actionpack 7.0.4.3 → 7.1.3.4

data/lib/action_dispatch/middleware/session/mem_cache_store.rb

@@ -4,12 +4,14 @@ require "action_dispatch/middleware/session/abstract_store"
 begin
   require "rack/session/dalli"
 rescue LoadError => e
-  $stderr.puts "You don't have dalli installed in your application. Please add it to your Gemfile and run bundle install"
+  warn "You don't have dalli installed in your application. Please add it to your Gemfile and run bundle install"
   raise e
 end
 
 module ActionDispatch
   module Session
+    # = Action Dispatch Session \MemCacheStore
+    #
     # A session store that uses MemCache to implement storage.
     #
     # ==== Options

data/lib/action_dispatch/middleware/show_exceptions.rb

@@ -3,18 +3,24 @@
 require "action_dispatch/middleware/exception_wrapper"
 
 module ActionDispatch
+  # = Action Dispatch \ShowExceptions
+  #
   # This middleware rescues any exception returned by the application
   # and calls an exceptions app that will wrap it in a format for the end user.
   #
-  # The exceptions app should be passed as parameter on initialization
-  # of ShowExceptions. Every time there is an exception, ShowExceptions will
-  # store the exception in env["action_dispatch.exception"], rewrite the
-  # PATH_INFO to the exception status code and call the Rack app.
+  # The exceptions app should be passed as a parameter on initialization of
+  # +ShowExceptions+. Every time there is an exception, +ShowExceptions+ will
+  # store the exception in <tt>env["action_dispatch.exception"]</tt>, rewrite
+  # the +PATH_INFO+ to the exception status code, and call the Rack app.
+  #
+  # In \Rails applications, the exceptions app can be configured with
+  # +config.exceptions_app+, which defaults to ActionDispatch::PublicExceptions.
   #
-  # If the application returns a "X-Cascade" pass response, this middleware
-  # will send an empty response as result with the correct status code.
-  # If any exception happens inside the exceptions app, this middleware
-  # catches the exceptions and returns a failsafe response.
+  # If the application returns a response with the <tt>X-Cascade</tt> header
+  # set to <tt>"pass"</tt>, this middleware will send an empty response as a
+  # result with the correct status code. If any exception happens inside the
+  # exceptions app, this middleware catches the exceptions and returns a
+  # failsafe response.
   class ShowExceptions
     def initialize(app, exceptions_app)
       @app = app
@@ -22,21 +28,21 @@ module ActionDispatch
     end
 
     def call(env)
-      request = ActionDispatch::Request.new env
       @app.call(env)
     rescue Exception => exception
-      if request.show_exceptions?
-        render_exception(request, exception)
+      request = ActionDispatch::Request.new env
+      backtrace_cleaner = request.get_header("action_dispatch.backtrace_cleaner")
+      wrapper = ExceptionWrapper.new(backtrace_cleaner, exception)
+      if wrapper.show?(request)
+        render_exception(request, wrapper)
       else
         raise exception
       end
     end
 
     private
-      def render_exception(request, exception)
-        backtrace_cleaner = request.get_header "action_dispatch.backtrace_cleaner"
-        wrapper = ExceptionWrapper.new(backtrace_cleaner, exception)
-        status  = wrapper.status_code
+      def render_exception(request, wrapper)
+        status = wrapper.status_code
         request.set_header "action_dispatch.exception", wrapper.unwrapped_exception
         request.set_header "action_dispatch.original_path", request.path_info
         request.set_header "action_dispatch.original_request_method", request.raw_request_method
@@ -44,11 +50,11 @@ module ActionDispatch
         request.path_info = "/#{status}"
         request.request_method = "GET"
         response = @exceptions_app.call(request.env)
-        response[1]["X-Cascade"] == "pass" ? pass_response(status) : response
+        response[1][Constants::X_CASCADE] == "pass" ? pass_response(status) : response
       rescue Exception => failsafe_error
         $stderr.puts "Error during failsafe response: #{failsafe_error}\n  #{failsafe_error.backtrace * "\n  "}"
 
