actionpack 3.2.22 → 3.2.22.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6efaa79668a2f1506e7dafd4cb0a3cb9c7263bf4
-  data.tar.gz: 1fc55fc7fc7dbed9de6ada5c4e8e8e7994f46a47
+  metadata.gz: b2589906c64cd869c852384400c0faaa3ce38781
+  data.tar.gz: 791a03c38208269ba110b4d5afaa77b3144894b6
 SHA512:
-  metadata.gz: 9680438e9bd275263d4c10b16607db1c22c12e9a12bc84ef3117e03ada6af7db63c5feb911f4f29536697a8e3b9f23b30c26e8a73cd3cb0cf09a60fffcac16a1
-  data.tar.gz: e143b76f02121dec0af4974a839ca2793f227a18b434ee3e54065f4234733008fba44e58b5c267839f00de8ecd4cbfccdbcf9b26afdb330557f70b83c2140787
+  metadata.gz: ac4faea0a3986fbaa9644ec86c74bab96478b4b75786901f0d9142f563ada0d0efdf56e3c094af894eb7542fedfb7c88eaa93fa04fdb37be981c7e9267a65875
+  data.tar.gz: ef93100f309d422d5d4542e73dd02a7087cd4f0fc3b37e48d01fc9d0deedbc282550cf81780489d707ad2902e559f3a65711ca03c25b03ad2fce7ab28b5e5186

data/lib/abstract_controller/rendering.rb

@@ -1,6 +1,7 @@
 require "abstract_controller/base"
 require "action_view"
 require "active_support/core_ext/object/instance_variables"
+require "active_support/hash_with_indifferent_access"
 
 module AbstractController
   class DoubleRenderError < Error
@@ -138,7 +139,7 @@ module AbstractController
     end
 
     # Normalize args by converting render "foo" to render :action => "foo" and
-    # render "foo/bar" to render :file => "foo/bar".
+    # render "foo/bar" to render :app_template_file => "foo/bar".
     # :api: plugin
     def _normalize_args(action=nil, options={})
       case action
@@ -147,12 +148,11 @@ module AbstractController
         options = action
       when String, Symbol
         action = action.to_s
-        key = action.include?(?/) ? :file : :action
+        key = action.include?(?/) ? :app_template_file : :action
         options[key] = action
       else
         options[:partial] = action
       end
-
       options
     end
 

data/lib/action_controller/metal/http_authentication.rb

@@ -1,5 +1,6 @@
 require 'active_support/base64'
 require 'active_support/core_ext/object/blank'
+require 'active_support/security_utils'
 
 module ActionController
   module HttpAuthentication
@@ -111,7 +112,11 @@ module ActionController
           def http_basic_authenticate_with(options = {})
             before_filter(options.except(:name, :password, :realm)) do
               authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
-                name == options[:name] && password == options[:password]
+                # This comparison uses & so that it doesn't short circuit and
+                # uses `variable_size_secure_compare` so that length information
+                # isn't leaked.
+                ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) &
+                  ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password])
               end
             end
           end

data/lib/action_dispatch/http/mime_type.rb

@@ -22,7 +22,7 @@ module Mime
 
   SET              = Mimes.new
   EXTENSION_LOOKUP = {}
-  LOOKUP           = Hash.new { |h, k| h[k] = Type.new(k) unless k.blank? }
+  LOOKUP           = {}
 
   def self.[](type)
     return type if type.is_a?(Type)
@@ -85,7 +85,7 @@ module Mime
       Q_SEPARATOR_REGEXP = /;\s*q=/
 
       def lookup(string)
-        LOOKUP[string]
+        LOOKUP[string] || Type.new(string)
       end
 
       def lookup_by_extension(extension)
@@ -204,9 +204,12 @@ module Mime
       end
     end
 
+    attr_reader :hash
+
     def initialize(string, symbol = nil, synonyms = [])
       @symbol, @synonyms = symbol, synonyms
       @string = string
+      @hash = [@string, @synonyms, @symbol].hash
     end
 
     def to_s
@@ -240,6 +243,13 @@ module Mime
       end
     end
 
+    def eql?(other)
+      super || (self.class == other.class &&
+                @string    == other.string &&
+                @synonyms  == other.synonyms &&
+                @symbol    == other.symbol)
+    end
+
     def =~(mime_type)
       return false if mime_type.blank?
       regexp = Regexp.new(Regexp.quote(mime_type.to_s))
@@ -262,6 +272,10 @@ module Mime
       super || method.to_s =~ /(\w+)\?$/
     end
 
+    protected
+
+    attr_reader :string, :synonyms
+
     private
       def method_missing(method, *args)
         if method.to_s =~ /(\w+)\?$/

data/lib/action_pack/version.rb

@@ -3,7 +3,7 @@ module ActionPack
     MAJOR = 3
     MINOR = 2
     TINY  = 22
-    PRE   = nil
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
   end

data/lib/action_view/helpers/rendering_helper.rb

@@ -1,3 +1,5 @@
+require "active_support/core_ext/hash/indifferent_access"
+
 module ActionView
   module Helpers
     # = Action View Rendering

data/lib/action_view/helpers/tag_helper.rb

@@ -10,6 +10,7 @@ module ActionView
     module TagHelper
       extend ActiveSupport::Concern
       include CaptureHelper
+      include OutputSafetyHelper
 
