actionpack 3.2.22.5 → 5.2.4

data/lib/action_dispatch/http/mime_type.rb

@@ -1,22 +1,34 @@
-require 'set'
-require 'active_support/core_ext/class/attribute_accessors'
-require 'active_support/core_ext/object/blank'
+# frozen_string_literal: true
+
+# -*- frozen-string-literal: true -*-
+
+require "singleton"
+require "active_support/core_ext/string/starts_ends_with"
 
 module Mime
-  class Mimes < Array
-    def symbols
-      @symbols ||= map {|m| m.to_sym }
+  class Mimes
+    include Enumerable
+
+    def initialize
+      @mimes = []
+      @symbols = nil
     end
 
-    %w(<< concat shift unshift push pop []= clear compact! collect!
-    delete delete_at delete_if flatten! map! insert reject! reverse!
-    replace slice! sort! uniq!).each do |method|
-      module_eval <<-CODE, __FILE__, __LINE__ + 1
-        def #{method}(*)
-          @symbols = nil
-          super
-        end
-      CODE
+    def each
+      @mimes.each { |x| yield x }
+    end
+
+    def <<(type)
+      @mimes << type
+      @symbols = nil
+    end
+
+    def delete_if
+      @mimes.delete_if { |x| yield x }.tap { @symbols = nil }
+    end
+
+    def symbols
+      @symbols ||= map(&:to_sym)
     end
   end
 
@@ -24,12 +36,19 @@ module Mime
   EXTENSION_LOOKUP = {}
   LOOKUP           = {}
 
-  def self.[](type)
-    return type if type.is_a?(Type)
-    Type.lookup_by_extension(type.to_s)
+  class << self
+    def [](type)
+      return type if type.is_a?(Type)
+      Type.lookup_by_extension(type)
+    end
+
+    def fetch(type)
+      return type if type.is_a?(Type)
+      EXTENSION_LOOKUP.fetch(type.to_s) { |k| yield k }
+    end
   end
 
-  # Encapsulates the notion of a mime type. Can be used at render time, for example, with:
+  # Encapsulates the notion of a MIME type. Can be used at render time, for example, with:
   #
   #   class PostsController < ActionController::Base
   #     def show
@@ -37,52 +56,90 @@ module Mime
   #
   #       respond_to do |format|
   #         format.html
-  #         format.ics { render :text => post.to_ics, :mime_type => Mime::Type["text/calendar"]  }
-  #         format.xml { render :xml => @people.to_xml }
+  #         format.ics { render body: @post.to_ics, mime_type: Mime::Type.lookup("text/calendar")  }
+  #         format.xml { render xml: @post }
   #       end
   #     end
   #   end
   class Type
-    @@html_types = Set.new [:html, :all]
-    cattr_reader :html_types
-
-    # These are the content types which browsers can generate without using ajax, flash, etc
-    # i.e. following a link, getting an image or posting a form. CSRF protection
-    # only needs to protect against these types.
-    @@browser_generated_types = Set.new [:html, :url_encoded_form, :multipart_form, :text]
-    cattr_reader :browser_generated_types
     attr_reader :symbol
 
-    # A simple helper class used in parsing the accept header
+    @register_callbacks = []
+
+    # A simple helper class used in parsing the accept header.
     class AcceptItem #:nodoc:
-      attr_accessor :order, :name, :q
+      attr_accessor :index, :name, :q
+      alias :to_s :name
 
-      def initialize(order, name, q=nil)
-        @order = order
-        @name = name.strip
-        q ||= 0.0 if @name == Mime::ALL # default wildcard match to end of list
+      def initialize(index, name, q = nil)
+        @index = index
+        @name = name
+        q ||= 0.0 if @name == "*/*".freeze # Default wildcard match to end of list.
         @q = ((q || 1.0).to_f * 100).to_i
       end
 
