actionpack 5.2.4.4 → 6.0.0.beta1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +111 -379
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/lib/abstract_controller/base.rb +4 -2
- data/lib/abstract_controller/caching/fragments.rb +6 -21
- data/lib/abstract_controller/callbacks.rb +12 -0
- data/lib/abstract_controller/collector.rb +1 -1
- data/lib/abstract_controller/helpers.rb +2 -2
- data/lib/abstract_controller/railties/routes_helpers.rb +1 -1
- data/lib/action_controller.rb +1 -0
- data/lib/action_controller/api.rb +2 -1
- data/lib/action_controller/base.rb +2 -7
- data/lib/action_controller/caching.rb +1 -1
- data/lib/action_controller/log_subscriber.rb +8 -5
- data/lib/action_controller/metal.rb +2 -2
- data/lib/action_controller/metal/conditional_get.rb +9 -3
- data/lib/action_controller/metal/data_streaming.rb +5 -6
- data/lib/action_controller/metal/default_headers.rb +17 -0
- data/lib/action_controller/metal/exceptions.rb +22 -1
- data/lib/action_controller/metal/flash.rb +5 -5
- data/lib/action_controller/metal/force_ssl.rb +17 -57
- data/lib/action_controller/metal/head.rb +1 -1
- data/lib/action_controller/metal/helpers.rb +1 -2
- data/lib/action_controller/metal/http_authentication.rb +20 -21
- data/lib/action_controller/metal/implicit_render.rb +2 -12
- data/lib/action_controller/metal/instrumentation.rb +3 -5
- data/lib/action_controller/metal/live.rb +28 -26
- data/lib/action_controller/metal/mime_responds.rb +13 -2
- data/lib/action_controller/metal/params_wrapper.rb +18 -14
- data/lib/action_controller/metal/redirecting.rb +32 -11
- data/lib/action_controller/metal/rendering.rb +1 -1
- data/lib/action_controller/metal/request_forgery_protection.rb +26 -40
- data/lib/action_controller/metal/strong_parameters.rb +57 -34
- data/lib/action_controller/metal/url_for.rb +1 -1
- data/lib/action_controller/railties/helpers.rb +1 -1
- data/lib/action_controller/renderer.rb +15 -2
- data/lib/action_controller/test_case.rb +3 -7
- data/lib/action_dispatch.rb +7 -6
- data/lib/action_dispatch/http/cache.rb +14 -10
- data/lib/action_dispatch/http/content_disposition.rb +45 -0
- data/lib/action_dispatch/http/content_security_policy.rb +9 -8
- data/lib/action_dispatch/http/filter_parameters.rb +8 -6
- data/lib/action_dispatch/http/filter_redirect.rb +1 -1
- data/lib/action_dispatch/http/headers.rb +1 -1
- data/lib/action_dispatch/http/mime_negotiation.rb +7 -10
- data/lib/action_dispatch/http/mime_type.rb +1 -5
- data/lib/action_dispatch/http/parameter_filter.rb +5 -79
- data/lib/action_dispatch/http/parameters.rb +13 -3
- data/lib/action_dispatch/http/request.rb +10 -13
- data/lib/action_dispatch/http/response.rb +14 -14
- data/lib/action_dispatch/http/upload.rb +5 -0
- data/lib/action_dispatch/http/url.rb +81 -81
- data/lib/action_dispatch/journey/formatter.rb +1 -1
- data/lib/action_dispatch/journey/nfa/simulator.rb +0 -2
- data/lib/action_dispatch/journey/nodes/node.rb +9 -8
- data/lib/action_dispatch/journey/path/pattern.rb +3 -4
- data/lib/action_dispatch/journey/router.rb +0 -3
- data/lib/action_dispatch/journey/router/utils.rb +10 -10
- data/lib/action_dispatch/journey/scanner.rb +11 -4
- data/lib/action_dispatch/journey/visitors.rb +1 -1
- data/lib/action_dispatch/middleware/callbacks.rb +2 -4
- data/lib/action_dispatch/middleware/cookies.rb +49 -70
- data/lib/action_dispatch/middleware/debug_exceptions.rb +32 -58
- data/lib/action_dispatch/middleware/debug_locks.rb +5 -5
- data/lib/action_dispatch/middleware/debug_view.rb +50 -0
- data/lib/action_dispatch/middleware/exception_wrapper.rb +36 -7
- data/lib/action_dispatch/middleware/flash.rb +1 -1
- data/lib/action_dispatch/middleware/host_authorization.rb +103 -0
