actionpack 5.2.0 → 6.1.4

data/lib/action_dispatch/middleware/debug_view.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "pp"
+
+require "action_view"
+require "action_view/base"
+
+module ActionDispatch
+  class DebugView < ActionView::Base # :nodoc:
+    RESCUES_TEMPLATE_PATH = File.expand_path("templates", __dir__)
+
+    def initialize(assigns)
+      paths = [RESCUES_TEMPLATE_PATH]
+      lookup_context = ActionView::LookupContext.new(paths)
+      super(lookup_context, assigns, nil)
+    end
+
+    def compiled_method_container
+      self.class
+    end
+
+    def debug_params(params)
+      clean_params = params.clone
+      clean_params.delete("action")
+      clean_params.delete("controller")
+
+      if clean_params.empty?
+        "None"
+      else
+        PP.pp(clean_params, +"", 200)
+      end
+    end
+
+    def debug_headers(headers)
+      if headers.present?
+        headers.inspect.gsub(",", ",\n")
+      else
+        "None"
+      end
+    end
+
+    def debug_hash(object)
+      object.to_hash.sort_by { |k, _| k.to_s }.map { |k, v| "#{k}: #{v.inspect rescue $!.message}" }.join("\n")
+    end
+
+    def render(*)
+      logger = ActionView::Base.logger
+
+      if logger && logger.respond_to?(:silence)
+        logger.silence { super }
+      else
+        super
+      end
+    end
+
+    def protect_against_forgery?
+      false
+    end
+
+    def params_valid?
+      @request.parameters
+    rescue ActionController::BadRequest
+      false
+    end
+  end
+end

data/lib/action_dispatch/middleware/exception_wrapper.rb

@@ -6,44 +6,72 @@ require "rack/utils"
 module ActionDispatch
   class ExceptionWrapper
     cattr_accessor :rescue_responses, default: Hash.new(:internal_server_error).merge!(
-      "ActionController::RoutingError"               => :not_found,
-      "AbstractController::ActionNotFound"           => :not_found,
-      "ActionController::MethodNotAllowed"           => :method_not_allowed,
-      "ActionController::UnknownHttpMethod"          => :method_not_allowed,
-      "ActionController::NotImplemented"             => :not_implemented,
-      "ActionController::UnknownFormat"              => :not_acceptable,
-      "ActionController::InvalidAuthenticityToken"   => :unprocessable_entity,
-      "ActionController::InvalidCrossOriginRequest"  => :unprocessable_entity,
-      "ActionDispatch::Http::Parameters::ParseError" => :bad_request,
-      "ActionController::BadRequest"                 => :bad_request,
-      "ActionController::ParameterMissing"           => :bad_request,
-      "Rack::QueryParser::ParameterTypeError"        => :bad_request,
-      "Rack::QueryParser::InvalidParameterError"     => :bad_request
+      "ActionController::RoutingError"                     => :not_found,
+      "AbstractController::ActionNotFound"                 => :not_found,
+      "ActionController::MethodNotAllowed"                 => :method_not_allowed,
+      "ActionController::UnknownHttpMethod"                => :method_not_allowed,
+      "ActionController::NotImplemented"                   => :not_implemented,
+      "ActionController::UnknownFormat"                    => :not_acceptable,
+      "ActionDispatch::Http::MimeNegotiation::InvalidType" => :not_acceptable,
+      "ActionController::MissingExactTemplate"             => :not_acceptable,
+      "ActionController::InvalidAuthenticityToken"         => :unprocessable_entity,
+      "ActionController::InvalidCrossOriginRequest"        => :unprocessable_entity,
+      "ActionDispatch::Http::Parameters::ParseError"       => :bad_request,
+      "ActionController::BadRequest"                       => :bad_request,
+      "ActionController::ParameterMissing"                 => :bad_request,
+      "Rack::QueryParser::ParameterTypeError"              => :bad_request,
+      "Rack::QueryParser::InvalidParameterError"           => :bad_request
     )
 
