actionpack 7.1.3.4 → 7.2.0.beta1

data/lib/action_dispatch/http/permissions_policy.rb

@@ -1,31 +1,33 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 require "active_support/core_ext/object/deep_dup"
 
 module ActionDispatch # :nodoc:
-  # = Action Dispatch \PermissionsPolicy
+  # # Action Dispatch PermissionsPolicy
   #
   # Configures the HTTP
-  # {Feature-Policy}[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy]
-  # response header to specify which browser features the current document and
-  # its iframes can use.
+  # [Feature-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
+  # response header to specify which browser features the current
+  # document and its iframes can use.
   #
   # Example global policy:
   #
-  #   Rails.application.config.permissions_policy do |policy|
-  #     policy.camera      :none
-  #     policy.gyroscope   :none
-  #     policy.microphone  :none
-  #     policy.usb         :none
-  #     policy.fullscreen  :self
-  #     policy.payment     :self, "https://secure.example.com"
-  #   end
+  #     Rails.application.config.permissions_policy do |policy|
+  #       policy.camera      :none
+  #       policy.gyroscope   :none
+  #       policy.microphone  :none
+  #       policy.usb         :none
+  #       policy.fullscreen  :self
+  #       policy.payment     :self, "https://secure.example.com"
+  #     end
   #
-  # The Feature-Policy header has been renamed to Permissions-Policy.
-  # The Permissions-Policy requires a different implementation and isn't
-  # yet supported by all browsers. To avoid having to rename this
-  # middleware in the future we use the new name for the middleware but
-  # keep the old header name and implementation for now.
+  # The Feature-Policy header has been renamed to Permissions-Policy. The
+  # Permissions-Policy requires a different implementation and isn't yet supported
+  # by all browsers. To avoid having to rename this middleware in the future we
+  # use the new name for the middleware but keep the old header name and
+  # implementation for now.
   class PermissionsPolicy
     class Middleware
       def initialize(app)
@@ -35,6 +37,7 @@ module ActionDispatch # :nodoc:
       def call(env)
         _, headers, _ = response = @app.call(env)
 
+        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         request = ActionDispatch::Request.new(env)
@@ -51,6 +54,12 @@ module ActionDispatch # :nodoc:
       end
 
       private
+        def html_response?(headers)
+          if content_type = headers[Rack::CONTENT_TYPE]
+            content_type.include?("html")
+          end
+        end
+
         def policy_present?(headers)
           headers[ActionDispatch::Constants::FEATURE_POLICY]
         end
@@ -89,7 +98,7 @@ module ActionDispatch # :nodoc:
       geolocation:          "geolocation",
       gyroscope:            "gyroscope",
       hid:                  "hid",
-      idle_detection:       "idle_detection",
+      idle_detection:       "idle-detection",
       magnetometer:         "magnetometer",
       microphone:           "microphone",
       midi:                 "midi",
@@ -125,25 +134,6 @@ module ActionDispatch # :nodoc:
       end
     end
 
-    %w[speaker vibrate vr].each do |directive|
-      define_method(directive) do |*sources|
-        ActionDispatch.deprecator.warn(<<~MSG)
-          The `#{directive}` permissions policy directive is deprecated
-          and will be removed in Rails 7.2.
-
-          There is no browser support for this directive, and no plan
-          for browser support in the future. You can just remove this
-          directive from your application.
-        MSG
-
-        if sources.first
-          @directives[directive] = apply_mappings(sources)
-        else
-          @directives.delete(directive)
-        end
-      end
-    end
-
     def build(context = nil)
       build_directives(context).compact.join("; ")
     end

data/lib/action_dispatch/http/rack_cache.rb

@@ -2,6 +2,8 @@
 
 # :enddoc:
 
+# :markup: markdown
+
 require "rack/cache"
 require "rack/cache/context"
 require "active_support/cache"

data/lib/action_dispatch/http/request.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 require "stringio"
 
 require "active_support/inflector"
@@ -102,26 +104,26 @@ module ActionDispatch
 
     # Returns true if the request has a header matching the given key parameter.
     #
-    #    request.key? :ip_spoofing_check # => true
+    #     request.key? :ip_spoofing_check # => true
     def key?(key)
       has_header? key
     end
 
