RubyGems - actionpack - Versions diffs - 5.2.4.rc1 → 6.0.0.rc2 - Mend

actionpack 5.2.4.rc1 → 6.0.0.rc2

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (127) hide show

checksums.yaml CHANGED

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3679931508ff00406357c690c6bc03d08966109a5af4ea64042e0186b0772f96
-  data.tar.gz: e8da8f7149e84a388350f037eda5cb7729b8edeb778195be79e7f1273d2cc0a6
+  metadata.gz: 26f4fec272345e80b305e73426e4663417440124270a5983ed336e1a9c42f557
+  data.tar.gz: 59685a9093f22dce01fc58fede17184c7574cb60a70e64ef594bef87ad6abadd
 SHA512:
-  metadata.gz: 20695595eef6511baae42535270e30053369304a6629e521afea29f9758eae2b7e7f018e8b263055ba61a88c4a8e543ed1dab320449982c8ff1314b3ae27dcbd
-  data.tar.gz: 337e059cb93403ba173424a8516cc6c24b393a2cb602e6c8f71cd0db37d6aa7ec8b9a06cd2eb21874eff968adfd0db1dde5e6676783783a3399834ce610fcf98
+  metadata.gz: f68fa705893a264ffbda5af95e3ed0273f05db7daff281ebb9fafb123e8e42eca36f56a0e98a24a63b26856f2b528a3459ff8277df21e2a6282d329dd215a8cb
+  data.tar.gz: 3de347c592dd31a0c39216438ae0171f470e334ef6e357063130507630dc95ba78b158c544fda3fd24b2f16aebe77c0058bc534c725499cb85b2106794d28a67

data/CHANGELOG.md CHANGED

@@ -1,462 +1,306 @@
-## Rails 5.2.4.rc1 (November 22, 2019) ##
+## Rails 6.0.0.rc2 (July 22, 2019) ##
-*   No changes.
-## Rails 5.2.3 (March 27, 2019) ##
-*   Allow using `public` and `no-cache` together in the the Cache Control header.
-    Before this change, even if `public` was specified in the Cache Control header,
-    it was excluded when `no-cache` was included. This change preserves the
-    `public` value as is.
+*   Add the ability to set the CSP nonce only to the specified directives.
-    Fixes #34780.
+    Fixes #35137.
     *Yuji Yaginuma*
-*   Allow `nil` params for `ActionController::TestCase`.
-    *Ryo Nakamura*
-## Rails 5.2.2.1 (March 11, 2019) ##
-*   No changes.
+*   Keep part when scope option has value.
+    When a route was defined within an optional scope, if that route didn't
+    take parameters the scope was lost when using path helpers. This commit
+    ensures scope is kept both when the route takes parameters or when it
+    doesn't.
-## Rails 5.2.2 (December 04, 2018) ##
+    Fixes #33219
-*   Reset Capybara sessions if failed system test screenshot raising an exception.
+    *Alberto Almagro*
-    Reset Capybara sessions if `take_failed_screenshot` raise exception
-    in system test `after_teardown`.
+*   Change `ActionDispatch::Response#content_type` to return Content-Type header as it is.
-    *Maxim Perepelitsa*
+    Previously, `ActionDispatch::Response#content_type` returned value does NOT
+    contain charset part. This behavior changed to returned Content-Type header
+    containing charset part as it is.
-*   Use request object for context if there's no controller
+    If you want just MIME type, please use `ActionDispatch::Response#media_type`
+    instead.
-    There is no controller instance when using a redirect route or a
-    mounted rack application so pass the request object as the context
-    when resolving dynamic CSP sources in this scenario.
+    Enable `action_dispatch.return_only_media_type_on_content_type` to use this change.
+    If not enabled, `ActionDispatch::Response#content_type` returns the same
+    value as before version, but its behavior is deprecate.
-    Fixes #34200.
-    *Andrew White*
-*   Apply mapping to symbols returned from dynamic CSP sources
-    Previously if a dynamic source returned a symbol such as :self it
-    would be converted to a string implicity, e.g:
-        policy.default_src -> { :self }
-    would generate the header:
-        Content-Security-Policy: default-src self
-    and now it generates:
-        Content-Security-Policy: default-src 'self'
-    *Andrew White*
-*   Fix `rails routes -c` for controller name consists of multiple word.
-    *Yoshiyuki Kinjo*
+    *Yuji Yaginuma*
-*   Call the `#redirect_to` block in controller context.
