RubyGems - actionpack - Versions diffs - 6.0.3.2 → 6.1.0 - Mend

actionpack 6.0.3.2 → 6.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (115) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +258 -223
data/MIT-LICENSE +1 -1
data/lib/abstract_controller.rb +1 -0
data/lib/abstract_controller/base.rb +35 -2
data/lib/abstract_controller/callbacks.rb +2 -2
data/lib/abstract_controller/helpers.rb +105 -90
data/lib/abstract_controller/rendering.rb +9 -9
data/lib/abstract_controller/translation.rb +8 -2
data/lib/action_controller.rb +2 -3
data/lib/action_controller/api.rb +2 -2
data/lib/action_controller/base.rb +4 -2
data/lib/action_controller/caching.rb +0 -1
data/lib/action_controller/log_subscriber.rb +3 -3
data/lib/action_controller/metal.rb +2 -2
data/lib/action_controller/metal/conditional_get.rb +10 -2
data/lib/action_controller/metal/content_security_policy.rb +1 -1
data/lib/action_controller/metal/cookies.rb +3 -1
data/lib/action_controller/metal/data_streaming.rb +1 -1
data/lib/action_controller/metal/etag_with_template_digest.rb +2 -4
data/lib/action_controller/metal/exceptions.rb +33 -0
data/lib/action_controller/metal/head.rb +7 -4
data/lib/action_controller/metal/helpers.rb +11 -1
data/lib/action_controller/metal/http_authentication.rb +4 -2
data/lib/action_controller/metal/implicit_render.rb +1 -1
data/lib/action_controller/metal/instrumentation.rb +11 -9
data/lib/action_controller/metal/live.rb +1 -1
data/lib/action_controller/metal/logging.rb +20 -0
data/lib/action_controller/metal/mime_responds.rb +6 -2
data/lib/action_controller/metal/parameter_encoding.rb +35 -4
data/lib/action_controller/metal/params_wrapper.rb +14 -8
data/lib/action_controller/metal/permissions_policy.rb +46 -0
data/lib/action_controller/metal/redirecting.rb +1 -1
data/lib/action_controller/metal/rendering.rb +6 -0
data/lib/action_controller/metal/request_forgery_protection.rb +48 -24
data/lib/action_controller/metal/rescue.rb +1 -1
data/lib/action_controller/metal/strong_parameters.rb +103 -15
data/lib/action_controller/renderer.rb +24 -13
data/lib/action_controller/test_case.rb +62 -56
data/lib/action_dispatch.rb +3 -2
data/lib/action_dispatch/http/cache.rb +12 -10
data/lib/action_dispatch/http/content_disposition.rb +2 -2
data/lib/action_dispatch/http/content_security_policy.rb +5 -1
data/lib/action_dispatch/http/filter_parameters.rb +1 -1
data/lib/action_dispatch/http/filter_redirect.rb +1 -1
data/lib/action_dispatch/http/headers.rb +3 -2
data/lib/action_dispatch/http/mime_negotiation.rb +20 -8
data/lib/action_dispatch/http/mime_type.rb +28 -15
data/lib/action_dispatch/http/parameters.rb +1 -19
data/lib/action_dispatch/http/permissions_policy.rb +173 -0
data/lib/action_dispatch/http/request.rb +26 -8
data/lib/action_dispatch/http/response.rb +17 -16
data/lib/action_dispatch/http/url.rb +3 -2
data/lib/action_dispatch/journey.rb +0 -2
data/lib/action_dispatch/journey/formatter.rb +53 -28
data/lib/action_dispatch/journey/gtg/builder.rb +22 -36
data/lib/action_dispatch/journey/gtg/simulator.rb +8 -7
data/lib/action_dispatch/journey/gtg/transition_table.rb +6 -4
data/lib/action_dispatch/journey/nfa/dot.rb +0 -11
