actionpack 4.2.10 → 7.2.0.rc1

data/lib/action_dispatch/middleware/ssl.rb

@@ -1,72 +1,170 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
 module ActionDispatch
+  # # Action Dispatch SSL
+  #
+  # This middleware is added to the stack when `config.force_ssl = true`, and is
+  # passed the options set in `config.ssl_options`. It does three jobs to enforce
+  # secure HTTP requests:
+  #
+  # 1.  **TLS redirect**: Permanently redirects `http://` requests to `https://`
+  #     with the same URL host, path, etc. Enabled by default. Set
+  #     `config.ssl_options` to modify the destination URL (e.g. `redirect: {
+  #     host: "secure.widgets.com", port: 8080 }`), or set `redirect: false` to
+  #     disable this feature.
+  #
+  #     Requests can opt-out of redirection with `exclude`:
+  #
+  #         config.ssl_options = { redirect: { exclude: -> request { /healthcheck/.match?(request.path) } } }
+  #
+  #     Cookies will not be flagged as secure for excluded requests.
+  #
+  # 2.  **Secure cookies**: Sets the `secure` flag on cookies to tell browsers
+  #     they must not be sent along with `http://` requests. Enabled by default.
+  #     Set `config.ssl_options` with `secure_cookies: false` to disable this
+  #     feature.
+  #
+  # 3.  **HTTP Strict Transport Security (HSTS)**: Tells the browser to remember
+  #     this site as TLS-only and automatically redirect non-TLS requests. Enabled
+  #     by default. Configure `config.ssl_options` with `hsts: false` to disable.
+  #
+  #     Set `config.ssl_options` with `hsts: { ... }` to configure HSTS:
+  #
+  #     *   `expires`: How long, in seconds, these settings will stick. The
+  #         minimum required to qualify for browser preload lists is 1 year.
+  #         Defaults to 2 years (recommended).
+  #
+  #     *   `subdomains`: Set to `true` to tell the browser to apply these
+  #         settings to all subdomains. This protects your cookies from
+  #         interception by a vulnerable site on a subdomain. Defaults to `true`.
+  #
+  #     *   `preload`: Advertise that this site may be included in browsers'
+  #         preloaded HSTS lists. HSTS protects your site on every visit *except
+  #         the first visit* since it hasn't seen your HSTS header yet. To close
+  #         this gap, browser vendors include a baked-in list of HSTS-enabled
+  #         sites. Go to https://hstspreload.org to submit your site for
+  #         inclusion. Defaults to `false`.
+  #
+  #
+  #     To turn off HSTS, omitting the header is not enough. Browsers will
+  #     remember the original HSTS directive until it expires. Instead, use the
+  #     header to tell browsers to expire HSTS immediately. Setting `hsts: false`
+  #     is a shortcut for `hsts: { expires: 0 }`.
+  #
   class SSL
-    YEAR = 31536000
+    # :stopdoc: Default to 2 years as recommended on hstspreload.org.
+    HSTS_EXPIRES_IN = 63072000
+
+    PERMANENT_REDIRECT_REQUEST_METHODS = %w[GET HEAD] # :nodoc:
 
     def self.default_hsts_options
-      { :expires => YEAR, :subdomains => false }
+      { expires: HSTS_EXPIRES_IN, subdomains: true, preload: false }
     end
 
-    def initialize(app, options = {})
+    def initialize(app, redirect: {}, hsts: {}, secure_cookies: true, ssl_default_redirect_status: nil)
       @app = app
 
-      @hsts = options.fetch(:hsts, {})
-      @hsts = {} if @hsts == true
-      @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts
+      @redirect = redirect
+
+      @exclude = @redirect && @redirect[:exclude] || proc { !@redirect }
+      @secure_cookies = secure_cookies
 
-      @host    = options[:host]
-      @port    = options[:port]
+      @hsts_header = build_hsts_header(normalize_hsts_options(hsts))
+      @ssl_default_redirect_status = ssl_default_redirect_status
     end
 
     def call(env)
-      request = Request.new(env)
+      request = Request.new env
 
       if request.ssl?
-        status, headers, body = @app.call(env)
-        headers.reverse_merge!(hsts_headers)
-        flag_cookies_as_secure!(headers)
-        [status, headers, body]
+        @app.call(env).tap do |status, headers, body|
+          set_hsts_header! headers
+          flag_cookies_as_secure! headers if @secure_cookies && !@exclude.call(request)
+        end
       else
-        redirect_to_https(request)
+        return redirect_to_https request unless @exclude.call(request)
+        @app.call(env)
       end
     end
 
     private
-      def redirect_to_https(request)
-        host = @host || request.host
-        port = @port || request.port
-
-        location = "https://#{host}"
-        location << ":#{port}" if port != 80
-        location << request.fullpath
-
-        headers = { 'Content-Type' => 'text/html', 'Location' => location }
-
-        [301, headers, []]
+      def set_hsts_header!(headers)
+        headers[Constants::STRICT_TRANSPORT_SECURITY] ||= @hsts_header
       end
 
