actionpack 7.1.3 → 7.2.1.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

Files changed (158) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +82 -501
  3. data/lib/abstract_controller/asset_paths.rb +2 -0
  4. data/lib/abstract_controller/base.rb +102 -98
  5. data/lib/abstract_controller/caching/fragments.rb +50 -53
  6. data/lib/abstract_controller/caching.rb +2 -0
  7. data/lib/abstract_controller/callbacks.rb +66 -64
  8. data/lib/abstract_controller/collector.rb +6 -6
  9. data/lib/abstract_controller/deprecator.rb +2 -0
  10. data/lib/abstract_controller/error.rb +2 -0
  11. data/lib/abstract_controller/helpers.rb +70 -85
  12. data/lib/abstract_controller/logger.rb +2 -0
  13. data/lib/abstract_controller/railties/routes_helpers.rb +2 -0
  14. data/lib/abstract_controller/rendering.rb +13 -12
  15. data/lib/abstract_controller/translation.rb +15 -7
  16. data/lib/abstract_controller/url_for.rb +8 -6
  17. data/lib/abstract_controller.rb +2 -0
  18. data/lib/action_controller/api/api_rendering.rb +2 -0
  19. data/lib/action_controller/api.rb +74 -72
  20. data/lib/action_controller/base.rb +198 -126
  21. data/lib/action_controller/caching.rb +15 -12
  22. data/lib/action_controller/deprecator.rb +2 -0
  23. data/lib/action_controller/form_builder.rb +20 -17
  24. data/lib/action_controller/log_subscriber.rb +3 -1
  25. data/lib/action_controller/metal/allow_browser.rb +123 -0
  26. data/lib/action_controller/metal/basic_implicit_render.rb +2 -0
  27. data/lib/action_controller/metal/conditional_get.rb +188 -174
  28. data/lib/action_controller/metal/content_security_policy.rb +25 -24
  29. data/lib/action_controller/metal/cookies.rb +4 -2
  30. data/lib/action_controller/metal/data_streaming.rb +64 -55
  31. data/lib/action_controller/metal/default_headers.rb +5 -3
  32. data/lib/action_controller/metal/etag_with_flash.rb +3 -1
  33. data/lib/action_controller/metal/etag_with_template_digest.rb +17 -15
  34. data/lib/action_controller/metal/exceptions.rb +11 -9
  35. data/lib/action_controller/metal/flash.rb +12 -10
  36. data/lib/action_controller/metal/head.rb +12 -10
  37. data/lib/action_controller/metal/helpers.rb +63 -55
  38. data/lib/action_controller/metal/http_authentication.rb +210 -205
  39. data/lib/action_controller/metal/implicit_render.rb +17 -15
  40. data/lib/action_controller/metal/instrumentation.rb +15 -12
  41. data/lib/action_controller/metal/live.rb +113 -107
  42. data/lib/action_controller/metal/logging.rb +6 -4
  43. data/lib/action_controller/metal/mime_responds.rb +151 -142
  44. data/lib/action_controller/metal/parameter_encoding.rb +34 -32
  45. data/lib/action_controller/metal/params_wrapper.rb +57 -59
  46. data/lib/action_controller/metal/permissions_policy.rb +13 -12
  47. data/lib/action_controller/metal/rate_limiting.rb +62 -0
  48. data/lib/action_controller/metal/redirecting.rb +108 -82
  49. data/lib/action_controller/metal/renderers.rb +50 -49
  50. data/lib/action_controller/metal/rendering.rb +103 -75
  51. data/lib/action_controller/metal/request_forgery_protection.rb +162 -133
  52. data/lib/action_controller/metal/rescue.rb +11 -9
  53. data/lib/action_controller/metal/streaming.rb +138 -136
  54. data/lib/action_controller/metal/strong_parameters.rb +525 -480
  55. data/lib/action_controller/metal/testing.rb +2 -0
  56. data/lib/action_controller/metal/url_for.rb +17 -15
  57. data/lib/action_controller/metal.rb +86 -60
  58. data/lib/action_controller/railtie.rb +3 -0