-        [500, { "Content-Type" => "text/plain" },
+        [500, { Rack::CONTENT_TYPE => "text/plain; charset=utf-8" },
           ["500 Internal Server Error\n" \
           "If you are the administrator of this website, then please read this web " \
           "application's log file and/or the web server's log file to find out what " \
@@ -65,7 +71,8 @@ module ActionDispatch
       end
 
       def pass_response(status)
-        [status, { "Content-Type" => "text/html; charset=#{Response.default_charset}", "Content-Length" => "0" }, []]
+        [status, { Rack::CONTENT_TYPE => "text/html; charset=#{Response.default_charset}",
+                  Rack::CONTENT_LENGTH => "0" }, []]
       end
   end
 end

data/lib/action_dispatch/middleware/ssl.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActionDispatch
+  # = Action Dispatch \SSL
+  #
   # This middleware is added to the stack when <tt>config.force_ssl = true</tt>, and is passed
   # the options set in +config.ssl_options+. It does three jobs to enforce secure HTTP
   # requests:
@@ -86,7 +88,7 @@ module ActionDispatch
 
     private
       def set_hsts_header!(headers)
-        headers["Strict-Transport-Security"] ||= @hsts_header
+        headers[Constants::STRICT_TRANSPORT_SECURITY] ||= @hsts_header
       end
 
       def normalize_hsts_options(options)
@@ -112,23 +114,33 @@ module ActionDispatch
       end
 
       def flag_cookies_as_secure!(headers)
-        if cookies = headers["Set-Cookie"]
-          cookies = cookies.split("\n")
+        cookies = headers[Rack::SET_COOKIE]
+        return unless cookies
 
-          headers["Set-Cookie"] = cookies.map { |cookie|
+        if Gem::Version.new(Rack::RELEASE) < Gem::Version.new("3")
+          cookies = cookies.split("\n")
+          headers[Rack::SET_COOKIE] = cookies.map { |cookie|
             if !/;\s*secure\s*(;|$)/i.match?(cookie)
               "#{cookie}; secure"
             else
               cookie
             end
           }.join("\n")
+        else
+          headers[Rack::SET_COOKIE] = Array(cookies).map do |cookie|
+            if !/;\s*secure\s*(;|$)/i.match?(cookie)
+              "#{cookie}; secure"
+            else
+              cookie
+            end
+          end
         end
       end
 
       def redirect_to_https(request)
         [ @redirect.fetch(:status, redirection_status(request)),
-          { "Content-Type" => "text/html",
-            "Location" => https_location_for(request) },
+          { Rack::CONTENT_TYPE => "text/html; charset=utf-8",
+            Constants::LOCATION => https_location_for(request) },
           (@redirect[:body] || []) ]
       end
 

data/lib/action_dispatch/middleware/stack.rb

@@ -4,6 +4,11 @@ require "active_support/inflector/methods"
 require "active_support/dependencies"
 
 module ActionDispatch
+  # = Action Dispatch \MiddlewareStack
+  #
+  # Read more about {Rails middleware
+  # stack}[https://guides.rubyonrails.org/rails_on_rack.html#action-dispatcher-middleware-stack]
+  # in the guides.
   class MiddlewareStack
     class Middleware
       attr_reader :args, :block, :klass
@@ -20,13 +25,13 @@ module ActionDispatch
         case middleware
         when Middleware
           klass == middleware.klass
-        when Class
+        when Module
           klass == middleware
         end
       end
 
       def inspect
-        if klass.is_a?(Class)
+        if klass.is_a?(Module)
           klass.to_s
         else
           klass.class.to_s

data/lib/action_dispatch/middleware/static.rb

@@ -3,10 +3,12 @@
 require "rack/utils"
 
 module ActionDispatch
+  # = Action Dispatch \Static
+  #
   # This middleware serves static files from disk, if available.
   # If no file is found, it hands off to the main app.
   #
-  # In Rails apps, this middleware is configured to serve assets from
+  # In \Rails apps, this middleware is configured to serve assets from
   # the +public/+ directory.
   #
   # Only GET and HEAD requests are served. POST and other HTTP methods
@@ -24,22 +26,24 @@ module ActionDispatch
     end
   end
 
