actionpack 8.1.0.beta1 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed45caa459109b7c6009c7b63f8be21dfe1965dc7bc745e8e7588579a9384391
-  data.tar.gz: aabc44311112b16f6e9b8c3f34f391d1fc1abe91cb1b0df7e920dd0068cbc8b0
+  metadata.gz: 8a6a9e8f62251d8a2effa940639912fb8780489767c229427b614b7832cfa9db
+  data.tar.gz: 4a1143a6c62f275e05c6ed9d8f19f0361ca7a2c208045421f9e0d7e5f7e0403b
 SHA512:
-  metadata.gz: 05dc45165c2451cf7a0bd23c7b5baf55ba3e970cde0877211b208f227b98e538237c373135f5d8c3ba905c18af5834d69086ab8e223a11f7d77fed3f0e067746
-  data.tar.gz: 43cba6f2e00ce49bc0b4ef8172eb26b6571325dcfa5c8b5deebcec90cfad8f6d8d7d0804459dc29e5fd36073aa8f1b09348999e6258197360be3306d9c41134e
+  metadata.gz: 9aaa8fb203ce8b597633893fa89e55948012c7c9b8d0f8e73296fe589933dc31c047d11ff7170b905cef1e023ba5a9afb1f9c165c574bee54f90f73b5a707b31
+  data.tar.gz: db8d534af910c0bf937de64d457c24e20739c2e814b95363c9fae5726f723e7c2fc416aa94fc90754929f899095a6bdbc7f4bc9ef752010e49844cb7362d1dc7

data/CHANGELOG.md

@@ -1,4 +1,108 @@
-## Rails 8.1.0.beta1 (September 04, 2025) ##
+## Rails 8.1.0 (October 22, 2025) ##
+
+*   Submit test requests using `as: :html` with `Content-Type: x-www-form-urlencoded`
+
+    *Sean Doyle*
+
+*   Add link-local IP ranges to `ActionDispatch::RemoteIp` default proxies.
+
+    Link-local addresses (`169.254.0.0/16` for IPv4 and `fe80::/10` for IPv6)
+    are now included in the default trusted proxy list, similar to private IP ranges.
+
+    *Adam Daniels*
+
+*   `remote_ip` will no longer ignore IPs in X-Forwarded-For headers if they
+    are accompanied by port information.
+
+    *Duncan Brown*, *Prevenios Marinos*, *Masafumi Koba*, *Adam Daniels*
+
+*   Add `action_dispatch.verbose_redirect_logs` setting that logs where redirects were called from.
+
+    Similar to `active_record.verbose_query_logs` and `active_job.verbose_enqueue_logs`, this adds a line in your logs that shows where a redirect was called from.
+
+    Example:
+
+    ```
+    Redirected to http://localhost:3000/posts/1
+    ↳ app/controllers/posts_controller.rb:32:in `block (2 levels) in create'
+    ```
+
+    *Dennis Paagman*
+
+*   Add engine route filtering and better formatting in `bin/rails routes`.
+
+    Allow engine routes to be filterable in the routing inspector, and
+    improve formatting of engine routing output.
+
+    Before:
+    ```
+    > bin/rails routes -e engine_only
+    No routes were found for this grep pattern.
+    For more information about routes, see the Rails guide: https://guides.rubyonrails.org/routing.html.
+    ```
+
+    After:
+    ```
+    > bin/rails routes -e engine_only
+    Routes for application:
+    No routes were found for this grep pattern.
+    For more information about routes, see the Rails guide: https://guides.rubyonrails.org/routing.html.
+
+    Routes for Test::Engine:
+    Prefix Verb URI Pattern       Controller#Action
+    engine GET  /engine_only(.:format) a#b
+    ```
+
+    *Dennis Paagman*, *Gannon McGibbon*
+
+*   Add structured events for Action Pack and Action Dispatch:
+    - `action_dispatch.redirect`
+    - `action_controller.request_started`
+    - `action_controller.request_completed`
+    - `action_controller.callback_halted`
+    - `action_controller.rescue_from_handled`
+    - `action_controller.file_sent`
+    - `action_controller.redirected`
+    - `action_controller.data_sent`
+    - `action_controller.unpermitted_parameters`
+    - `action_controller.fragment_cache`
+
+    *Adrianna Chang*
+
+*   URL helpers for engines mounted at the application root handle `SCRIPT_NAME` correctly.
+
+    Fixed an issue where `SCRIPT_NAME` is not applied to paths generated for routes in an engine
+    mounted at "/".
+
+    *Mike Dalessio*
+
+*   Update `ActionController::Metal::RateLimiting` to support passing method names to `:by` and `:with`
+
+    ```ruby
+    class SignupsController < ApplicationController
+      rate_limit to: 10, within: 1.minute, with: :redirect_with_flash
+
+      private
+        def redirect_with_flash
+          redirect_to root_url, alert: "Too many requests!"
+        end
+    end
+    ```
+
+    *Sean Doyle*
+
+*   Optimize `ActionDispatch::Http::URL.build_host_url` when protocol is included in host.
+
+    When using URL helpers with a host that includes the protocol (e.g., `{ host: "https://example.com" }`),
+    skip unnecessary protocol normalization and string duplication since the extracted protocol is already
+    in the correct format. This eliminates 2 string allocations per URL generation and provides a ~10%
+    performance improvement for this case.
+
+    *Joshua Young*, *Hartley McGuire*
+
+*   Allow `action_controller.logger` to be disabled by setting it to `nil` or `false` instead of always defaulting to `Rails.logger`.
+
+    *Roberto Miranda*
 
 *   Remove deprecated support to a route to multiple paths.
 

data/lib/abstract_controller/base.rb

@@ -97,7 +97,8 @@ module AbstractController
           methods = public_instance_methods(true) - internal_methods
           # Be sure to include shadowed public instance methods of this class.
           methods.concat(public_instance_methods(false))
-          methods.map!(&:to_s)
+          methods.reject! { |m| m.start_with?("_") }
+          methods.map!(&:name)
           methods.to_set
         end
       end

data/lib/abstract_controller/helpers.rb

@@ -90,7 +90,7 @@ module AbstractController
       #--
       # Implemented by Resolution#modules_for_helpers.
 
-      # :method: # all_helpers_from_path
+      # :method: all_helpers_from_path
       # :call-seq: all_helpers_from_path(path)
       #
       # Returns a list of helper names in a given path.

data/lib/action_controller/api.rb

@@ -5,6 +5,7 @@
 require "action_view"
 require "action_controller"
 require "action_controller/log_subscriber"
+require "action_controller/structured_event_subscriber"
 
 module ActionController
   # # Action Controller API

data/lib/action_controller/base.rb

@@ -4,6 +4,7 @@
 
 require "action_view"
 require "action_controller/log_subscriber"
+require "action_controller/structured_event_subscriber"
 require "action_controller/metal/params_wrapper"
 
 module ActionController

data/lib/action_controller/log_subscriber.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-# :markup: markdown
-
 module ActionController
-  class LogSubscriber < ActiveSupport::LogSubscriber
+  class LogSubscriber < ActiveSupport::LogSubscriber # :nodoc:
     INTERNAL_PARAMS = %w(controller action format _method only_path)
 
+    class_attribute :backtrace_cleaner, default: ActiveSupport::BacktraceCleaner.new
+
     def start_processing(event)
       return unless logger.info?
 