  59. data/lib/action_controller/railties/helpers.rb +2 -0
  60. data/lib/action_controller/renderer.rb +42 -36
  61. data/lib/action_controller/template_assertions.rb +4 -2
  62. data/lib/action_controller/test_case.rb +146 -126
  63. data/lib/action_controller.rb +10 -3
  64. data/lib/action_dispatch/constants.rb +2 -0
  65. data/lib/action_dispatch/deprecator.rb +2 -0
  66. data/lib/action_dispatch/http/cache.rb +27 -26
  67. data/lib/action_dispatch/http/content_disposition.rb +2 -0
  68. data/lib/action_dispatch/http/content_security_policy.rb +44 -38
  69. data/lib/action_dispatch/http/filter_parameters.rb +18 -9
  70. data/lib/action_dispatch/http/filter_redirect.rb +22 -1
  71. data/lib/action_dispatch/http/headers.rb +22 -22
  72. data/lib/action_dispatch/http/mime_negotiation.rb +30 -41
  73. data/lib/action_dispatch/http/mime_type.rb +31 -24
  74. data/lib/action_dispatch/http/mime_types.rb +2 -0
  75. data/lib/action_dispatch/http/parameters.rb +11 -9
  76. data/lib/action_dispatch/http/permissions_policy.rb +20 -44
  77. data/lib/action_dispatch/http/rack_cache.rb +2 -0
  78. data/lib/action_dispatch/http/request.rb +94 -75
  79. data/lib/action_dispatch/http/response.rb +73 -61
  80. data/lib/action_dispatch/http/upload.rb +18 -16
  81. data/lib/action_dispatch/http/url.rb +75 -73
  82. data/lib/action_dispatch/journey/formatter.rb +13 -6
  83. data/lib/action_dispatch/journey/gtg/builder.rb +4 -3
  84. data/lib/action_dispatch/journey/gtg/simulator.rb +2 -0
  85. data/lib/action_dispatch/journey/gtg/transition_table.rb +10 -8
  86. data/lib/action_dispatch/journey/nfa/dot.rb +2 -0
  87. data/lib/action_dispatch/journey/nodes/node.rb +6 -5
  88. data/lib/action_dispatch/journey/parser.rb +4 -3
  89. data/lib/action_dispatch/journey/parser_extras.rb +2 -0
  90. data/lib/action_dispatch/journey/path/pattern.rb +4 -1
  91. data/lib/action_dispatch/journey/route.rb +9 -7
  92. data/lib/action_dispatch/journey/router/utils.rb +16 -15
  93. data/lib/action_dispatch/journey/router.rb +4 -2
  94. data/lib/action_dispatch/journey/routes.rb +4 -2
  95. data/lib/action_dispatch/journey/scanner.rb +4 -2
  96. data/lib/action_dispatch/journey/visitors.rb +2 -0
  97. data/lib/action_dispatch/journey.rb +2 -0
  98. data/lib/action_dispatch/log_subscriber.rb +2 -0
  99. data/lib/action_dispatch/middleware/actionable_exceptions.rb +2 -0
  100. data/lib/action_dispatch/middleware/assume_ssl.rb +8 -5
  101. data/lib/action_dispatch/middleware/callbacks.rb +3 -1
  102. data/lib/action_dispatch/middleware/cookies.rb +119 -104
  103. data/lib/action_dispatch/middleware/debug_exceptions.rb +13 -5
  104. data/lib/action_dispatch/middleware/debug_locks.rb +15 -13
  105. data/lib/action_dispatch/middleware/debug_view.rb +2 -0
  106. data/lib/action_dispatch/middleware/exception_wrapper.rb +6 -11
  107. data/lib/action_dispatch/middleware/executor.rb +8 -0
  108. data/lib/action_dispatch/middleware/flash.rb +63 -51
  109. data/lib/action_dispatch/middleware/host_authorization.rb +17 -15
  110. data/lib/action_dispatch/middleware/public_exceptions.rb +8 -6
  111. data/lib/action_dispatch/middleware/reloader.rb +5 -3
  112. data/lib/action_dispatch/middleware/remote_ip.rb +77 -72
  113. data/lib/action_dispatch/middleware/request_id.rb +14 -9
  114. data/lib/action_dispatch/middleware/server_timing.rb +4 -2
  115. data/lib/action_dispatch/middleware/session/abstract_store.rb +2 -0
  116. data/lib/action_dispatch/middleware/session/cache_store.rb +13 -8