-  # This endpoint serves static files from disk using Rack::File.
+  # = Action Dispatch \FileHandler
+  #
+  # This endpoint serves static files from disk using +Rack::Files+.
   #
   # URL paths are matched with static files according to expected
   # conventions: +path+, +path+.html, +path+/index.html.
   #
   # Precompressed versions of these files are checked first. Brotli (.br)
   # and gzip (.gz) files are supported. If +path+.br exists, this
-  # endpoint returns that file with a <tt>Content-Encoding: br</tt> header.
+  # endpoint returns that file with a <tt>content-encoding: br</tt> header.
   #
-  # If no matching file is found, this endpoint responds 404 Not Found.
+  # If no matching file is found, this endpoint responds <tt>404 Not Found</tt>.
   #
   # Pass the +root+ directory to search for matching files, an optional
   # <tt>index: "index"</tt> to change the default +path+/index.html, and optional
   # additional response headers.
   class FileHandler
-    # Accept-Encoding value -> file extension
+    # +Accept-Encoding+ value -> file extension
     PRECOMPRESSED = {
       "br" => ".br",
       "gzip" => ".gz",
@@ -53,7 +57,7 @@ module ActionDispatch
       @precompressed = Array(precompressed).map(&:to_s) | %w[ identity ]
       @compressible_content_types = compressible_content_types
 
-      @file_server = ::Rack::File.new(@root, headers)
+      @file_server = ::Rack::Files.new(@root, headers)
     end
 
     def call(env)
@@ -76,7 +80,7 @@ module ActionDispatch
           request.path_info, ::Rack::Utils.escape_path(filepath).b
 
         @file_server.call(request.env).tap do |status, headers, body|
-          # Omit Content-Encoding/Type/etc headers for 304 Not Modified
+          # Omit content-encoding/type/etc headers for 304 Not Modified
           if status != 304
             headers.update(content_headers)
           end
@@ -104,7 +108,7 @@ module ActionDispatch
       end
 
       def try_files(filepath, content_type, accept_encoding:)
-        headers = { "Content-Type" => content_type }
+        headers = { Rack::CONTENT_TYPE => content_type }
 
         if compressible? content_type
           try_precompressed_files filepath, headers, accept_encoding: accept_encoding
@@ -124,10 +128,10 @@ module ActionDispatch
             if content_encoding == "identity"
               return precompressed_filepath, headers
             else
-              headers["Vary"] = "Accept-Encoding"
+              headers[ActionDispatch::Constants::VARY] = "accept-encoding"
 
               if accept_encoding.any? { |enc, _| /\b#{content_encoding}\b/i.match?(enc) }
-                headers["Content-Encoding"] = content_encoding
+                headers[ActionDispatch::Constants::CONTENT_ENCODING] = content_encoding
                 return precompressed_filepath, headers
               end
             end

data/lib/action_dispatch/middleware/templates/rescues/_actions.html.erb

@@ -1,10 +1,10 @@
-<% actions = ActiveSupport::ActionableError.actions(exception) %>
+<% actions = exception_wrapper.actions %>
 
 <% if actions.any? %>
   <div class="actions">
     <% actions.each do |action, _| %>
       <%= button_to action, ActionDispatch::ActionableExceptions.endpoint, params: {
-        error: exception.class.name,
+        error: exception_wrapper.exception_class_name,
         action: action,
         location: request.path
       } %>

data/lib/action_dispatch/middleware/templates/rescues/_message_and_suggestions.html.erb