@@ -63,6 +63,10 @@ module ActionController
 
     def redirect_to(event)
       info { "Redirected to #{event.payload[:location]}" }
+
+      if ActionDispatch.verbose_redirect_logs && (source = redirect_source_location)
+        info { "↳ #{source}" }
+      end
     end
     subscribe_log_level :redirect_to, :info
 
@@ -97,6 +101,10 @@ module ActionController
     def logger
       ActionController::Base.logger
     end
+
+    def redirect_source_location
+      backtrace_cleaner.first_clean_frame
+    end
   end
 end
 

data/lib/action_controller/metal/live.rb

@@ -133,15 +133,16 @@ module ActionController
       private
         def perform_write(json, options)
           current_options = @options.merge(options).stringify_keys
-
+          event = +""
           PERMITTED_OPTIONS.each do |option_name|
             if (option_value = current_options[option_name])
-              @stream.write "#{option_name}: #{option_value}\n"
+              event << "#{option_name}: #{option_value}\n"
             end
           end
 
           message = json.gsub("\n", "\ndata: ")
-          @stream.write "data: #{message}\n\n"
+          event << "data: #{message}\n\n"
+          @stream.write event
         end
     end
 
@@ -236,12 +237,7 @@ module ActionController
 
       private
         def each_chunk(&block)
-          loop do
-            str = nil
-            ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
-              str = @buf.pop
-            end
-            break unless str
+          while str = @buf.pop
             yield str
           end
         end
@@ -275,16 +271,14 @@ module ActionController
       # This processes the action in a child thread. It lets us return the response
       # code and headers back up the Rack stack, and still process the body in
       # parallel with sending data to the client.
-      new_controller_thread {
+      new_controller_thread do
         ActiveSupport::Dependencies.interlock.running do
           t2 = Thread.current
 
           # Since we're processing the view in a different thread, copy the thread locals
           # from the main thread to the child thread. :'(
           locals.each { |k, v| t2[k] = v }
-          ActiveSupport::IsolatedExecutionState.share_with(t1)
-
-          begin
+          ActiveSupport::IsolatedExecutionState.share_with(t1) do
             super(name)
           rescue => e
             if @_response.committed?
@@ -301,18 +295,15 @@ module ActionController
               error = e
             end
           ensure
-            ActiveSupport::IsolatedExecutionState.clear
             clean_up_thread_locals(locals, t2)
 
             @_response.commit!
           end
         end
-      }
-
-      ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
-        @_response.await_commit
       end
 
+      @_response.await_commit
+
       raise error if error
     end
 

data/lib/action_controller/metal/rate_limiting.rb

@@ -45,7 +45,12 @@ module ActionController # :nodoc:
       #
       #     class SignupsController < ApplicationController
       #       rate_limit to: 1000, within: 10.seconds,
-      #         by: -> { request.domain }, with: -> { redirect_to busy_controller_url, alert: "Too many signups on domain!" }, only: :new
+      #         by: -> { request.domain }, with: :redirect_to_busy, only: :new
+      #
+      #       private
+      #         def redirect_to_busy
+      #           redirect_to busy_controller_url, alert: "Too many signups on domain!"
+      #         end
       #     end
       #
       #     class APIController < ApplicationController
@@ -65,7 +70,8 @@ module ActionController # :nodoc:
 
     private
       def rate_limiting(to:, within:, by:, with:, store:, name:, scope:)
-        by = instance_exec(&by)
+        by = by.is_a?(Symbol) ? send(by) : instance_exec(&by)
+
         cache_key = ["rate-limit", scope, name, by].compact.join(":")
         count = store.increment(cache_key, 1, expires_in: within)
         if count && count > to
@@ -78,7 +84,7 @@ module ActionController # :nodoc:
               name: name,
               scope: scope,
               cache_key: cache_key) do
-            instance_exec(&with)
+            with.is_a?(Symbol) ? send(with) : instance_exec(&with)
           end
         end
       end

data/lib/action_controller/metal/redirecting.rb

@@ -11,10 +11,23 @@ module ActionController
 
     class UnsafeRedirectError < StandardError; end
 
+    class OpenRedirectError < UnsafeRedirectError
+      def initialize(location)
+        super("Unsafe redirect to #{location.to_s.truncate(100).inspect}, pass allow_other_host: true to redirect anyway.")
+      end
+    end
+
+    class PathRelativeRedirectError < UnsafeRedirectError
+      def initialize(url)
+        super("Path relative URL redirect detected: #{url.inspect}")
+      end
+    end
+
     ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/
 
