actionpack 5.2.5 → 6.0.0.beta1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +111 -399
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/lib/abstract_controller/base.rb +4 -2
- data/lib/abstract_controller/caching/fragments.rb +6 -21
- data/lib/abstract_controller/callbacks.rb +12 -0
- data/lib/abstract_controller/collector.rb +1 -1
- data/lib/abstract_controller/helpers.rb +2 -2
- data/lib/abstract_controller/railties/routes_helpers.rb +1 -1
- data/lib/action_controller.rb +1 -0
- data/lib/action_controller/api.rb +2 -1
- data/lib/action_controller/base.rb +2 -7
- data/lib/action_controller/caching.rb +1 -1
- data/lib/action_controller/log_subscriber.rb +8 -5
- data/lib/action_controller/metal.rb +2 -2
- data/lib/action_controller/metal/conditional_get.rb +9 -3
- data/lib/action_controller/metal/data_streaming.rb +5 -6
- data/lib/action_controller/metal/default_headers.rb +17 -0
- data/lib/action_controller/metal/exceptions.rb +22 -1
- data/lib/action_controller/metal/flash.rb +5 -5
- data/lib/action_controller/metal/force_ssl.rb +17 -57
- data/lib/action_controller/metal/head.rb +1 -1
- data/lib/action_controller/metal/helpers.rb +1 -2
- data/lib/action_controller/metal/http_authentication.rb +20 -21
- data/lib/action_controller/metal/implicit_render.rb +2 -12
- data/lib/action_controller/metal/instrumentation.rb +3 -5
- data/lib/action_controller/metal/live.rb +28 -26
- data/lib/action_controller/metal/mime_responds.rb +13 -2
- data/lib/action_controller/metal/params_wrapper.rb +18 -14
- data/lib/action_controller/metal/redirecting.rb +32 -11
- data/lib/action_controller/metal/rendering.rb +1 -1
- data/lib/action_controller/metal/request_forgery_protection.rb +32 -41
- data/lib/action_controller/metal/strong_parameters.rb +57 -34
- data/lib/action_controller/metal/url_for.rb +1 -1
- data/lib/action_controller/railties/helpers.rb +1 -1
- data/lib/action_controller/renderer.rb +15 -2
- data/lib/action_controller/test_case.rb +5 -9
- data/lib/action_dispatch.rb +7 -6
- data/lib/action_dispatch/http/cache.rb +14 -10
- data/lib/action_dispatch/http/content_disposition.rb +45 -0
- data/lib/action_dispatch/http/content_security_policy.rb +9 -8
- data/lib/action_dispatch/http/filter_parameters.rb +8 -6
- data/lib/action_dispatch/http/filter_redirect.rb +1 -1
- data/lib/action_dispatch/http/headers.rb +1 -1
- data/lib/action_dispatch/http/mime_negotiation.rb +7 -10
- data/lib/action_dispatch/http/mime_type.rb +1 -5
- data/lib/action_dispatch/http/parameter_filter.rb +5 -79
- data/lib/action_dispatch/http/parameters.rb +13 -3
- data/lib/action_dispatch/http/request.rb +10 -13
- data/lib/action_dispatch/http/response.rb +14 -14
- data/lib/action_dispatch/http/upload.rb +5 -0
- data/lib/action_dispatch/http/url.rb +81 -81
- data/lib/action_dispatch/journey/formatter.rb +1 -1
- data/lib/action_dispatch/journey/nfa/simulator.rb +0 -2
- data/lib/action_dispatch/journey/nodes/node.rb +9 -8
- data/lib/action_dispatch/journey/path/pattern.rb +3 -4
- data/lib/action_dispatch/journey/router.rb +0 -3
- data/lib/action_dispatch/journey/router/utils.rb +10 -10
- data/lib/action_dispatch/journey/scanner.rb +11 -4
- data/lib/action_dispatch/journey/visitors.rb +1 -1
- data/lib/action_dispatch/middleware/callbacks.rb +2 -4
- data/lib/action_dispatch/middleware/cookies.rb +49 -70