-      def to_s
-        @name
-      end
-
       def <=>(item)
-        result = item.q <=> q
-        result = order <=> item.order if result == 0
+        result = item.q <=> @q
+        result = @index <=> item.index if result == 0
         result
       end
+    end
 
-      def ==(item)
-        name == (item.respond_to?(:name) ? item.name : item)
+    class AcceptList #:nodoc:
+      def self.sort!(list)
+        list.sort!
+
+        text_xml_idx = find_item_by_name list, "text/xml"
+        app_xml_idx = find_item_by_name list, Mime[:xml].to_s
+
+        # Take care of the broken text/xml entry by renaming or deleting it.
+        if text_xml_idx && app_xml_idx
+          app_xml = list[app_xml_idx]
+          text_xml = list[text_xml_idx]
+
+          app_xml.q = [text_xml.q, app_xml.q].max # Set the q value to the max of the two.
+          if app_xml_idx > text_xml_idx  # Make sure app_xml is ahead of text_xml in the list.
+            list[app_xml_idx], list[text_xml_idx] = text_xml, app_xml
+            app_xml_idx, text_xml_idx = text_xml_idx, app_xml_idx
+          end
+          list.delete_at(text_xml_idx)  # Delete text_xml from the list.
+        elsif text_xml_idx
+          list[text_xml_idx].name = Mime[:xml].to_s
+        end
+
+        # Look for more specific XML-based types and sort them ahead of app/xml.
+        if app_xml_idx
+          app_xml = list[app_xml_idx]
+          idx = app_xml_idx
+
+          while idx < list.length
+            type = list[idx]
+            break if type.q < app_xml.q
+
+            if type.name.ends_with? "+xml"
+              list[app_xml_idx], list[idx] = list[idx], app_xml
+              app_xml_idx = idx
+            end
+            idx += 1
+          end
+        end
+
+        list.map! { |i| Mime::Type.lookup(i.name) }.uniq!
+        list
+      end
+
+      def self.find_item_by_name(array, name)
+        array.index { |item| item.name == name }
       end
     end
 
     class << self
+      TRAILING_STAR_REGEXP = /^(text|application)\/\*/
+      PARAMETER_SEPARATOR_REGEXP = /;\s*\w+="?\w+"?/
 
-      TRAILING_STAR_REGEXP = /(text|application)\/\*/
-      Q_SEPARATOR_REGEXP = /;\s*q=/
+      def register_callback(&block)
+        @register_callbacks << block
+      end
 
       def lookup(string)
         LOOKUP[string] || Type.new(string)
@@ -92,115 +149,75 @@ module Mime
         EXTENSION_LOOKUP[extension.to_s]
       end
 
-      # Registers an alias that's not used on mime type lookup, but can be referenced directly. Especially useful for
+      # Registers an alias that's not used on MIME type lookup, but can be referenced directly. Especially useful for
       # rendering different HTML versions depending on the user agent, like an iPhone.
       def register_alias(string, symbol, extension_synonyms = [])
         register(string, symbol, [], extension_synonyms, true)
       end
 
       def register(string, symbol, mime_type_synonyms = [], extension_synonyms = [], skip_lookup = false)
-        Mime.const_set(symbol.to_s.upcase, Type.new(string, symbol, mime_type_synonyms))
+        new_mime = Type.new(string, symbol, mime_type_synonyms)
 
-        SET << Mime.const_get(symbol.to_s.upcase)
+        SET << new_mime
 
-        ([string] + mime_type_synonyms).each { |str| LOOKUP[str] = SET.last } unless skip_lookup
-        ([symbol] + extension_synonyms).each { |ext| EXTENSION_LOOKUP[ext.to_s] = SET.last }
+        ([string] + mime_type_synonyms).each { |str| LOOKUP[str] = new_mime } unless skip_lookup
+        ([symbol] + extension_synonyms).each { |ext| EXTENSION_LOOKUP[ext.to_s] = new_mime }
+
+        @register_callbacks.each do |callback|
+          callback.call(new_mime)
+        end
+        new_mime
       end
 
