actionpack 2.2.3 → 2.3.2

data/test/controller/selector_test.rb

@@ -303,7 +303,7 @@ class SelectorTest < Test::Unit::TestCase
     assert_equal 1, @matches.size
     assert_equal "2", @matches[0].attributes["id"]
     # Before first and past last returns nothing.:
-    assert_raises(ArgumentError) { select("tr:nth-child(-1)") }
+    assert_raise(ArgumentError) { select("tr:nth-child(-1)") }
     select("tr:nth-child(0)")
     assert_equal 0, @matches.size
     select("tr:nth-child(5)")
@@ -597,8 +597,8 @@ class SelectorTest < Test::Unit::TestCase
 
   def test_negation_details
     parse(%Q{<p id="1"></p><p id="2"></p><p id="3"></p>})
-    assert_raises(ArgumentError) { select(":not(") }
-    assert_raises(ArgumentError) { select(":not(:not())") }
+    assert_raise(ArgumentError) { select(":not(") }
+    assert_raise(ArgumentError) { select(":not(:not())") }
     select("p:not(#1):not(#3)")
     assert_equal 1, @matches.size
     assert_equal "2", @matches[0].attributes["id"]

data/test/controller/send_file_test.rb

@@ -19,7 +19,8 @@ class SendFileController < ActionController::Base
   def rescue_action(e) raise end
 end
 
-class SendFileTest < Test::Unit::TestCase
+class SendFileTest < ActionController::TestCase
+  tests SendFileController
   include TestFileUtils
 
   Mime::Type.register "image/png", :png unless defined? Mime::PNG
@@ -69,6 +70,7 @@ class SendFileTest < Test::Unit::TestCase
 
     assert_equal @controller.file_path, response.headers['X-Sendfile']
     assert response.body.blank?
+    assert !response.etag?
   end
 
   def test_data
@@ -118,17 +120,42 @@ class SendFileTest < Test::Unit::TestCase
     assert_equal 'private', h['Cache-Control']
   end
 
+  def test_send_file_headers_with_mime_lookup_with_symbol
+    options = {
+      :length => 1,
+      :type => :png
+    }
+
+    @controller.headers = {}
+    @controller.send(:send_file_headers!, options)
+
+    headers = @controller.headers
+
+    assert_equal 'image/png', headers['Content-Type']
+  end
+  
+
+  def test_send_file_headers_with_bad_symbol
+    options = {
+      :length => 1,
+      :type => :this_type_is_not_registered
+    }
+
+    @controller.headers = {}
+    assert_raise(ArgumentError){ @controller.send(:send_file_headers!, options) }
+  end
+
   %w(file data).each do |method|
     define_method "test_send_#{method}_status" do
       @controller.options = { :stream => false, :status => 500 }
       assert_nothing_raised { assert_not_nil process(method) }
-      assert_equal '500 Internal Server Error', @response.headers['Status']
+      assert_equal '500 Internal Server Error', @response.status
     end
 
     define_method "test_default_send_#{method}_status" do
       @controller.options = { :stream => false }
       assert_nothing_raised { assert_not_nil process(method) }
-      assert_equal ActionController::Base::DEFAULT_RENDER_STATUS_CODE, @response.headers['Status']
+      assert_equal ActionController::Base::DEFAULT_RENDER_STATUS_CODE, @response.status
     end
   end
 end

data/test/controller/session/cookie_store_test.rb

@@ -1,310 +1,239 @@
 require 'abstract_unit'
-require 'action_controller/cgi_process'
-require 'action_controller/cgi_ext'
-
 require 'stringio'
 
+class CookieStoreTest < ActionController::IntegrationTest
+  SessionKey = '_myapp_session'
+  SessionSecret = 'b3c631c314c0bbca50c1b2843150fe33'
+
+  DispatcherApp = ActionController::Dispatcher.new
+  CookieStoreApp = ActionController::Session::CookieStore.new(DispatcherApp, :key => SessionKey, :secret => SessionSecret)
+
+  Verifier = ActiveSupport::MessageVerifier.new(SessionSecret, 'SHA1')
+
+  SignedBar = "BAh7BjoIZm9vIghiYXI%3D--fef868465920f415f2c0652d6910d3af288a0367"
 