- data/lib/action_dispatch/middleware/remote_ip.rb +6 -8
- data/lib/action_dispatch/middleware/request_id.rb +2 -2
- data/lib/action_dispatch/middleware/session/abstract_store.rb +0 -14
- data/lib/action_dispatch/middleware/session/cache_store.rb +6 -11
- data/lib/action_dispatch/middleware/session/cookie_store.rb +11 -27
- data/lib/action_dispatch/middleware/ssl.rb +8 -8
- data/lib/action_dispatch/middleware/stack.rb +2 -2
- data/lib/action_dispatch/middleware/static.rb +5 -6
- data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +4 -2
- data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +45 -35
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb +7 -0
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb +5 -0
- data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +20 -2
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +4 -4
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +19 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.text.erb +3 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +1 -1
- data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +3 -0
- data/lib/action_dispatch/railtie.rb +1 -0
- data/lib/action_dispatch/request/session.rb +8 -6
- data/lib/action_dispatch/routing.rb +3 -2
- data/lib/action_dispatch/routing/inspector.rb +99 -50
- data/lib/action_dispatch/routing/mapper.rb +36 -29
- data/lib/action_dispatch/routing/polymorphic_routes.rb +3 -4
- data/lib/action_dispatch/routing/route_set.rb +11 -12
- data/lib/action_dispatch/routing/url_for.rb +1 -0
- data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +3 -3
- data/lib/action_dispatch/testing/assertions/response.rb +2 -3
- data/lib/action_dispatch/testing/assertions/routing.rb +7 -2
- data/lib/action_dispatch/testing/integration.rb +11 -4
- data/lib/action_dispatch/testing/test_process.rb +2 -2
- data/lib/action_dispatch/testing/test_response.rb +4 -32
- data/lib/action_pack.rb +1 -1
- data/lib/action_pack/gem_version.rb +4 -4
- metadata +22 -20
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: df5b083c08009f1025bfbf541400a4819b5620f5bb49aa3d4bbe0c056eae44b3
|
4
|
+
data.tar.gz: '0374579e1273c1d727e0bc94d7a73b3933d8c0f54e7196beedc61ea30d88209f'
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: cb0e467dc8c10baa42df2d08d79b2f5caedad996d247523abf54713a542f6d49a01f120ca0b0faa6930ea89592bfe074979201adec97d33135a5877391a5d4bb
|
7
|
+
data.tar.gz: dee5cf35ce9af7e795d65bb2a44d5edb229439f5fbde0dde1c35e8d3cf2564c49ddf929a9d5499b3aa6248c42cf6f61ca2c75c85a623ba51f1dd6106750d3267
|
data/CHANGELOG.md
CHANGED
@@ -1,53 +1,66 @@
|
|
1
|
-
## Rails
|
1
|
+
## Rails 6.0.0.beta1 (January 18, 2019) ##
|
2
2
|
|
3
|
-
*
|
3
|
+
* Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
|
4
4
|
|
5
|
+
*Rafael Mendonça França*
|
5
6
|
|
6
|
-
|
7
|
-
|
8
|
-
* [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
|
9
|
-
|
10
|
-
* [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
|
11
|
-
|
7
|
+
* Remove deprecated methods in `ActionDispatch::TestResponse`.
|
12
8
|
|
13
|
-
|
9
|
+
`#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
|
10
|
+
`#successful?`, `not_found?` and `server_error?`.
|
14
11
|
|
15
|
-
*
|
12
|
+
*Rafael Mendonça França*
|
16
13
|
|
17
|
-
|
18
|
-
gem dalli to be updated as well.
|
14
|
+
* Ensure external redirects are explicitly allowed
|
19
15
|
|
20
|
-
|
16
|
+
Add `fallback_location` and `allow_other_host` options to `redirect_to`.
|
21
17
|
|
18
|
+
*Gannon McGibbon*
|
22
19
|
|
23
|
-
|
20
|
+
* Introduce ActionDispatch::HostAuthorization
|
24
21
|
|
25
|
-
|
22
|
+
This is a new middleware that guards against DNS rebinding attacks by
|
23
|
+
white-listing the allowed hosts a request can be made to.