       def parse(accept_header)
-        if accept_header !~ /,/
-          accept_header = accept_header.split(Q_SEPARATOR_REGEXP).first
-          if accept_header =~ TRAILING_STAR_REGEXP
-            parse_data_with_trailing_star($1)
-          else
-            [Mime::Type.lookup(accept_header)]
-          end
+        if !accept_header.include?(",")
+          accept_header = accept_header.split(PARAMETER_SEPARATOR_REGEXP).first
+          parse_trailing_star(accept_header) || [Mime::Type.lookup(accept_header)].compact
         else
-          # keep track of creation order to keep the subsequent sort stable
           list, index = [], 0
-          accept_header.split(/,/).each do |header|
-            params, q = header.split(Q_SEPARATOR_REGEXP)
-            if params.present?
-              params.strip!
-
-              if params =~ TRAILING_STAR_REGEXP
-                parse_data_with_trailing_star($1).each do |m|
-                  list << AcceptItem.new(index, m.to_s, q)
-                  index += 1
-                end
-              else
-                list << AcceptItem.new(index, params, q)
-                index += 1
-              end
-            end
-          end
-          list.sort!
-
-          # Take care of the broken text/xml entry by renaming or deleting it
-          text_xml = list.index("text/xml")
-          app_xml = list.index(Mime::XML.to_s)
-
-          if text_xml && app_xml
-            # set the q value to the max of the two
-            list[app_xml].q = [list[text_xml].q, list[app_xml].q].max
-
-            # make sure app_xml is ahead of text_xml in the list
-            if app_xml > text_xml
-              list[app_xml], list[text_xml] = list[text_xml], list[app_xml]
-              app_xml, text_xml = text_xml, app_xml
-            end
+          accept_header.split(",").each do |header|
+            params, q = header.split(PARAMETER_SEPARATOR_REGEXP)
 
-            # delete text_xml from the list
-            list.delete_at(text_xml)
+            next unless params
+            params.strip!
+            next if params.empty?
 
-          elsif text_xml
-            list[text_xml].name = Mime::XML.to_s
-          end
-
-          # Look for more specific XML-based types and sort them ahead of app/xml
-
-          if app_xml
-            idx = app_xml
-            app_xml_type = list[app_xml]
+            params = parse_trailing_star(params) || [params]
 
-            while(idx < list.length)
-              type = list[idx]
-              break if type.q < app_xml_type.q
-              if type.name =~ /\+xml$/
-                list[app_xml], list[idx] = list[idx], list[app_xml]
-                app_xml = idx
-              end
-              idx += 1
+            params.each do |m|
+              list << AcceptItem.new(index, m.to_s, q)
+              index += 1
             end
           end
-
-          list.map! { |i| Mime::Type.lookup(i.name) }.uniq!
-          list
+          AcceptList.sort! list
         end
       end
 
-      # input: 'text'
-      # returned value:  [Mime::JSON, Mime::XML, Mime::ICS, Mime::HTML, Mime::CSS, Mime::CSV, Mime::JS, Mime::YAML, Mime::TEXT]
+      def parse_trailing_star(accept_header)
+        parse_data_with_trailing_star($1) if accept_header =~ TRAILING_STAR_REGEXP
+      end
+
+      # For an input of <tt>'text'</tt>, returns <tt>[Mime[:json], Mime[:xml], Mime[:ics],
+      # Mime[:html], Mime[:css], Mime[:csv], Mime[:js], Mime[:yaml], Mime[:text]</tt>.
       #
-      # input: 'application'
-      # returned value: [Mime::HTML, Mime::JS, Mime::XML, Mime::YAML, Mime::ATOM, Mime::JSON, Mime::RSS, Mime::URL_ENCODED_FORM]
-      def parse_data_with_trailing_star(input)
-        Mime::SET.select { |m| m =~ input }
+      # For an input of <tt>'application'</tt>, returns <tt>[Mime[:html], Mime[:js],
+      # Mime[:xml], Mime[:yaml], Mime[:atom], Mime[:json], Mime[:rss], Mime[:url_encoded_form]</tt>.
+      def parse_data_with_trailing_star(type)
+        Mime::SET.select { |m| m =~ type }
       end
 