-class CGI::Session::CookieStore
-  def ensure_secret_secure_with_test_hax(secret)
-    if secret == CookieStoreTest.default_session_options['secret']
-      return true
-    else
-      ensure_secret_secure_without_test_hax(secret)
+  class TestController < ActionController::Base
+    def no_session_access
+      head :ok
     end
-  end
-  alias_method_chain :ensure_secret_secure, :test_hax
-end
 
+    def persistent_session_id
+      render :text => session[:session_id]
+    end
 
-# Expose for tests.
-class CGI
-  attr_reader :output_cookies, :output_hidden
+    def set_session_value
+      session[:foo] = "bar"
+      render :text => Rack::Utils.escape(Verifier.generate(session.to_hash))
+    end
 
-  class Session
-    attr_reader :dbman
+    def get_session_value
+      render :text => "foo: #{session[:foo].inspect}"
+    end
 
-    class CookieStore
-      attr_reader :data, :original, :cookie_options
+    def get_session_id
+      render :text => "foo: #{session[:foo].inspect}; id: #{request.session_options[:id]}"
     end
-  end
-end
 
-class CookieStoreTest < Test::Unit::TestCase
-  def self.default_session_options
-    { 'database_manager' => CGI::Session::CookieStore,
-      'session_key' => '_myapp_session',
-      'secret' => 'Keep it secret; keep it safe.',
-      'no_cookies' => true,
-      'no_hidden' => true,
-      'session_http_only' => true
-       }
-  end
+    def call_reset_session
+      reset_session
+      head :ok
+    end
 
-  def self.cookies
-    { :empty => ['BAgw--0686dcaccc01040f4bd4f35fe160afe9bc04c330', {}],
-      :a_one => ['BAh7BiIGYWkG--5689059497d7f122a7119f171aef81dcfd807fec', { 'a' => 1 }],
-      :typical => ['BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7BiILbm90aWNlIgxIZXkgbm93--9d20154623b9eeea05c62ab819be0e2483238759', { 'user_id' => 123, 'flash' => { 'notice' => 'Hey now' }}],
-      :flashed => ['BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7AA==--bf9785a666d3c4ac09f7fe3353496b437546cfbf', { 'user_id' => 123, 'flash' => {} }],
-      :double_escaped => [CGI.escape('BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7AA%3D%3D--bf9785a666d3c4ac09f7fe3353496b437546cfbf'), { 'user_id' => 123, 'flash' => {} }] }
+    def raise_data_overflow
+      session[:foo] = 'bye!' * 1024
+      head :ok
+    end
 
+    def rescue_action(e) raise end
   end
 
   def setup
-    ENV.delete('HTTP_COOKIE')
+    @integration_session = open_session(CookieStoreApp)
   end
 
   def test_raises_argument_error_if_missing_session_key
-    [nil, ''].each do |blank|
-      assert_raise(ArgumentError, blank.inspect) { new_session 'session_key' => blank }
-    end
+    assert_raise(ArgumentError, nil.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+        :key => nil, :secret => SessionSecret)
+    }
+
+    assert_raise(ArgumentError, ''.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+        :key => '', :secret => SessionSecret)
+    }
   end
 
   def test_raises_argument_error_if_missing_secret
-    [nil, ''].each do |blank|
-      assert_raise(ArgumentError, blank.inspect) { new_session 'secret' => blank }
-    end
+    assert_raise(ArgumentError, nil.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => nil)
+    }
+
+    assert_raise(ArgumentError, ''.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => '')
+    }
   end
 
   def test_raises_argument_error_if_secret_is_probably_insecure
-    ["password", "secret", "12345678901234567890123456789"].each do |blank|
-      assert_raise(ArgumentError, blank.inspect) { new_session 'secret' => blank }
-    end
-  end
+    assert_raise(ArgumentError, "password".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "password")
+    }
 