@@ -1,11 +1,11 @@
-<% if exception.respond_to?(:original_message) && exception.respond_to?(:corrections) %>
+<% if exception_wrapper.has_corrections? %>
   <div class="exception-message">
-    <%= simple_format h(exception.original_message), { class: "message" }, wrapper_tag: "div" %>
+    <%= simple_format h(exception_wrapper.original_message), { class: "message" }, wrapper_tag: "div" %>
   </div>
   <%
     # The 'did_you_mean' gem can raise exceptions when calling #corrections on
     # the exception. If it does there are no corrections to show.
-    corrections = exception.corrections rescue []
+    corrections = exception_wrapper.corrections rescue []
   %>
   <% if corrections.any? %>
     <b>Did you mean?</b>
@@ -17,6 +17,6 @@
   <% end %>
 <% else %>
   <div class="exception-message">
-    <%= simple_format h(exception.message), { class: "message" }, wrapper_tag: "div" %>
+    <%= simple_format h(exception_wrapper.message), { class: "message" }, wrapper_tag: "div" %>
   </div>
 <% end %>

data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb

@@ -18,12 +18,19 @@
             </td>
 <td width="100%">
 <pre>
-<% source_extract[:code].each do |line, source| -%><div class="line<%= " active" if line == source_extract[:line_number] -%>"><%= source -%></div><% end -%>
+<% source_extract[:code].each do |line, source| -%>
+<div class="line<%= " active" if line == source_extract[:line_number] -%>"><% if source.is_a?(Array) -%><%= source[0] -%><span class="error_highlight"><%= source[1] -%></span><%= source[2] -%>
+<% else -%>
+<%= source -%>
+<% end -%></div><% end -%>
 </pre>
 </td>
           </tr>
         </table>
       </div>
+      <%- unless self.error_highlight_available? -%>
+        <p class="error_highlight_tip">Tip: You may want to add <code>gem 'error_highlight', '&gt;= 0.4.0'</code> into your Gemfile, which will display the fine-grained error location.</p>
+      <%- end -%>
     </div>
   <% end %>
 <% end %>

data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb

@@ -1,8 +1,12 @@
 <header>
-  <h1>Blocked host: <%= @host %></h1>
+  <h1>Blocked hosts: <%= @hosts.join(", ") %></h1>
 </header>
 <main role="main" id="container">
-  <h2>To allow requests to <%= @host %> make sure it is a valid hostname (containing only numbers, letters, dashes and dots), then add the following to your environment configuration:</h2>
-  <pre>config.hosts &lt;&lt; "<%= @host %>"</pre>
+  <h2>To allow requests to these hosts, make sure they are valid hostnames (containing only numbers, letters, dashes and dots), then add the following to your environment configuration:</h2>
+  <pre>
+  <% @hosts.each do |host| %>
+    config.hosts &lt;&lt; "<%= host %>"
+  <% end %>
+  </pre>
   <p>For more details view: <a href="https://guides.rubyonrails.org/configuring.html#actiondispatch-hostauthorization">the Host Authorization guide</a></p>
 </main>

data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb

@@ -1,7 +1,9 @@
-Blocked host: <%= @host %>
+Blocked hosts: <%= @hosts.join(", ") %>
 
-To allow requests to <%= @host %> make sure it is a valid hostname (containing only numbers, letters, dashes and dots), then add the following to your environment configuration:
+To allow requests to these hosts, make sure they are valid hostnames (containing only numbers, letters, dashes and dots), then add the following to your environment configuration:
 
-  config.hosts << "<%= @host %>"
+<% @hosts.each do |host| %>
+  config.hosts << "<%= host %>"
+<% end %>
 
 For more details on host authorization view: https://guides.rubyonrails.org/configuring.html#actiondispatch-hostauthorization

data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb

@@ -1,6 +1,6 @@
 <header>
   <h1>
-    <%= @exception.class.to_s %>
+    <%= @exception_wrapper.exception_class_name %>
     <% if params_valid? && @request.parameters['controller'] %>
       in <%= @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%= @request.parameters['action'] %><% end %>
     <% end %>
@@ -8,24 +8,24 @@
 </header>
 