       # This method is opposite of register method.
       #
-      # Usage:
+      # To unregister a MIME type:
       #
-      # Mime::Type.unregister(:mobile)
+      #   Mime::Type.unregister(:mobile)
       def unregister(symbol)
-        symbol = symbol.to_s.upcase
-        mime = Mime.const_get(symbol)
-        Mime.instance_eval { remove_const(symbol) }
-
-        SET.delete_if { |v| v.eql?(mime) }
-        LOOKUP.delete_if { |k,v| v.eql?(mime) }
-        EXTENSION_LOOKUP.delete_if { |k,v| v.eql?(mime) }
+        symbol = symbol.downcase
+        if mime = Mime[symbol]
+          SET.delete_if { |v| v.eql?(mime) }
+          LOOKUP.delete_if { |_, v| v.eql?(mime) }
+          EXTENSION_LOOKUP.delete_if { |_, v| v.eql?(mime) }
+        end
       end
     end
 
@@ -225,7 +242,7 @@ module Mime
     end
 
     def ref
-      to_sym || to_s
+      symbol || to_s
     end
 
     def ===(list)
@@ -237,7 +254,7 @@ module Mime
     end
 
     def ==(mime_type)
-      return false if mime_type.blank?
+      return false unless mime_type
       (@synonyms + [ self ]).any? do |synonym|
         synonym.to_s == mime_type.to_s || synonym.to_sym == mime_type.to_sym
       end
@@ -251,40 +268,75 @@ module Mime
     end
 
     def =~(mime_type)
-      return false if mime_type.blank?
+      return false unless mime_type
       regexp = Regexp.new(Regexp.quote(mime_type.to_s))
-      (@synonyms + [ self ]).any? do |synonym|
-        synonym.to_s =~ regexp
-      end
-    end
-
-    # Returns true if Action Pack should check requests using this Mime Type for possible request forgery. See
-    # ActionController::RequestForgeryProtection.
-    def verify_request?
-      @@browser_generated_types.include?(to_sym)
+      @synonyms.any? { |synonym| synonym.to_s =~ regexp } || @string =~ regexp
     end
 
     def html?
-      @@html_types.include?(to_sym) || @string =~ /html/
+      symbol == :html || @string =~ /html/
     end
 
-    def respond_to?(method, include_private = false) #:nodoc:
-      super || method.to_s =~ /(\w+)\?$/
-    end
+    def all?; false; end
 
+    # TODO Change this to private once we've dropped Ruby 2.2 support.
+    # Workaround for Ruby 2.2 "private attribute?" warning.
     protected
 
-    attr_reader :string, :synonyms
+      attr_reader :string, :synonyms
 
     private
+
+      def to_ary; end
+      def to_a; end
+
       def method_missing(method, *args)
-        if method.to_s =~ /(\w+)\?$/
-          $1.downcase.to_sym == to_sym
+        if method.to_s.ends_with? "?"
+          method[0..-2].downcase.to_sym == to_sym
         else
           super
         end
       end
+
+      def respond_to_missing?(method, include_private = false)
+        (method.to_s.ends_with? "?") || super
+      end
+  end
+
+  class AllType < Type
+    include Singleton
+
+    def initialize
+      super "*/*", :all
+    end
+
+    def all?; true; end
+    def html?; true; end
+  end
+
+  # ALL isn't a real MIME type, so we don't register it for lookup with the
+  # other concrete types. It's a wildcard match that we use for `respond_to`
+  # negotiation internals.
+  ALL = AllType.instance
+
+  class NullType
+    include Singleton
+
+    def nil?
+      true
+    end
+
+    def ref; end
+
+    private
+      def respond_to_missing?(method, _)
+        method.to_s.ends_with? "?"
+      end
+
+      def method_missing(method, *args)
+        false if method.to_s.ends_with? "?"
+      end
   end
 end
 
