actionpack 6.0.4.7 → 6.1.0.rc1

data/lib/action_dispatch/journey/nfa/dot.rb

@@ -9,17 +9,6 @@ module ActionDispatch
             "  #{from} -> #{to} [label=\"#{sym || 'ε'}\"];"
           }
 
-          # memo_nodes = memos.values.flatten.map { |n|
-          #   label = n
-          #   if Journey::Route === n
-          #     label = "#{n.verb.source} #{n.path.spec}"
-          #   end
-          #   "  #{n.object_id} [label=\"#{label}\", shape=box];"
-          # }
-          # memo_edges = memos.flat_map { |k, memos|
-          #   (memos || []).map { |v| "  #{k} -> #{v.object_id};" }
-          # }.uniq
-
           <<-eodot
 digraph nfa {
   rankdir=LR;

data/lib/action_dispatch/journey/nodes/node.rb

@@ -79,9 +79,10 @@ module ActionDispatch
         attr_reader :name
 
         DEFAULT_EXP = /[^\.\/\?]+/
-        def initialize(left)
-          super
-          @regexp = DEFAULT_EXP
+        GREEDY_EXP = /(.+)/
+        def initialize(left, regexp = DEFAULT_EXP)
+          super(left)
+          @regexp = regexp
           @name = -left.tr("*:", "")
         end
 

data/lib/action_dispatch/journey/parser.rb

@@ -1,6 +1,6 @@
 #
 # DO NOT MODIFY!!!!
-# This file is automatically generated by Racc 1.4.14
+# This file is automatically generated by Racc 1.4.16
 # from Racc grammar file "".
 #
 
@@ -135,11 +135,11 @@ Racc_debug_parser = false
 # reduce 0 omitted
 
 def _reduce_1(val, _values)
- Cat.new(val.first, val.last) 
+ Cat.new(val.first, val.last)
 end
 
 def _reduce_2(val, _values)
- val.first 
+ val.first
 end
 
 # reduce 3 omitted
@@ -151,19 +151,19 @@ end
 # reduce 6 omitted
 
 def _reduce_7(val, _values)
- Group.new(val[1]) 
+ Group.new(val[1])
 end
 
 def _reduce_8(val, _values)
- Or.new([val.first, val.last]) 
+ Or.new([val.first, val.last])
 end
 
 def _reduce_9(val, _values)
- Or.new([val.first, val.last]) 
+ Or.new([val.first, val.last])
 end
 
 def _reduce_10(val, _values)
- Star.new(Symbol.new(val.last)) 
+ Star.new(Symbol.new(val.last, Symbol::GREEDY_EXP))
 end
 
 # reduce 11 omitted
@@ -175,19 +175,19 @@ end
 # reduce 14 omitted
 
 def _reduce_15(val, _values)
- Slash.new(val.first) 
+ Slash.new(val.first)
 end
 
 def _reduce_16(val, _values)
- Symbol.new(val.first) 
+ Symbol.new(val.first)
 end
 
 def _reduce_17(val, _values)
- Literal.new(val.first) 
+ Literal.new(val.first)
 end
 
 def _reduce_18(val, _values)
- Dot.new(val.first) 
+ Dot.new(val.first)
 end
 
 def _reduce_none(val, _values)
@@ -195,5 +195,5 @@ def _reduce_none(val, _values)
 end
 
     end   # class Parser
-    end   # module Journey
-  end   # module ActionDispatch
+  end   # module Journey
+end   # module ActionDispatch

data/lib/action_dispatch/journey/parser.y

@@ -21,7 +21,7 @@ rule
     | expression OR or { Or.new([val.first, val.last]) }
     ;
   star
-    : STAR       { Star.new(Symbol.new(val.last)) }
+    : STAR       { Star.new(Symbol.new(val.last, Symbol::GREEDY_EXP)) }
     ;
   terminal
     : symbol

data/lib/action_dispatch/journey/path/pattern.rb

@@ -6,16 +6,6 @@ module ActionDispatch
       class Pattern # :nodoc:
         attr_reader :spec, :requirements, :anchored
 
-        def self.from_string(string)
-          build(string, {}, "/.?", true)
-        end
-
-        def self.build(path, requirements, separators, anchored)
-          parser = Journey::Parser.new
-          ast = parser.parse path
-          new ast, requirements, separators, anchored
-        end
-
         def initialize(ast, requirements, separators, anchored)
           @spec         = ast
           @requirements = requirements
@@ -46,11 +36,6 @@ module ActionDispatch
             node.regexp = re if re
           end
 