 <main role="main" id="container">
-  <%= render "rescues/message_and_suggestions", exception: @exception %>
-  <%= render "rescues/actions", exception: @exception, request: @request %>
+  <%= render "rescues/message_and_suggestions", exception: @exception, exception_wrapper: @exception_wrapper %>
+  <%= render "rescues/actions", exception: @exception, request: @request, exception_wrapper: @exception_wrapper %>
 
   <%= render "rescues/source", source_extracts: @source_extracts, show_source_idx: @show_source_idx, error_index: 0 %>
   <%= render "rescues/trace", traces: @traces, trace_to_show: @trace_to_show, error_index: 0 %>
 
-  <% if @exception.cause %>
+  <% if @exception_wrapper.has_cause? %>
     <h2>Exception Causes</h2>
   <% end %>
 
   <% @exception_wrapper.wrapped_causes.each.with_index(1) do |wrapper, index| %>
     <div class="details">
-      <a class="summary" href="#" onclick="return toggle(<%= wrapper.exception.object_id %>)">
-        <%= wrapper.exception.class.name %>: <%= h wrapper.exception.message %>
+      <a class="summary" href="#" onclick="return toggle(<%= wrapper.exception_id %>)">
+        <%= wrapper.exception_class_name %>: <%= h wrapper.message %>
       </a>
     </div>
 
-    <div id="<%= wrapper.exception.object_id %>" class="hidden">
+    <div id="<%= wrapper.exception_id %>" class="hidden">
       <%= render "rescues/source", source_extracts: wrapper.source_extracts, show_source_idx: wrapper.source_to_show_id, error_index: index %>
       <%= render "rescues/trace", traces: wrapper.traces, trace_to_show: wrapper.trace_to_show, error_index: index %>
     </div>

data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb

@@ -1,9 +1,9 @@
-<%= @exception.class.to_s %><%
+<%= @exception_wrapper.exception_class_name %><%
   if params_valid? && @request.parameters['controller']
 %> in <%= @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%= @request.parameters['action'] %><% end %>
 <% end %>
 
-<%= @exception.message %>
+<%= @exception_wrapper.message %>
 <%= render template: "rescues/_source" %>
 <%= render template: "rescues/_trace" %>
 <%= render template: "rescues/_request_and_response" %>

data/lib/action_dispatch/middleware/templates/rescues/layout.erb

@@ -3,6 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="turbo-visit-control" content="reload">
   <title>Action Controller: Exception caught</title>
   <style>
     body {
@@ -148,6 +149,18 @@
       background-color: #FCC;
     }
 
+    .error_highlight {
+      display: inline-block;
+      background-color: #FF9;
+      text-decoration: #F00 wavy underline;
+    }
+
+    .error_highlight_tip {
+      color: #666;
+      padding: 2px 2px;
+      font-size: 10px;
+    }
+
     .button_to {
       display: inline-block;
       margin-top: 0.75em;
@@ -225,6 +238,10 @@
         background-color: #900;
       }
 
+      .error_highlight {
+        color: #333;
+      }
+
       input[type="submit"] {
         box-shadow: 0 3px #800;
       }

data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb

@@ -1,19 +1,23 @@
 <header role="banner">
-  <h1>No template for interactive request</h1>
+  <h1>No view template for interactive request</h1>
 </header>
 