-  def test_reconfigures_session_to_omit_id_cookie_and_hidden_field
-    new_session do |session|
-      assert_equal true, @options['no_hidden']
-      assert_equal true, @options['no_cookies']
-    end
-  end
+    assert_raise(ArgumentError, "secret".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "secret")
+    }
 
-  def test_restore_unmarshals_missing_cookie_as_empty_hash
-    new_session do |session|
-      assert_nil session.dbman.data
-      assert_nil session['test']
-      assert_equal Hash.new, session.dbman.data
-    end
+    assert_raise(ArgumentError, "12345678901234567890123456789".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "12345678901234567890123456789")
+    }
   end
 
-  def test_restore_unmarshals_good_cookies
-    cookies(:empty, :a_one, :typical).each do |value, expected|
-      set_cookie! value
-      new_session do |session|
-        assert_nil session['lazy loads the data hash']
-        assert_equal expected, session.dbman.data
-      end
-    end
+  def test_setting_session_value
+    with_test_route_set do
+      get '/set_session_value'
+      assert_response :success
+      assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
+        headers['Set-Cookie']
+   end
   end
 
-  def test_restore_deletes_tampered_cookies
-    set_cookie! 'a--b'
-    new_session do |session|
-      assert_raise(CGI::Session::CookieStore::TamperedWithCookie) { session['fail'] }
-      assert_cookie_deleted session
-    end
+  def test_getting_session_value
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: "bar"', response.body
+   end
   end
 
-  def test_restores_double_encoded_cookies
-    set_cookie! cookie_value(:double_escaped)
-    new_session do |session|
-      session.dbman.restore
-      assert_equal session["user_id"], 123
-      assert_equal session["flash"], {}
-    end
-  end
+  def test_getting_session_id
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/persistent_session_id'
+      assert_response :success
+      assert_equal response.body.size, 32
+      session_id = response.body
 
-  def test_close_doesnt_write_cookie_if_data_is_blank
-    new_session do |session|
-      assert_no_cookies session
-      session.close
-      assert_no_cookies session
+      get '/get_session_id'
+      assert_response :success
+      assert_equal "foo: \"bar\"; id: #{session_id}", response.body
     end
   end
 
-  def test_close_doesnt_write_cookie_if_data_is_unchanged
-    set_cookie! cookie_value(:typical)
-    new_session do |session|
-      assert_no_cookies session
-      session['user_id'] = session['user_id']
-      session.close
-      assert_no_cookies session
+  def test_disregards_tampered_sessions
+    with_test_route_set do
+      cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--123456780"
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body
     end
   end
 
   def test_close_raises_when_data_overflows
-    set_cookie! cookie_value(:empty)
-    new_session do |session|
-      session['overflow'] = 'bye!' * 1024
-      assert_raise(CGI::Session::CookieStore::CookieOverflow) { session.close }
-      assert_no_cookies session
-    end
-  end
-
-  def test_close_marshals_and_writes_cookie
-    set_cookie! cookie_value(:typical)
-    new_session do |session|
-      assert_no_cookies session
-      session['flash'] = {}
-      assert_no_cookies session
-      session.close
-      assert_equal 1, session.cgi.output_cookies.size
-      cookie = session.cgi.output_cookies.first
-      assert_cookie cookie, cookie_value(:flashed)
-      assert_http_only_cookie cookie
-      assert_secure_cookie cookie, false
-    end
-  end
-
-  def test_writes_non_secure_cookie_by_default
-    set_cookie! cookie_value(:typical)
-    new_session do |session|
-      session['flash'] = {}
-      session.close
-      cookie = session.cgi.output_cookies.first
-      assert_secure_cookie cookie,false
+    with_test_route_set do
+      assert_raise(ActionController::Session::CookieStore::CookieOverflow) {
+        get '/raise_data_overflow'
+      }
     end
   end
 