-    # HTTP methods from {RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1}[https://www.ietf.org/rfc/rfc2616.txt]
+    # HTTP methods from [RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1](https://www.ietf.org/rfc/rfc2616.txt)
     RFC2616 = %w(OPTIONS GET HEAD POST PUT DELETE TRACE CONNECT)
-    # HTTP methods from {RFC 2518: HTTP Extensions for Distributed Authoring -- WEBDAV}[https://www.ietf.org/rfc/rfc2518.txt]
+    # HTTP methods from [RFC 2518: HTTP Extensions for Distributed Authoring -- WEBDAV](https://www.ietf.org/rfc/rfc2518.txt)
     RFC2518 = %w(PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK)
-    # HTTP methods from {RFC 3253: Versioning Extensions to WebDAV}[https://www.ietf.org/rfc/rfc3253.txt]
+    # HTTP methods from [RFC 3253: Versioning Extensions to WebDAV](https://www.ietf.org/rfc/rfc3253.txt)
     RFC3253 = %w(VERSION-CONTROL REPORT CHECKOUT CHECKIN UNCHECKOUT MKWORKSPACE UPDATE LABEL MERGE BASELINE-CONTROL MKACTIVITY)
-    # HTTP methods from {RFC 3648: WebDAV Ordered Collections Protocol}[https://www.ietf.org/rfc/rfc3648.txt]
+    # HTTP methods from [RFC 3648: WebDAV Ordered Collections Protocol](https://www.ietf.org/rfc/rfc3648.txt)
     RFC3648 = %w(ORDERPATCH)
-    # HTTP methods from {RFC 3744: WebDAV Access Control Protocol}[https://www.ietf.org/rfc/rfc3744.txt]
+    # HTTP methods from [RFC 3744: WebDAV Access Control Protocol](https://www.ietf.org/rfc/rfc3744.txt)
     RFC3744 = %w(ACL)
-    # HTTP methods from {RFC 5323: WebDAV SEARCH}[https://www.ietf.org/rfc/rfc5323.txt]
+    # HTTP methods from [RFC 5323: WebDAV SEARCH](https://www.ietf.org/rfc/rfc5323.txt)
     RFC5323 = %w(SEARCH)
-    # HTTP methods from {RFC 4791: Calendaring Extensions to WebDAV}[https://www.ietf.org/rfc/rfc4791.txt]
+    # HTTP methods from [RFC 4791: Calendaring Extensions to WebDAV](https://www.ietf.org/rfc/rfc4791.txt)
     RFC4791 = %w(MKCALENDAR)
-    # HTTP methods from {RFC 5789: PATCH Method for HTTP}[https://www.ietf.org/rfc/rfc5789.txt]
+    # HTTP methods from [RFC 5789: PATCH Method for HTTP](https://www.ietf.org/rfc/rfc5789.txt)
     RFC5789 = %w(PATCH)
 
     HTTP_METHODS = RFC2616 + RFC2518 + RFC3253 + RFC3648 + RFC3744 + RFC5323 + RFC4791 + RFC5789
@@ -135,20 +137,19 @@ module ActionDispatch
 
     alias raw_request_method request_method # :nodoc:
 
-    # Returns the HTTP \method that the application should see.
-    # In the case where the \method was overridden by a middleware
-    # (for instance, if a HEAD request was converted to a GET,
-    # or if a _method parameter was used to determine the \method
-    # the application should use), this \method returns the overridden
-    # value, not the original.
+    # Returns the HTTP method that the application should see. In the case where the
+    # method was overridden by a middleware (for instance, if a HEAD request was
+    # converted to a GET, or if a _method parameter was used to determine the method
+    # the application should use), this method returns the overridden value, not the
+    # original.
     def request_method
       @request_method ||= check_method(super)
     end
 
-    # Returns the URI pattern of the matched route for the request,
-    # using the same format as `bin/rails routes`:
+    # Returns the URI pattern of the matched route for the request, using the same
+    # format as `bin/rails routes`:
     #
-    #   request.route_uri_pattern # => "/:controller(/:action(/:id))(.:format)"
+    #     request.route_uri_pattern # => "/:controller(/:action(/:id))(.:format)"
     def route_uri_pattern
       get_header("action_dispatch.route_uri_pattern")
     end
@@ -196,12 +197,11 @@ module ActionDispatch
       HTTP_METHOD_LOOKUP[request_method]
     end
 