- data/lib/action_dispatch/middleware/debug_exceptions.rb +32 -58
- data/lib/action_dispatch/middleware/debug_locks.rb +5 -5
- data/lib/action_dispatch/middleware/debug_view.rb +50 -0
- data/lib/action_dispatch/middleware/exception_wrapper.rb +36 -7
- data/lib/action_dispatch/middleware/flash.rb +1 -1
- data/lib/action_dispatch/middleware/host_authorization.rb +103 -0
- data/lib/action_dispatch/middleware/remote_ip.rb +6 -8
- data/lib/action_dispatch/middleware/request_id.rb +2 -2
- data/lib/action_dispatch/middleware/session/abstract_store.rb +0 -14
- data/lib/action_dispatch/middleware/session/cache_store.rb +6 -11
- data/lib/action_dispatch/middleware/session/cookie_store.rb +11 -27
- data/lib/action_dispatch/middleware/ssl.rb +8 -8
- data/lib/action_dispatch/middleware/stack.rb +2 -2
- data/lib/action_dispatch/middleware/static.rb +5 -6
- data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +4 -2
- data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +45 -35
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb +7 -0
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb +5 -0
- data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +20 -2
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +4 -4
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +19 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.text.erb +3 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +1 -1
- data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +3 -0
- data/lib/action_dispatch/railtie.rb +1 -0
- data/lib/action_dispatch/request/session.rb +8 -6
- data/lib/action_dispatch/routing.rb +3 -2
- data/lib/action_dispatch/routing/inspector.rb +99 -50
- data/lib/action_dispatch/routing/mapper.rb +36 -29
- data/lib/action_dispatch/routing/polymorphic_routes.rb +3 -4
- data/lib/action_dispatch/routing/route_set.rb +11 -12
- data/lib/action_dispatch/routing/url_for.rb +1 -0
- data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +3 -3
- data/lib/action_dispatch/testing/assertions/response.rb +2 -3
- data/lib/action_dispatch/testing/assertions/routing.rb +7 -2
- data/lib/action_dispatch/testing/integration.rb +11 -5
- data/lib/action_dispatch/testing/test_process.rb +2 -2
- data/lib/action_dispatch/testing/test_response.rb +4 -32
- data/lib/action_pack.rb +1 -1
- data/lib/action_pack/gem_version.rb +4 -4
- metadata +22 -20
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: df5b083c08009f1025bfbf541400a4819b5620f5bb49aa3d4bbe0c056eae44b3
|
4
|
+
data.tar.gz: '0374579e1273c1d727e0bc94d7a73b3933d8c0f54e7196beedc61ea30d88209f'
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: cb0e467dc8c10baa42df2d08d79b2f5caedad996d247523abf54713a542f6d49a01f120ca0b0faa6930ea89592bfe074979201adec97d33135a5877391a5d4bb
|
7
|
+
data.tar.gz: dee5cf35ce9af7e795d65bb2a44d5edb229439f5fbde0dde1c35e8d3cf2564c49ddf929a9d5499b3aa6248c42cf6f61ca2c75c85a623ba51f1dd6106750d3267
|
data/CHANGELOG.md
CHANGED
@@ -1,73 +1,66 @@
|
|
1
|
-
## Rails
|
1
|
+
## Rails 6.0.0.beta1 (January 18, 2019) ##
|
2
2
|
|
3
|
-
*
|
3
|
+
* Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
|
4
4
|
|
5
|
+
*Rafael Mendonça França*
|
5
6
|
|
6
|
-
|
7
|
-
|
8
|
-
* No changes.
|
9
|
-
|
10
|
-
|
11
|
-
## Rails 5.2.4.4 (September 09, 2020) ##
|
12
|
-
|
13
|
-
* No changes.