-          @spec.find_all(&:star?).each do |node|
-            node = node.left
-            node.regexp = @requirements[node.to_sym] || /(.+)/
-          end
-
           @spec
         end
 
@@ -81,7 +66,7 @@ module ActionDispatch
           end
 
           def visit_CAT(node)
-            [visit(node.left), visit(node.right)].join
+            "#{visit(node.left)}#{visit(node.right)}"
           end
 
           def visit_SYMBOL(node)
@@ -107,8 +92,8 @@ module ActionDispatch
           end
 
           def visit_STAR(node)
-            re = @matchers[node.left.to_sym] || ".+"
-            "(#{re})"
+            re = @matchers[node.left.to_sym]
+            re ? "(#{re})" : "(.+)"
           end
 
           def visit_OR(node)
@@ -165,6 +150,10 @@ module ActionDispatch
         end
         alias :=~ :match
 
+        def match?(other)
+          to_regexp.match?(other)
+        end
+
         def source
           to_regexp.source
         end
@@ -173,6 +162,12 @@ module ActionDispatch
           @re ||= regexp_visitor.new(@separators, @requirements).accept spec
         end
 
+        def requirements_for_missing_keys_check
+          @requirements_for_missing_keys_check ||= requirements.transform_values do |regex|
+            /\A#{regex}\Z/
+          end
+        end
+
         private
           def regexp_visitor
             @anchored ? AnchoredRegexp : UnanchoredRegexp

data/lib/action_dispatch/journey/route.rb

@@ -13,6 +13,7 @@ module ActionDispatch
         VERBS = %w{ DELETE GET HEAD OPTIONS LINK PATCH POST PUT TRACE UNLINK }
         VERBS.each do |v|
           class_eval <<-eoc, __FILE__, __LINE__ + 1
+            # frozen_string_literal: true
             class #{v}
               def self.verb; name.split("::").last; end
               def self.call(req); req.#{v.downcase}?; end
@@ -27,7 +28,7 @@ module ActionDispatch
             @verb = verb
           end
 
-          def call(request); @verb === request.request_method; end
+          def call(request); @verb == request.request_method; end
         end
 
         class All
@@ -49,15 +50,10 @@ module ActionDispatch
         end
       end
 
-      def self.build(name, app, path, constraints, required_defaults, defaults)
-        request_method_match = verb_matcher(constraints.delete(:request_method))
-        new name, app, path, constraints, required_defaults, defaults, request_method_match, 0, {}
-      end
-
       ##
       # +path+ is a path constraint.
       # +constraints+ is a hash of constraints to be applied to this route.
-      def initialize(name, app, path, constraints, required_defaults, defaults, request_method_match, precedence, scope_options, internal = false)
+      def initialize(name:, app: nil, path:, constraints: {}, required_defaults: [], defaults: {}, request_method_match: nil, precedence: 0, scope_options: {}, internal: false)
         @name        = name
         @app         = app
         @path        = path
@@ -92,7 +88,7 @@ module ActionDispatch
         end
       end
 
-      # Needed for `rails routes`. Picks up succinctly defined requirements
+      # Needed for `bin/rails routes`. Picks up succinctly defined requirements
       # for a route, for example route
       #
       #   get 'photo/:id', :controller => 'photos', :action => 'show',
@@ -115,18 +111,11 @@ module ActionDispatch
       end
 
       def score(supplied_keys)
-        required_keys = path.required_names
-
-        required_keys.each do |k|
+        path.required_names.each do |k|
           return -1 unless supplied_keys.include?(k)
         end
 
-        score = 0
-        path.names.each do |k|
-          score += 1 if supplied_keys.include?(k)
-        end
-
-        score + (required_defaults.length * 2)
+        (required_defaults.length * 2) + path.names.count { |k| supplied_keys.include?(k) }
       end
 
       def parts
@@ -153,7 +142,7 @@ module ActionDispatch
       end
 
       def glob?
-        !path.spec.grep(Nodes::Star).empty?
+        path.spec.any?(Nodes::Star)
       end
 
       def dispatcher?