+*   Calling `ActionController::Parameters#transform_keys/!` without a block now returns
+    an enumerator for the parameters instead of the underlying hash.
-    *Steven Peckins*
+    *Eugene Kenny*
+*   Fix a bug where DebugExceptions throws an error when malformed query parameters are provided
-## Rails 5.2.1.1 (November 27, 2018) ##
+    *Yuki Nishijima*, *Stan Lo*
-*   No changes.
+## Rails 6.0.0.rc1 (April 24, 2019) ##
-## Rails 5.2.1 (August 07, 2018) ##
+*   Make system tests take a failed screenshot in a `before_teardown` hook
+    rather than an `after_teardown` hook.
-*   Prevent `?null=` being passed on JSON encoded test requests.
+    This helps minimize the time gap between when an assertion fails and when
+    the screenshot is taken (reducing the time in which the page could have
+    been dynamically updated after the assertion failed).
-    `RequestEncoder#encode_params` won't attempt to parse params if
-    there are none.
+    *Richard Macklin*
-    So call like this will no longer append a `?null=` query param.
+*   Introduce `ActionDispatch::ActionableExceptions`.
-        get foos_url, as: :json
+    The `ActionDispatch::ActionableExceptions` middleware dispatches actions
+    from `ActiveSupport::ActionableError` descendants.
-    *Alireza Bashiri*
+    Actionable errors let's you dispatch actions from Rails' error pages.
-*   Ensure `ActionController::Parameters#transform_values` and
-    `ActionController::Parameters#transform_values!` converts hashes into
-    parameters.
+    *Vipul A M*, *Yao Jie*, *Genadi Samokovarov*
-    *Kevin Sjöberg*
+*   Raise an `ArgumentError` if a resource custom param contains a colon (`:`).
-*   Fix strong parameters `permit!` with nested arrays.
+    After this change it's not possible anymore to configure routes like this:
-    Given:
     ```
-    params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
-    params.permit!
+    routes.draw do
+      resources :users, param: 'name/:sneaky'
+    end
     ```
-    `params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
-    *Steve Hull*
-*   Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
-    `ActionController::TestCase` subclasses.
-    *Eugene Kenny*
-*   Output only one Content-Security-Policy nonce header value per request.
-    Fixes #32597.
-    *Andrey Novikov*, *Andrew White*
-*   Only disable GPUs for headless Chrome on Windows.
-    It is not necessary anymore for Linux and macOS machines.
-    https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
-    *Stefan Wrobel*
-*   Fix system tests transactions not closed between examples.
-    *Sergey Tarasov*
-## Rails 5.2.0 (April 09, 2018) ##
+    Fixes #30467.
-*   Check exclude before flagging cookies as secure.
+    *Josua Schmid*
-    *Catherine Khuu*
-*   Always yield a CSP policy instance from `content_security_policy`
-    This allows a controller action to enable the policy individually
-    for a controller and/or specific actions.
-    *Andrew White*
-*   Add the ability to disable the global CSP in a controller, e.g:
-        class LegacyPagesController < ApplicationController
-          content_security_policy false, only: :index
-        end
-    *Andrew White*
+## Rails 6.0.0.beta3 (March 11, 2019) ##
-*   Add alias method `to_hash` to `to_h` for `cookies`.
-    Add alias method `to_h` to `to_hash` for `session`.
-    *Igor Kasyanchuk*
+*   No changes.
-*   Update the default HSTS max-age value to 31536000 seconds (1 year)
-    to meet the minimum max-age requirement for https://hstspreload.org/.
-    *Grant Bourque*
+## Rails 6.0.0.beta2 (February 25, 2019) ##
-*   Add support for automatic nonce generation for Rails UJS.
+*   Make debug exceptions works in an environment where ActiveStorage is not loaded.
-    Because the UJS library creates a script tag to process responses it
-    normally requires the script-src attribute of the content security
-    policy to include 'unsafe-inline'.
+    *Tomoyuki Kurosawa*
-    To work around this we generate a per-request nonce value that is
-    embedded in a meta tag in a similar fashion to how CSRF protection
-    embeds its token in a meta tag. The UJS library can then read the
-    nonce value and set it on the dynamically generated script tag to
-    enable it to execute without needing 'unsafe-inline' enabled.
+*   `ActionDispatch::SystemTestCase.driven_by` can now be called with a block
+    to define specific browser capabilities.