data/lib/action_dispatch/journey/nodes/node.rb +4 -3
data/lib/action_dispatch/journey/parser.rb +13 -13
data/lib/action_dispatch/journey/parser.y +1 -1
data/lib/action_dispatch/journey/path/pattern.rb +13 -18
data/lib/action_dispatch/journey/route.rb +7 -18
data/lib/action_dispatch/journey/router.rb +26 -30
data/lib/action_dispatch/journey/router/utils.rb +6 -4
data/lib/action_dispatch/middleware/actionable_exceptions.rb +9 -2
data/lib/action_dispatch/middleware/cookies.rb +74 -33
data/lib/action_dispatch/middleware/debug_exceptions.rb +10 -17
data/lib/action_dispatch/middleware/debug_view.rb +1 -1
data/lib/action_dispatch/middleware/exception_wrapper.rb +29 -17
data/lib/action_dispatch/middleware/host_authorization.rb +25 -5
data/lib/action_dispatch/middleware/public_exceptions.rb +1 -1
data/lib/action_dispatch/middleware/remote_ip.rb +5 -4
data/lib/action_dispatch/middleware/request_id.rb +4 -5
data/lib/action_dispatch/middleware/session/abstract_store.rb +2 -2
data/lib/action_dispatch/middleware/session/cookie_store.rb +2 -2
data/lib/action_dispatch/middleware/ssl.rb +9 -6
data/lib/action_dispatch/middleware/stack.rb +18 -0
data/lib/action_dispatch/middleware/static.rb +154 -93
data/lib/action_dispatch/middleware/templates/rescues/_message_and_suggestions.html.erb +22 -0
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +2 -5
data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +2 -2
data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +2 -2
data/lib/action_dispatch/middleware/templates/rescues/layout.erb +100 -8
data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb +1 -1
data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +12 -1
data/lib/action_dispatch/railtie.rb +3 -2
data/lib/action_dispatch/request/session.rb +2 -8
data/lib/action_dispatch/request/utils.rb +26 -2
data/lib/action_dispatch/routing/inspector.rb +8 -7
data/lib/action_dispatch/routing/mapper.rb +102 -71
data/lib/action_dispatch/routing/polymorphic_routes.rb +12 -11
data/lib/action_dispatch/routing/redirection.rb +3 -3
data/lib/action_dispatch/routing/route_set.rb +49 -41
data/lib/action_dispatch/routing/url_for.rb +1 -0
data/lib/action_dispatch/system_test_case.rb +29 -24
data/lib/action_dispatch/system_testing/browser.rb +33 -27
data/lib/action_dispatch/system_testing/driver.rb +6 -7
data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +47 -6
data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb +4 -7
data/lib/action_dispatch/testing/assertions.rb +1 -1
data/lib/action_dispatch/testing/assertions/response.rb +2 -4
data/lib/action_dispatch/testing/assertions/routing.rb +5 -5
data/lib/action_dispatch/testing/integration.rb +38 -27
data/lib/action_dispatch/testing/test_process.rb +29 -4
data/lib/action_dispatch/testing/test_request.rb +3 -3
data/lib/action_pack.rb +1 -1
data/lib/action_pack/gem_version.rb +3 -3
metadata +21 -22
data/lib/action_controller/metal/force_ssl.rb +0 -58
data/lib/action_dispatch/http/parameter_filter.rb +0 -12
data/lib/action_dispatch/journey/nfa/builder.rb +0 -78
data/lib/action_dispatch/journey/nfa/simulator.rb +0 -47
data/lib/action_dispatch/journey/nfa/transition_table.rb +0 -119