     included do
       mattr_accessor :raise_on_open_redirects, default: false
+      mattr_accessor :action_on_open_redirect, default: :log
       mattr_accessor :action_on_path_relative_redirect, default: :log
       class_attribute :_allowed_redirect_hosts, :allowed_redirect_hosts_permissions, instance_accessor: false, instance_predicate: false
       singleton_class.alias_method :allowed_redirect_hosts, :_allowed_redirect_hosts
@@ -95,16 +108,17 @@ module ActionController
     # ### Open Redirect protection
     #
     # By default, Rails protects against redirecting to external hosts for your
-    # app's safety, so called open redirects. Note: this was a new default in Rails
-    # 7.0, after upgrading opt-in by uncommenting the line with
-    # `raise_on_open_redirects` in
-    # `config/initializers/new_framework_defaults_7_0.rb`
+    # app's safety, so called open redirects.
     #
     # Here #redirect_to automatically validates the potentially-unsafe URL:
     #
     #     redirect_to params[:redirect_url]
     #
-    # Raises UnsafeRedirectError in the case of an unsafe redirect.
+    # The `action_on_open_redirect` configuration option controls the behavior when an unsafe
+    # redirect is detected:
+    # * `:log` - Logs a warning but allows the redirect
+    # * `:notify` - Sends an ActiveSupport notification for monitoring
+    # * `:raise` - Raises an UnsafeRedirectError
     #
     # To allow any external redirects pass `allow_other_host: true`, though using a
     # user-provided param in that case is unsafe.
@@ -137,7 +151,7 @@ module ActionController
       raise ActionControllerError.new("Cannot redirect to nil!") unless options
       raise AbstractController::DoubleRenderError if response_body
 
-      allow_other_host = response_options.delete(:allow_other_host) { _allow_other_host }
+      allow_other_host = response_options.delete(:allow_other_host)
 
       proposed_status = _extract_redirect_to_status(options, response_options)
 
@@ -244,7 +258,9 @@ module ActionController
 
     private
       def _allow_other_host
-        !raise_on_open_redirects
+        return false if raise_on_open_redirects
+
+        action_on_open_redirect != :raise
       end
 
       def _extract_redirect_to_status(options, response_options)
@@ -258,10 +274,30 @@ module ActionController
       end
 
       def _enforce_open_redirect_protection(location, allow_other_host:)
+        # Explictly allowed other host or host is in allow list allow redirect
         if allow_other_host || _url_host_allowed?(location)
           location
+        # Explicitly disallowed other host
+        elsif allow_other_host == false
+          raise OpenRedirectError.new(location)
+        # Configuration disallows other hosts
+        elsif !_allow_other_host
+          raise OpenRedirectError.new(location)
+        # Log but allow redirect
+        elsif action_on_open_redirect == :log
+          logger.warn "Open redirect to #{location.inspect} detected" if logger
+          location
+        # Notify but allow redirect
+        elsif action_on_open_redirect == :notify
+          ActiveSupport::Notifications.instrument("open_redirect.action_controller",
+            location: location,
+            request: request,
+            stack_trace: caller,
+          )
+          location
+        # Fall through, should not happen but raise for safety
         else
-          raise UnsafeRedirectError, "Unsafe redirect to #{location.truncate(100).inspect}, pass allow_other_host: true to redirect anyway."
+          raise OpenRedirectError.new(location)
         end
       end
 
@@ -301,7 +337,7 @@ module ActionController
             stack_trace: caller
           )
         when :raise
-          raise UnsafeRedirectError, message
+          raise PathRelativeRedirectError.new(url)
         end
       end
   end

data/lib/action_controller/railtie.rb

@@ -12,7 +12,7 @@ require "action_view/railtie"
 module ActionController
   class Railtie < Rails::Railtie # :nodoc:
     config.action_controller = ActiveSupport::OrderedOptions.new
-    config.action_controller.raise_on_open_redirects = false
+    config.action_controller.action_on_open_redirect = :log
     config.action_controller.action_on_path_relative_redirect = :log
     config.action_controller.log_query_tags_around_actions = true
     config.action_controller.wrap_parameters_by_default = false
@@ -57,7 +57,8 @@ module ActionController
       paths   = app.config.paths
       options = app.config.action_controller
 