     cattr_accessor :rescue_templates, default: Hash.new("diagnostics").merge!(
-      "ActionView::MissingTemplate"         => "missing_template",
-      "ActionController::RoutingError"      => "routing_error",
-      "AbstractController::ActionNotFound"  => "unknown_action",
-      "ActiveRecord::StatementInvalid"      => "invalid_statement",
-      "ActionView::Template::Error"         => "template_error"
+      "ActionView::MissingTemplate"            => "missing_template",
+      "ActionController::RoutingError"         => "routing_error",
+      "AbstractController::ActionNotFound"     => "unknown_action",
+      "ActiveRecord::StatementInvalid"         => "invalid_statement",
+      "ActionView::Template::Error"            => "template_error",
+      "ActionController::MissingExactTemplate" => "missing_exact_template",
     )
 
-    attr_reader :backtrace_cleaner, :exception, :line_number, :file
+    cattr_accessor :wrapper_exceptions, default: [
+      "ActionView::Template::Error"
+    ]
+
+    cattr_accessor :silent_exceptions, default: [
+      "ActionController::RoutingError",
+      "ActionDispatch::Http::MimeNegotiation::InvalidType"
+    ]
+
+    attr_reader :backtrace_cleaner, :exception, :wrapped_causes, :line_number, :file
 
     def initialize(backtrace_cleaner, exception)
       @backtrace_cleaner = backtrace_cleaner
-      @exception = original_exception(exception)
+      @exception = exception
+      @exception_class_name = @exception.class.name
+      @wrapped_causes = wrapped_causes_for(exception, backtrace_cleaner)
 
       expand_backtrace if exception.is_a?(SyntaxError) || exception.cause.is_a?(SyntaxError)
     end
 
+    def unwrapped_exception
+      if wrapper_exceptions.include?(@exception_class_name)
+        exception.cause
+      else
+        exception
+      end
+    end
+
     def rescue_template
-      @@rescue_templates[@exception.class.name]
+      @@rescue_templates[@exception_class_name]
     end
 
     def status_code
-      self.class.status_code_for_exception(@exception.class.name)
+      self.class.status_code_for_exception(unwrapped_exception.class.name)
+    end
+
+    def exception_trace
+      trace = application_trace
+      trace = framework_trace if trace.empty? && !silent_exceptions.include?(@exception_class_name)
+      trace
     end
 
     def application_trace
@@ -64,7 +92,11 @@ module ActionDispatch
       full_trace_with_ids = []
 
       full_trace.each_with_index do |trace, idx|
-        trace_with_id = { id: idx, trace: trace }
+        trace_with_id = {
+          exception_object_id: @exception.object_id,
+          id: idx,
+          trace: trace
+        }
 
         if application_trace.include?(trace)
           application_trace_with_ids << trace_with_id
@@ -97,18 +129,31 @@ module ActionDispatch
       end
     end
 
-    private
+    def trace_to_show
+      if traces["Application Trace"].empty? && rescue_template != "routing_error"
+        "Full Trace"
+      else
+        "Application Trace"
+      end
+    end
+
+    def source_to_show_id
+      (traces[trace_to_show].first || {})[:id]
+    end
 
+    private
       def backtrace
         Array(@exception.backtrace)
       end
 
-      def original_exception(exception)
-        if @@rescue_responses.has_key?(exception.cause.class.name)
-          exception.cause
-        else
-          exception
-        end
+      def causes_for(exception)
+        return enum_for(__method__, exception) unless block_given?
+
+        yield exception while exception = exception.cause
+      end
+
+      def wrapped_causes_for(exception, backtrace_cleaner)
+        causes_for(exception).map { |cause| self.class.new(backtrace_cleaner, cause) }
       end
 
       def clean_backtrace(*args)

data/lib/action_dispatch/middleware/flash.rb

@@ -38,7 +38,7 @@ module ActionDispatch
   #
   # See docs on the FlashHash class for more details about the flash.
   class Flash
-    KEY = "action_dispatch.request.flash_hash".freeze
+    KEY = "action_dispatch.request.flash_hash"
 
     module RequestMethods
       # Access the contents of the flash. Use <tt>flash["notice"]</tt> to
@@ -73,7 +73,7 @@ module ActionDispatch
         end
       end
 
