actionpack 5.2.3 → 6.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdbc11b76565d6d325a51b67c7a598b0a70c33e3e26c849dc57733e3fa7c0833
-  data.tar.gz: 3afcd1526eb36e16fd199bb242fb232ddc3c01125e0d1306c94d31b315e93039
+  metadata.gz: bc5f83963aacf31948bfa962abe255253d903e1722dd900926747d02dc6f5803
+  data.tar.gz: 0cdd481cd358a6a2445f12827cff82dfe0da5b01e0bc109209b016727f4e7107
 SHA512:
-  metadata.gz: 3122260924160e941c750fba0e3a671b2b2f40723c9c6766fae0f3987ac9521332d3a4128959fa61b993d72bd0539b7925ebb785b50d9b9811514897a2d5bf9e
-  data.tar.gz: 4be02fcd7f87d2b725ba823274bc2c40eb367a2a26d7b1b53da8e4df699eae389fec796ff5164c7cb721426fa6cdf8f8b5ae5b6d74a712e5631e5e1ded283717
+  metadata.gz: c30b9a96b7d80a6b4af7f68bdda026dc2b98eea17e1c55da9c40f61c0155b1bcf32418e275de6729115c003a1fecf2f442214002ddaacca508ad363d0c8afad5
+  data.tar.gz: b0dc7fb5e501e1f4d04fa0f1ec87ea5411c6e5cb067e35f5eec2d40467b4a84381b81d27d383ff416914131613042ce89efdd2854a14325dd3717aec1750da39

data/CHANGELOG.md

@@ -1,429 +1,328 @@
-## Rails 5.2.3 (March 27, 2019) ##
+## Rails 6.0.1 (November 5, 2019) ##
 
-*   Allow using combine the Cache Control `public` and `no-cache` headers.
+*   `ActionDispatch::SystemTestCase` now inherits from `ActiveSupport::TestCase`
+    rather than `ActionDispatch::IntegrationTest`. This permits running jobs in
+    system tests.
 
-    Before this change, even if `public` was specified for Cache Control header,
-    it was excluded when `no-cache` was included. This fixed to keep `public`
-    header as is.
+    *George Claghorn*, *Edouard Chin*
 
-    Fixes #34780.
+*   Registered MIME types may contain extra flags:
 
-    *Yuji Yaginuma*
-
-*   Allow `nil` params for `ActionController::TestCase`.
+    ```ruby
+    Mime::Type.register "text/html; fragment", :html_fragment
+    ```
 
-    *Ryo Nakamura*
+    *Aaron Patterson*
 
 
-## Rails 5.2.2.1 (March 11, 2019) ##
+## Rails 6.0.0 (August 16, 2019) ##
 
 *   No changes.
 
 
-## Rails 5.2.2 (December 04, 2018) ##
-
-*   Reset Capybara sessions if failed system test screenshot raising an exception.
+## Rails 6.0.0.rc2 (July 22, 2019) ##
 
-    Reset Capybara sessions if `take_failed_screenshot` raise exception
-    in system test `after_teardown`.
+*   Add the ability to set the CSP nonce only to the specified directives.
 
-    *Maxim Perepelitsa*
+    Fixes #35137.
 
-*   Use request object for context if there's no controller
-
-    There is no controller instance when using a redirect route or a
-    mounted rack application so pass the request object as the context
-    when resolving dynamic CSP sources in this scenario.
-
-    Fixes #34200.
-
-    *Andrew White*
-
-*   Apply mapping to symbols returned from dynamic CSP sources
+    *Yuji Yaginuma*
 
-    Previously if a dynamic source returned a symbol such as :self it
-    would be converted to a string implicity, e.g:
+*   Keep part when scope option has value.
 
-        policy.default_src -> { :self }
+    When a route was defined within an optional scope, if that route didn't
+    take parameters the scope was lost when using path helpers. This commit
+    ensures scope is kept both when the route takes parameters or when it
+    doesn't.
 
-    would generate the header:
+    Fixes #33219
 
-        Content-Security-Policy: default-src self
+    *Alberto Almagro*
 
-    and now it generates:
+*   Change `ActionDispatch::Response#content_type` to return Content-Type header as it is.
 
-        Content-Security-Policy: default-src 'self'
+    Previously, `ActionDispatch::Response#content_type` returned value does NOT
+    contain charset part. This behavior changed to returned Content-Type header
+    containing charset part as it is.
 
-    *Andrew White*
+    If you want just MIME type, please use `ActionDispatch::Response#media_type`
+    instead.
 