|
14
|
-
|
15
|
-
|
16
|
-
## Rails 5.2.4.3 (May 18, 2020) ##
|
17
|
-
|
18
|
-
* [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
|
19
|
-
|
20
|
-
* [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
|
21
|
-
|
22
|
-
|
23
|
-
## Rails 5.2.4.2 (March 19, 2020) ##
|
24
|
-
|
25
|
-
* No changes.
|
26
|
-
|
7
|
+
* Remove deprecated methods in `ActionDispatch::TestResponse`.
|
27
8
|
|
28
|
-
|
9
|
+
`#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
|
10
|
+
`#successful?`, `not_found?` and `server_error?`.
|
29
11
|
|
30
|
-
*
|
12
|
+
*Rafael Mendonça França*
|
31
13
|
|
32
|
-
|
33
|
-
gem dalli to be updated as well.
|
34
|
-
|
35
|
-
_Breaking changes:_
|
36
|
-
* `session.id` now returns an instance of `Rack::Session::SessionId` and not a String (use `session.id.public_id` to restore the old behaviour, see #38063)
|
37
|
-
* Accessing the session id using `session[:session_id]`/`session['session_id']` no longer works with
|
38
|
-
ruby 2.2 (see https://github.com/rails/rails/commit/2a52a38cb51b65d71cf91fc960777213cf96f962#commitcomment-37929811)
|
14
|
+
* Ensure external redirects are explicitly allowed
|
39
15
|
|
40
|
-
|
16
|
+
Add `fallback_location` and `allow_other_host` options to `redirect_to`.
|
41
17
|
|
18
|
+
*Gannon McGibbon*
|
42
19
|
|
43
|
-
|
20
|
+
* Introduce ActionDispatch::HostAuthorization
|
44
21
|
|
45
|
-
|
22
|
+
This is a new middleware that guards against DNS rebinding attacks by
|
23
|
+
white-listing the allowed hosts a request can be made to.
|
46
24
|
|
25
|
+
Each host is checked with the case operator (`#===`) to support `RegExp`,
|
26
|
+
`Proc`, `IPAddr` and custom objects as host allowances.
|
47
27
|
|
48
|
-
|
28
|
+
*Genadi Samokovarov*
|
49
29
|
|
50
|
-
* Allow using `
|
30
|
+
* Allow using `parsed_body` in `ActionController::TestCase`.
|
51
31
|
|
52
|
-
|
53
|
-
|
54
|
-
`public` value as is.
|
32
|
+
In addition to `ActionDispatch::IntegrationTest`, allow using
|
33
|
+
`parsed_body` in `ActionController::TestCase`:
|
55
34
|
|
56
|
-
|
35
|
+
```
|
36
|
+
class SomeControllerTest < ActionController::TestCase
|
37
|
+
def test_some_action
|
38
|
+
post :action, body: { foo: 'bar' }
|
39
|
+
assert_equal({ "foo" => "bar" }, response.parsed_body)
|
40
|
+
end
|
41
|
+
end
|
42
|
+
```
|
57
43
|
|
58
|
-
|
44
|
+
Fixes #34676.
|
59
45
|
|
60
|
-
*
|
46
|
+
*Tobias Bühlmann*
|
61
47
|
|
62
|
-
|
48
|
+
* Raise an error on root route naming conflicts.
|
63
49
|
|
50
|
+
Raises an ArgumentError when multiple root routes are defined in the
|
51
|
+
same context instead of assigning nil names to subsequent roots.
|
64
52
|
|
65
|
-
|
53
|
+
*Gannon McGibbon*
|
66
54
|
|
67
|
-
*
|
55
|
+
* Allow rescue from parameter parse errors:
|
68
56
|
|
57
|
+
```
|
58
|
+
rescue_from ActionDispatch::Http::Parameters::ParseError do
|
59
|
+
head :unauthorized
|
60
|
+
end
|
61
|
+
```
|
69
62
|
|
70
|
-
|
63
|
+
*Gannon McGibbon*, *Josh Cheek*
|
71
64
|
|
72
65
|
* Reset Capybara sessions if failed system test screenshot raising an exception.