-require 'action_dispatch/http/mime_types'
+require "action_dispatch/http/mime_types"

data/lib/action_dispatch/http/mime_types.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 # Build list of Mime types for HTTP responses
-# http://www.iana.org/assignments/media-types/
+# https://www.iana.org/assignments/media-types/
 
 Mime::Type.register "text/html", :html, %w( application/xhtml+xml ), %w( xhtml )
 Mime::Type.register "text/plain", :text, [], %w(txt)
@@ -7,29 +9,42 @@ Mime::Type.register "text/javascript", :js, %w( application/javascript applicati
 Mime::Type.register "text/css", :css
 Mime::Type.register "text/calendar", :ics
 Mime::Type.register "text/csv", :csv
+Mime::Type.register "text/vcard", :vcf
+Mime::Type.register "text/vtt", :vtt, %w(vtt)
 
 Mime::Type.register "image/png", :png, [], %w(png)
-Mime::Type.register "image/jpeg", :jpeg, [], %w(jpg jpeg jpe)
+Mime::Type.register "image/jpeg", :jpeg, [], %w(jpg jpeg jpe pjpeg)
 Mime::Type.register "image/gif", :gif, [], %w(gif)
 Mime::Type.register "image/bmp", :bmp, [], %w(bmp)
 Mime::Type.register "image/tiff", :tiff, [], %w(tif tiff)
+Mime::Type.register "image/svg+xml", :svg
 
 Mime::Type.register "video/mpeg", :mpeg, [], %w(mpg mpeg mpe)
 
+Mime::Type.register "audio/mpeg", :mp3, [], %w(mp1 mp2 mp3)
+Mime::Type.register "audio/ogg", :ogg, [], %w(oga ogg spx opus)
+Mime::Type.register "audio/aac", :m4a, %w( audio/mp4 ), %w(m4a mpg4 aac)
+
+Mime::Type.register "video/webm", :webm, [], %w(webm)
+Mime::Type.register "video/mp4", :mp4, [], %w(mp4 m4v)
+
+Mime::Type.register "font/otf", :otf, [], %w(otf)
+Mime::Type.register "font/ttf", :ttf, [], %w(ttf)
+Mime::Type.register "font/woff", :woff, [], %w(woff)
+Mime::Type.register "font/woff2", :woff2, [], %w(woff2)
+
 Mime::Type.register "application/xml", :xml, %w( text/xml application/x-xml )
 Mime::Type.register "application/rss+xml", :rss
 Mime::Type.register "application/atom+xml", :atom
-Mime::Type.register "application/x-yaml", :yaml, %w( text/yaml )
+Mime::Type.register "application/x-yaml", :yaml, %w( text/yaml ), %w(yml yaml)
 
 Mime::Type.register "multipart/form-data", :multipart_form
 Mime::Type.register "application/x-www-form-urlencoded", :url_encoded_form
 
-# http://www.ietf.org/rfc/rfc4627.txt
+# https://www.ietf.org/rfc/rfc4627.txt
 # http://www.json.org/JSONRequest.html
 Mime::Type.register "application/json", :json, %w( text/x-json application/jsonrequest )
 
 Mime::Type.register "application/pdf", :pdf, [], %w(pdf)
 Mime::Type.register "application/zip", :zip, [], %w(zip)
-
-# Create Mime::ALL but do not add it to the SET.
-Mime::ALL = Mime::Type.new("*/*", :all, [])
+Mime::Type.register "application/gzip", :gzip, %w(application/x-gzip), %w(gz)

data/lib/action_dispatch/http/parameter_filter.rb

@@ -1,74 +1,86 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/object/duplicable"
+
 module ActionDispatch
   module Http
     class ParameterFilter
+      FILTERED = "[FILTERED]".freeze # :nodoc:
 