-*   Fix `rails routes -c` for controller name consists of multiple word.
+    Enable `action_dispatch.return_only_media_type_on_content_type` to use this change.
+    If not enabled, `ActionDispatch::Response#content_type` returns the same
+    value as before version, but its behavior is deprecate.
 
-    *Yoshiyuki Kinjo*
+    *Yuji Yaginuma*
 
-*   Call the `#redirect_to` block in controller context.
+*   Calling `ActionController::Parameters#transform_keys/!` without a block now returns
+    an enumerator for the parameters instead of the underlying hash.
 
-    *Steven Peckins*
+    *Eugene Kenny*
 
+*   Fix a bug where DebugExceptions throws an error when malformed query parameters are provided
 
-## Rails 5.2.1.1 (November 27, 2018) ##
+    *Yuki Nishijima*, *Stan Lo*
 
-*   No changes.
 
+## Rails 6.0.0.rc1 (April 24, 2019) ##
 
-## Rails 5.2.1 (August 07, 2018) ##
+*   Make system tests take a failed screenshot in a `before_teardown` hook
+    rather than an `after_teardown` hook.
 
-*   Prevent `?null=` being passed on JSON encoded test requests.
+    This helps minimize the time gap between when an assertion fails and when
+    the screenshot is taken (reducing the time in which the page could have
+    been dynamically updated after the assertion failed).
 
-    `RequestEncoder#encode_params` won't attempt to parse params if
-    there are none.
+    *Richard Macklin*
 
-    So call like this will no longer append a `?null=` query param.
+*   Introduce `ActionDispatch::ActionableExceptions`.
 
-        get foos_url, as: :json
+    The `ActionDispatch::ActionableExceptions` middleware dispatches actions
+    from `ActiveSupport::ActionableError` descendants.
 
-    *Alireza Bashiri*
+    Actionable errors let's you dispatch actions from Rails' error pages.
 
-*   Ensure `ActionController::Parameters#transform_values` and
-    `ActionController::Parameters#transform_values!` converts hashes into
-    parameters.
+    *Vipul A M*, *Yao Jie*, *Genadi Samokovarov*
 
-    *Kevin Sjöberg*
+*   Raise an `ArgumentError` if a resource custom param contains a colon (`:`).
 
-*   Fix strong parameters `permit!` with nested arrays.
+    After this change it's not possible anymore to configure routes like this:
 
-    Given:
     ```
-    params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
-    params.permit!
+    routes.draw do
+      resources :users, param: 'name/:sneaky'
+    end
     ```
 
-    `params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
-
-    *Steve Hull*
-
-*   Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
-    `ActionController::TestCase` subclasses.
-
-    *Eugene Kenny*
-
-*   Output only one Content-Security-Policy nonce header value per request.
-
-    Fixes #32597.
-
-    *Andrey Novikov*, *Andrew White*
-
-*   Only disable GPUs for headless Chrome on Windows.
-
-    It is not necessary anymore for Linux and macOS machines.
+    Fixes #30467.
 
-    https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
+    *Josua Schmid*
 
-    *Stefan Wrobel*
 
-*   Fix system tests transactions not closed between examples.
+## Rails 6.0.0.beta3 (March 11, 2019) ##
 
-    *Sergey Tarasov*
-
-
-## Rails 5.2.0 (April 09, 2018) ##
-
-*   Check exclude before flagging cookies as secure.
-
-    *Catherine Khuu*
-
-*   Always yield a CSP policy instance from `content_security_policy`
-
-    This allows a controller action to enable the policy individually
-    for a controller and/or specific actions.
+*   No changes.
 
-    *Andrew White*
 
-*   Add the ability to disable the global CSP in a controller, e.g:
+## Rails 6.0.0.beta2 (February 25, 2019) ##
 
-        class LegacyPagesController < ApplicationController
-          content_security_policy false, only: :index
-        end
+*   Make debug exceptions works in an environment where ActiveStorage is not loaded.
 
-    *Andrew White*
+    *Tomoyuki Kurosawa*
 
-*   Add alias method `to_hash` to `to_h` for `cookies`.
-    Add alias method `to_h` to `to_hash` for `session`.
+*   `ActionDispatch::SystemTestCase.driven_by` can now be called with a block
+    to define specific browser capabilities.
 
-    *Igor Kasyanchuk*
+    *Edouard Chin*
 
-*   Update the default HSTS max-age value to 31536000 seconds (1 year)
-    to meet the minimum max-age requirement for https://hstspreload.org/.
 