|
73
66
|
|
@@ -103,402 +96,121 @@
|
|
103
96
|
|
104
97
|
*Andrew White*
|
105
98
|
|
106
|
-
*
|
107
|
-
|
108
|
-
*Yoshiyuki Kinjo*
|
109
|
-
|
110
|
-
* Call the `#redirect_to` block in controller context.
|
111
|
-
|
112
|
-
*Steven Peckins*
|
113
|
-
|
114
|
-
|
115
|
-
## Rails 5.2.1.1 (November 27, 2018) ##
|
116
|
-
|
117
|
-
* No changes.
|
118
|
-
|
119
|
-
|
120
|
-
## Rails 5.2.1 (August 07, 2018) ##
|
121
|
-
|
122
|
-
* Prevent `?null=` being passed on JSON encoded test requests.
|
123
|
-
|
124
|
-
`RequestEncoder#encode_params` won't attempt to parse params if
|
125
|
-
there are none.
|
126
|
-
|
127
|
-
So call like this will no longer append a `?null=` query param.
|
128
|
-
|
129
|
-
get foos_url, as: :json
|
130
|
-
|
131
|
-
*Alireza Bashiri*
|
132
|
-
|
133
|
-
* Ensure `ActionController::Parameters#transform_values` and
|
134
|
-
`ActionController::Parameters#transform_values!` converts hashes into
|
135
|
-
parameters.
|
136
|
-
|
137
|
-
*Kevin Sjöberg*
|
138
|
-
|
139
|
-
* Fix strong parameters `permit!` with nested arrays.
|
140
|
-
|
141
|
-
Given:
|
142
|
-
```
|
143
|
-
params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
|
144
|
-
params.permit!
|
145
|
-
```
|
146
|
-
|
147
|
-
`params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
|
99
|
+
* Add `ActionController::Parameters#each_value`.
|
148
100
|
|
149
|
-
*
|
101
|
+
*Lukáš Zapletal*
|
150
102
|
|
151
|
-
*
|
152
|
-
`ActionController::TestCase` subclasses.
|
103
|
+
* Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
|
153
104
|
|
154
|
-
*
|
155
|
-
|
156
|
-
* Output only one Content-Security-Policy nonce header value per request.
|
157
|
-
|
158
|
-
Fixes #32597.
|
159
|
-
|
160
|
-
*Andrey Novikov*, *Andrew White*
|
161
|
-
|
162
|
-
* Only disable GPUs for headless Chrome on Windows.
|
163
|
-
|
164
|
-
It is not necessary anymore for Linux and macOS machines.
|
165
|
-
|
166
|
-
https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
|
167
|
-
|
168
|
-
*Stefan Wrobel*
|
169
|
-
|
170
|
-
* Fix system tests transactions not closed between examples.
|
171
|
-
|
172
|
-
*Sergey Tarasov*
|
173
|
-
|
174
|
-
|
175
|
-
## Rails 5.2.0 (April 09, 2018) ##
|
176
|
-
|
177
|
-
* Check exclude before flagging cookies as secure.
|
178
|
-
|
179
|
-
*Catherine Khuu*
|
180
|
-
|
181
|
-
* Always yield a CSP policy instance from `content_security_policy`
|
182
|
-
|
183
|
-
This allows a controller action to enable the policy individually
|
184
|
-
for a controller and/or specific actions.
|
185
|
-
|
186
|
-
*Andrew White*
|
187
|
-
|
188
|
-
* Add the ability to disable the global CSP in a controller, e.g:
|
189
|
-
|
190
|
-
class LegacyPagesController < ApplicationController
|
191
|
-
content_security_policy false, only: :index
|
192
|
-
end
|
193
|
-
|
194
|
-
*Andrew White*
|
195
|
-
|
196
|
-
* Add alias method `to_hash` to `to_h` for `cookies`.