data/lib/action_dispatch/journey/router/utils.rb

@@ -19,11 +19,13 @@ module ActionDispatch
           encoding = path.encoding
           path = +"/#{path}"
           path.squeeze!("/")
-          path.sub!(%r{/+\Z}, "")
-          path.gsub!(/(%[a-f0-9]{2})/) { $1.upcase }
-          path = +"/" if path == ""
+
+          unless path == "/"
+            path.delete_suffix!("/")
+            path.gsub!(/(%[a-f0-9]{2})/) { $1.upcase }
+          end
+
           path.force_encoding(encoding)
-          path
         end
 
         # URI path and fragment escaping

data/lib/action_dispatch/journey/router.rb

@@ -40,11 +40,12 @@ module ActionDispatch
             req.path_info = "/" + req.path_info unless req.path_info.start_with? "/"
           end
 
-          parameters = route.defaults.merge parameters.transform_values { |val|
-            val.dup.force_encoding(::Encoding::UTF_8)
+          tmp_params = set_params.merge route.defaults
+          parameters.each_pair { |key, val|
+            tmp_params[key] = val.force_encoding(::Encoding::UTF_8)
           }
 
-          req.path_parameters = set_params.merge parameters
+          req.path_parameters = tmp_params
 
           status, headers, body = route.app.serve(req)
 
@@ -65,7 +66,8 @@ module ActionDispatch
         find_routes(rails_req).each do |match, parameters, route|
           unless route.path.anchored
             rails_req.script_name = match.to_s
-            rails_req.path_info   = match.post_match.sub(/^([^\/])/, '/\1')
+            rails_req.path_info   = match.post_match
+            rails_req.path_info   = "/" + rails_req.path_info unless rails_req.path_info.start_with? "/"
           end
 
           parameters = route.defaults.merge parameters
@@ -105,23 +107,24 @@ module ActionDispatch
         end
 
         def find_routes(req)
-          routes = filter_routes(req.path_info).concat custom_routes.find_all { |r|
-            r.path.match(req.path_info)
+          path_info = req.path_info
+          routes = filter_routes(path_info).concat custom_routes.find_all { |r|
+            r.path.match?(path_info)
           }
 
-          routes =
-            if req.head?
-              match_head_routes(routes, req)
-            else
-              match_routes(routes, req)
-            end
+          if req.head?
+            routes = match_head_routes(routes, req)
+          else
+            routes.select! { |r| r.matches?(req) }
+          end
 
           routes.sort_by!(&:precedence)
 
           routes.map! { |r|
-            match_data = r.path.match(req.path_info)
+            match_data = r.path.match(path_info)
             path_parameters = {}
-            match_data.names.zip(match_data.captures) { |name, val|
+            match_data.names.each_with_index { |name, i|
+              val = match_data[i + 1]
               path_parameters[name.to_sym] = Utils.unescape_uri(val) if val
             }
             [match_data, path_parameters, r]
@@ -129,24 +132,17 @@ module ActionDispatch
         end
 
         def match_head_routes(routes, req)
-          verb_specific_routes = routes.select(&:requires_matching_verb?)
-          head_routes = match_routes(verb_specific_routes, req)
-
-          if head_routes.empty?
-            begin
-              req.request_method = "GET"
-              match_routes(routes, req)
-            ensure
-              req.request_method = "HEAD"
-            end
-          else
-            head_routes
+          head_routes = routes.select { |r| r.requires_matching_verb? && r.matches?(req) }
+          return head_routes unless head_routes.empty?
+
+          begin
+            req.request_method = "GET"
+            routes.select! { |r| r.matches?(req) }
+            routes
+          ensure
+            req.request_method = "HEAD"
           end
         end
-
-        def match_routes(routes, req)
-          routes.select { |r| r.matches?(req) }
-        end
     end
   end
 end

data/lib/action_dispatch/journey.rb

@@ -3,5 +3,3 @@
 require "action_dispatch/journey/router"
 require "action_dispatch/journey/gtg/builder"
 require "action_dispatch/journey/gtg/simulator"
-require "action_dispatch/journey/nfa/builder"
-require "action_dispatch/journey/nfa/simulator"

data/lib/action_dispatch/middleware/actionable_exceptions.rb

@@ -24,7 +24,7 @@ module ActionDispatch
 
     private
       def actionable_request?(request)
-        request.get_header("action_dispatch.show_detailed_exceptions")  && request.post? && request.path == endpoint
+        request.get_header("action_dispatch.show_detailed_exceptions") && request.post? && request.path == endpoint
       end
 
       def redirect_to(location)

data/lib/action_dispatch/middleware/cookies.rb

@@ -69,6 +69,10 @@ module ActionDispatch
       get_header Cookies::COOKIES_SERIALIZER
     end
 