-    *Grant Bourque*
+## Rails 6.0.0.beta1 (January 18, 2019) ##
 
-*   Add support for automatic nonce generation for Rails UJS.
+*   Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
 
-    Because the UJS library creates a script tag to process responses it
-    normally requires the script-src attribute of the content security
-    policy to include 'unsafe-inline'.
+    *Rafael Mendonça França*
 
-    To work around this we generate a per-request nonce value that is
-    embedded in a meta tag in a similar fashion to how CSRF protection
-    embeds its token in a meta tag. The UJS library can then read the
-    nonce value and set it on the dynamically generated script tag to
-    enable it to execute without needing 'unsafe-inline' enabled.
+*   Remove deprecated methods in `ActionDispatch::TestResponse`.
 
-    Nonce generation isn't 100% safe - if your script tag is including
-    user generated content in someway then it may be possible to exploit
-    an XSS vulnerability which can take advantage of the nonce. It is
-    however an improvement on a blanket permission for inline scripts.
+    `#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
+    `#successful?`, `not_found?` and `server_error?`.
 
-    It is also possible to use the nonce within your own script tags by
-    using `nonce: true` to set the nonce value on the tag, e.g
+    *Rafael Mendonça França*
 
-        <%= javascript_tag nonce: true do %>
-          alert('Hello, World!');
-        <% end %>
+*   Introduce `ActionDispatch::HostAuthorization`.
 
-    Fixes #31689.
+    This is a new middleware that guards against DNS rebinding attacks by
+    explicitly permitting the hosts a request can be made to.
 
-    *Andrew White*
+    Each host is checked with the case operator (`#===`) to support `Regexp`,
+    `Proc`, `IPAddr` and custom objects as host allowances.
 
-*   Matches behavior of `Hash#each` in `ActionController::Parameters#each`.
+    *Genadi Samokovarov*
 
-    *Dominic Cleal*
+*   Allow using `parsed_body` in `ActionController::TestCase`.
 
-*   Add `Referrer-Policy` header to default headers set.
+    In addition to `ActionDispatch::IntegrationTest`, allow using
+    `parsed_body` in `ActionController::TestCase`:
 
-    *Guillermo Iguaran*
+    ```
+    class SomeControllerTest < ActionController::TestCase
+      def test_some_action
+        post :action, body: { foo: 'bar' }
+        assert_equal({ "foo" => "bar" }, response.parsed_body)
+      end
+    end
+    ```
 
-*   Changed the system tests to set Puma as default server only when the
-    user haven't specified manually another server.
+    Fixes #34676.
 
-    *Guillermo Iguaran*
+    *Tobias Bühlmann*
 
-*   Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
-    default headers set.
+*   Raise an error on root route naming conflicts.
 
-    *Guillermo Iguaran*
+    Raises an `ArgumentError` when multiple root routes are defined in the
+    same context instead of assigning nil names to subsequent roots.
 
-*   Add headless firefox support to System Tests.
+    *Gannon McGibbon*
 
-    *bogdanvlviv*
+*   Allow rescue from parameter parse errors:
 
-*   Changed the default system test screenshot output from `inline` to `simple`.
+    ```
+    rescue_from ActionDispatch::Http::Parameters::ParseError do
+      head :unauthorized
+    end
+    ```
 
-    `inline` works well for iTerm2 but not everyone uses iTerm2. Some terminals like
-    Terminal.app ignore the `inline` and output the path to the file since it can't
-    render the image. Other terminals, like those on Ubuntu, cannot handle the image
-    inline, but also don't handle it gracefully and instead of outputting the file
-    path, it dumps binary into the terminal.
+    *Gannon McGibbon*, *Josh Cheek*
 
-    Commit 9d6e28 fixes this by changing the default for screenshot to be `simple`.
+*   Reset Capybara sessions if failed system test screenshot raising an exception.
 
-    *Eileen M. Uchitelle*
+    Reset Capybara sessions if `take_failed_screenshot` raise exception
+    in system test `after_teardown`.
 
-*   Register most popular audio/video/font mime types supported by modern browsers.
+    *Maxim Perepelitsa*
 
-    *Guillermo Iguaran*
+*   Use request object for context if there's no controller
 
-*   Fix optimized url helpers when using relative url root.
+    There is no controller instance when using a redirect route or a
+    mounted rack application so pass the request object as the context
+    when resolving dynamic CSP sources in this scenario.
 
-    Fixes #31220.
+    Fixes #34200.
 