  117. data/lib/action_dispatch/middleware/session/cookie_store.rb +27 -26
  118. data/lib/action_dispatch/middleware/session/mem_cache_store.rb +7 -3
  119. data/lib/action_dispatch/middleware/show_exceptions.rb +31 -21
  120. data/lib/action_dispatch/middleware/ssl.rb +43 -40
  121. data/lib/action_dispatch/middleware/stack.rb +11 -10
  122. data/lib/action_dispatch/middleware/static.rb +33 -31
  123. data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +1 -1
  124. data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +1 -1
  125. data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +1 -1
  126. data/lib/action_dispatch/railtie.rb +2 -4
  127. data/lib/action_dispatch/request/session.rb +23 -21
  128. data/lib/action_dispatch/request/utils.rb +2 -0
  129. data/lib/action_dispatch/routing/endpoint.rb +2 -0
  130. data/lib/action_dispatch/routing/inspector.rb +5 -3
  131. data/lib/action_dispatch/routing/mapper.rb +671 -636
  132. data/lib/action_dispatch/routing/polymorphic_routes.rb +69 -62
  133. data/lib/action_dispatch/routing/redirection.rb +37 -32
  134. data/lib/action_dispatch/routing/route_set.rb +59 -45
  135. data/lib/action_dispatch/routing/routes_proxy.rb +6 -4
  136. data/lib/action_dispatch/routing/url_for.rb +130 -125
  137. data/lib/action_dispatch/routing.rb +150 -148
  138. data/lib/action_dispatch/system_test_case.rb +91 -81
  139. data/lib/action_dispatch/system_testing/browser.rb +10 -3
  140. data/lib/action_dispatch/system_testing/driver.rb +3 -1
  141. data/lib/action_dispatch/system_testing/server.rb +2 -0
  142. data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +32 -21
  143. data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb +2 -0
  144. data/lib/action_dispatch/testing/assertion_response.rb +8 -6
  145. data/lib/action_dispatch/testing/assertions/response.rb +26 -23
  146. data/lib/action_dispatch/testing/assertions/routing.rb +153 -84
  147. data/lib/action_dispatch/testing/assertions.rb +2 -0
  148. data/lib/action_dispatch/testing/integration.rb +223 -222
  149. data/lib/action_dispatch/testing/request_encoder.rb +2 -0
  150. data/lib/action_dispatch/testing/test_helpers/page_dump_helper.rb +35 -0
  151. data/lib/action_dispatch/testing/test_process.rb +12 -8
  152. data/lib/action_dispatch/testing/test_request.rb +3 -1
  153. data/lib/action_dispatch/testing/test_response.rb +27 -26
  154. data/lib/action_dispatch.rb +22 -28
  155. data/lib/action_pack/gem_version.rb +6 -4
  156. data/lib/action_pack/version.rb +3 -1
  157. data/lib/action_pack.rb +17 -16
  158. metadata +39 -16
@@ -1,14 +1,16 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ # :markup: markdown
4
+
3
5
  module AbstractController
4
- # = URL For
6
+ # # URL For
5
7
  #
6
- # Includes +url_for+ into the host class (e.g. an abstract controller or mailer). The class
7
- # has to provide a +RouteSet+ by implementing the <tt>_routes</tt> methods. Otherwise, an
8
- # exception will be raised.
8
+ # Includes `url_for` into the host class (e.g. an abstract controller or
9
+ # mailer). The class has to provide a `RouteSet` by implementing the `_routes`
10
+ # methods. Otherwise, an exception will be raised.
9
11
  #
10
- # Note that this module is completely decoupled from HTTP - the only requirement is a valid
11
- # <tt>_routes</tt> implementation.
12
+ # Note that this module is completely decoupled from HTTP - the only requirement
13
+ # is a valid `_routes` implementation.