-    # Returns the original value of the environment's REQUEST_METHOD,
-    # even if it was overridden by middleware. See #request_method for
-    # more information.
+    # Returns the original value of the environment's REQUEST_METHOD, even if it was
+    # overridden by middleware. See #request_method for more information.
     #
-    # For debugging purposes, when called with arguments this method will
-    # fall back to Object#method
+    # For debugging purposes, when called with arguments this method will fall back
+    # to Object#method
     def method(*args)
       if args.empty?
         @method ||= check_method(
@@ -221,62 +221,61 @@ module ActionDispatch
 
     # Provides access to the request's HTTP headers, for example:
     #
-    #   request.headers["Content-Type"] # => "text/plain"
+    #     request.headers["Content-Type"] # => "text/plain"
     def headers
       @headers ||= Http::Headers.new(self)
     end
 
-    # Early Hints is an HTTP/2 status code that indicates hints to help a client start
-    # making preparations for processing the final response.
+    # Early Hints is an HTTP/2 status code that indicates hints to help a client
+    # start making preparations for processing the final response.
     #
-    # If the env contains +rack.early_hints+ then the server accepts HTTP2 push for Link headers.
+    # If the env contains `rack.early_hints` then the server accepts HTTP2 push for
+    # Link headers.
     #
-    # The +send_early_hints+ method accepts a hash of links as follows:
+    # The `send_early_hints` method accepts a hash of links as follows:
     #
-    #   send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
+    #     send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
     #
-    # If you are using +javascript_include_tag+ or +stylesheet_link_tag+ the
-    # Early Hints headers are included by default if supported.
+    # If you are using `javascript_include_tag` or `stylesheet_link_tag` the Early
+    # Hints headers are included by default if supported.
     def send_early_hints(links)
-      return unless env["rack.early_hints"]
-
-      env["rack.early_hints"].call(links)
+      env["rack.early_hints"]&.call(links)
     end
 
-    # Returns a +String+ with the last requested path including their params.
+    # Returns a `String` with the last requested path including their params.
     #
-    #    # get '/foo'
-    #    request.original_fullpath # => '/foo'
+    #     # get '/foo'
+    #     request.original_fullpath # => '/foo'
     #
-    #    # get '/foo?bar'
-    #    request.original_fullpath # => '/foo?bar'
+    #     # get '/foo?bar'
+    #     request.original_fullpath # => '/foo?bar'
     def original_fullpath
       @original_fullpath ||= (get_header("ORIGINAL_FULLPATH") || fullpath)
     end
 
-    # Returns the +String+ full path including params of the last URL requested.
+    # Returns the `String` full path including params of the last URL requested.
     #
-    #    # get "/articles"
-    #    request.fullpath # => "/articles"
+    #     # get "/articles"
+    #     request.fullpath # => "/articles"
     #
-    #    # get "/articles?page=2"
-    #    request.fullpath # => "/articles?page=2"
+    #     # get "/articles?page=2"
+    #     request.fullpath # => "/articles?page=2"
     def fullpath
       @fullpath ||= super
     end
 
-    # Returns the original request URL as a +String+.
+    # Returns the original request URL as a `String`.
     #
-    #    # get "/articles?page=2"
-    #    request.original_url # => "http://www.example.com/articles?page=2"
+    #     # get "/articles?page=2"
+    #     request.original_url # => "http://www.example.com/articles?page=2"
     def original_url
       base_url + original_fullpath
     end
 
-    # The +String+ MIME type of the request.
+    # The `String` MIME type of the request.
     #
-    #    # get "/articles"
-    #    request.media_type # => "application/x-www-form-urlencoded"
+    #     # get "/articles"
+    #     request.media_type # => "application/x-www-form-urlencoded"
     def media_type
       content_mime_type&.to_s
     end
@@ -287,7 +286,7 @@ module ActionDispatch
       super.to_i
     end
 
-    # Returns true if the +X-Requested-With+ header contains "XMLHttpRequest"
+    # Returns true if the `X-Requested-With` header contains "XMLHttpRequest"
     # (case-insensitive), which may need to be manually added depending on the
     # choice of JavaScript libraries and frameworks.
     def xml_http_request?
@@ -295,13 +294,13 @@ module ActionDispatch
     end
     alias :xhr? :xml_http_request?
 