|
26
24
|
|
25
|
+
Each host is checked with the case operator (`#===`) to support `RegExp`,
|
26
|
+
`Proc`, `IPAddr` and custom objects as host allowances.
|
27
27
|
|
28
|
-
|
28
|
+
*Genadi Samokovarov*
|
29
29
|
|
30
|
-
* Allow using `
|
30
|
+
* Allow using `parsed_body` in `ActionController::TestCase`.
|
31
31
|
|
32
|
-
|
33
|
-
|
34
|
-
`public` value as is.
|
32
|
+
In addition to `ActionDispatch::IntegrationTest`, allow using
|
33
|
+
`parsed_body` in `ActionController::TestCase`:
|
35
34
|
|
36
|
-
|
35
|
+
```
|
36
|
+
class SomeControllerTest < ActionController::TestCase
|
37
|
+
def test_some_action
|
38
|
+
post :action, body: { foo: 'bar' }
|
39
|
+
assert_equal({ "foo" => "bar" }, response.parsed_body)
|
40
|
+
end
|
41
|
+
end
|
42
|
+
```
|
37
43
|
|
38
|
-
|
44
|
+
Fixes #34676.
|
39
45
|
|
40
|
-
*
|
46
|
+
*Tobias Bühlmann*
|
41
47
|
|
42
|
-
|
48
|
+
* Raise an error on root route naming conflicts.
|
43
49
|
|
50
|
+
Raises an ArgumentError when multiple root routes are defined in the
|
51
|
+
same context instead of assigning nil names to subsequent roots.
|
44
52
|
|
45
|
-
|
53
|
+
*Gannon McGibbon*
|
46
54
|
|
47
|
-
*
|
55
|
+
* Allow rescue from parameter parse errors:
|
48
56
|
|
57
|
+
```
|
58
|
+
rescue_from ActionDispatch::Http::Parameters::ParseError do
|
59
|
+
head :unauthorized
|
60
|
+
end
|
61
|
+
```
|
49
62
|
|
50
|
-
|
63
|
+
*Gannon McGibbon*, *Josh Cheek*
|
51
64
|
|
52
65
|
* Reset Capybara sessions if failed system test screenshot raising an exception.
|
53
66
|
|
@@ -83,402 +96,121 @@
|
|
83
96
|
|
84
97
|
*Andrew White*
|
85
98
|
|
86
|
-
*
|
87
|
-
|
88
|
-
*Yoshiyuki Kinjo*
|
89
|
-
|
90
|
-
* Call the `#redirect_to` block in controller context.
|
91
|
-
|
92
|
-
*Steven Peckins*
|
93
|
-
|
94
|
-
|
95
|
-
## Rails 5.2.1.1 (November 27, 2018) ##
|
96
|
-
|
97
|
-
* No changes.
|
98
|
-
|
99
|
-
|
100
|
-
## Rails 5.2.1 (August 07, 2018) ##
|
101
|
-
|
102
|
-
* Prevent `?null=` being passed on JSON encoded test requests.
|
103
|
-
|
104
|
-
`RequestEncoder#encode_params` won't attempt to parse params if
|
105
|
-
there are none.
|
106
|
-
|
107
|
-
So call like this will no longer append a `?null=` query param.
|
108
|
-
|
109
|
-
get foos_url, as: :json
|
110
|
-
|
111
|
-
*Alireza Bashiri*
|
112
|
-
|
113
|
-
* Ensure `ActionController::Parameters#transform_values` and
|
114
|
-
`ActionController::Parameters#transform_values!` converts hashes into
|
115
|
-
parameters.
|
116
|
-
|
117
|
-
*Kevin Sjöberg*
|
118
|
-
|
119
|
-
* Fix strong parameters `permit!` with nested arrays.
|
120
|
-
|
121
|
-
Given:
|
122
|
-
```
|
123
|
-
params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
|
124
|
-
params.permit!
|
125
|
-
```
|
126
|
-
|
127
|
-
`params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
|
128
|
-
|
129
|
-
*Steve Hull*
|
130
|
-
|
131
|
-
* Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
|
132
|
-
`ActionController::TestCase` subclasses.