+    def cookies_same_site_protection
+      get_header(Cookies::COOKIES_SAME_SITE_PROTECTION) || Proc.new { }
+    end
+
     def cookies_digest
       get_header Cookies::COOKIES_DIGEST
     end
@@ -84,11 +88,10 @@ module ActionDispatch
     # :startdoc:
   end
 
-  # \Cookies are read and written through ActionController#cookies.
+  # Read and write data to cookies through ActionController#cookies.
   #
-  # The cookies being read are the ones received along with the request, the cookies
-  # being written will be sent out with the response. Reading a cookie does not get
-  # the cookie object itself back, just the value it holds.
+  # When reading cookie data, the data is read from the HTTP request header, Cookie.
+  # When writing cookie data, the data is sent out in the HTTP response header, Set-Cookie.
   #
   # Examples of writing:
   #
@@ -150,8 +153,10 @@ module ActionDispatch
   # * <tt>:domain</tt> - The domain for which this cookie applies so you can
   #   restrict to the domain level. If you use a schema like www.example.com
   #   and want to share session with user.example.com set <tt>:domain</tt>
-  #   to <tt>:all</tt>. Make sure to specify the <tt>:domain</tt> option with
-  #   <tt>:all</tt> or <tt>Array</tt> again when deleting cookies.
+  #   to <tt>:all</tt>. To support multiple domains, provide an array, and
+  #   the first domain matching <tt>request.host</tt> will be used. Make
+  #   sure to specify the <tt>:domain</tt> option with <tt>:all</tt> or
+  #   <tt>Array</tt> again when deleting cookies.
   #
   #     domain: nil  # Does not set cookie domain. (default)
   #     domain: :all # Allow the cookie for the top most level
@@ -181,6 +186,7 @@ module ActionDispatch
     COOKIES_SERIALIZER = "action_dispatch.cookies_serializer"
     COOKIES_DIGEST = "action_dispatch.cookies_digest"
     COOKIES_ROTATIONS = "action_dispatch.cookies_rotations"
+    COOKIES_SAME_SITE_PROTECTION = "action_dispatch.cookies_same_site_protection"
     USE_COOKIES_WITH_METADATA = "action_dispatch.use_cookies_with_metadata"
 
     # Cookies can typically store 4096 bytes.
@@ -259,6 +265,12 @@ module ActionDispatch
             request.use_authenticated_cookie_encryption
         end
 
+        def prepare_upgrade_legacy_hmac_aes_cbc_cookies?
+          request.secret_key_base.present? &&
+            request.authenticated_encrypted_cookie_salt.present? &&
+            !request.use_authenticated_cookie_encryption
+        end
+
         def encrypted_cookie_cipher
           request.encrypted_cookie_cipher || "aes-256-gcm"
         end
@@ -286,9 +298,9 @@ module ActionDispatch
       DOMAIN_REGEXP = /[^.]*\.([^.]*|..\...|...\...)$/
 
       def self.build(req, cookies)
-        new(req).tap do |hash|
-          hash.update(cookies)
-        end
+        jar = new(req)
+        jar.update(cookies)
+        jar
       end
 
       attr_reader :request
@@ -346,28 +358,6 @@ module ActionDispatch
         @cookies.map { |k, v| "#{escape(k)}=#{escape(v)}" }.join "; "
       end
 