data/lib/action_dispatch/journey/router/utils.rb CHANGED

@@ -19,11 +19,13 @@ module ActionDispatch
           encoding = path.encoding
           path = +"/#{path}"
           path.squeeze!("/")
-          path.sub!(%r{/+\Z}, "")
-          path.gsub!(/(%[a-f0-9]{2})/) { $1.upcase }
-          path = +"/" if path == ""
+          unless path == "/"
+            path.delete_suffix!("/")
+            path.gsub!(/(%[a-f0-9]{2})/) { $1.upcase }
+          end
           path.force_encoding(encoding)
-          path
         end
         # URI path and fragment escaping

data/lib/action_dispatch/middleware/actionable_exceptions.rb CHANGED

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require "erb"
+require "uri"
 require "action_dispatch/http/request"
 require "active_support/actionable_error"
@@ -23,11 +24,17 @@ module ActionDispatch
     private
       def actionable_request?(request)
-        request.get_header("action_dispatch.show_detailed_exceptions")  && request.post? && request.path == endpoint
+        request.get_header("action_dispatch.show_detailed_exceptions") && request.post? && request.path == endpoint
       end
       def redirect_to(location)
-        body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(location)}\">redirected</a>.</body></html>"
+        uri = URI.parse location
+        if uri.relative? || uri.scheme == "http" || uri.scheme == "https"
+          body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(location)}\">redirected</a>.</body></html>"
+        else
+          return [400, { "Content-Type" => "text/plain" }, ["Invalid redirection URI"]]
+        end
         [302, {
           "Content-Type" => "text/html; charset=#{Response.default_charset}",