12
14
  module UrlFor
13
15
  extend ActiveSupport::Concern
14
16
  include ActionDispatch::Routing::UrlFor
@@ -1,5 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ # :markup: markdown
4
+
3
5
  require "action_pack"
4
6
  require "active_support"
5
7
  require "active_support/rails"
@@ -1,5 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ # :markup: markdown
4
+
3
5
  module ActionController
4
6
  module ApiRendering
5
7
  extend ActiveSupport::Concern
@@ -1,107 +1,108 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ # :markup: markdown
4
+
3
5
  require "action_view"
4
6
  require "action_controller"
5
7
  require "action_controller/log_subscriber"
6
8
 
7
9
  module ActionController
8
- # = Action Controller \API
10
+ # # Action Controller API
9
11
  #
10
- # API Controller is a lightweight version of ActionController::Base,
11
- # created for applications that don't require all functionalities that a complete
12
- # \Rails controller provides, allowing you to create controllers with just the
13
- # features that you need for API only applications.
12
+ # API Controller is a lightweight version of ActionController::Base, created for
13
+ # applications that don't require all functionalities that a complete Rails
14
+ # controller provides, allowing you to create controllers with just the features
15
+ # that you need for API only applications.
14
16
  #
15
- # An API Controller is different from a normal controller in the sense that
16
- # by default it doesn't include a number of features that are usually required
17
- # by browser access only: layouts and templates rendering,
18
- # flash, assets, and so on. This makes the entire controller stack thinner,
19
- # suitable for API applications. It doesn't mean you won't have such
20
- # features if you need them: they're all available for you to include in
21
- # your application, they're just not part of the default API controller stack.
17
+ # An API Controller is different from a normal controller in the sense that by
18
+ # default it doesn't include a number of features that are usually required by
19
+ # browser access only: layouts and templates rendering, flash, assets, and so
20
+ # on. This makes the entire controller stack thinner, suitable for API
21
+ # applications. It doesn't mean you won't have such features if you need them:
22
+ # they're all available for you to include in your application, they're just not
23
+ # part of the default API controller stack.
22
24
  #
23
- # Normally, +ApplicationController+ is the only controller that inherits from
24
- # +ActionController::API+. All other controllers in turn inherit from
25
- # +ApplicationController+.
25
+ # Normally, `ApplicationController` is the only controller that inherits from
26
+ # `ActionController::API`. All other controllers in turn inherit from
27
+ # `ApplicationController`.
26
28
  #
27
29
  # A sample controller could look like this:
28
30
  #
29
- # class PostsController < ApplicationController
30
- # def index
31
- # posts = Post.all
32
- # render json: posts
31
+ # class PostsController < ApplicationController
32
+ # def index
33
+ # posts = Post.all
34
+ # render json: posts
35
+ # end
33
36
  # end
34
- # end
35
37
  #
36
38
  # Request, response, and parameters objects all work the exact same way as
37
39
  # ActionController::Base.
38
40
  #
39
- # == Renders
41
+ # ## Renders
40
42
  #
41
- # The default API Controller stack includes all renderers, which means you
42
- # can use <tt>render :json</tt> and siblings freely in your controllers. Keep
43
- # in mind that templates are not going to be rendered, so you need to ensure
44
- # your controller is calling either <tt>render</tt> or <tt>redirect_to</tt> in
45
- # all actions, otherwise it will return <tt>204 No Content</tt>.
43
+ # The default API Controller stack includes all renderers, which means you can
44
+ # use `render :json` and siblings freely in your controllers. Keep in mind that
45
+ # templates are not going to be rendered, so you need to ensure your controller
46
+ # is calling either `render` or `redirect_to` in all actions, otherwise it will
47
+ # return `204 No Content`.
46
48
  #
47
- # def show
48
- # post = Post.find(params[:id])
49
- # render json: post
50
- # end
49
+ # def show
50
+ # post = Post.find(params[:id])
51
+ # render json: post
52
+ # end
51
53
  #
52
- # == Redirects
54
+ # ## Redirects
53
55
  #
54
56
  # Redirects are used to move from one action to another. You can use the
55
- # <tt>redirect_to</tt> method in your controllers in the same way as in
57
+ # `redirect_to` method in your controllers in the same way as in
56
58
  # ActionController::Base. For example:
57
59
  #
58
- # def create
59
- # redirect_to root_url and return if not_authorized?
60
- # # do stuff here
61
- # end
60
+ # def create
61
+ # redirect_to root_url and return if not_authorized?