|
133
|
-
|
134
|
-
*Eugene Kenny*
|
135
|
-
|
136
|
-
* Output only one Content-Security-Policy nonce header value per request.
|
137
|
-
|
138
|
-
Fixes #32597.
|
139
|
-
|
140
|
-
*Andrey Novikov*, *Andrew White*
|
141
|
-
|
142
|
-
* Only disable GPUs for headless Chrome on Windows.
|
143
|
-
|
144
|
-
It is not necessary anymore for Linux and macOS machines.
|
145
|
-
|
146
|
-
https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
|
147
|
-
|
148
|
-
*Stefan Wrobel*
|
149
|
-
|
150
|
-
* Fix system tests transactions not closed between examples.
|
151
|
-
|
152
|
-
*Sergey Tarasov*
|
153
|
-
|
154
|
-
|
155
|
-
## Rails 5.2.0 (April 09, 2018) ##
|
156
|
-
|
157
|
-
* Check exclude before flagging cookies as secure.
|
158
|
-
|
159
|
-
*Catherine Khuu*
|
160
|
-
|
161
|
-
* Always yield a CSP policy instance from `content_security_policy`
|
162
|
-
|
163
|
-
This allows a controller action to enable the policy individually
|
164
|
-
for a controller and/or specific actions.
|
165
|
-
|
166
|
-
*Andrew White*
|
167
|
-
|
168
|
-
* Add the ability to disable the global CSP in a controller, e.g:
|
99
|
+
* Add `ActionController::Parameters#each_value`.
|
169
100
|
|
170
|
-
|
171
|
-
content_security_policy false, only: :index
|
172
|
-
end
|
173
|
-
|
174
|
-
*Andrew White*
|
175
|
-
|
176
|
-
* Add alias method `to_hash` to `to_h` for `cookies`.
|
177
|
-
Add alias method `to_h` to `to_hash` for `session`.
|
178
|
-
|
179
|
-
*Igor Kasyanchuk*
|
101
|
+
*Lukáš Zapletal*
|
180
102
|
|
181
|
-
*
|
182
|
-
to meet the minimum max-age requirement for https://hstspreload.org/.
|
103
|
+
* Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
|
183
104
|
|
184
|
-
*
|
185
|
-
|
186
|
-
* Add support for automatic nonce generation for Rails UJS.
|
187
|
-
|
188
|
-
Because the UJS library creates a script tag to process responses it
|
189
|
-
normally requires the script-src attribute of the content security
|
190
|
-
policy to include 'unsafe-inline'.
|
191
|
-
|
192
|
-
To work around this we generate a per-request nonce value that is
|
193
|
-
embedded in a meta tag in a similar fashion to how CSRF protection
|
194
|
-
embeds its token in a meta tag. The UJS library can then read the
|
195
|
-
nonce value and set it on the dynamically generated script tag to
|
196
|
-
enable it to execute without needing 'unsafe-inline' enabled.
|
105
|
+
*Yoshiyuki Kinjo*
|
197
106
|
|
198
|
-
|
199
|
-
|
200
|
-
|
201
|
-
|
107
|
+
* Encode Content-Disposition filenames on `send_data` and `send_file`.
|
108
|
+
Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
|
109
|
+
`"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
|
110
|
+
garbled.
|
111
|
+
Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
|
112
|
+
[RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
|
113
|
+
`"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
|
114
|
+
Most browsers can find filename correctly and old browsers fallback to ASCII
|
115
|
+
converted name.
|
202
116
|
|
203
|
-
|
204
|
-
using `nonce: true` to set the nonce value on the tag, e.g
|
117
|
+
*Fumiaki Matsushima*
|
205
118
|
|
206
|
-
|
207
|
-
|
208
|
-
<% end %>
|
119
|
+
* Expose `ActionController::Parameters#each_key` which allows iterating over
|
120
|
+
keys without allocating an array.
|
209
121
|
|
210
|
-
|
122
|
+
*Richard Schneeman*
|
211
123
|
|
212
|
-
|
124
|
+
* Purpose metadata for signed/encrypted cookies.
|
213
125
|
|
214
|
-
|
126
|
+
Rails can now thwart attacks that attempt to copy signed/encrypted value
|
127
|
+
of a cookie and use it as the value of another cookie.