-    Nonce generation isn't 100% safe - if your script tag is including
-    user generated content in someway then it may be possible to exploit
-    an XSS vulnerability which can take advantage of the nonce. It is
-    however an improvement on a blanket permission for inline scripts.
+    *Edouard Chin*
-    It is also possible to use the nonce within your own script tags by
-    using `nonce: true` to set the nonce value on the tag, e.g
-        <%= javascript_tag nonce: true do %>
-          alert('Hello, World!');
-        <% end %>
+## Rails 6.0.0.beta1 (January 18, 2019) ##
-    Fixes #31689.
+*   Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
-    *Andrew White*
+    *Rafael Mendonça França*
-*   Matches behavior of `Hash#each` in `ActionController::Parameters#each`.
+*   Remove deprecated methods in `ActionDispatch::TestResponse`.
-    Rails 5.0 introduced a bug when looping through controller params using `each`. Only the keys of params hash were passed to the block, e.g.
+    `#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
+    `#successful?`, `not_found?` and `server_error?`.
-        # Parameters: {"param"=>"1", "param_two"=>"2"}
-        def index
-          params.each do |name|
-            puts name
-          end
-        end
+    *Rafael Mendonça França*
-        # Prints
-        # param
-        # param_two
+*   Introduce `ActionDispatch::HostAuthorization`.
-    In Rails 5.2 the bug has been fixed and name will be an array (which was the behavior for all versions prior to 5.0), instead of a string.
+    This is a new middleware that guards against DNS rebinding attacks by
+    explicitly permitting the hosts a request can be made to.
-    To fix the code above simply change as per example below:
+    Each host is checked with the case operator (`#===`) to support `Regexp`,
+    `Proc`, `IPAddr` and custom objects as host allowances.
-        # Parameters: {"param"=>"1", "param_two"=>"2"}
-        def index
-          params.each do |name, value|
-            puts name
-          end
-        end
+    *Genadi Samokovarov*
-        # Prints
-        # param
-        # param_two
+*   Allow using `parsed_body` in `ActionController::TestCase`.
-    *Dominic Cleal*
+    In addition to `ActionDispatch::IntegrationTest`, allow using
+    `parsed_body` in `ActionController::TestCase`:
-*   Add `Referrer-Policy` header to default headers set.
-    *Guillermo Iguaran*
+    ```
+    class SomeControllerTest < ActionController::TestCase
+      def test_some_action
+        post :action, body: { foo: 'bar' }
+        assert_equal({ "foo" => "bar" }, response.parsed_body)
+      end
+    end
+    ```
-*   Changed the system tests to set Puma as default server only when the
-    user haven't specified manually another server.
+    Fixes #34676.
-    *Guillermo Iguaran*
+    *Tobias Bühlmann*
-*   Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
-    default headers set.
+*   Raise an error on root route naming conflicts.
-    *Guillermo Iguaran*
+    Raises an `ArgumentError` when multiple root routes are defined in the
+    same context instead of assigning nil names to subsequent roots.
-*   Add headless firefox support to System Tests.
+    *Gannon McGibbon*
-    *bogdanvlviv*
+*   Allow rescue from parameter parse errors:
-*   Changed the default system test screenshot output from `inline` to `simple`.
+    ```
+    rescue_from ActionDispatch::Http::Parameters::ParseError do
+      head :unauthorized
+    end
+    ```
-    `inline` works well for iTerm2 but not everyone uses iTerm2. Some terminals like
-    Terminal.app ignore the `inline` and output the path to the file since it can't
-    render the image. Other terminals, like those on Ubuntu, cannot handle the image
-    inline, but also don't handle it gracefully and instead of outputting the file
-    path, it dumps binary into the terminal.
+    *Gannon McGibbon*, *Josh Cheek*
-    Commit 9d6e28 fixes this by changing the default for screenshot to be `simple`.
+*   Reset Capybara sessions if failed system test screenshot raising an exception.
-    *Eileen M. Uchitelle*
+    Reset Capybara sessions if `take_failed_screenshot` raise exception
+    in system test `after_teardown`.
-*   Register most popular audio/video/font mime types supported by modern browsers.
+    *Maxim Perepelitsa*
-    *Guillermo Iguaran*
+*   Use request object for context if there's no controller
-*   Fix optimized url helpers when using relative url root.
+    There is no controller instance when using a redirect route or a
+    mounted rack application so pass the request object as the context
+    when resolving dynamic CSP sources in this scenario.