-    # Returns the IP address of client as a +String+.
+    # Returns the IP address of client as a `String`.
     def ip
       @ip ||= super
     end
 
-    # Returns the IP address of client as a +String+,
-    # usually set by the RemoteIp middleware.
+    # Returns the IP address of client as a `String`, usually set by the RemoteIp
+    # middleware.
     def remote_ip
       @remote_ip ||= (get_header("action_dispatch.remote_ip") || ip).to_s
     end
@@ -313,12 +312,14 @@ module ActionDispatch
 
     ACTION_DISPATCH_REQUEST_ID = "action_dispatch.request_id" # :nodoc:
 
-    # Returns the unique request id, which is based on either the +X-Request-Id+ header that can
-    # be generated by a firewall, load balancer, or web server, or by the RequestId middleware
-    # (which sets the +action_dispatch.request_id+ environment variable).
+    # Returns the unique request id, which is based on either the `X-Request-Id`
+    # header that can be generated by a firewall, load balancer, or web server, or
+    # by the RequestId middleware (which sets the `action_dispatch.request_id`
+    # environment variable).
     #
-    # This unique ID is useful for tracing a request from end-to-end as part of logging or debugging.
-    # This relies on the Rack variable set by the ActionDispatch::RequestId middleware.
+    # This unique ID is useful for tracing a request from end-to-end as part of
+    # logging or debugging. This relies on the Rack variable set by the
+    # ActionDispatch::RequestId middleware.
     def request_id
       get_header ACTION_DISPATCH_REQUEST_ID
     end
@@ -334,8 +335,8 @@ module ActionDispatch
       (get_header("SERVER_SOFTWARE") && /^([a-zA-Z]+)/ =~ get_header("SERVER_SOFTWARE")) ? $1.downcase : nil
     end
 
-    # Read the request \body. This is useful for web services that need to
-    # work with raw requests directly.
+    # Read the request body. This is useful for web services that need to work with
+    # raw requests directly.
     def raw_post
       unless has_header? "RAW_POST_DATA"
         set_header("RAW_POST_DATA", read_body_stream)
@@ -355,14 +356,13 @@ module ActionDispatch
       end
     end
 
-    # Determine whether the request body contains form-data by checking
-    # the request +Content-Type+ for one of the media-types:
-    # +application/x-www-form-urlencoded+ or +multipart/form-data+. The
-    # list of form-data media types can be modified through the
-    # +FORM_DATA_MEDIA_TYPES+ array.
+    # Determine whether the request body contains form-data by checking the request
+    # `Content-Type` for one of the media-types: `application/x-www-form-urlencoded`
+    # or `multipart/form-data`. The list of form-data media types can be modified
+    # through the `FORM_DATA_MEDIA_TYPES` array.
     #
-    # A request body is not assumed to contain form-data when no
-    # +Content-Type+ header is provided and the request_method is POST.
+    # A request body is not assumed to contain form-data when no `Content-Type`
+    # header is provided and the request_method is POST.
     def form_data?
       FORM_DATA_MEDIA_TYPES.include?(media_type)
     end
@@ -415,8 +415,8 @@ module ActionDispatch
     end
     alias :request_parameters :POST
 
-    # Returns the authorization header regardless of whether it was specified directly or through one of the
-    # proxy alternatives.
+    # Returns the authorization header regardless of whether it was specified
+    # directly or through one of the proxy alternatives.
     def authorization
       get_header("HTTP_AUTHORIZATION")   ||
       get_header("X-HTTP_AUTHORIZATION") ||
@@ -456,7 +456,7 @@ module ActionDispatch
     private
       def check_method(name)
         if name
-          HTTP_METHOD_LOOKUP[name] || raise(ActionController::UnknownHttpMethod, "#{name}, accepted HTTP methods are #{HTTP_METHODS[0...-1].join(', ')}, and #{HTTP_METHODS[-1]}")
+          HTTP_METHOD_LOOKUP[name] || raise(ActionController::UnknownHttpMethod, "#{name}, accepted HTTP methods are #{HTTP_METHODS.to_sentence(locale: false)}")
         end
 
         name

data/lib/action_dispatch/http/response.rb

@@ -1,38 +1,40 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 require "active_support/core_ext/module/attribute_accessors"
 require "action_dispatch/http/filter_redirect"
 require "action_dispatch/http/cache"
 require "monitor"
 