|
197
|
-
Add alias method `to_h` to `to_hash` for `session`.
|
198
|
-
|
199
|
-
*Igor Kasyanchuk*
|
200
|
-
|
201
|
-
* Update the default HSTS max-age value to 31536000 seconds (1 year)
|
202
|
-
to meet the minimum max-age requirement for https://hstspreload.org/.
|
203
|
-
|
204
|
-
*Grant Bourque*
|
205
|
-
|
206
|
-
* Add support for automatic nonce generation for Rails UJS.
|
105
|
+
*Yoshiyuki Kinjo*
|
207
106
|
|
208
|
-
|
209
|
-
|
210
|
-
|
107
|
+
* Encode Content-Disposition filenames on `send_data` and `send_file`.
|
108
|
+
Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
|
109
|
+
`"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
|
110
|
+
garbled.
|
111
|
+
Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
|
112
|
+
[RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
|
113
|
+
`"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
|
114
|
+
Most browsers can find filename correctly and old browsers fallback to ASCII
|
115
|
+
converted name.
|
211
116
|
|
212
|
-
|
213
|
-
embedded in a meta tag in a similar fashion to how CSRF protection
|
214
|
-
embeds its token in a meta tag. The UJS library can then read the
|
215
|
-
nonce value and set it on the dynamically generated script tag to
|
216
|
-
enable it to execute without needing 'unsafe-inline' enabled.
|
117
|
+
*Fumiaki Matsushima*
|
217
118
|
|
218
|
-
|
219
|
-
|
220
|
-
an XSS vulnerability which can take advantage of the nonce. It is
|
221
|
-
however an improvement on a blanket permission for inline scripts.
|
119
|
+
* Expose `ActionController::Parameters#each_key` which allows iterating over
|
120
|
+
keys without allocating an array.
|
222
121
|
|
223
|
-
|
224
|
-
using `nonce: true` to set the nonce value on the tag, e.g
|
122
|
+
*Richard Schneeman*
|
225
123
|
|
226
|
-
|
227
|
-
alert('Hello, World!');
|
228
|
-
<% end %>
|
124
|
+
* Purpose metadata for signed/encrypted cookies.
|
229
125
|
|
230
|
-
|
126
|
+
Rails can now thwart attacks that attempt to copy signed/encrypted value
|
127
|
+
of a cookie and use it as the value of another cookie.
|
231
128
|
|
232
|
-
|
129
|
+
It does so by stashing the cookie-name in the purpose field which is
|
130
|
+
then signed/encrypted along with the cookie value. Then, on a server-side
|
131
|
+
read, we verify the cookie-names and discard any attacked cookies.
|
233
132
|
|
234
|
-
|
133
|
+
Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
|
134
|
+
writes cookies with the new purpose and expiry metadata embedded.
|
235
135
|
|
236
|
-
|
237
|
-
|
238
|
-
# Parameters: {"param"=>"1", "param_two"=>"2"}
|
239
|
-
def index
|
240
|
-
params.each do |name|
|
241
|
-
puts name
|
242
|
-
end
|
243
|
-
end
|
244
|
-
|
245
|
-
# Prints
|
246
|
-
# param
|
247
|
-
# param_two
|
136
|
+
*Assain Jaleel*
|
248
137
|
|
249
|
-
|
138
|
+
* Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations.
|
250
139
|
|
251
|
-
|
140
|
+
`respond_to` can match multiple types and lead to undefined behavior when
|
141
|
+
multiple invocations are made and the types do not match:
|
252
142
|
|
253
|
-
|
254
|
-
|
255
|
-
|
256
|
-
|
143
|
+
respond_to do |outer_type|
|
144
|
+
outer_type.js do
|
145
|
+
respond_to do |inner_type|
|
146
|
+
inner_type.html { render body: "HTML" }
|
147
|
+
end
|
257
148
|
end
|
258
149
|
end
|
259
150
|
|
260
|
-
|
261
|
-
# param
|
262
|
-
# param_two
|
263
|
-
|
264
|
-
*Dominic Cleal*
|
151
|
+
*Patrick Toomey*
|
265
152
|
|
266
|
-
*
|
153
|
+
* `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
|
267
154
|
|
268
|
-
|
155
|
+
This allows uploaded file objects to be passed directly to `File.read`
|
156
|
+
without raising a `TypeError`:
|
269
157
|
|
270
|
-
|
271
|
-
|
158
|
+
uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
|
159
|
+
File.read(uploaded_file)
|
272
160
|
|
273
|
-
*
|
161
|
+
*Aaron Kromer*
|
274
162
|
|
275
|
-
*
|
276
|
-
default headers set.
|
163
|
+
* Pass along arguments to underlying `get` method in `follow_redirect!`.
|
277
164
|
|
278
|
-
|
165
|
+
Now all arguments passed to `follow_redirect!` are passed to the underlying
|
166
|
+
`get` method. This for example allows to set custom headers for the
|
167
|
+
redirection request to the server.
|
279
168
|
|
280
|
-
|
169
|
+
follow_redirect!(params: { foo: :bar })
|
281
170
|
|
282
|
-
*
|
171
|
+
*Remo Fritzsche*
|
283
172
|
|
284
|
-
*
|
173
|
+
* Introduce a new error page to when the implicit render page is accessed in the browser.
|
285
174
|
|
286
|
-
|
287
|
-
|
288
|
-
render the image. Other terminals, like those on Ubuntu, cannot handle the image
|
289
|
-
inline, but also don't handle it gracefully and instead of outputting the file
|
290
|
-
path, it dumps binary into the terminal.
|
175
|
+
Now instead of showing an error page that with exception and backtraces we now show only
|
176
|
+
one informative page.
|
291
177
|
|
292
|
-
|
178
|
+
*Vinicius Stock*
|
293
179
|
|
294
|
-
|
180
|
+
* Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
|
295
181
|
|
296
|
-
|
182
|
+
Exception aware plugin authors can use the newly introduced
|
183
|
+
`.register_interceptor` method to get the processed exception, instead of
|
184
|
+
monkey patching DebugExceptions.
|
297
185
|
|
298
|
-
|
299
|
-
|
300
|
-
* Fix optimized url helpers when using relative url root.
|
301
|
-
|
302
|
-
Fixes #31220.
|
303
|
-
|
304
|
-
*Andrew White*
|
305
|
-
|
306
|
-
* Add DSL for configuring Content-Security-Policy header.
|
307
|
-
|
308
|
-
The DSL allows you to configure a global Content-Security-Policy
|
309
|
-
header and then override within a controller. For more information
|
310
|
-
about the Content-Security-Policy header see MDN:
|
311
|
-
|
312
|
-
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
313
|
-
|
314
|
-
Example global policy:
|
315
|
-
|
316
|
-
# config/initializers/content_security_policy.rb
|
317
|
-
Rails.application.config.content_security_policy do |p|
|
318
|
-
p.default_src :self, :https
|
319
|
-
p.font_src :self, :https, :data
|
320
|
-
p.img_src :self, :https, :data
|
321
|
-
p.object_src :none
|
322
|
-
p.script_src :self, :https
|
323
|
-
p.style_src :self, :https, :unsafe_inline
|
324
|
-
end
|
325
|
-
|
326
|
-
Example controller overrides:
|
327
|
-
|
328
|
-
# Override policy inline
|
329
|
-
class PostsController < ApplicationController
|
330
|
-
content_security_policy do |p|
|
331
|
-
p.upgrade_insecure_requests true
|
332
|
-
end
|
333
|
-
end
|
334
|
-
|
335
|
-
# Using literal values
|
336
|
-
class PostsController < ApplicationController
|
337
|
-
content_security_policy do |p|
|
338
|
-
p.base_uri "https://www.example.com"
|
339
|
-
end
|
340
|
-
end
|
341
|
-
|
342
|
-
# Using mixed static and dynamic values
|
343
|
-
class PostsController < ApplicationController
|
344
|
-
content_security_policy do |p|
|
345
|
-
p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
|
346
|
-
end
|
186
|
+
ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
|
187
|
+
HypoteticalPlugin.capture_exception(request, exception)
|
347
188
|
end
|
348
189
|
|
349
|
-
|
350
|
-
legacy content using the `content_security_policy_report_only`
|
351
|
-
configuration attribute, e.g;
|
352
|
-
|
353
|
-
# config/initializers/content_security_policy.rb
|
354
|
-
Rails.application.config.content_security_policy_report_only = true
|
355
|
-
|
356
|
-
# controller override
|
357
|
-
class PostsController < ApplicationController
|
358
|
-
content_security_policy_report_only only: :index
|
359
|
-
end
|
360
|
-
|
361
|
-
Note that this feature does not validate the header for performance
|
362
|
-
reasons since the header is calculated at runtime.