-    Fixes #31220.
+    Fixes #34200.
     *Andrew White*
-*   Add DSL for configuring Content-Security-Policy header.
-    The DSL allows you to configure a global Content-Security-Policy
-    header and then override within a controller. For more information
-    about the Content-Security-Policy header see MDN:
-    https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-    Example global policy:
-        # config/initializers/content_security_policy.rb
-        Rails.application.config.content_security_policy do |p|
-          p.default_src :self, :https
-          p.font_src    :self, :https, :data
-          p.img_src     :self, :https, :data
-          p.object_src  :none
-          p.script_src  :self, :https
-          p.style_src   :self, :https, :unsafe_inline
-        end
-    Example controller overrides:
-        # Override policy inline
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.upgrade_insecure_requests true
-          end
-        end
+*   Apply mapping to symbols returned from dynamic CSP sources
-        # Using literal values
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.base_uri "https://www.example.com"
-          end
-        end
+    Previously if a dynamic source returned a symbol such as :self it
+    would be converted to a string implicitly, e.g:
-        # Using mixed static and dynamic values
-        class PostsController < ApplicationController
-          content_security_policy do |p|
-            p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
-          end
-        end
+        policy.default_src -> { :self }
-    Allows you to also only report content violations for migrating
-    legacy content using the `content_security_policy_report_only`
-    configuration attribute, e.g;
+    would generate the header:
-        # config/initializers/content_security_policy.rb
-        Rails.application.config.content_security_policy_report_only = true
+        Content-Security-Policy: default-src self
-        # controller override
-        class PostsController < ApplicationController
-          content_security_policy_report_only only: :index
-        end
+    and now it generates:
-    Note that this feature does not validate the header for performance
-    reasons since the header is calculated at runtime.
+        Content-Security-Policy: default-src 'self'
     *Andrew White*
-*   Make `assert_recognizes` to traverse mounted engines.
-    *Yuichiro Kaneko*
-*   Remove deprecated `ActionController::ParamsParser::ParseError`.
-    *Rafael Mendonça França*
-*   Add `:allow_other_host` option to `redirect_back` method.
-    When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
-    different host. `allow_other_host` is `true` by default.
-    *Tim Masliuchenko*
+*   Add `ActionController::Parameters#each_value`.
-*   Add headless chrome support to System Tests.
+    *Lukáš Zapletal*
-    *Yuji Yaginuma*
-*   Add ability to enable Early Hints for HTTP/2
-    If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
-    The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
-    *Eileen M. Uchitelle*, *Aaron Patterson*
+*   Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
-*   Simplify cookies middleware with key rotation support
+    *Yoshiyuki Kinjo*
-    Use the `rotate` method for both `MessageEncryptor` and
-    `MessageVerifier` to add key rotation support for encrypted and
-    signed cookies. This also helps simplify support for legacy cookie
-    security.
+*   Encode Content-Disposition filenames on `send_data` and `send_file`.
+    Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
+    `"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
+    garbled.
+    Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
+    [RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
+    `"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
+    Most browsers can find filename correctly and old browsers fallback to ASCII
+    converted name.
-    *Michael J Coyne*
+    *Fumiaki Matsushima*
-*   Use Capybara registered `:puma` server config.
+*   Expose `ActionController::Parameters#each_key` which allows iterating over
+    keys without allocating an array.
-    The Capybara registered `:puma` server ensures the puma server is run in process so
-    connection sharing and open request detection work correctly by default.
+    *Richard Schneeman*
-    *Thomas Walpole*
+*   Purpose metadata for signed/encrypted cookies.
-*   Cookies `:expires` option supports `ActiveSupport::Duration` object.
+    Rails can now thwart attacks that attempt to copy signed/encrypted value
+    of a cookie and use it as the value of another cookie.
-        cookies[:user_name] = { value: "assain", expires: 1.hour }
-        cookies[:key] = { value: "a yummy cookie", expires: 6.months }
+    It does so by stashing the cookie-name in the purpose field which is
+    then signed/encrypted along with the cookie value. Then, on a server-side
+    read, we verify the cookie-names and discard any attacked cookies.
-    Pull Request: #30121
+    Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
+    writes cookies with the new purpose and expiry metadata embedded.
     *Assain Jaleel*
-*   Enforce signed/encrypted cookie expiry server side.
-    Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
+*   Raises `ActionController::RespondToMismatchError` with conflicting `respond_to` invocations.