|
215
128
|
|
216
|
-
|
129
|
+
It does so by stashing the cookie-name in the purpose field which is
|
130
|
+
then signed/encrypted along with the cookie value. Then, on a server-side
|
131
|
+
read, we verify the cookie-names and discard any attacked cookies.
|
217
132
|
|
218
|
-
|
219
|
-
|
220
|
-
params.each do |name|
|
221
|
-
puts name
|
222
|
-
end
|
223
|
-
end
|
133
|
+
Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
|
134
|
+
writes cookies with the new purpose and expiry metadata embedded.
|
224
135
|
|
225
|
-
|
226
|
-
# param
|
227
|
-
# param_two
|
136
|
+
*Assain Jaleel*
|
228
137
|
|
229
|
-
|
138
|
+
* Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations.
|
230
139
|
|
231
|
-
|
140
|
+
`respond_to` can match multiple types and lead to undefined behavior when
|
141
|
+
multiple invocations are made and the types do not match:
|
232
142
|
|
233
|
-
|
234
|
-
|
235
|
-
|
236
|
-
|
143
|
+
respond_to do |outer_type|
|
144
|
+
outer_type.js do
|
145
|
+
respond_to do |inner_type|
|
146
|
+
inner_type.html { render body: "HTML" }
|
147
|
+
end
|
237
148
|
end
|
238
149
|
end
|
239
150
|
|
240
|
-
|
241
|
-
# param
|
242
|
-
# param_two
|
243
|
-
|
244
|
-
*Dominic Cleal*
|
245
|
-
|
246
|
-
* Add `Referrer-Policy` header to default headers set.
|
247
|
-
|
248
|
-
*Guillermo Iguaran*
|
249
|
-
|
250
|
-
* Changed the system tests to set Puma as default server only when the
|
251
|
-
user haven't specified manually another server.
|
252
|
-
|
253
|
-
*Guillermo Iguaran*
|
151
|
+
*Patrick Toomey*
|
254
152
|
|
255
|
-
*
|
256
|
-
default headers set.
|
153
|
+
* `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
|
257
154
|
|
258
|
-
|
155
|
+
This allows uploaded file objects to be passed directly to `File.read`
|
156
|
+
without raising a `TypeError`:
|
259
157
|
|
260
|
-
|
158
|
+
uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
|
159
|
+
File.read(uploaded_file)
|
261
160
|
|
262
|
-
*
|
161
|
+
*Aaron Kromer*
|
263
162
|
|
264
|
-
*
|
163
|
+
* Pass along arguments to underlying `get` method in `follow_redirect!`.
|
265
164
|
|
266
|
-
|
267
|
-
|
268
|
-
|
269
|
-
inline, but also don't handle it gracefully and instead of outputting the file
|
270
|
-
path, it dumps binary into the terminal.
|
165
|
+
Now all arguments passed to `follow_redirect!` are passed to the underlying
|
166
|
+
`get` method. This for example allows to set custom headers for the
|
167
|
+
redirection request to the server.
|
271
168
|
|
272
|
-
|
169
|
+
follow_redirect!(params: { foo: :bar })
|
273
170
|
|
274
|
-
*
|
171
|
+
*Remo Fritzsche*
|
275
172
|
|
276
|
-
*
|
173
|
+
* Introduce a new error page to when the implicit render page is accessed in the browser.
|
277
174
|
|
278
|
-
|
175
|
+
Now instead of showing an error page that with exception and backtraces we now show only
|
176
|
+
one informative page.