     *Andrew White*
 
-*   Add DSL for configuring Content-Security-Policy header.
-
-    The DSL allows you to configure a global Content-Security-Policy
-    header and then override within a controller. For more information
-    about the Content-Security-Policy header see MDN:
-
-    https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-
-    Example global policy:
-
-        # config/initializers/content_security_policy.rb
-        Rails.application.config.content_security_policy do |p|
-          p.default_src :self, :https
-          p.font_src    :self, :https, :data
-          p.img_src     :self, :https, :data
-          p.object_src  :none
-          p.script_src  :self, :https
-          p.style_src   :self, :https, :unsafe_inline
-        end
-
-    Example controller overrides:
-
-        # Override policy inline
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.upgrade_insecure_requests true
-          end
-        end
+*   Apply mapping to symbols returned from dynamic CSP sources
 
-        # Using literal values
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.base_uri "https://www.example.com"
-          end
-        end
+    Previously if a dynamic source returned a symbol such as :self it
+    would be converted to a string implicitly, e.g:
 
-        # Using mixed static and dynamic values
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
-          end
-        end
+        policy.default_src -> { :self }
 
-    Allows you to also only report content violations for migrating
-    legacy content using the `content_security_policy_report_only`
-    configuration attribute, e.g;
+    would generate the header:
 
-        # config/initializers/content_security_policy.rb
-        Rails.application.config.content_security_policy_report_only = true
+        Content-Security-Policy: default-src self
 
-        # controller override
-        class PostsController < ApplicationController
-          content_security_policy_report_only only: :index
-        end
+    and now it generates:
 
-    Note that this feature does not validate the header for performance
-    reasons since the header is calculated at runtime.
+        Content-Security-Policy: default-src 'self'
 
     *Andrew White*
 
-*   Make `assert_recognizes` to traverse mounted engines.
-
-    *Yuichiro Kaneko*
-
-*   Remove deprecated `ActionController::ParamsParser::ParseError`.
-
-    *Rafael Mendonça França*
-
-*   Add `:allow_other_host` option to `redirect_back` method.
-
-    When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
-    different host. `allow_other_host` is `true` by default.
-
-    *Tim Masliuchenko*
-
-*   Add headless chrome support to System Tests.
-
-    *Yuji Yaginuma*
-
-*   Add ability to enable Early Hints for HTTP/2
-
-    If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
+*   Add `ActionController::Parameters#each_value`.
 
-    The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
+    *Lukáš Zapletal*
 
-    *Eileen M. Uchitelle*, *Aaron Patterson*
+*   Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
 
-*   Simplify cookies middleware with key rotation support
+    *Yoshiyuki Kinjo*
 
-    Use the `rotate` method for both `MessageEncryptor` and
-    `MessageVerifier` to add key rotation support for encrypted and
-    signed cookies. This also helps simplify support for legacy cookie
-    security.
+*   Encode Content-Disposition filenames on `send_data` and `send_file`.
+    Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
+    `"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
+    garbled.
+    Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
+    [RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
+    `"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
+    Most browsers can find filename correctly and old browsers fallback to ASCII
+    converted name.
 
-    *Michael J Coyne*
+    *Fumiaki Matsushima*
 
-*   Use Capybara registered `:puma` server config.
+*   Expose `ActionController::Parameters#each_key` which allows iterating over
+    keys without allocating an array.
 
-    The Capybara registered `:puma` server ensures the puma server is run in process so
-    connection sharing and open request detection work correctly by default.
+    *Richard Schneeman*
 
-    *Thomas Walpole*
+*   Purpose metadata for signed/encrypted cookies.
 
-*   Cookies `:expires` option supports `ActiveSupport::Duration` object.
+    Rails can now thwart attacks that attempt to copy signed/encrypted value
+    of a cookie and use it as the value of another cookie.
 
-        cookies[:user_name] = { value: "assain", expires: 1.hour }
-        cookies[:key] = { value: "a yummy cookie", expires: 6.months }
+    It does so by stashing the cookie-name in the purpose field which is
+    then signed/encrypted along with the cookie value. Then, on a server-side
+    read, we verify the cookie-names and discard any attacked cookies.
 
-    Pull Request: #30121
+    Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
+    writes cookies with the new purpose and expiry metadata embedded.
 
     *Assain Jaleel*
 
-*   Enforce signed/encrypted cookie expiry server side.
-
-    Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
+*   Raises `ActionController::RespondToMismatchError` with conflicting `respond_to` invocations.
 