-      def reset_session # :nodoc
+      def reset_session # :nodoc:
         super
         self.flash = nil
       end

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "action_dispatch/http/request"
+
+module ActionDispatch
+  # This middleware guards from DNS rebinding attacks by explicitly permitting
+  # the hosts a request can be sent to, and is passed the options set in
+  # +config.host_authorization+.
+  #
+  # Requests can opt-out of Host Authorization with +exclude+:
+  #
+  #    config.host_authorization = { exclude: ->(request) { request.path =~ /healthcheck/ } }
+  #
+  # When a request comes to an unauthorized host, the +response_app+
+  # application will be executed and rendered. If no +response_app+ is given, a
+  # default one will run, which responds with <tt>403 Forbidden</tt>.
+  class HostAuthorization
+    class Permissions # :nodoc:
+      def initialize(hosts)
+        @hosts = sanitize_hosts(hosts)
+      end
+
+      def empty?
+        @hosts.empty?
+      end
+
+      def allows?(host)
+        @hosts.any? do |allowed|
+          allowed === host
+        rescue
+          # IPAddr#=== raises an error if you give it a hostname instead of
+          # IP. Treat similar errors as blocked access.
+          false
+        end
+      end
+
+      private
+        def sanitize_hosts(hosts)
+          Array(hosts).map do |host|
+            case host
+            when Regexp then sanitize_regexp(host)
+            when String then sanitize_string(host)
+            else host
+            end
+          end
+        end
+
+        def sanitize_regexp(host)
+          /\A#{host}\z/
+        end
+
+        def sanitize_string(host)
+          if host.start_with?(".")
+            /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
+          else
+            /\A#{Regexp.escape host}\z/i
+          end
+        end
+    end
+
+    DEFAULT_RESPONSE_APP = -> env do
+      request = Request.new(env)
+
+      format = request.xhr? ? "text/plain" : "text/html"
+      template = DebugView.new(host: request.host)
+      body = template.render(template: "rescues/blocked_host", layout: "rescues/layout")
+
+      [403, {
+        "Content-Type" => "#{format}; charset=#{Response.default_charset}",
+        "Content-Length" => body.bytesize.to_s,
+      }, [body]]
+    end
+
+    def initialize(app, hosts, deprecated_response_app = nil, exclude: nil, response_app: nil)
+      @app = app
+      @permissions = Permissions.new(hosts)
+      @exclude = exclude
+
+      unless deprecated_response_app.nil?
+        ActiveSupport::Deprecation.warn(<<-MSG.squish)
+          `action_dispatch.hosts_response_app` is deprecated and will be ignored in Rails 6.2.
+          Use the Host Authorization `response_app` setting instead.
+        MSG
+
+        response_app ||= deprecated_response_app
+      end
+
+      @response_app = response_app || DEFAULT_RESPONSE_APP
+    end
+
+    def call(env)
+      return @app.call(env) if @permissions.empty?
+
+      request = Request.new(env)
+
+      if authorized?(request) || excluded?(request)
+        mark_as_authorized(request)
+        @app.call(env)
+      else
+        @response_app.call(env)
+      end
+    end
+
+    private
+      def authorized?(request)
+        valid_host = /
+          \A
+          (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\])
+          (:\d+)?
+          \z
+        /x
+
+        origin_host = valid_host.match(
+          request.get_header("HTTP_HOST").to_s.downcase)
+        forwarded_host = valid_host.match(
+          request.x_forwarded_host.to_s.split(/,\s?/).last)
+
+        origin_host && @permissions.allows?(origin_host[:host]) && (
+          forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
+      end
+
+      def excluded?(request)
+        @exclude && @exclude.call(request)
+      end
+
+      def mark_as_authorized(request)
+        request.set_header("action_dispatch.authorized_host", request.host)
+      end
+  end
+end