-  def test_writes_secure_cookie
-    set_cookie! cookie_value(:typical)
-    new_session('session_secure'=>true) do |session|
-      session['flash'] = {}
-      session.close
-      cookie = session.cgi.output_cookies.first
-      assert_secure_cookie cookie
+  def test_doesnt_write_session_cookie_if_session_is_not_accessed
+    with_test_route_set do
+      get '/no_session_access'
+      assert_response :success
+      assert_equal "", headers['Set-Cookie']
     end
   end
 
-  def test_http_only_cookie_by_default
-    set_cookie! cookie_value(:typical)
-    new_session do |session|
-      session['flash'] = {}
-      session.close
-      cookie = session.cgi.output_cookies.first
-      assert_http_only_cookie cookie
+  def test_doesnt_write_session_cookie_if_session_is_unchanged
+    with_test_route_set do
+      cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--" +
+        "fef868465920f415f2c0652d6910d3af288a0367"
+      get '/no_session_access'
+      assert_response :success
+      assert_equal "", headers['Set-Cookie']
     end
   end
 
-  def test_overides_http_only_cookie
-    set_cookie! cookie_value(:typical)
-    new_session('session_http_only'=>false) do |session|
-      session['flash'] = {}
-      session.close
-      cookie = session.cgi.output_cookies.first
-      assert_http_only_cookie cookie, false
-    end
-  end
+  def test_setting_session_value_after_session_reset
+    with_test_route_set do
+      get '/set_session_value'
+      assert_response :success
+      session_payload = response.body
+      assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
+        headers['Set-Cookie']
 
-  def test_delete_writes_expired_empty_cookie_and_sets_data_to_nil
-    set_cookie! cookie_value(:typical)
-    new_session do |session|
-      assert_no_cookies session
-      session.delete
-      assert_cookie_deleted session
+      get '/call_reset_session'
+      assert_response :success
+      assert_not_equal [], headers['Set-Cookie']
+      assert_not_equal session_payload, cookies[SessionKey]
 
-      # @data is set to nil so #close doesn't send another cookie.
-      session.close
-      assert_cookie_deleted session
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body
     end
   end
 
-  def test_new_session_doesnt_reuse_deleted_cookie_data
-    set_cookie! cookie_value(:typical)
-
-    new_session do |session|
-      assert_not_nil session['user_id']
-      session.delete
-
-      # Start a new session using the same CGI instance.
-      post_delete_session = CGI::Session.new(session.cgi, self.class.default_session_options)
-      assert_nil post_delete_session['user_id']
+  def test_persistent_session_id
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/persistent_session_id'
+      assert_response :success
+      assert_equal response.body.size, 32
+      session_id = response.body
+      get '/persistent_session_id'
+      assert_equal session_id, response.body
+      reset!
+      get '/persistent_session_id'
+      assert_not_equal session_id, response.body
     end
   end
 
-  private
-    def assert_no_cookies(session)
-      assert_nil session.cgi.output_cookies, session.cgi.output_cookies.inspect
-    end
+  def test_session_store_with_expire_after
+    app = ActionController::Session::CookieStore.new(DispatcherApp, :key => SessionKey, :secret => SessionSecret, :expire_after => 5.hours)
+    @integration_session = open_session(app)
 
-    def assert_cookie_deleted(session, message = 'Expected session deletion cookie to be set')
-      assert_equal 1, session.cgi.output_cookies.size
-      cookie = session.cgi.output_cookies.first
-      assert_cookie cookie, nil, 1.year.ago.to_date, "#{message}: #{cookie.name} => #{cookie.value}"
-    end
+    with_test_route_set do
+      # First request accesses the session
+      time = Time.local(2008, 4, 24)
+      Time.stubs(:now).returns(time)
+      expected_expiry = (time + 5.hours).gmtime.strftime("%a, %d-%b-%Y %H:%M:%S GMT")
 
-    def assert_cookie(cookie, value = nil, expires = nil, message = nil)
-      assert_equal '_myapp_session', cookie.name, message
-      assert_equal [value].compact, cookie.value, message
-      assert_equal expires, cookie.expires ? cookie.expires.to_date : cookie.expires, message
-    end
+      cookies[SessionKey] = SignedBar
 