-    It does so by stashing the expiry within the written cookie and relying on the
-    signing/encrypting to vouch that it hasn't been tampered with. Then on a
-    server-side read, the expiry is verified and any expired cookie is discarded.
-
-    Pull Request: #30121
-
-    *Assain Jaleel*
+    `respond_to` can match multiple types and lead to undefined behavior when
+    multiple invocations are made and the types do not match:
 
-*   Make `take_failed_screenshot` work within engine.
+        respond_to do |outer_type|
+          outer_type.js do
+            respond_to do |inner_type|
+              inner_type.html { render body: "HTML" }
+            end
+          end
+        end
 
-    Fixes #30405.
+    *Patrick Toomey*
 
-    *Yuji Yaginuma*
+*   `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
 
-*   Deprecate `ActionDispatch::TestResponse` response aliases.
+    This allows uploaded file objects to be passed directly to `File.read`
+    without raising a `TypeError`:
 
-    `#success?`, `#missing?` & `#error?` are not supported by the actual
-    `ActionDispatch::Response` object and can produce false-positives. Instead,
-    use the response helpers provided by `Rack::Response`.
+        uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
+        File.read(uploaded_file)
 
-    *Trevor Wistaff*
+    *Aaron Kromer*
 
-*   Protect from forgery by default
+*   Pass along arguments to underlying `get` method in `follow_redirect!`
 
-    Rather than protecting from forgery in the generated `ApplicationController`,
-    add it to `ActionController::Base` depending on
-    `config.action_controller.default_protect_from_forgery`. This configuration
-    defaults to false to support older versions which have removed it from their
-    `ApplicationController`, but is set to true for Rails 5.2.
+    Now all arguments passed to `follow_redirect!` are passed to the underlying
+    `get` method. This for example allows to set custom headers for the
+    redirection request to the server.
 
-    *Lisa Ugray*
+        follow_redirect!(params: { foo: :bar })
 
-*   Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
+    *Remo Fritzsche*
 
-    *Kir Shatrov*
+*   Introduce a new error page to when the implicit render page is accessed in the browser.
 
-*   `driven_by` now registers poltergeist and capybara-webkit.
+    Now instead of showing an error page that with exception and backtraces we now show only
+    one informative page.
 
-    If poltergeist or capybara-webkit are set as drivers is set for System Tests,
-    `driven_by` will register the driver and set additional options passed via
-    the `:options` parameter.
+    *Vinicius Stock*
 
-    Refer to the respective driver's documentation to see what options can be passed.
+*   Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
 
-    *Mario Chavez*
+    Exception aware plugin authors can use the newly introduced
+    `.register_interceptor` method to get the processed exception, instead of
+    monkey patching DebugExceptions.
 
-*   AEAD encrypted cookies and sessions with GCM.
+        ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
+          HypoteticalPlugin.capture_exception(request, exception)
+        end
 
-    Encrypted cookies now use AES-GCM which couples authentication and
-    encryption in one faster step and produces shorter ciphertexts. Cookies
-    encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
-    this new mode is enabled via the
-    `action_dispatch.use_authenticated_cookie_encryption` configuration value.
+    *Genadi Samokovarov*
 
-    *Michael J Coyne*
+*   Output only one Content-Security-Policy nonce header value per request.
 
-*   Change the cache key format for fragments to make it easier to debug key churn. The new format is:
+    Fixes #32597.
 
-        views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
-              ^template path           ^template tree digest            ^class   ^id
+    *Andrey Novikov*, *Andrew White*
 
-    *DHH*
+*   Move default headers configuration into their own module that can be included in controllers.
 
-*   Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the
-    `ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
-    to support it.
+    *Kevin Deisz*
 
-    *DHH*
+*   Add method `dig` to `session`.
 
-*   Add `action_controller_api` and `action_controller_base` load hooks to be called in `ActiveSupport.on_load`
+    *claudiob*, *Takumi Shotoku*
 
-    `ActionController::Base` and `ActionController::API` have differing implementations. This means that
-    the one umbrella hook `action_controller` is not able to address certain situations where a method
-    may not exist in a certain implementation.
+*   Controller level `force_ssl` has been deprecated in favor of
+    `config.force_ssl`.
 
-    This is fixed by adding two new hooks so you can target `ActionController::Base` vs `ActionController::API`
+    *Derek Prior*
 
-    Fixes #27013.
+*   Rails 6 requires Ruby 2.5.0 or newer.
 
-    *Julian Nadeau*
+    *Jeremy Daer*, *Kasper Timm Hansen*
 
 
-Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.