-      # http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02
-      def hsts_headers
-        if @hsts
-          value = "max-age=#{@hsts[:expires].to_i}"
-          value += "; includeSubDomains" if @hsts[:subdomains]
-          { 'Strict-Transport-Security' => value }
+      def normalize_hsts_options(options)
+        case options
+        # Explicitly disabling HSTS clears the existing setting from browsers by setting
+        # expiry to 0.
+        when false
+          self.class.default_hsts_options.merge(expires: 0)
+        # Default to enabled, with default options.
+        when nil, true
+          self.class.default_hsts_options
         else
-          {}
+          self.class.default_hsts_options.merge(options)
         end
       end
 
+      # https://tools.ietf.org/html/rfc6797#section-6.1
+      def build_hsts_header(hsts)
+        value = +"max-age=#{hsts[:expires].to_i}"
+        value << "; includeSubDomains" if hsts[:subdomains]
+        value << "; preload" if hsts[:preload]
+        value
+      end
+
       def flag_cookies_as_secure!(headers)
-        if cookies = headers['Set-Cookie']
-          cookies = cookies.split("\n")
+        cookies = headers[Rack::SET_COOKIE]
+        return unless cookies
 
-          headers['Set-Cookie'] = cookies.map { |cookie|
-            if cookie !~ /;\s*secure\s*(;|$)/i
+        if Gem::Version.new(Rack::RELEASE) < Gem::Version.new("3")
+          cookies = cookies.split("\n")
+          headers[Rack::SET_COOKIE] = cookies.map { |cookie|
+            if !/;\s*secure\s*(;|$)/i.match?(cookie)
               "#{cookie}; secure"
             else
               cookie
             end
           }.join("\n")
+        else
+          headers[Rack::SET_COOKIE] = Array(cookies).map do |cookie|
+            if !/;\s*secure\s*(;|$)/i.match?(cookie)
+              "#{cookie}; secure"
+            else
+              cookie
+            end
+          end
         end
       end
+
+      def redirect_to_https(request)
+        [ @redirect.fetch(:status, redirection_status(request)),
+          { Rack::CONTENT_TYPE => "text/html; charset=utf-8",
+            Constants::LOCATION => https_location_for(request) },
+          (@redirect[:body] || []) ]
+      end
+
+      def redirection_status(request)
+        if PERMANENT_REDIRECT_REQUEST_METHODS.include?(request.raw_request_method)
+          301 # Issue a permanent redirect via a GET request.
+        elsif @ssl_default_redirect_status
+          @ssl_default_redirect_status
+        else
+          307 # Issue a fresh request redirect to preserve the HTTP method.
+        end
+      end
+
+      def https_location_for(request)
+        host = @redirect[:host] || request.host
+        port = @redirect[:port] || request.port
+
+        location = +"https://#{host}"
+        location << ":#{port}" if port != 80 && port != 443
+        location << request.fullpath
+        location
+      end
   end
 end

data/lib/action_dispatch/middleware/stack.rb

@@ -1,52 +1,71 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
 require "active_support/inflector/methods"
 require "active_support/dependencies"
 
 module ActionDispatch
+  # # Action Dispatch MiddlewareStack
+  #
+  # Read more about [Rails middleware
+  # stack](https://guides.rubyonrails.org/rails_on_rack.html#action-dispatcher-middleware-stack)
+  # in the guides.
   class MiddlewareStack
     class Middleware
-      attr_reader :args, :block, :name, :classcache
-
-      def initialize(klass_or_name, *args, &block)
-        @klass = nil
-
-        if klass_or_name.respond_to?(:name)
-          @klass = klass_or_name
-          @name  = @klass.name
-        else
-          @name  = klass_or_name.to_s
-        end
+      attr_reader :args, :block, :klass
 
-        @classcache = ActiveSupport::Dependencies::Reference
-        @args, @block = args, block
+      def initialize(klass, args, block)
+        @klass = klass
+        @args  = args
+        @block = block
       end
 
-      def klass
-        @klass || classcache[@name]
-      end
+      def name; klass.name; end
 
       def ==(middleware)
         case middleware
         when Middleware
           klass == middleware.klass
-        when Class
+        when Module
           klass == middleware
-        else
-          normalize(@name) == normalize(middleware)
         end
       end
 
       def inspect
-        klass.to_s
+        if klass.is_a?(Module)
+          klass.to_s
+        else
+          klass.class.to_s
+        end
       end
 
       def build(app)
         klass.new(app, *args, &block)
       end
 
-    private
+      def build_instrumented(app)
+        InstrumentationProxy.new(build(app), inspect)
+      end
+    end
+
+    # This class is used to instrument the execution of a single middleware. It
+    # proxies the `call` method transparently and instruments the method call.
+    class InstrumentationProxy
+      EVENT_NAME = "process_middleware.action_dispatch"
+
+      def initialize(middleware, class_name)
+        @middleware = middleware
 
-      def normalize(object)
-        object.to_s.strip.sub(/^::/, '')
+        @payload = {
+          middleware: class_name,
+        }
+      end
+
+      def call(env)
+        ActiveSupport::Notifications.instrument(EVENT_NAME, @payload) do
+          @middleware.call(env)
+        end
       end
     end
 
@@ -59,8 +78,8 @@ module ActionDispatch
       yield(self) if block_given?
     end
 
-    def each
-      @middlewares.each { |x| yield x }
+    def each(&block)
+      @middlewares.each(&block)
     end
 
     def size
@@ -75,20 +94,20 @@ module ActionDispatch
       middlewares[i]
     end
 
-    def unshift(*args, &block)
-      middleware = self.class::Middleware.new(*args, &block)
-      middlewares.unshift(middleware)
+    def unshift(klass, *args, &block)
+      middlewares.unshift(build_middleware(klass, args, block))
     end
+    ruby2_keywords(:unshift)
 
     def initialize_copy(other)
       self.middlewares = other.middlewares.dup
     end
 
-    def insert(index, *args, &block)
+    def insert(index, klass, *args, &block)
       index = assert_index(index, :before)
-      middleware = self.class::Middleware.new(*args, &block)
-      middlewares.insert(index, middleware)
+      middlewares.insert(index, build_middleware(klass, args, block))
     end
+    ruby2_keywords(:insert)
 
     alias_method :insert_before, :insert
 
@@ -96,34 +115,80 @@ module ActionDispatch
       index = assert_index(index, :after)
       insert(index + 1, *args, &block)
     end
+    ruby2_keywords(:insert_after)
 
     def swap(target, *args, &block)
       index = assert_index(target, :before)
       insert(index, *args, &block)
       middlewares.delete_at(index + 1)
     end
+    ruby2_keywords(:swap)
 
+    # Deletes a middleware from the middleware stack.
+    #
+    # Returns the array of middlewares not including the deleted item, or returns
+    # nil if the target is not found.
     def delete(target)
-      middlewares.delete target
+      middlewares.reject! { |m| m.name == target.name }
     end
 
-    def use(*args, &block)
-      middleware = self.class::Middleware.new(*args, &block)
-      middlewares.push(middleware)
+    # Deletes a middleware from the middleware stack.
+    #
+    # Returns the array of middlewares not including the deleted item, or raises
+    # `RuntimeError` if the target is not found.
+    def delete!(target)
+      delete(target) || (raise "No such middleware to remove: #{target.inspect}")
     end
 
-    def build(app = nil, &block)
-      app ||= block
-      raise "MiddlewareStack#build requires an app" unless app
-      middlewares.freeze.reverse.inject(app) { |a, e| e.build(a) }
+    def move(target, source)
+      source_index = assert_index(source, :before)
+      source_middleware = middlewares.delete_at(source_index)
+
+      target_index = assert_index(target, :before)
+      middlewares.insert(target_index, source_middleware)
     end
 
-  protected
+    alias_method :move_before, :move
+
+    def move_after(target, source)
+      source_index = assert_index(source, :after)
+      source_middleware = middlewares.delete_at(source_index)
 
-    def assert_index(index, where)
-      i = index.is_a?(Integer) ? index : middlewares.index(index)
-      raise "No such middleware to insert #{where}: #{index.inspect}" unless i
-      i
+      target_index = assert_index(target, :after)
+      middlewares.insert(target_index + 1, source_middleware)
+    end
+
+    def use(klass, *args, &block)
+      middlewares.push(build_middleware(klass, args, block))
+    end
+    ruby2_keywords(:use)
+
+    def build(app = nil, &block)
+      instrumenting = ActiveSupport::Notifications.notifier.listening?(InstrumentationProxy::EVENT_NAME)
+      middlewares.freeze.reverse.inject(app || block) do |a, e|
+        if instrumenting
+          e.build_instrumented(a)
+        else
+          e.build(a)
+        end
+      end
     end
+
+    private
+      def assert_index(index, where)
+        i = index.is_a?(Integer) ? index : index_of(index)
+        raise "No such middleware to insert #{where}: #{index.inspect}" unless i
+        i
+      end
+
+      def build_middleware(klass, args, block)
+        Middleware.new(klass, args, block)
+      end
+
+      def index_of(klass)
+        middlewares.index do |m|
+          m.name == klass.name
+        end
+      end
   end
 end