       BOOLEAN_ATTRIBUTES = %w(disabled readonly multiple checked autobuffer
                            autoplay controls loop selected hidden scoped async
@@ -141,20 +142,26 @@ module ActionView
                   unless v.is_a?(String) || v.is_a?(Symbol) || v.is_a?(BigDecimal)
                     v = v.to_json
                   end
-                  v = ERB::Util.html_escape(v) if escape
-                  attrs << %(data-#{k.to_s.dasherize}="#{v}")
+                  attrs << tag_option("data-#{k.to_s.dasherize}", v, escape)
                 end
               elsif BOOLEAN_ATTRIBUTES.include?(key)
                 attrs << %(#{key}="#{key}") if value
               elsif !value.nil?
-                final_value = value.is_a?(Array) ? value.join(" ") : value
-                final_value = ERB::Util.html_escape(final_value) if escape
-                attrs << %(#{key}="#{final_value}")
+                attrs << tag_option(key, value, escape)
               end
             end
             " #{attrs.sort * ' '}".html_safe unless attrs.empty?
           end
         end
+
+        def tag_option(key, value, escape)
+          if value.is_a?(Array)
+            value = escape ? safe_join(value, " ") : value.join(" ")
+          else
+            value = escape ? ERB::Util.html_escape(value) : value.to_s
+          end
+          %(#{key}="#{value.gsub(/"/, '&quot;'.freeze)}")
+        end
     end
   end
 end

data/lib/action_view/lookup_context.rb

@@ -127,6 +127,10 @@ module ActionView
         @view_paths.find_all(*args_for_lookup(name, prefixes, partial, keys, options))
       end
 
+      def find_file(name, prefixes = [], partial = false, keys = [], options = {})
+        @view_paths.find_file(*args_for_lookup(name, prefixes, partial, keys, options))
+      end
+
       def exists?(name, prefixes = [], partial = false, keys = [], options = {})
         @view_paths.exists?(*args_for_lookup(name, prefixes, partial, keys, options))
       end

data/lib/action_view/path_set.rb

@@ -58,23 +58,35 @@ module ActionView #:nodoc:
       find_all(*args).first || raise(MissingTemplate.new(self, *args))
     end
 
+    def find_file(path, prefixes = [], *args)
+      _find_all(path, prefixes, args, true).first || raise(MissingTemplate.new(self, path, prefixes, *args))
+    end
+
     def find_all(path, prefixes = [], *args)
+      _find_all path, prefixes, args, false
+    end
+
+    def exists?(path, prefixes, *args)
+      find_all(path, prefixes, *args).any?
+    end
+
+    private
+
+    def _find_all(path, prefixes, args, outside_app)
       prefixes = [prefixes] if String === prefixes
       prefixes.each do |prefix|
         paths.each do |resolver|
-          templates = resolver.find_all(path, prefix, *args)
+          if outside_app
+            templates = resolver.find_all_anywhere(path, prefix, *args)
+          else
+            templates = resolver.find_all(path, prefix, *args)
+          end
           return templates unless templates.empty?
         end
       end
       []
     end
 
-    def exists?(path, prefixes, *args)
-      find_all(path, prefixes, *args).any?
-    end
-
-    private
-
     def typecast(paths)
       paths.map do |path|
         case path

data/lib/action_view/renderer/abstract_renderer.rb

@@ -1,6 +1,6 @@
 module ActionView
   class AbstractRenderer #:nodoc:
-    delegate :find_template, :template_exists?, :with_fallbacks, :update_details,
+    delegate :find_template, :find_file, :template_exists?, :with_fallbacks, :update_details,
       :with_layout_format, :formats, :to => :@lookup_context
 
     def initialize(lookup_context)

data/lib/action_view/renderer/renderer.rb

@@ -1,3 +1,5 @@
+require 'active_support/hash_with_indifferent_access'
+
 module ActionView
   # This is the main entry point for rendering. It basically delegates
   # to other objects like TemplateRenderer and PartialRenderer which
@@ -11,6 +13,11 @@ module ActionView
 
     # Main render entry point shared by AV and AC.
     def render(context, options)
+      if (options.is_a?(HashWithIndifferentAccess) && !options.respond_to?(:permitted?)) ||
+         (options.respond_to?(:permitted?) && !options.permitted?)
+        raise ArgumentError, "render parameters are not permitted"
+      end
+
       if options.key?(:partial)
         render_partial(context, options)
       else