data/lib/action_dispatch/middleware/public_exceptions.rb

@@ -21,14 +21,17 @@ module ActionDispatch
     def call(env)
       request      = ActionDispatch::Request.new(env)
       status       = request.path_info[1..-1].to_i
-      content_type = request.formats.first
-      body         = { status: status, error: Rack::Utils::HTTP_STATUS_CODES.fetch(status, Rack::Utils::HTTP_STATUS_CODES[500]) }
+      begin
+        content_type = request.formats.first
+      rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+        content_type = Mime[:text]
+      end
+      body = { status: status, error: Rack::Utils::HTTP_STATUS_CODES.fetch(status, Rack::Utils::HTTP_STATUS_CODES[500]) }
 
       render(status, content_type, body)
     end
 
     private
-
       def render(status, content_type, body)
         format = "to_#{content_type.to_sym}" if content_type
         if format && body.respond_to?(format)

data/lib/action_dispatch/middleware/remote_ip.rb

@@ -8,13 +8,13 @@ module ActionDispatch
   # contain the address, and then picking the last-set address that is not
   # on the list of trusted IPs. This follows the precedent set by e.g.
   # {the Tomcat server}[https://issues.apache.org/bugzilla/show_bug.cgi?id=50453],
-  # with {reasoning explained at length}[http://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection]
+  # with {reasoning explained at length}[https://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection]
   # by @gingerlime. A more detailed explanation of the algorithm is given
   # at GetIp#calculate_ip.
   #
   # Some Rack servers concatenate repeated headers, like {HTTP RFC 2616}[https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2]
   # requires. Some Rack servers simply drop preceding headers, and only report
-  # the value that was {given in the last header}[http://andre.arko.net/2011/12/26/repeated-headers-and-ruby-web-servers].
+  # the value that was {given in the last header}[https://andre.arko.net/2011/12/26/repeated-headers-and-ruby-web-servers].
   # If you are behind multiple proxy servers (like NGINX to HAProxy to Unicorn)
   # then you should test your Rack server to make sure your data is good.
   #
@@ -33,7 +33,7 @@ module ActionDispatch
     # not be the ultimate client IP in production, and so are discarded. See
     # https://en.wikipedia.org/wiki/Private_network for details.
     TRUSTED_PROXIES = [
-      "127.0.0.1",      # localhost IPv4
+      "127.0.0.0/8",    # localhost IPv4 range, per RFC-3330
       "::1",            # localhost IPv6
       "fc00::/7",       # private IPv6 range fc00::/7
       "10.0.0.0/8",     # private IPv4 range 10.x.x.x
@@ -102,7 +102,7 @@ module ActionDispatch
       # proxies, that header may contain a list of IPs. Other proxy services
       # set the Client-Ip header instead, so we check that too.
       #
-      # As discussed in {this post about Rails IP Spoofing}[http://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/],
+      # As discussed in {this post about Rails IP Spoofing}[https://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/],
       # while the first IP in the list is likely to be the "originating" IP,
       # it could also have been set by the client maliciously.
       #
@@ -143,10 +143,11 @@ module ActionDispatch
         #   - X-Forwarded-For will be a list of IPs, one per proxy, or blank
         #   - Client-Ip is propagated from the outermost proxy, or is blank
         #   - REMOTE_ADDR will be the IP that made the request to Rack
-        ips = [forwarded_ips, client_ips, remote_addr].flatten.compact
+        ips = [forwarded_ips, client_ips].flatten.compact
 
-        # If every single IP option is in the trusted list, just return REMOTE_ADDR
-        filter_proxies(ips).first || remote_addr
+        # If every single IP option is in the trusted list, return the IP
+        # that's furthest away
+        filter_proxies(ips + [remote_addr]).first || ips.last || remote_addr
       end
 
       # Memoizes the value returned by #calculate_ip and returns it for
@@ -156,20 +157,17 @@ module ActionDispatch
       end
 
     private
-
       def ips_from(header) # :doc:
         return [] unless header
         # Split the comma-separated list into an array of strings.
         ips = header.strip.split(/[,\s]+/)
         ips.select do |ip|
-          begin
-            # Only return IPs that are valid according to the IPAddr#new method.
-            range = IPAddr.new(ip).to_range
-            # We want to make sure nobody is sneaking a netmask in.
-            range.begin == range.end
-          rescue ArgumentError
-            nil
-          end
+          # Only return IPs that are valid according to the IPAddr#new method.
+          range = IPAddr.new(ip).to_range
+          # We want to make sure nobody is sneaking a netmask in.
+          range.begin == range.end
+        rescue ArgumentError
+          nil
         end
       end
 

data/lib/action_dispatch/middleware/request_id.rb

@@ -15,22 +15,21 @@ module ActionDispatch
   # The unique request id can be used to trace a request end-to-end and would typically end up being part of log files
   # from multiple pieces of the stack.
   class RequestId
-    X_REQUEST_ID = "X-Request-Id".freeze #:nodoc:
-
-    def initialize(app)
+    def initialize(app, header:)
       @app = app
+      @header = header
     end
 
     def call(env)
       req = ActionDispatch::Request.new env
-      req.request_id = make_request_id(req.x_request_id)
-      @app.call(env).tap { |_status, headers, _body| headers[X_REQUEST_ID] = req.request_id }
+      req.request_id = make_request_id(req.headers[@header])
+      @app.call(env).tap { |_status, headers, _body| headers[@header] = req.request_id }
     end
 
     private
       def make_request_id(request_id)
         if request_id.presence
-          request_id.gsub(/[^\w\-@]/, "".freeze).first(255)
+          request_id.gsub(/[^\w\-@]/, "").first(255)
         else
           internal_request_id
         end

data/lib/action_dispatch/middleware/session/abstract_store.rb

@@ -30,7 +30,6 @@ module ActionDispatch
       end
 
     private
-
       def initialize_sid # :doc:
         @default_options.delete(:sidbits)
         @default_options.delete(:secure_random)
@@ -83,8 +82,22 @@ module ActionDispatch
       include SessionObject
 
       private
+        def set_cookie(request, response, cookie)
+          request.cookie_jar[key] = cookie
+        end
+    end
+
+    class AbstractSecureStore < Rack::Session::Abstract::PersistedSecure
+      include Compatibility
+      include StaleSessionCheck
+      include SessionObject
+
+      def generate_sid
+        Rack::Session::SessionId.new(super)
+      end
 
-        def set_cookie(request, session_id, cookie)
+      private
+        def set_cookie(request, response, cookie)
           request.cookie_jar[key] = cookie
         end
     end

data/lib/action_dispatch/middleware/session/cache_store.rb

@@ -12,7 +12,7 @@ module ActionDispatch
     # * <tt>cache</tt>         - The cache to use. If it is not specified, <tt>Rails.cache</tt> will be used.
     # * <tt>expire_after</tt>  - The length of time a session will be stored before automatically expiring.
     #   By default, the <tt>:expires_in</tt> option of the cache is used.
-    class CacheStore < AbstractStore
+    class CacheStore < AbstractSecureStore
       def initialize(app, options = {})
         @cache = options[:cache] || Rails.cache
         options[:expire_after] ||= @cache.options[:expires_in]
@@ -21,7 +21,7 @@ module ActionDispatch
 
       # Get a session from the cache.
       def find_session(env, sid)
-        unless sid && (session = @cache.read(cache_key(sid)))
+        unless sid && (session = get_session_with_fallback(sid))
           sid, session = generate_sid, {}
         end
         [sid, session]
@@ -29,7 +29,7 @@ module ActionDispatch
 
       # Set a session in the cache.
       def write_session(env, sid, session, options)
-        key = cache_key(sid)
+        key = cache_key(sid.private_id)
         if session
           @cache.write(key, session, expires_in: options[:expire_after])
         else
@@ -40,14 +40,19 @@ module ActionDispatch
 