|
363
|
-
|
364
|
-
*Andrew White*
|
365
|
-
|
366
|
-
* Make `assert_recognizes` to traverse mounted engines.
|
367
|
-
|
368
|
-
*Yuichiro Kaneko*
|
369
|
-
|
370
|
-
* Remove deprecated `ActionController::ParamsParser::ParseError`.
|
371
|
-
|
372
|
-
*Rafael Mendonça França*
|
373
|
-
|
374
|
-
* Add `:allow_other_host` option to `redirect_back` method.
|
375
|
-
|
376
|
-
When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
|
377
|
-
different host. `allow_other_host` is `true` by default.
|
378
|
-
|
379
|
-
*Tim Masliuchenko*
|
380
|
-
|
381
|
-
* Add headless chrome support to System Tests.
|
382
|
-
|
383
|
-
*Yuji Yaginuma*
|
384
|
-
|
385
|
-
* Add ability to enable Early Hints for HTTP/2
|
386
|
-
|
387
|
-
If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
|
388
|
-
|
389
|
-
The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
|
190
|
+
*Genadi Samokovarov*
|
390
191
|
|
391
|
-
|
392
|
-
|
393
|
-
* Simplify cookies middleware with key rotation support
|
394
|
-
|
395
|
-
Use the `rotate` method for both `MessageEncryptor` and
|
396
|
-
`MessageVerifier` to add key rotation support for encrypted and
|
397
|
-
signed cookies. This also helps simplify support for legacy cookie
|
398
|
-
security.
|
399
|
-
|
400
|
-
*Michael J Coyne*
|
401
|
-
|
402
|
-
* Use Capybara registered `:puma` server config.
|
403
|
-
|
404
|
-
The Capybara registered `:puma` server ensures the puma server is run in process so
|
405
|
-
connection sharing and open request detection work correctly by default.
|
406
|
-
|
407
|
-
*Thomas Walpole*
|
408
|
-
|
409
|
-
* Cookies `:expires` option supports `ActiveSupport::Duration` object.
|
410
|
-
|
411
|
-
cookies[:user_name] = { value: "assain", expires: 1.hour }
|
412
|
-
cookies[:key] = { value: "a yummy cookie", expires: 6.months }
|
413
|
-
|
414
|
-
Pull Request: #30121
|
415
|
-
|
416
|
-
*Assain Jaleel*
|
417
|
-
|
418
|
-
* Enforce signed/encrypted cookie expiry server side.
|
419
|
-
|
420
|
-
Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
|
421
|
-
|
422
|
-
It does so by stashing the expiry within the written cookie and relying on the
|
423
|
-
signing/encrypting to vouch that it hasn't been tampered with. Then on a
|
424
|
-
server-side read, the expiry is verified and any expired cookie is discarded.