data/lib/action_view/renderer/template_renderer.rb

@@ -21,11 +21,12 @@ module ActionView
     # Determine the template to be rendered using the given options.
     def determine_template(options) #:nodoc:
       keys = options[:locals].try(:keys) || []
-
       if options.key?(:text)
         Template::Text.new(options[:text], formats.try(:first))
+      elsif options.key?(:app_template_file)
+        find_template(options[:app_template_file], nil, false, keys, @details)
       elsif options.key?(:file)
-        with_fallbacks { find_template(options[:file], nil, false, keys, @details) }
+        with_fallbacks { find_file(options[:file], nil, false, keys, @details) }
       elsif options.key?(:inline)
         handler = Template.handler_for_extension(options[:type] || "erb")
         Template.new(options[:inline], "inline template", handler, :locals => keys)

data/lib/action_view/template/resolver.rb

@@ -1,6 +1,7 @@
 require "pathname"
 require "active_support/core_ext/class"
 require "active_support/core_ext/io"
+require "active_support/core_ext/string/starts_ends_with"
 require "action_view/template"
 
 module ActionView
@@ -43,7 +44,13 @@ module ActionView
     # Normalizes the arguments and passes it on to find_template.
     def find_all(name, prefix=nil, partial=false, details={}, key=nil, locals=[])
       cached(key, [name, prefix, partial], details, locals) do
-        find_templates(name, prefix, partial, details)
+        find_templates(name, prefix, partial, details, false)
+      end
+    end
+
+    def find_all_anywhere(name, prefix, partial=false, details={}, key=nil, locals=[])
+      cached(key, [name, prefix, partial], details, locals) do
+        find_templates(name, prefix, partial, details, true)
       end
     end
 
@@ -54,8 +61,8 @@ module ActionView
     # This is what child classes implement. No defaults are needed
     # because Resolver guarantees that the arguments are present and
     # normalized.
-    def find_templates(name, prefix, partial, details)
-      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details) method"
+    def find_templates(name, prefix, partial, details, outside_app_allowed = false)
+      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details, outside_app_allowed) method"
     end
 
     # Helpers that builds a path. Useful for building virtual paths.
@@ -110,18 +117,22 @@ module ActionView
       super()
     end
 
+    cattr_accessor :instance_reader => false, :instance_writer => false
+
     private
 
-    def find_templates(name, prefix, partial, details)
+    def find_templates(name, prefix, partial, details, outside_app_allowed = false)
       path = Path.build(name, prefix, partial)
-      query(path, details, details[:formats])
+      query(path, details, details[:formats], outside_app_allowed)
     end
 
-    def query(path, details, formats)
+    def query(path, details, formats, outside_app_allowed)
       query = build_query(path, details)
 
       template_paths = find_template_paths query
 
+      template_paths = reject_files_external_to_app(template_paths) unless outside_app_allowed
+
       template_paths.map { |template|
         handler, format = extract_handler_and_format(template, formats)
         contents = File.binread template
@@ -133,6 +144,10 @@ module ActionView
       }
     end
 
+    def reject_files_external_to_app(files)
+      files.reject { |filename| !inside_path?(@path, filename) }
+    end
+
     if RUBY_VERSION >= '2.2.0'
       def find_template_paths(query)
         Dir[query].reject { |filename|
@@ -153,6 +168,12 @@ module ActionView
       end
     end
 
+    def inside_path?(path, filename)
+      filename = File.expand_path(filename)
+      path = File.join(path, '')
+      filename.start_with?(path)
+    end
+
     # Helper for building query glob string based on resolver's pattern.
     def build_query(path, details)
       query = @pattern.dup
@@ -250,7 +271,12 @@ module ActionView
   class OptimizedFileSystemResolver < FileSystemResolver #:nodoc:
     def build_query(path, details)
       exts = EXTENSIONS.map { |ext| details[ext] }
-      query = escape_entry(File.join(@path, path))
+
+      if path.to_s.starts_with? @path.to_s
+        query = escape_entry(path)
+      else
+        query = escape_entry(File.join(@path, path))
+      end
 
       query + exts.map { |ext|
         "{#{ext.compact.uniq.map { |e| ".#{e}," }.join}}"

data/lib/action_view/testing/resolvers.rb

@@ -19,7 +19,7 @@ module ActionView #:nodoc:
 
   private
 
-    def query(path, exts, formats)
+    def query(path, exts, formats, outside_app_allowed)
       query = ""
       EXTENSIONS.each do |ext|
         query << '(' << exts[ext].map {|e| e && Regexp.escape(".#{e}") }.join('|') << '|)'
@@ -40,11 +40,10 @@ module ActionView #:nodoc:
   end
 
   class NullResolver < PathResolver
-    def query(path, exts, formats)
+    def query(path, exts, formats, outside_app_allowed)
       handler, format = extract_handler_and_format(path, formats)
       [ActionView::Template.new("Template generated by Null Resolver", path, handler, :virtual_path => path, :format => format)]
     end
   end
 
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 3.2.22
+  version: 3.2.22.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-16 00:00:00.000000000 Z
+date: 2016-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.22
+        version: 3.2.22.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.22
+        version: 3.2.22.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.22
+        version: 3.2.22.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.22
+        version: 3.2.22.5
 - !ruby/object:Gem::Dependency
   name: rack-cache
   requirement: !ruby/object:Gem::Requirement
@@ -369,8 +369,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - none
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.6
 signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []
+has_rdoc: