
     # * <tt>:only_path</tt> If true, the relative url is returned. Defaults to false.
     # * <tt>:protocol</tt> The protocol to connect to. Defaults to 'http'.
-    # * <tt>:host</tt> Specifies the host the link should be targetted at. If <tt>:only_path</tt> is false, this option must be 
-    #   provided either explicitly, or via default_url_options. 
+    # * <tt>:host</tt> Specifies the host the link should be targetted at. If <tt>:only_path</tt> is false, this option must be
+    #   provided either explicitly, or via default_url_options.
     # * <tt>:port</tt> Optionally specify the port to connect to.
     # * <tt>:anchor</tt> An anchor name to be appended to the path.
-    # 
+    # * <tt>:skip_relative_url_root</tt> If true, the url is not constructed using the relative_url_root set in <tt>ActionController::AbstractRequest.relative_url_root</tt>.
+    #
     # Any other key(:controller, :action, etc...) given to <tt>url_for</tt> is forwarded to the Routes module.
-    # 
+    #
     # Examples:
-    # 
+    #
     #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :port=>'8080'    # => 'http://somehost.org:8080/tasks/testing'
     #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :anchor => 'ok', :only_path => true    # => '/tasks/testing#ok'
     #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :number => '33'  # => 'http://somehost.org/tasks/testing?number=33'
-    # 
     def url_for(options)
       options = self.class.default_url_options.merge(options)
-      
+
       url = ''
 
-      unless options.delete :only_path
+      unless options.delete(:only_path)
         url << (options.delete(:protocol) || 'http')
-        url << '://' unless url.match("://") #dont add separator if its already been specified in :protocol 
-        
+        url << '://' unless url.match("://")
+
         raise "Missing host to link to! Please provide :host parameter or set default_url_options[:host]" unless options[:host]
 
         url << options.delete(:host)
         url << ":#{options.delete(:port)}" if options.key?(:port)
       else
-        # Delete the unused options to prevent their appearance in the query string
-        [:protocol, :host, :port].each { |k| options.delete k }
+        # Delete the unused options to prevent their appearance in the query string.
+        [:protocol, :host, :port, :skip_relative_url_root].each { |k| options.delete(k) }
       end
 
-      anchor = "##{CGI.escape options.delete(:anchor).to_param.to_s}" if options.key?(:anchor)
+      url << ActionController::AbstractRequest.relative_url_root.to_s unless options[:skip_relative_url_root]
+      anchor = "##{CGI.escape options.delete(:anchor).to_param.to_s}" if options[:anchor]
       url << Routing::Routes.generate(options, {})
       url << anchor if anchor
 
-      return url
-    end    
+      url
+    end
   end
-  
+
   # Rewrites URLs for Base.redirect_to and Base.url_for in the controller.
   class UrlRewriter #:nodoc:
     RESERVED_OPTIONS = [:anchor, :params, :only_path, :host, :protocol, :port, :trailing_slash, :skip_relative_url_root]
     def initialize(request, parameters)
       @request, @parameters = request, parameters
     end
-    
+
     def rewrite(options = {})
       rewrite_url(options)
     end
@@ -123,7 +124,7 @@ module ActionController
         # Generates the query string, too
         Routing::Routes.generate(options, @request.symbolized_path_parameters)
       end
-      
+
       def rewrite_authentication(options)
         if options[:user] && options[:password]
           "#{CGI.escape(options.delete(:user))}:#{CGI.escape(options.delete(:password))}@"