-      def handle_options(options) # :nodoc:
-        if options[:expires].respond_to?(:from_now)
-          options[:expires] = options[:expires].from_now
-        end
-
-        options[:path] ||= "/"
-
-        if options[:domain] == :all || options[:domain] == "all"
-          # If there is a provided tld length then we use it otherwise default domain regexp.
-          domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
-
-          # If host is not ip and matches domain regexp.
-          # (ip confirms to domain regexp so we explicitly check for ip)
-          options[:domain] = if (request.host !~ /^[\d.]+$/) && (request.host =~ domain_regexp)
-            ".#{$&}"
-          end
-        elsif options[:domain].is_a? Array
-          # If host matches one of the supplied domains without a dot in front of it.
-          options[:domain] = options[:domain].find { |domain| request.host.include? domain.sub(/^\./, "") }
-        end
-      end
-
       # Sets the cookie named +name+. The second argument may be the cookie's
       # value or a hash of options as documented above.
       def []=(name, options)
@@ -447,6 +437,34 @@ module ActionDispatch
         def write_cookie?(cookie)
           request.ssl? || !cookie[:secure] || always_write_cookie
         end
+
+        def handle_options(options)
+          if options[:expires].respond_to?(:from_now)
+            options[:expires] = options[:expires].from_now
+          end
+
+          options[:path]      ||= "/"
+
+          cookies_same_site_protection = request.cookies_same_site_protection
+          options[:same_site] ||= cookies_same_site_protection.call(request)
+
+          if options[:domain] == :all || options[:domain] == "all"
+            # If there is a provided tld length then we use it otherwise default domain regexp.
+            domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
+
+            # If host is not ip and matches domain regexp.
+            # (ip confirms to domain regexp so we explicitly check for ip)
+            options[:domain] = if !request.host.match?(/^[\d.]+$/) && (request.host =~ domain_regexp)
+              ".#{$&}"
+            end
+          elsif options[:domain].is_a? Array
+            # If host matches one of the supplied domains.
+            options[:domain] = options[:domain].find do |domain|
+              domain = domain.delete_prefix(".")
+              request.host == domain || request.host.end_with?(".#{domain}")
+            end
+          end
+        end
     end
 
     class AbstractCookieJar # :nodoc:
@@ -508,6 +526,18 @@ module ActionDispatch
         end
     end
 
+    class MarshalWithJsonFallback # :nodoc:
+      def self.load(value)
+        Marshal.load(value)
+      rescue TypeError => e
+        ActiveSupport::JSON.decode(value) rescue raise e
+      end
+
+      def self.dump(value)
+        Marshal.dump(value)
+      end
+    end
+
     class JsonSerializer # :nodoc:
       def self.load(value)
         ActiveSupport::JSON.decode(value)
@@ -555,7 +585,7 @@ module ActionDispatch
           serializer = request.cookies_serializer || :marshal
           case serializer
           when :marshal
-            Marshal
+            MarshalWithJsonFallback
           when :json, :hybrid
             JsonSerializer
           else
@@ -625,6 +655,11 @@ module ActionDispatch
           sign_secret = request.key_generator.generate_key(request.encrypted_signed_cookie_salt)
 
           @encryptor.rotate(secret, sign_secret, cipher: legacy_cipher, digest: digest, serializer: SERIALIZER)
+        elsif prepare_upgrade_legacy_hmac_aes_cbc_cookies?
+          future_cipher = encrypted_cookie_cipher
+          secret = request.key_generator.generate_key(request.authenticated_encrypted_cookie_salt, ActiveSupport::MessageEncryptor.key_len(future_cipher))
+
+          @encryptor.rotate(secret, nil, cipher: future_cipher, serializer: SERIALIZER)
         end
       end
 

data/lib/action_dispatch/middleware/debug_exceptions.rb

@@ -4,10 +4,7 @@ require "action_dispatch/http/request"
 require "action_dispatch/middleware/exception_wrapper"
 require "action_dispatch/routing/inspector"
 
-require "active_support/actionable_error"
-
 require "action_view"
-require "action_view/base"
 
 module ActionDispatch
   # This middleware is responsible for logging exceptions and
@@ -140,20 +137,16 @@ module ActionDispatch
         return unless logger
 
         exception = wrapper.exception
+        trace = wrapper.exception_trace
 
-        trace = wrapper.application_trace
-        trace = wrapper.framework_trace if trace.empty?
-
-        ActiveSupport::Deprecation.silence do
-          message = []
-          message << "  "
-          message << "#{exception.class} (#{exception.message}):"
-          message.concat(exception.annotated_source_code) if exception.respond_to?(:annotated_source_code)
-          message << "  "
-          message.concat(trace)
+        message = []
+        message << "  "
+        message << "#{exception.class} (#{exception.message}):"
+        message.concat(exception.annotated_source_code) if exception.respond_to?(:annotated_source_code)
+        message << "  "
+        message.concat(trace)
 
-          log_array(logger, message)
-        end
+        log_array(logger, message)
       end
 
       def log_array(logger, array)

data/lib/action_dispatch/middleware/debug_view.rb

@@ -12,7 +12,7 @@ module ActionDispatch
     def initialize(assigns)
       paths = [RESCUES_TEMPLATE_PATH]
       lookup_context = ActionView::LookupContext.new(paths)
-      super(lookup_context, assigns)
+      super(lookup_context, assigns, nil)
     end
 
     def compiled_method_container