       # Remove a session from the cache.
       def delete_session(env, sid, options)
-        @cache.delete(cache_key(sid))
+        @cache.delete(cache_key(sid.private_id))
+        @cache.delete(cache_key(sid.public_id))
         generate_sid
       end
 
       private
         # Turn the session id into a cache key.
-        def cache_key(sid)
-          "_session_id:#{sid}"
+        def cache_key(id)
+          "_session_id:#{id}"
+        end
+
+        def get_session_with_fallback(sid)
+          @cache.read(cache_key(sid.private_id)) || @cache.read(cache_key(sid.public_id))
         end
     end
   end

data/lib/action_dispatch/middleware/session/cookie_store.rb

@@ -10,28 +10,24 @@ module ActionDispatch
     # dramatically faster than the alternatives.
     #
     # Sessions typically contain at most a user_id and flash message; both fit
-    # within the 4K cookie size limit. A CookieOverflow exception is raised if
-    # you attempt to store more than 4K of data.
+    # within the 4096 bytes cookie size limit. A CookieOverflow exception is raised if
+    # you attempt to store more than 4096 bytes of data.
     #
     # The cookie jar used for storage is automatically configured to be the
     # best possible option given your application's configuration.
     #
-    # If you only have secret_token set, your cookies will be signed, but
-    # not encrypted. This means a user cannot alter their +user_id+ without
-    # knowing your app's secret key, but can easily read their +user_id+. This
-    # was the default for Rails 3 apps.
-    #
     # Your cookies will be encrypted using your apps secret_key_base. This
     # goes a step further than signed cookies in that encrypted cookies cannot
     # be altered or read by users. This is the default starting in Rails 4.
     #
-    # Configure your session store in <tt>config/initializers/session_store.rb</tt>:
+    # Configure your session store in an initializer:
     #
     #   Rails.application.config.session_store :cookie_store, key: '_your_app_session'
     #
-    # By default, your secret key base is derived from your application name in
-    # the test and development environments. In all other environments, it is stored
-    # encrypted in the <tt>config/credentials.yml.enc</tt> file.
+    # In the development and test environments your application's secret key base is
+    # generated by Rails and stored in a temporary file in <tt>tmp/development_secret.txt</tt>.
+    # In all other environments, it is stored encrypted in the
+    # <tt>config/credentials.yml.enc</tt> file.
     #
     # If your application was not updated to Rails 5.2 defaults, the secret_key_base
     # will be found in the old <tt>config/secrets.yml</tt> file.
@@ -50,7 +46,16 @@ module ActionDispatch
     # would set the session cookie to expire automatically 14 days after creation.
     # Other useful options include <tt>:key</tt>, <tt>:secure</tt> and
     # <tt>:httponly</tt>.
-    class CookieStore < AbstractStore
+    class CookieStore < AbstractSecureStore
+      class SessionId < DelegateClass(Rack::Session::SessionId)
+        attr_reader :cookie_value
+
+        def initialize(session_id, cookie_value = {})
+          super(session_id)
+          @cookie_value = cookie_value
+        end
+      end
+
       def initialize(app, options = {})
         super(app, options.merge!(cookie_only: true))
       end
@@ -58,7 +63,7 @@ module ActionDispatch
       def delete_session(req, session_id, options)
         new_sid = generate_sid unless options[:drop]
         # Reset hash and Assign the new session id
-        req.set_header("action_dispatch.request.unsigned_session_cookie", new_sid ? { "session_id" => new_sid } : {})
+        req.set_header("action_dispatch.request.unsigned_session_cookie", new_sid ? { "session_id" => new_sid.public_id } : {})
         new_sid
       end
 
@@ -66,15 +71,15 @@ module ActionDispatch
         stale_session_check! do
           data = unpacked_cookie_data(req)
           data = persistent_session_id!(data)
-          [data["session_id"], data]
+          [Rack::Session::SessionId.new(data["session_id"]), data]
         end
       end
 
       private
-
         def extract_session_id(req)
           stale_session_check! do
-            unpacked_cookie_data(req)["session_id"]
+            sid = unpacked_cookie_data(req)["session_id"]
+            sid && Rack::Session::SessionId.new(sid)
           end
         end
 
@@ -92,13 +97,13 @@ module ActionDispatch
 
         def persistent_session_id!(data, sid = nil)
           data ||= {}
-          data["session_id"] ||= sid || generate_sid
+          data["session_id"] ||= sid || generate_sid.public_id
           data
         end
 
         def write_session(req, sid, session_data, options)
-          session_data["session_id"] = sid
-          session_data
+          session_data["session_id"] = sid.public_id
+          SessionId.new(sid, session_data)
         end
 
         def set_cookie(request, session_id, cookie)