data/lib/action_dispatch/middleware/cookies.rb CHANGED

@@ -69,6 +69,10 @@ module ActionDispatch
       get_header Cookies::COOKIES_SERIALIZER
     end
+    def cookies_same_site_protection
+      get_header(Cookies::COOKIES_SAME_SITE_PROTECTION) || Proc.new { }
+    end
     def cookies_digest
       get_header Cookies::COOKIES_DIGEST
     end
@@ -84,11 +88,10 @@ module ActionDispatch
     # :startdoc:
   end
-  # \Cookies are read and written through ActionController#cookies.
+  # Read and write data to cookies through ActionController#cookies.
   #
-  # The cookies being read are the ones received along with the request, the cookies
-  # being written will be sent out with the response. Reading a cookie does not get
-  # the cookie object itself back, just the value it holds.
+  # When reading cookie data, the data is read from the HTTP request header, Cookie.
+  # When writing cookie data, the data is sent out in the HTTP response header, Set-Cookie.
   #
   # Examples of writing:
   #
@@ -150,8 +153,10 @@ module ActionDispatch
   # * <tt>:domain</tt> - The domain for which this cookie applies so you can
   #   restrict to the domain level. If you use a schema like www.example.com
   #   and want to share session with user.example.com set <tt>:domain</tt>
-  #   to <tt>:all</tt>. Make sure to specify the <tt>:domain</tt> option with
-  #   <tt>:all</tt> or <tt>Array</tt> again when deleting cookies.
+  #   to <tt>:all</tt>. To support multiple domains, provide an array, and
+  #   the first domain matching <tt>request.host</tt> will be used. Make
+  #   sure to specify the <tt>:domain</tt> option with <tt>:all</tt> or
+  #   <tt>Array</tt> again when deleting cookies.
   #
   #     domain: nil  # Does not set cookie domain. (default)
   #     domain: :all # Allow the cookie for the top most level
@@ -181,6 +186,7 @@ module ActionDispatch
     COOKIES_SERIALIZER = "action_dispatch.cookies_serializer"
     COOKIES_DIGEST = "action_dispatch.cookies_digest"
     COOKIES_ROTATIONS = "action_dispatch.cookies_rotations"
+    COOKIES_SAME_SITE_PROTECTION = "action_dispatch.cookies_same_site_protection"
     USE_COOKIES_WITH_METADATA = "action_dispatch.use_cookies_with_metadata"
     # Cookies can typically store 4096 bytes.
@@ -259,6 +265,12 @@ module ActionDispatch
             request.use_authenticated_cookie_encryption
         end
+        def prepare_upgrade_legacy_hmac_aes_cbc_cookies?
+          request.secret_key_base.present? &&
+            request.authenticated_encrypted_cookie_salt.present? &&
+            !request.use_authenticated_cookie_encryption
+        end
         def encrypted_cookie_cipher
           request.encrypted_cookie_cipher || "aes-256-gcm"
         end
@@ -286,9 +298,9 @@ module ActionDispatch
       DOMAIN_REGEXP = /[^.]*\.([^.]*|..\...|...\...)$/
       def self.build(req, cookies)
-        new(req).tap do |hash|
-          hash.update(cookies)
-        end
+        jar = new(req)
+        jar.update(cookies)
+        jar
       end
       attr_reader :request
@@ -346,28 +358,6 @@ module ActionDispatch
         @cookies.map { |k, v| "#{escape(k)}=#{escape(v)}" }.join "; "
       end
-      def handle_options(options) # :nodoc:
-        if options[:expires].respond_to?(:from_now)
-          options[:expires] = options[:expires].from_now
-        end
-        options[:path] ||= "/"
-        if options[:domain] == :all || options[:domain] == "all"
-          # If there is a provided tld length then we use it otherwise default domain regexp.
-          domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
-          # If host is not ip and matches domain regexp.
-          # (ip confirms to domain regexp so we explicitly check for ip)
-          options[:domain] = if (request.host !~ /^[\d.]+$/) && (request.host =~ domain_regexp)
-            ".#{$&}"
-          end
-        elsif options[:domain].is_a? Array
-          # If host matches one of the supplied domains without a dot in front of it.
-          options[:domain] = options[:domain].find { |domain| request.host.include? domain.sub(/^\./, "") }
-        end
-      end
       # Sets the cookie named +name+. The second argument may be the cookie's
       # value or a hash of options as documented above.
       def []=(name, options)
@@ -447,6 +437,34 @@ module ActionDispatch
         def write_cookie?(cookie)
           request.ssl? || !cookie[:secure] || always_write_cookie
         end
+        def handle_options(options)
+          if options[:expires].respond_to?(:from_now)
+            options[:expires] = options[:expires].from_now
+          end
+          options[:path]      ||= "/"
+          cookies_same_site_protection = request.cookies_same_site_protection
+          options[:same_site] ||= cookies_same_site_protection.call(request)
+          if options[:domain] == :all || options[:domain] == "all"
+            # If there is a provided tld length then we use it otherwise default domain regexp.
+            domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
+            # If host is not ip and matches domain regexp.
+            # (ip confirms to domain regexp so we explicitly check for ip)
+            options[:domain] = if !request.host.match?(/^[\d.]+$/) && (request.host =~ domain_regexp)
+              ".#{$&}"
+            end
+          elsif options[:domain].is_a? Array
+            # If host matches one of the supplied domains.
+            options[:domain] = options[:domain].find do |domain|
+              domain = domain.delete_prefix(".")
+              request.host == domain || request.host.end_with?(".#{domain}")
+            end
+          end
+        end
     end
     class AbstractCookieJar # :nodoc:
@@ -458,7 +476,13 @@ module ActionDispatch
       def [](name)
         if data = @parent_jar[name.to_s]
-          parse(name, data, purpose: "cookie.#{name}") || parse(name, data)
+          result = parse(name, data, purpose: "cookie.#{name}")
+          if result.nil?
+            parse(name, data)
+          else
+            result
+          end
         end
       end
@@ -502,6 +526,18 @@ module ActionDispatch
         end
     end
+    class MarshalWithJsonFallback # :nodoc:
+      def self.load(value)
+        Marshal.load(value)
+      rescue TypeError => e
+        ActiveSupport::JSON.decode(value) rescue raise e
+      end
+      def self.dump(value)
+        Marshal.dump(value)
+      end
+    end
     class JsonSerializer # :nodoc:
       def self.load(value)
         ActiveSupport::JSON.decode(value)
@@ -549,7 +585,7 @@ module ActionDispatch
           serializer = request.cookies_serializer || :marshal
           case serializer
           when :marshal
-            Marshal
+            MarshalWithJsonFallback
           when :json, :hybrid
             JsonSerializer
           else
@@ -619,6 +655,11 @@ module ActionDispatch
           sign_secret = request.key_generator.generate_key(request.encrypted_signed_cookie_salt)
           @encryptor.rotate(secret, sign_secret, cipher: legacy_cipher, digest: digest, serializer: SERIALIZER)
+        elsif prepare_upgrade_legacy_hmac_aes_cbc_cookies?
+          future_cipher = encrypted_cookie_cipher
+          secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, ActiveSupport::MessageEncryptor.key_len(future_cipher))
+          @encryptor.rotate(secret, nil, cipher: future_cipher, serializer: SERIALIZER)
         end
       end