-      options.logger      ||= Rails.logger
+      options.logger = options.fetch(:logger, Rails.logger)
+
       options.cache_store ||= Rails.cache
 
       options.javascripts_dir ||= paths["public/javascripts"].first
@@ -103,6 +104,22 @@ module ActionController
       end
     end
 
+    initializer "action_controller.open_redirects" do |app|
+      ActiveSupport.on_load(:action_controller, run_once: true) do
+        if app.config.action_controller.has_key?(:raise_on_open_redirects)
+          ActiveSupport.deprecator.warn(<<~MSG.squish)
+            `raise_on_open_redirects` is deprecated and will be removed in a future Rails version.
+            Use `config.action_controller.action_on_open_redirect = :raise` instead.
+          MSG
+
+          # Fallback to the default behavior in case of `load_default` set `action_on_open_redirect`, but apps set `raise_on_open_redirects`.
+          if app.config.action_controller.raise_on_open_redirects == false && app.config.action_controller.action_on_open_redirect == :raise
+            self.action_on_open_redirect = :log
+          end
+        end
+      end
+    end
+
     initializer "action_controller.query_log_tags" do |app|
       query_logs_tags_enabled = app.config.respond_to?(:active_record) &&
         app.config.active_record.query_log_tags_enabled &&
@@ -135,5 +152,11 @@ module ActionController
         ActionController::TestCase.executor_around_each_request = app.config.active_support.executor_around_test_case
       end
     end
+
+    initializer "action_controller.backtrace_cleaner" do
+      ActiveSupport.on_load(:action_controller) do
+        ActionController::LogSubscriber.backtrace_cleaner = Rails.backtrace_cleaner
+      end
+    end
   end
 end

data/lib/action_controller/structured_event_subscriber.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module ActionController
+  class StructuredEventSubscriber < ActiveSupport::StructuredEventSubscriber # :nodoc:
+    INTERNAL_PARAMS = %w(controller action format _method only_path)
+
+    def start_processing(event)
+      payload = event.payload
+      params = {}
+      payload[:params].each_pair do |k, v|
+        params[k] = v unless INTERNAL_PARAMS.include?(k)
+      end
+      format = payload[:format]
+      format = format.to_s.upcase if format.is_a?(Symbol)
+      format = "*/*" if format.nil?
+
+      emit_event("action_controller.request_started",
+        controller: payload[:controller],
+        action: payload[:action],
+        format:,
+        params:,
+      )
+    end
+
+    def process_action(event)
+      payload = event.payload
+      status = payload[:status]
+
+      if status.nil? && (exception_class_name = payload[:exception]&.first)
+        status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception_class_name)
+      end
+
+      emit_event("action_controller.request_completed", {
+        controller: payload[:controller],
+        action: payload[:action],
+        status: status,
+        **additions_for(payload),
+        duration_ms: event.duration.round(2),
+        gc_time_ms: event.gc_time.round(1),
+      }.compact)
+    end
+
+    def halted_callback(event)
+      emit_event("action_controller.callback_halted", filter: event.payload[:filter])
+    end
+
+    def rescue_from_callback(event)
+      exception = event.payload[:exception]
+      emit_event("action_controller.rescue_from_handled",
+        exception_class: exception.class.name,
+        exception_message: exception.message,
+        exception_backtrace: exception.backtrace&.first&.delete_prefix("#{Rails.root}/")
+      )
+    end
+
+    def send_file(event)
+      emit_event("action_controller.file_sent", path: event.payload[:path], duration_ms: event.duration.round(1))
+    end
+
+    def redirect_to(event)
+      emit_event("action_controller.redirected", location: event.payload[:location])
+    end
+
+    def send_data(event)
+      emit_event("action_controller.data_sent", filename: event.payload[:filename], duration_ms: event.duration.round(1))
+    end
+
+    def unpermitted_parameters(event)
+      unpermitted_keys = event.payload[:keys]
+      context = event.payload[:context]
+
+      emit_debug_event("action_controller.unpermitted_parameters",
+        unpermitted_keys:,
+        context: context.except(:request)
+      )
+    end
+    debug_only :unpermitted_parameters
+
+    def write_fragment(event)
+      fragment_cache(__method__, event)
+    end
+
+    def read_fragment(event)
+      fragment_cache(__method__, event)
+    end
+
+    def exist_fragment?(event)
+      fragment_cache(__method__, event)
+    end
+
+    def expire_fragment(event)
+      fragment_cache(__method__, event)
+    end
+
+    private
+      def fragment_cache(method_name, event)
+        key = ActiveSupport::Cache.expand_cache_key(event.payload[:key] || event.payload[:path])
+
+        emit_event("action_controller.fragment_cache",
+          method: "#{method_name}",
+          key: key,
+          duration_ms: event.duration.round(1)
+        )
+      end
+
+      def additions_for(payload)
+        payload.slice(:view_runtime, :db_runtime, :queries_count, :cached_queries_count)
+      end
+  end
+end
+
+ActionController::StructuredEventSubscriber.attach_to :action_controller