62
+ # # do stuff here
63
+ # end
62
64
  #
63
- # == Adding New Behavior
65
+ # ## Adding New Behavior
64
66
  #
65
67
  # In some scenarios you may want to add back some functionality provided by
66
68
  # ActionController::Base that is not present by default in
67
- # +ActionController::API+, for instance <tt>MimeResponds</tt>. This
68
- # module gives you the <tt>respond_to</tt> method. Adding it is quite simple,
69
- # you just need to include the module in a specific controller or in
70
- # +ApplicationController+ in case you want it available in your entire
71
- # application:
72
- #
73
- # class ApplicationController < ActionController::API
74
- # include ActionController::MimeResponds
75
- # end
76
- #
77
- # class PostsController < ApplicationController
78
- # def index
79
- # posts = Post.all
80
- #
81
- # respond_to do |format|
82
- # format.json { render json: posts }
83
- # format.xml { render xml: posts }
69
+ # `ActionController::API`, for instance `MimeResponds`. This module gives you
70
+ # the `respond_to` method. Adding it is quite simple, you just need to include
71
+ # the module in a specific controller or in `ApplicationController` in case you
72
+ # want it available in your entire application:
73
+ #
74
+ # class ApplicationController < ActionController::API
75
+ # include ActionController::MimeResponds
76
+ # end
77
+ #
78
+ # class PostsController < ApplicationController
79
+ # def index
80
+ # posts = Post.all
81
+ #
82
+ # respond_to do |format|
83
+ # format.json { render json: posts }
84
+ # format.xml { render xml: posts }
85
+ # end
84
86
  # end
85
87
  # end
86
- # end
87
88
  #
88
- # Make sure to check the modules included in ActionController::Base
89
- # if you want to use any other functionality that is not provided
90
- # by +ActionController::API+ out of the box.
89
+ # Make sure to check the modules included in ActionController::Base if you want
90
+ # to use any other functionality that is not provided by `ActionController::API`
91
+ # out of the box.
91
92
  class API < Metal
92
93
  abstract!
93
94
 
94
- # Shortcut helper that returns all the ActionController::API modules except
95
- # the ones passed as arguments:
95
+ # Shortcut helper that returns all the ActionController::API modules except the
96
+ # ones passed as arguments:
96
97
  #
97
- # class MyAPIBaseController < ActionController::Metal
98
- # ActionController::API.without_modules(:UrlFor).each do |left|
99
- # include left
98
+ # class MyAPIBaseController < ActionController::Metal
99
+ # ActionController::API.without_modules(:UrlFor).each do |left|
100
+ # include left
101
+ # end
100
102
  # end
101
- # end
102
103
  #
103
- # This gives better control over what you want to exclude and makes it easier
104
- # to create an API controller class, instead of listing the modules required
104
+ # This gives better control over what you want to exclude and makes it easier to
105
+ # create an API controller class, instead of listing the modules required
105
106
  # manually.
106
107
  def self.without_modules(*modules)
107
108
  modules = modules.map do |m|
@@ -121,24 +122,25 @@ module ActionController
121
122
  ConditionalGet,
122
123
  BasicImplicitRender,
123
124
  StrongParameters,
125
+ RateLimiting,
124
126
 
125
127
  DataStreaming,
126
128
  DefaultHeaders,
127
129
  Logging,
128
130
 
129
- # Before callbacks should also be executed as early as possible, so
130
- # also include them at the bottom.
131
+ # Before callbacks should also be executed as early as possible, so also include
132
+ # them at the bottom.
131
133
  AbstractController::Callbacks,
132
134
 
133
135
  # Append rescue at the bottom to wrap as much as possible.
134
136
  Rescue,
135
137
 
136
- # Add instrumentations hooks at the bottom, to ensure they instrument
137
- # all the methods properly.
138
+ # Add instrumentations hooks at the bottom, to ensure they instrument all the
139
+ # methods properly.
138
140
  Instrumentation,
139
141
 
140
- # Params wrapper should come before instrumentation so they are
141
- # properly showed in logs
142
+ # Params wrapper should come before instrumentation so they are properly showed
143
+ # in logs
142
144
  ParamsWrapper
143
145
  ]
144
146