-    It does so by stashing the expiry within the written cookie and relying on the
-    signing/encrypting to vouch that it hasn't been tampered with. Then on a
-    server-side read, the expiry is verified and any expired cookie is discarded.
+    `respond_to` can match multiple types and lead to undefined behavior when
+    multiple invocations are made and the types do not match:
-    Pull Request: #30121
-    *Assain Jaleel*
-*   Make `take_failed_screenshot` work within engine.
+        respond_to do |outer_type|
+          outer_type.js do
+            respond_to do |inner_type|
+              inner_type.html { render body: "HTML" }
+            end
+          end
+        end
-    Fixes #30405.
+    *Patrick Toomey*
-    *Yuji Yaginuma*
+*   `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
-*   Deprecate `ActionDispatch::TestResponse` response aliases.
+    This allows uploaded file objects to be passed directly to `File.read`
+    without raising a `TypeError`:
-    `#success?`, `#missing?` & `#error?` are not supported by the actual
-    `ActionDispatch::Response` object and can produce false-positives. Instead,
-    use the response helpers provided by `Rack::Response`.
+        uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
+        File.read(uploaded_file)
-    *Trevor Wistaff*
+    *Aaron Kromer*
-*   Protect from forgery by default
+*   Pass along arguments to underlying `get` method in `follow_redirect!`
-    Rather than protecting from forgery in the generated `ApplicationController`,
-    add it to `ActionController::Base` depending on
-    `config.action_controller.default_protect_from_forgery`. This configuration
-    defaults to false to support older versions which have removed it from their
-    `ApplicationController`, but is set to true for Rails 5.2.
+    Now all arguments passed to `follow_redirect!` are passed to the underlying
+    `get` method. This for example allows to set custom headers for the
+    redirection request to the server.
-    *Lisa Ugray*
+        follow_redirect!(params: { foo: :bar })
-*   Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
+    *Remo Fritzsche*
-    *Kir Shatrov*
+*   Introduce a new error page to when the implicit render page is accessed in the browser.
-*   `driven_by` now registers poltergeist and capybara-webkit.
+    Now instead of showing an error page that with exception and backtraces we now show only
+    one informative page.
-    If poltergeist or capybara-webkit are set as drivers is set for System Tests,
-    `driven_by` will register the driver and set additional options passed via
-    the `:options` parameter.
+    *Vinicius Stock*
-    Refer to the respective driver's documentation to see what options can be passed.
+*   Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
-    *Mario Chavez*
+    Exception aware plugin authors can use the newly introduced
+    `.register_interceptor` method to get the processed exception, instead of
+    monkey patching DebugExceptions.
-*   AEAD encrypted cookies and sessions with GCM.
+        ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
+          HypoteticalPlugin.capture_exception(request, exception)
+        end
-    Encrypted cookies now use AES-GCM which couples authentication and
-    encryption in one faster step and produces shorter ciphertexts. Cookies
-    encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
-    this new mode is enabled via the
-    `action_dispatch.use_authenticated_cookie_encryption` configuration value.
+    *Genadi Samokovarov*
-    *Michael J Coyne*
+*   Output only one Content-Security-Policy nonce header value per request.
-*   Change the cache key format for fragments to make it easier to debug key churn. The new format is:
+    Fixes #32597.
-        views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
-              ^template path           ^template tree digest            ^class   ^id
+    *Andrey Novikov*, *Andrew White*
-    *DHH*
+*   Move default headers configuration into their own module that can be included in controllers.
-*   Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the
-    `ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
-    to support it.
+    *Kevin Deisz*
-    *DHH*
+*   Add method `dig` to `session`.
-*   Add `action_controller_api` and `action_controller_base` load hooks to be called in `ActiveSupport.on_load`
+    *claudiob*, *Takumi Shotoku*
-    `ActionController::Base` and `ActionController::API` have differing implementations. This means that
-    the one umbrella hook `action_controller` is not able to address certain situations where a method
-    may not exist in a certain implementation.
+*   Controller level `force_ssl` has been deprecated in favor of
+    `config.force_ssl`.
-    This is fixed by adding two new hooks so you can target `ActionController::Base` vs `ActionController::API`
+    *Derek Prior*
-    Fixes #27013.
+*   Rails 6 requires Ruby 2.5.0 or newer.
-    *Julian Nadeau*
+    *Jeremy Daer*, *Kasper Timm Hansen*
-Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.