 <main id="container">
   <h2><%= h @exception.message %></h2>
 
-  <p class="summary">
-    <strong>NOTE!</strong><br>
-    Unless told otherwise, Rails expects an action to render a template with the same name,<br>
-    contained in a folder named after its controller.
-
-    If this controller is an API responding with 204 (No Content), <br>
-    which does not require a template,
-    then this error will occur when trying to access it via browser,<br>
-    since we expect an HTML template
-    to be rendered for such requests. If that's the case, carry on.
-  </p>
+  <div class="summary">
+    <p>
+      <strong>NOTE:</strong> Rails usually expects a controller action to render a view template with the same name.
+    </p>
+    <p>
+      For example, a <code><%= @exception.controller %>#<%= @exception.action_name %></code> action defined in <code>app/controllers/<%= @exception.controller.controller_path %>_controller.rb</code> should have a corresponding view template
+      in a file named <code>app/views/<%= @exception.controller.controller_name %>/<%= @exception.action_name %>.html.erb</code>.
+    </p>
+    <p>
+      However, if this controller is an API endpoint responding with 204 (No Content), which does not require a view template because it doesn't serve an HTML response, then this error will occur when trying to access it with a browser. In this particular scenario, you can ignore this error.
+    </p>
+    <p>
+      You can find more about view template rendering conventions in the <a href="https://guides.rubyonrails.org/layouts_and_rendering.html#rendering-by-default-convention-over-configuration-in-action">Rails Guides on Layouts and Rendering in Rails</a>.
+    </p>
+  </div>
 </main>

data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb

@@ -3,7 +3,7 @@
 </header>
 
 <main role="main" id="container">
-  <h2><%= h @exception.message %></h2>
+  <h2><%= h @exception_wrapper.message %></h2>
 
   <%= render "rescues/source", source_extracts: @source_extracts, show_source_idx: @show_source_idx %>
   <%= render "rescues/trace", traces: @traces, trace_to_show: @trace_to_show %>

data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb

@@ -2,12 +2,12 @@
   <h1>Routing Error</h1>
 </header>
 <main role="main" id="container">
-  <h2><%= h @exception.message %></h2>
-  <% unless @exception.failures.empty? %>
+  <h2><%= h @exception_wrapper.message %></h2>
+  <% unless @exception_wrapper.failures.empty? %>
     <p>
       <h2>Failure reasons:</h2>
       <ol>
-      <% @exception.failures.each do |route, reason| %>
+      <% @exception_wrapper.failures.each do |route, reason| %>
         <li><code><%= route.inspect.delete('\\') %></code> failed because <%= reason.downcase %></li>
       <% end %>
       </ol>

data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb

@@ -1,19 +1,19 @@
 <header role="banner">
   <h1>
-    <%= @exception.cause.class.to_s %> in
+    <%= @exception_wrapper.exception_name %> in
     <%= @request.parameters["controller"].camelize if @request.parameters["controller"] %>#<%= @request.parameters["action"] %>
   </h1>
 </header>
 
 <main role="main" id="container">
   <p>
-    Showing <i><%= @exception.file_name %></i> where line <b>#<%= @exception.line_number %></b> raised:
+    Showing <i><%= @exception_wrapper.file_name %></i> where line <b>#<%= @exception_wrapper.line_number %></b> raised:
   </p>
-  <pre><code><%= h @exception.message %></code></pre>
+  <pre><code><%= h @exception_wrapper.message %></code></pre>
 
   <%= render "rescues/source", source_extracts: @source_extracts, show_source_idx: @show_source_idx %>
 
-  <p><%= @exception.sub_template_message %></p>
+  <p><%= @exception_wrapper.sub_template_message %></p>
 
   <%= render "rescues/trace", traces: @traces, trace_to_show: @trace_to_show %>
   <%= render template: "rescues/_request_and_response" %>

data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb

@@ -2,5 +2,5 @@
   <h1>Unknown action</h1>
 </header>
 <main role="main" id="container">
-  <%= render "rescues/message_and_suggestions", exception: @exception %>
+  <%= render "rescues/message_and_suggestions", exception: @exception, exception_wrapper: @exception_wrapper %>
 </main>

data/lib/action_dispatch/middleware/templates/rescues/unknown_action.text.erb

@@ -1,3 +1,3 @@
 Unknown action
 
-<%= @exception.message %>
+<%= @exception_wrapper.message %>

data/lib/action_dispatch/middleware/templates/routes/_route.html.erb

@@ -13,4 +13,7 @@
   <td>
     <%=simple_format route[:reqs] %>
   </td>
+  <td>
+    <%=simple_format route[:source_location] %>
+  </td>
 </tr>