data/lib/action_dispatch/middleware/debug_exceptions.rb CHANGED

@@ -4,10 +4,7 @@ require "action_dispatch/http/request"
 require "action_dispatch/middleware/exception_wrapper"
 require "action_dispatch/routing/inspector"
-require "active_support/actionable_error"
 require "action_view"
-require "action_view/base"
 module ActionDispatch
   # This middleware is responsible for logging exceptions and
@@ -63,8 +60,8 @@ module ActionDispatch
         if request.get_header("action_dispatch.show_detailed_exceptions")
           begin
             content_type = request.formats.first
-          rescue Mime::Type::InvalidMimeType
-            render_for_api_request(Mime[:text], wrapper)
+          rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+            content_type = Mime[:text]
           end
           if api_request?(content_type)
@@ -140,20 +137,16 @@ module ActionDispatch
         return unless logger
         exception = wrapper.exception
+        trace = wrapper.exception_trace
-        trace = wrapper.application_trace
-        trace = wrapper.framework_trace if trace.empty?
-        ActiveSupport::Deprecation.silence do
-          message = []
-          message << "  "
-          message << "#{exception.class} (#{exception.message}):"
-          message.concat(exception.annotated_source_code) if exception.respond_to?(:annotated_source_code)
-          message << "  "
-          message.concat(trace)
+        message = []
+        message << "  "
+        message << "#{exception.class} (#{exception.message}):"
+        message.concat(exception.annotated_source_code) if exception.respond_to?(:annotated_source_code)
+        message << "  "
+        message.concat(trace)
-          log_array(logger, message)
-        end
+        log_array(logger, message)
       end
       def log_array(logger, array)

data/lib/action_dispatch/middleware/debug_view.rb CHANGED

@@ -12,7 +12,7 @@ module ActionDispatch
     def initialize(assigns)
       paths = [RESCUES_TEMPLATE_PATH]
       lookup_context = ActionView::LookupContext.new(paths)
-      super(lookup_context, assigns)
+      super(lookup_context, assigns, nil)
     end
     def compiled_method_container

data/lib/action_dispatch/middleware/exception_wrapper.rb CHANGED

@@ -6,21 +6,21 @@ require "rack/utils"
 module ActionDispatch
   class ExceptionWrapper
     cattr_accessor :rescue_responses, default: Hash.new(:internal_server_error).merge!(
-      "ActionController::RoutingError"               => :not_found,
-      "AbstractController::ActionNotFound"           => :not_found,
-      "ActionController::MethodNotAllowed"           => :method_not_allowed,
-      "ActionController::UnknownHttpMethod"          => :method_not_allowed,
-      "ActionController::NotImplemented"             => :not_implemented,
-      "ActionController::UnknownFormat"              => :not_acceptable,
-      "Mime::Type::InvalidMimeType"                  => :not_acceptable,
-      "ActionController::MissingExactTemplate"       => :not_acceptable,
-      "ActionController::InvalidAuthenticityToken"   => :unprocessable_entity,
-      "ActionController::InvalidCrossOriginRequest"  => :unprocessable_entity,
-      "ActionDispatch::Http::Parameters::ParseError" => :bad_request,
-      "ActionController::BadRequest"                 => :bad_request,
-      "ActionController::ParameterMissing"           => :bad_request,
-      "Rack::QueryParser::ParameterTypeError"        => :bad_request,
-      "Rack::QueryParser::InvalidParameterError"     => :bad_request
+      "ActionController::RoutingError"                     => :not_found,
+      "AbstractController::ActionNotFound"                 => :not_found,
+      "ActionController::MethodNotAllowed"                 => :method_not_allowed,
+      "ActionController::UnknownHttpMethod"                => :method_not_allowed,
+      "ActionController::NotImplemented"                   => :not_implemented,
+      "ActionController::UnknownFormat"                    => :not_acceptable,
+      "ActionDispatch::Http::MimeNegotiation::InvalidType" => :not_acceptable,
+      "ActionController::MissingExactTemplate"             => :not_acceptable,
+      "ActionController::InvalidAuthenticityToken"         => :unprocessable_entity,
+      "ActionController::InvalidCrossOriginRequest"        => :unprocessable_entity,
+      "ActionDispatch::Http::Parameters::ParseError"       => :bad_request,
+      "ActionController::BadRequest"                       => :bad_request,
+      "ActionController::ParameterMissing"                 => :bad_request,
+      "Rack::QueryParser::ParameterTypeError"              => :bad_request,
+      "Rack::QueryParser::InvalidParameterError"           => :bad_request
     )
     cattr_accessor :rescue_templates, default: Hash.new("diagnostics").merge!(
@@ -36,18 +36,24 @@ module ActionDispatch
       "ActionView::Template::Error"
     ]
+    cattr_accessor :silent_exceptions, default: [
+      "ActionController::RoutingError",
+      "ActionDispatch::Http::MimeNegotiation::InvalidType"
+    ]
     attr_reader :backtrace_cleaner, :exception, :wrapped_causes, :line_number, :file
     def initialize(backtrace_cleaner, exception)
       @backtrace_cleaner = backtrace_cleaner
       @exception = exception
+      @exception_class_name = @exception.class.name
       @wrapped_causes = wrapped_causes_for(exception, backtrace_cleaner)
       expand_backtrace if exception.is_a?(SyntaxError) || exception.cause.is_a?(SyntaxError)
     end
     def unwrapped_exception
-      if wrapper_exceptions.include?(exception.class.to_s)
+      if wrapper_exceptions.include?(@exception_class_name)
         exception.cause
       else
         exception
@@ -55,13 +61,19 @@ module ActionDispatch
     end
     def rescue_template
-      @@rescue_templates[@exception.class.name]
+      @@rescue_templates[@exception_class_name]
     end
     def status_code
       self.class.status_code_for_exception(unwrapped_exception.class.name)
     end
+    def exception_trace
+      trace = application_trace
+      trace = framework_trace if trace.empty? && !silent_exceptions.include?(@exception_class_name)
+      trace
+    end
     def application_trace
       clean_backtrace(:silent)
     end