-      def initialize(filters)
+      def initialize(filters = [])
         @filters = filters
       end
 
       def filter(params)
-        if enabled?
-          compiled_filter.call(params)
-        else
-          params.dup
-        end
+        compiled_filter.call(params)
       end
 
     private
 
-      def enabled?
-        @filters.present?
+      def compiled_filter
+        @compiled_filter ||= CompiledFilter.compile(@filters)
       end
 
-      FILTERED = '[FILTERED]'.freeze
+      class CompiledFilter # :nodoc:
+        def self.compile(filters)
+          return lambda { |params| params.dup } if filters.empty?
 
-      def compiled_filter
-        @compiled_filter ||= begin
-          regexps, blocks = compile_filter
-
-          lambda do |original_params|
-            filtered_params = {}
-
-            original_params.each do |key, value|
-              if regexps.find { |r| key =~ r }
-                value = FILTERED
-              elsif value.is_a?(Hash)
-                value = filter(value)
-              elsif value.is_a?(Array)
-                value = value.map { |v| v.is_a?(Hash) ? filter(v) : v }
-              elsif blocks.present?
-                key = key.dup
-                value = value.dup if value.duplicable?
-                blocks.each { |b| b.call(key, value) }
-              end
-
-              filtered_params[key] = value
-            end
+          strings, regexps, blocks = [], [], []
 
-            filtered_params
+          filters.each do |item|
+            case item
+            when Proc
+              blocks << item
+            when Regexp
+              regexps << item
+            else
+              strings << Regexp.escape(item.to_s)
+            end
           end
+
+          deep_regexps, regexps = regexps.partition { |r| r.to_s.include?("\\.".freeze) }
+          deep_strings, strings = strings.partition { |s| s.include?("\\.".freeze) }
+
+          regexps << Regexp.new(strings.join("|".freeze), true) unless strings.empty?
+          deep_regexps << Regexp.new(deep_strings.join("|".freeze), true) unless deep_strings.empty?
+
+          new regexps, deep_regexps, blocks
         end
-      end
 
-      def compile_filter
-        strings, regexps, blocks = [], [], []
-
-        @filters.each do |item|
-          case item
-          when NilClass
-          when Proc
-            blocks << item
-          when Regexp
-            regexps << item
-          else
-            strings << item.to_s
-          end
+        attr_reader :regexps, :deep_regexps, :blocks
+
+        def initialize(regexps, deep_regexps, blocks)
+          @regexps = regexps
+          @deep_regexps = deep_regexps.any? ? deep_regexps : nil
+          @blocks = blocks
         end
 
-        regexps << Regexp.new(strings.join('|'), true) unless strings.empty?
-        [regexps, blocks]
-      end
+        def call(original_params, parents = [])
+          filtered_params = original_params.class.new
+
+          original_params.each do |key, value|
+            parents.push(key) if deep_regexps
+            if regexps.any? { |r| key =~ r }
+              value = FILTERED
+            elsif deep_regexps && (joined = parents.join(".")) && deep_regexps.any? { |r| joined =~ r }
+              value = FILTERED
+            elsif value.is_a?(Hash)
+              value = call(value, parents)
+            elsif value.is_a?(Array)
+              value = value.map { |v| v.is_a?(Hash) ? call(v, parents) : v }
+            elsif blocks.any?
+              key = key.dup if key.duplicable?
+              value = value.dup if value.duplicable?
+              blocks.each { |b| b.call(key, value) }
+            end
+            parents.pop if deep_regexps
+
+            filtered_params[key] = value
+          end
 
+          filtered_params
+        end
+      end
     end
   end
 end