-    def assert_secure_cookie(cookie,value=true)
-      assert cookie.secure==value
-    end
+      get '/set_session_value'
+      assert_response :success
 
-    def assert_http_only_cookie(cookie,value=true)
-      assert cookie.http_only==value
-    end
+      cookie_body = response.body
+      assert_equal "_myapp_session=#{cookie_body}; path=/; expires=#{expected_expiry}; HttpOnly",
+        headers['Set-Cookie']
 
-    def cookies(*which)
-      self.class.cookies.values_at(*which)
-    end
+      # Second request does not access the session
+      time = Time.local(2008, 4, 25)
+      Time.stubs(:now).returns(time)
+      expected_expiry = (time + 5.hours).gmtime.strftime("%a, %d-%b-%Y %H:%M:%S GMT")
 
-    def cookie_value(which)
-      self.class.cookies[which].first
-    end
+      get '/no_session_access'
+      assert_response :success
 
-    def set_cookie!(value)
-      ENV['HTTP_COOKIE'] = "_myapp_session=#{value}"
+      assert_equal "_myapp_session=#{cookie_body}; path=/; expires=#{expected_expiry}; HttpOnly",
+        headers['Set-Cookie']
     end
+  end
 
-    def new_session(options = {})
-      with_cgi do |cgi|
-        assert_nil cgi.output_hidden, "Output hidden params should be empty: #{cgi.output_hidden.inspect}"
-        assert_nil cgi.output_cookies, "Output cookies should be empty: #{cgi.output_cookies.inspect}"
-
-        @options = self.class.default_session_options.merge(options)
-        session = CGI::Session.new(cgi, @options)
-        ObjectSpace.undefine_finalizer(session)
-
-        assert_nil cgi.output_hidden, "Output hidden params should be empty: #{cgi.output_hidden.inspect}"
-        assert_nil cgi.output_cookies, "Output cookies should be empty: #{cgi.output_cookies.inspect}"
-
-        yield session if block_given?
-        session
+  private
+    def with_test_route_set
+      with_routing do |set|
+        set.draw do |map|
+          map.with_options :controller => "cookie_store_test/test" do |c|
+            c.connect "/:action"
+          end
+        end
+        yield
       end
     end
-
-    def with_cgi
-      ENV['REQUEST_METHOD'] = 'GET'
-      ENV['HTTP_HOST'] = 'example.com'
-      ENV['QUERY_STRING'] = ''
-
-      cgi = CGI.new('query', StringIO.new(''))
-      yield cgi if block_given?
-      cgi
-    end
-end
-
-
-class CookieStoreWithBlockAsSecretTest < CookieStoreTest
-  def self.default_session_options
-    CookieStoreTest.default_session_options.merge 'secret' => Proc.new { 'Keep it secret; keep it safe.' }
-  end
-end
-
-
-class CookieStoreWithMD5DigestTest < CookieStoreTest
-  def self.default_session_options
-    CookieStoreTest.default_session_options.merge 'digest' => 'MD5'
-  end
-
-  def self.cookies
-    { :empty => ['BAgw--0415cc0be9579b14afc22ee2d341aa21', {}],
-      :a_one => ['BAh7BiIGYWkG--5a0ed962089cc6600ff44168a5d59bc8', { 'a' => 1 }],
-      :typical => ['BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7BiILbm90aWNlIgxIZXkgbm93--f426763f6ef435b3738b493600db8d64', { 'user_id' => 123, 'flash' => { 'notice' => 'Hey now' }}],
-      :flashed => ['BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7AA==--0af9156650dab044a53a91a4ddec2c51', { 'user_id' => 123, 'flash' => {} }],
-      :double_escaped => [CGI.escape('BAh7ByIMdXNlcl9pZGkBeyIKZmxhc2h7AA%3D%3D--0af9156650dab044a53a91a4ddec2c51'), { 'user_id' => 123, 'flash' => {} }] }
-  end
 end