data/lib/action_dispatch/http/mime_negotiation.rb

@@ -91,7 +91,49 @@ module ActionDispatch
         end
       end
 
-      # Sets the variant for template.
+      # Sets the \variant for the response template.
+      #
+      # When determining which template to render, Action View will incorporate
+      # all variants from the request. For example, if an
+      # `ArticlesController#index` action needs to respond to
+      # `request.variant = [:ios, :turbo_native]`, it will render the
+      # first template file it can find in the following list:
+      #
+      # - `app/views/articles/index.html+ios.erb`
+      # - `app/views/articles/index.html+turbo_native.erb`
+      # - `app/views/articles/index.html.erb`
+      #
+      # Variants add context to the requests that views render appropriately.
+      # Variant names are arbitrary, and can communicate anything from the
+      # request's platform (`:android`, `:ios`, `:linux`, `:macos`, `:windows`)
+      # to its browser (`:chrome`, `:edge`, `:firefox`, `:safari`), to the type
+      # of user (`:admin`, `:guest`, `:user`).
+      #
+      # Note: Adding many new variant templates with similarities to existing
+      # template files can make maintaining your view code more difficult.
+      #
+      # #### Parameters
+      #
+      # * `variant` - a symbol name or an array of symbol names for variants
+      #   used to render the response template
+      #
+      # #### Examples
+      #
+      #     class ApplicationController < ActionController::Base
+      #       before_action :determine_variants
+      #
+      #       private
+      #         def determine_variants
+      #           variants = []
+      #
+      #           # some code to determine the variant(s) to use
+      #
+      #           variants << :ios if request.user_agent.include?("iOS")
+      #           variants << :turbo_native if request.user_agent.include?("Turbo Native")
+      #
+      #           request.variant = variants
+      #         end
+      #     end
       def variant=(variant)
         variant = Array(variant)
 
@@ -102,6 +144,18 @@ module ActionDispatch
         end
       end
 
+      # Returns the \variant for the response template as an instance of
+      # ActiveSupport::ArrayInquirer.
+      #
+      #     request.variant = :phone
+      #     request.variant.phone?  # => true
+      #     request.variant.tablet? # => false
+      #
+      #     request.variant = [:phone, :tablet]
+      #     request.variant.phone?                  # => true
+      #     request.variant.desktop?                # => false
+      #     request.variant.any?(:phone, :desktop)  # => true
+      #     request.variant.any?(:desktop, :watch)  # => false
       def variant
         @variant ||= ActiveSupport::ArrayInquirer.new
       end