|
279
177
|
|
280
|
-
*
|
178
|
+
*Vinicius Stock*
|
281
179
|
|
282
|
-
|
180
|
+
* Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
|
283
181
|
|
284
|
-
|
285
|
-
|
286
|
-
|
287
|
-
|
288
|
-
The DSL allows you to configure a global Content-Security-Policy
|
289
|
-
header and then override within a controller. For more information
|
290
|
-
about the Content-Security-Policy header see MDN:
|
291
|
-
|
292
|
-
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
293
|
-
|
294
|
-
Example global policy:
|
295
|
-
|
296
|
-
# config/initializers/content_security_policy.rb
|
297
|
-
Rails.application.config.content_security_policy do |p|
|
298
|
-
p.default_src :self, :https
|
299
|
-
p.font_src :self, :https, :data
|
300
|
-
p.img_src :self, :https, :data
|
301
|
-
p.object_src :none
|
302
|
-
p.script_src :self, :https
|
303
|
-
p.style_src :self, :https, :unsafe_inline
|
304
|
-
end
|
305
|
-
|
306
|
-
Example controller overrides:
|
307
|
-
|
308
|
-
# Override policy inline
|
309
|
-
class PostsController < ApplicationController
|
310
|
-
content_security_policy do |p|
|
311
|
-
p.upgrade_insecure_requests true
|
312
|
-
end
|
313
|
-
end
|
314
|
-
|
315
|
-
# Using literal values
|
316
|
-
class PostsController < ApplicationController
|
317
|
-
content_security_policy do |p|
|
318
|
-
p.base_uri "https://www.example.com"
|
319
|
-
end
|
320
|
-
end
|
321
|
-
|
322
|
-
# Using mixed static and dynamic values
|
323
|
-
class PostsController < ApplicationController
|
324
|
-
content_security_policy do |p|
|
325
|
-
p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
|
326
|
-
end
|
327
|
-
end
|
328
|
-
|
329
|
-
Allows you to also only report content violations for migrating
|
330
|
-
legacy content using the `content_security_policy_report_only`
|
331
|
-
configuration attribute, e.g;
|
182
|
+
Exception aware plugin authors can use the newly introduced
|
183
|
+
`.register_interceptor` method to get the processed exception, instead of
|
184
|
+
monkey patching DebugExceptions.
|
332
185
|
|
333
|
-
|
334
|
-
|
335
|
-
|
336
|
-
# controller override
|
337
|
-
class PostsController < ApplicationController
|
338
|
-
content_security_policy_report_only only: :index
|
186
|
+
ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
|
187
|
+
HypoteticalPlugin.capture_exception(request, exception)
|
339
188
|
end
|
340
189
|
|
341
|
-
|
342
|
-
reasons since the header is calculated at runtime.
|
343
|
-
|
344
|
-
*Andrew White*
|
345
|
-
|
346
|
-
* Make `assert_recognizes` to traverse mounted engines.
|
347
|
-
|
348
|
-
*Yuichiro Kaneko*
|
349
|
-
|
350
|
-
* Remove deprecated `ActionController::ParamsParser::ParseError`.
|
351
|
-
|
352
|
-
*Rafael Mendonça França*
|
353
|
-
|
354
|
-
* Add `:allow_other_host` option to `redirect_back` method.
|
355
|
-
|
356
|
-
When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
|
357
|
-
different host. `allow_other_host` is `true` by default.
|
358
|
-
|
359
|
-
*Tim Masliuchenko*
|
360
|
-
|
361
|
-
* Add headless chrome support to System Tests.
|
362
|
-
|
363
|
-
*Yuji Yaginuma*
|
364
|
-
|
365
|
-
* Add ability to enable Early Hints for HTTP/2
|
366
|
-
|
367
|
-
If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
|
368
|
-
|
369
|
-
The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
|
370
|
-
|
371
|
-
*Eileen M. Uchitelle*, *Aaron Patterson*
|
372
|
-
|
373
|
-
* Simplify cookies middleware with key rotation support
|
190
|
+
*Genadi Samokovarov*
|
374
191
|
|
375
|
-
|
376
|
-
`MessageVerifier` to add key rotation support for encrypted and
|
377
|
-
signed cookies. This also helps simplify support for legacy cookie
|
378
|
-
security.
|
379
|
-
|
380
|
-
*Michael J Coyne*
|
381
|
-
|
382
|
-
* Use Capybara registered `:puma` server config.
|
383
|
-
|
384
|
-
The Capybara registered `:puma` server ensures the puma server is run in process so
|
385
|
-
connection sharing and open request detection work correctly by default.
|
386
|
-
|
387
|
-
*Thomas Walpole*
|
388
|
-
|
389
|
-
* Cookies `:expires` option supports `ActiveSupport::Duration` object.
|
390
|
-
|
391
|
-
cookies[:user_name] = { value: "assain", expires: 1.hour }
|
392
|
-
cookies[:key] = { value: "a yummy cookie", expires: 6.months }
|
393
|
-
|
394
|
-
Pull Request: #30121
|
395
|
-
|
396
|
-
*Assain Jaleel*
|
397
|
-
|
398
|
-
* Enforce signed/encrypted cookie expiry server side.