|
425
|
-
|
426
|
-
Pull Request: #30121
|
427
|
-
|
428
|
-
*Assain Jaleel*
|
429
|
-
|
430
|
-
* Make `take_failed_screenshot` work within engine.
|
431
|
-
|
432
|
-
Fixes #30405.
|
433
|
-
|
434
|
-
*Yuji Yaginuma*
|
435
|
-
|
436
|
-
* Deprecate `ActionDispatch::TestResponse` response aliases.
|
437
|
-
|
438
|
-
`#success?`, `#missing?` & `#error?` are not supported by the actual
|
439
|
-
`ActionDispatch::Response` object and can produce false-positives. Instead,
|
440
|
-
use the response helpers provided by `Rack::Response`.
|
441
|
-
|
442
|
-
*Trevor Wistaff*
|
443
|
-
|
444
|
-
* Protect from forgery by default
|
445
|
-
|
446
|
-
Rather than protecting from forgery in the generated `ApplicationController`,
|
447
|
-
add it to `ActionController::Base` depending on
|
448
|
-
`config.action_controller.default_protect_from_forgery`. This configuration
|
449
|
-
defaults to false to support older versions which have removed it from their
|
450
|
-
`ApplicationController`, but is set to true for Rails 5.2.
|
451
|
-
|
452
|
-
*Lisa Ugray*
|
453
|
-
|
454
|
-
* Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
|
455
|
-
|
456
|
-
*Kir Shatrov*
|
457
|
-
|
458
|
-
* `driven_by` now registers poltergeist and capybara-webkit.
|
459
|
-
|
460
|
-
If poltergeist or capybara-webkit are set as drivers is set for System Tests,
|
461
|
-
`driven_by` will register the driver and set additional options passed via
|
462
|
-
the `:options` parameter.
|
463
|
-
|
464
|
-
Refer to the respective driver's documentation to see what options can be passed.
|
465
|
-
|
466
|
-
*Mario Chavez*
|
467
|
-
|
468
|
-
* AEAD encrypted cookies and sessions with GCM.
|
469
|
-
|
470
|
-
Encrypted cookies now use AES-GCM which couples authentication and
|
471
|
-
encryption in one faster step and produces shorter ciphertexts. Cookies
|
472
|
-
encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
|
473
|
-
this new mode is enabled via the
|
474
|
-
`action_dispatch.use_authenticated_cookie_encryption` configuration value.
|
475
|
-
|
476
|
-
*Michael J Coyne*
|
192
|
+
* Output only one Content-Security-Policy nonce header value per request.
|
477
193
|
|
478
|
-
|
194
|
+
Fixes #32597.
|
479
195
|
|
480
|
-
|
481
|
-
^template path ^template tree digest ^class ^id
|
196
|
+
*Andrey Novikov*, *Andrew White*
|
482
197
|
|
483
|
-
|
198
|
+
* Move default headers configuration into their own module that can be included in controllers.
|
484
199
|
|
485
|
-
*
|
486
|
-
`ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
|
487
|
-
to support it.
|
200
|
+
*Kevin Deisz*
|
488
201
|
|
489
|
-
|
202
|
+
* Add method `dig` to `session`.
|
490
203
|
|
491
|
-
*
|
204
|
+
*claudiob*, *Takumi Shotoku*
|
492
205
|
|
493
|
-
|
494
|
-
|
495
|
-
may not exist in a certain implementation.
|
206
|
+
* Controller level `force_ssl` has been deprecated in favor of
|
207
|
+
`config.force_ssl`.
|
496
208
|
|
497
|
-
|
209
|
+
*Derek Prior*
|
498
210
|
|
499
|
-
|
211
|
+
* Rails 6 requires Ruby 2.5.0 or newer.
|
500
212
|
|
501
|
-
*
|
213
|
+
*Jeremy Daer*, *Kasper Timm Hansen*
|
502
214
|
|
503
215
|
|
504
|
-
Please check [5-
|
216
|
+
Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.
|