data/lib/action_dispatch/middleware/host_authorization.rb CHANGED

@@ -4,7 +4,12 @@ require "action_dispatch/http/request"
 module ActionDispatch
   # This middleware guards from DNS rebinding attacks by explicitly permitting
-  # the hosts a request can be sent to.
+  # the hosts a request can be sent to, and is passed the options set in
+  # +config.host_authorization+.
+  #
+  # Requests can opt-out of Host Authorization with +exclude+:
+  #
+  #    config.host_authorization = { exclude: ->(request) { request.path =~ /healthcheck/ } }
   #
   # When a request comes to an unauthorized host, the +response_app+
   # application will be executed and rendered. If no +response_app+ is given, a
@@ -46,9 +51,9 @@ module ActionDispatch
         def sanitize_string(host)
           if host.start_with?(".")
-            /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/
+            /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
           else
-            host
+            /\A#{host}\z/i
           end
         end
     end
@@ -66,9 +71,20 @@ module ActionDispatch
       }, [body]]
     end
-    def initialize(app, hosts, response_app = nil)
+    def initialize(app, hosts, deprecated_response_app = nil, exclude: nil, response_app: nil)
       @app = app
       @permissions = Permissions.new(hosts)
+      @exclude = exclude
+      unless deprecated_response_app.nil?
+        ActiveSupport::Deprecation.warn(<<-MSG.squish)
+          `action_dispatch.hosts_response_app` is deprecated and will be ignored in Rails 6.2.
+          Use the Host Authorization `response_app` setting instead.
+        MSG
+        response_app ||= deprecated_response_app
+      end
       @response_app = response_app || DEFAULT_RESPONSE_APP
     end
@@ -77,7 +93,7 @@ module ActionDispatch
       request = Request.new(env)
-      if authorized?(request)
+      if authorized?(request) || excluded?(request)
         mark_as_authorized(request)
         @app.call(env)
       else
@@ -94,6 +110,10 @@ module ActionDispatch
           (forwarded_host.blank? || @permissions.allows?(forwarded_host))
       end
+      def excluded?(request)
+        @exclude && @exclude.call(request)
+      end
       def mark_as_authorized(request)
         request.set_header("action_dispatch.authorized_host", request.host)
       end

data/lib/action_dispatch/middleware/public_exceptions.rb CHANGED

@@ -23,7 +23,7 @@ module ActionDispatch
       status       = request.path_info[1..-1].to_i
       begin
         content_type = request.formats.first
-      rescue Mime::Type::InvalidMimeType
+      rescue ActionDispatch::Http::MimeNegotiation::InvalidType
         content_type = Mime[:text]
       end
       body = { status: status, error: Rack::Utils::HTTP_STATUS_CODES.fetch(status, Rack::Utils::HTTP_STATUS_CODES[500]) }