|
399
|
-
|
400
|
-
Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
|
401
|
-
|
402
|
-
It does so by stashing the expiry within the written cookie and relying on the
|
403
|
-
signing/encrypting to vouch that it hasn't been tampered with. Then on a
|
404
|
-
server-side read, the expiry is verified and any expired cookie is discarded.
|
405
|
-
|
406
|
-
Pull Request: #30121
|
407
|
-
|
408
|
-
*Assain Jaleel*
|
409
|
-
|
410
|
-
* Make `take_failed_screenshot` work within engine.
|
411
|
-
|
412
|
-
Fixes #30405.
|
413
|
-
|
414
|
-
*Yuji Yaginuma*
|
415
|
-
|
416
|
-
* Deprecate `ActionDispatch::TestResponse` response aliases.
|
417
|
-
|
418
|
-
`#success?`, `#missing?` & `#error?` are not supported by the actual
|
419
|
-
`ActionDispatch::Response` object and can produce false-positives. Instead,
|
420
|
-
use the response helpers provided by `Rack::Response`.
|
421
|
-
|
422
|
-
*Trevor Wistaff*
|
423
|
-
|
424
|
-
* Protect from forgery by default
|
425
|
-
|
426
|
-
Rather than protecting from forgery in the generated `ApplicationController`,
|
427
|
-
add it to `ActionController::Base` depending on
|
428
|
-
`config.action_controller.default_protect_from_forgery`. This configuration
|
429
|
-
defaults to false to support older versions which have removed it from their
|
430
|
-
`ApplicationController`, but is set to true for Rails 5.2.
|
431
|
-
|
432
|
-
*Lisa Ugray*
|
433
|
-
|
434
|
-
* Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
|
435
|
-
|
436
|
-
*Kir Shatrov*
|
437
|
-
|
438
|
-
* `driven_by` now registers poltergeist and capybara-webkit.
|
439
|
-
|
440
|
-
If poltergeist or capybara-webkit are set as drivers is set for System Tests,
|
441
|
-
`driven_by` will register the driver and set additional options passed via
|
442
|
-
the `:options` parameter.
|
443
|
-
|
444
|
-
Refer to the respective driver's documentation to see what options can be passed.
|
445
|
-
|
446
|
-
*Mario Chavez*
|
447
|
-
|
448
|
-
* AEAD encrypted cookies and sessions with GCM.
|
449
|
-
|
450
|
-
Encrypted cookies now use AES-GCM which couples authentication and
|
451
|
-
encryption in one faster step and produces shorter ciphertexts. Cookies
|
452
|
-
encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
|
453
|
-
this new mode is enabled via the
|
454
|
-
`action_dispatch.use_authenticated_cookie_encryption` configuration value.
|
455
|
-
|
456
|
-
*Michael J Coyne*
|
192
|
+
* Output only one Content-Security-Policy nonce header value per request.
|
457
193
|
|
458
|
-
|
194
|
+
Fixes #32597.
|
459
195
|
|
460
|
-
|
461
|
-
^template path ^template tree digest ^class ^id
|
196
|
+
*Andrey Novikov*, *Andrew White*
|
462
197
|
|
463
|
-
|
198
|
+
* Move default headers configuration into their own module that can be included in controllers.
|
464
199
|
|
465
|
-
*
|
466
|
-
`ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
|
467
|
-
to support it.
|
200
|
+
*Kevin Deisz*
|
468
201
|
|
469
|
-
|
202
|
+
* Add method `dig` to `session`.
|
470
203
|
|
471
|
-
*
|
204
|
+
*claudiob*, *Takumi Shotoku*
|
472
205
|
|
473
|
-
|
474
|
-
|
475
|
-
may not exist in a certain implementation.
|
206
|
+
* Controller level `force_ssl` has been deprecated in favor of
|
207
|
+
`config.force_ssl`.
|
476
208
|
|
477
|
-
|
209
|
+
*Derek Prior*
|
478
210
|
|
479
|
-
|
211
|
+
* Rails 6 requires Ruby 2.5.0 or newer.
|
480
212
|
|
481
|
-
*
|
213
|
+
*Jeremy Daer*, *Kasper Timm Hansen*
|
482
214
|
|
483
215
|
|
484
|
-
Please check [5-
|
216
|
+
Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.
|