 module ActionDispatch # :nodoc:
-  # = Action Dispatch \Response
+  # # Action Dispatch Response
   #
   # Represents an HTTP response generated by a controller action. Use it to
   # retrieve the current state of the response, or customize the response. It can
-  # either represent a real HTTP response (i.e. one that is meant to be sent
-  # back to the web browser) or a TestResponse (i.e. one that is generated
-  # from integration tests).
+  # either represent a real HTTP response (i.e. one that is meant to be sent back
+  # to the web browser) or a TestResponse (i.e. one that is generated from
+  # integration tests).
   #
-  # The \Response object for the current request is exposed on controllers as
-  # ActionController::Metal#response. ActionController::Metal also provides a
-  # few additional methods that delegate to attributes of the \Response such as
+  # The Response object for the current request is exposed on controllers as
+  # ActionController::Metal#response. ActionController::Metal also provides a few
+  # additional methods that delegate to attributes of the Response such as
   # ActionController::Metal#headers.
   #
-  # Integration tests will likely also want to inspect responses in
-  # more detail. Methods such as Integration::RequestHelpers#get
-  # and Integration::RequestHelpers#post return instances of
-  # TestResponse (which inherits from \Response) for this purpose.
+  # Integration tests will likely also want to inspect responses in more detail.
+  # Methods such as Integration::RequestHelpers#get and
+  # Integration::RequestHelpers#post return instances of TestResponse (which
+  # inherits from Response) for this purpose.
   #
   # For example, the following demo integration test prints the body of the
   # controller response to the console:
   #
-  #  class DemoControllerTest < ActionDispatch::IntegrationTest
-  #    def test_print_root_path_to_console
-  #      get('/')
-  #      puts response.body
-  #    end
-  #  end
+  #     class DemoControllerTest < ActionDispatch::IntegrationTest
+  #       def test_print_root_path_to_console
+  #         get('/')
+  #         puts response.body
+  #       end
+  #     end
   class Response
     begin
       # For `Rack::Headers` (Rack 3+):
@@ -55,17 +57,17 @@ module ActionDispatch # :nodoc:
 
     # The headers for the response.
     #
-    #   header["Content-Type"] # => "text/plain"
-    #   header["Content-Type"] = "application/json"
-    #   header["Content-Type"] # => "application/json"
+    #     header["Content-Type"] # => "text/plain"
+    #     header["Content-Type"] = "application/json"
+    #     header["Content-Type"] # => "application/json"
     #
-    # Also aliased as +headers+.
+    # Also aliased as `headers`.
     #
-    #   headers["Content-Type"] # => "text/plain"
-    #   headers["Content-Type"] = "application/json"
-    #   headers["Content-Type"] # => "application/json"
+    #     headers["Content-Type"] # => "text/plain"
+    #     headers["Content-Type"] = "application/json"
+    #     headers["Content-Type"] # => "application/json"
     #
-    # Also aliased as +header+ for compatibility.
+    # Also aliased as `header` for compatibility.
     attr_reader :headers
 
     alias_method :header, :headers
@@ -234,13 +236,13 @@ module ActionDispatch # :nodoc:
       @status = Rack::Utils.status_code(status)
     end
 
-    # Sets the HTTP response's content MIME type. For example, in the controller
-    # you could write this:
+    # Sets the HTTP response's content MIME type. For example, in the controller you
+    # could write this:
     #
-    #  response.content_type = "text/plain"
+    #     response.content_type = "text/plain"
     #
-    # If a character set has been defined for this response (see charset=) then
-    # the character set information will also be included in the content type
+    # If a character set has been defined for this response (see charset=) then the
+    # character set information will also be included in the content type
     # information.
     def content_type=(content_type)
       return unless content_type
@@ -267,11 +269,11 @@ module ActionDispatch # :nodoc:
       end
     end
 
-    # Sets the HTTP character set. In case of +nil+ parameter
-    # it sets the charset to +default_charset+.
+    # Sets the HTTP character set. In case of `nil` parameter it sets the charset to
+    # `default_charset`.
     #
-    #   response.charset = 'utf-16' # => 'utf-16'
-    #   response.charset = nil      # => 'utf-8'
+    #     response.charset = 'utf-16' # => 'utf-16'
+    #     response.charset = nil      # => 'utf-8'
     def charset=(charset)
       content_type = parsed_content_type_header.mime_type
       if false == charset
@@ -281,8 +283,8 @@ module ActionDispatch # :nodoc:
       end
     end
 
-    # The charset of the response. HTML wants to know the encoding of the
-    # content you're giving them, so we need to send that along.
+    # The charset of the response. HTML wants to know the encoding of the content
+    # you're giving them, so we need to send that along.
     def charset
       header_info = parsed_content_type_header
       header_info.charset || self.class.default_charset
@@ -293,26 +295,26 @@ module ActionDispatch # :nodoc:
       @status
     end
 
-    # Returns a string to ensure compatibility with +Net::HTTPResponse+.
+    # Returns a string to ensure compatibility with `Net::HTTPResponse`.
     def code
       @status.to_s
     end
 
     # Returns the corresponding message for the current HTTP status code:
     #
-    #   response.status = 200
-    #   response.message # => "OK"
+    #     response.status = 200
+    #     response.message # => "OK"
     #
-    #   response.status = 404
-    #   response.message # => "Not Found"
+    #     response.status = 404
+    #     response.message # => "Not Found"
     #
     def message
       Rack::Utils::HTTP_STATUS_CODES[@status]
     end
     alias_method :status_message, :message
 
-    # Returns the content of the response as a string. This contains the contents
-    # of any calls to <tt>render</tt>.
+    # Returns the content of the response as a string. This contains the contents of
+    # any calls to `render`.
     def body
       @stream.body
     end
@@ -332,9 +334,9 @@ module ActionDispatch # :nodoc:
       end
     end
 
-    # Avoid having to pass an open file handle as the response body.
-    # Rack::Sendfile will usually intercept the response and uses
-    # the path directly, so there is no reason to open the file.
+    # Avoid having to pass an open file handle as the response body. Rack::Sendfile
+    # will usually intercept the response and uses the path directly, so there is no
+    # reason to open the file.
     class FileBody # :nodoc:
       attr_reader :to_path
 
@@ -356,7 +358,7 @@ module ActionDispatch # :nodoc:
       end
     end
 
-    # Send the file stored at +path+ as the response body.
+    # Send the file stored at `path` as the response body.
     def send_file(path)
       commit!
       @stream = FileBody.new(path)
@@ -383,17 +385,16 @@ module ActionDispatch # :nodoc:
       if stream.respond_to?(:abort)
         stream.abort
       elsif stream.respond_to?(:close)
-        # `stream.close` should really be reserved for a close from the
-        # other direction, but we must fall back to it for
-        # compatibility.
+        # `stream.close` should really be reserved for a close from the other direction,
+        # but we must fall back to it for compatibility.
         stream.close
       end
     end
 
-    # Turns the Response into a Rack-compatible array of the status, headers,
-    # and body. Allows explicit splatting:
+    # Turns the Response into a Rack-compatible array of the status, headers, and
+    # body. Allows explicit splatting:
     #
-    #   status, headers, body = *response
+    #     status, headers, body = *response
     def to_a
       commit!
       rack_response @status, @headers.to_hash
@@ -402,7 +403,7 @@ module ActionDispatch # :nodoc:
 
     # Returns the response cookies, converted to a Hash of (name => value) pairs
     #
-    #   assert_equal 'AuthorOfNewPage', r.cookies['author']
+    #     assert_equal 'AuthorOfNewPage', r.cookies['author']
     def cookies
       cookies = {}
       if header = get_header(SET_COOKIE)
@@ -456,11 +457,10 @@ module ActionDispatch # :nodoc:
     end
 
     def before_sending
-      # Normally we've already committed by now, but it's possible
-      # (e.g., if the controller action tries to read back its own
-      # response) to get here before that. In that case, we must force
-      # an "early" commit: we're about to freeze the headers, so this is
-      # our last chance.
+      # Normally we've already committed by now, but it's possible (e.g., if the
+      # controller action tries to read back its own response) to get here before
+      # that. In that case, we must force an "early" commit: we're about to freeze the
+      # headers, so this is our last chance.
       commit! unless committed?
 
       @request.commit_cookie_jar! unless committed?
@@ -488,8 +488,8 @@ module ActionDispatch # :nodoc:
       end
 
       def close
-        # Rack "close" maps to Response#abort, and *not* Response#close
-        # (which is used when the controller's finished writing)
+        # Rack "close" maps to Response#abort, and **not** Response#close (which is used
+        # when the controller's finished writing)
         @response.abort
       end