actionpack 6.0.0.rc1 → 6.0.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d2725f46356b4d4f8462ad40d29c435ed006f3c848b07488179d7d0046ad560
-  data.tar.gz: 9564e815a7a0f778a6f355016278d194926bcf081b30ff027168c1897f014a64
+  metadata.gz: 26f4fec272345e80b305e73426e4663417440124270a5983ed336e1a9c42f557
+  data.tar.gz: 59685a9093f22dce01fc58fede17184c7574cb60a70e64ef594bef87ad6abadd
 SHA512:
-  metadata.gz: f7fed7e925346ebe539b41e638f1ba3bf43d4276a20c392cad35901d179c07cc9933d662f473076a484225e4c8cf0e2a8023fad1fe261405c2dc5ab3f820787e
-  data.tar.gz: 2d3bb76a1215e66f9a55a450cb39723e8d370007787ef2550b001484e2056431a6eb2e564fb16cc6563475d342a5f5ba25a826183e58bacb89e65d1e70fc6b87
+  metadata.gz: f68fa705893a264ffbda5af95e3ed0273f05db7daff281ebb9fafb123e8e42eca36f56a0e98a24a63b26856f2b528a3459ff8277df21e2a6282d329dd215a8cb
+  data.tar.gz: 3de347c592dd31a0c39216438ae0171f470e334ef6e357063130507630dc95ba78b158c544fda3fd24b2f16aebe77c0058bc534c725499cb85b2106794d28a67

data/CHANGELOG.md

@@ -1,3 +1,47 @@
+## Rails 6.0.0.rc2 (July 22, 2019) ##
+
+*   Add the ability to set the CSP nonce only to the specified directives.
+
+    Fixes #35137.
+
+    *Yuji Yaginuma*
+
+*   Keep part when scope option has value.
+
+    When a route was defined within an optional scope, if that route didn't
+    take parameters the scope was lost when using path helpers. This commit
+    ensures scope is kept both when the route takes parameters or when it
+    doesn't.
+
+    Fixes #33219
+
+    *Alberto Almagro*
+
+*   Change `ActionDispatch::Response#content_type` to return Content-Type header as it is.
+
+    Previously, `ActionDispatch::Response#content_type` returned value does NOT
+    contain charset part. This behavior changed to returned Content-Type header
+    containing charset part as it is.
+
+    If you want just MIME type, please use `ActionDispatch::Response#media_type`
+    instead.
+
+    Enable `action_dispatch.return_only_media_type_on_content_type` to use this change.
+    If not enabled, `ActionDispatch::Response#content_type` returns the same
+    value as before version, but its behavior is deprecate.
+
+    *Yuji Yaginuma*
+
+*   Calling `ActionController::Parameters#transform_keys/!` without a block now returns
+    an enumerator for the parameters instead of the underlying hash.
+
+    *Eugene Kenny*
+
+*   Fix a bug where DebugExceptions throws an error when malformed query parameters are provided
+
+    *Yuki Nishijima*, *Stan Lo*
+
+
 ## Rails 6.0.0.rc1 (April 24, 2019) ##
 
 *   Make system tests take a failed screenshot in a `before_teardown` hook
@@ -68,7 +112,7 @@
     This is a new middleware that guards against DNS rebinding attacks by
     explicitly permitting the hosts a request can be made to.
 
-    Each host is checked with the case operator (`#===`) to support `RegExp`,
+    Each host is checked with the case operator (`#===`) to support `Regexp`,
     `Proc`, `IPAddr` and custom objects as host allowances.
 
     *Genadi Samokovarov*

data/lib/action_controller/metal.rb

@@ -148,7 +148,7 @@ module ActionController
     attr_internal :response, :request
     delegate :session, to: "@_request"
     delegate :headers, :status=, :location=, :content_type=,
-             :status, :location, :content_type, to: "@_response"
+             :status, :location, :content_type, :media_type, to: "@_response"
 
     def initialize
       @_request = nil

data/lib/action_controller/metal/mime_responds.rb

@@ -205,7 +205,7 @@ module ActionController #:nodoc:
       yield collector if block_given?
 
       if format = collector.negotiate_format(request)
-        if content_type && content_type != format
+        if media_type && media_type != format
           raise ActionController::RespondToMismatchError
         end
         _process_format(format)

data/lib/action_controller/metal/renderers.rb

@@ -157,7 +157,7 @@ module ActionController
       json = json.to_json(options) unless json.kind_of?(String)
 
       if options[:callback].present?
-        if content_type.nil? || content_type == Mime[:json]
+        if media_type.nil? || media_type == Mime[:json]
           self.content_type = Mime[:js]
         end
 

data/lib/action_controller/metal/rendering.rb

@@ -73,7 +73,7 @@ module ActionController
       end
 
       def _set_rendered_content_type(format)
-        if format && !response.content_type
+        if format && !response.media_type
           self.content_type = format.to_s
         end
       end

data/lib/action_controller/metal/strong_parameters.rb

@@ -673,18 +673,16 @@ module ActionController
     # Returns a new <tt>ActionController::Parameters</tt> instance with the
     # results of running +block+ once for every key. The values are unchanged.
     def transform_keys(&block)
-      if block
-        new_instance_with_inherited_permitted_status(
-          @parameters.transform_keys(&block)
-        )
-      else
-        @parameters.transform_keys
-      end
+      return to_enum(:transform_keys) unless block_given?
+      new_instance_with_inherited_permitted_status(
+        @parameters.transform_keys(&block)
+      )
     end
 
     # Performs keys transformation and returns the altered
     # <tt>ActionController::Parameters</tt> instance.
     def transform_keys!(&block)
+      return to_enum(:transform_keys!) unless block_given?
       @parameters.transform_keys!(&block)
       self
     end

data/lib/action_controller/template_assertions.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module ActionController
-  module TemplateAssertions
+  module TemplateAssertions # :nodoc:
     def assert_template(options = {}, message = nil)
       raise NoMethodError,
         "assert_template has been extracted to a gem. To continue using it,

data/lib/action_dispatch/http/content_security_policy.rb

@@ -22,8 +22,9 @@ module ActionDispatch #:nodoc:
 
         if policy = request.content_security_policy
           nonce = request.content_security_policy_nonce
+          nonce_directives = request.content_security_policy_nonce_directives
           context = request.controller_instance || request
-          headers[header_name(request)] = policy.build(context, nonce)
+          headers[header_name(request)] = policy.build(context, nonce, nonce_directives)
         end
 
         response
@@ -55,6 +56,7 @@ module ActionDispatch #:nodoc:
       POLICY_REPORT_ONLY = "action_dispatch.content_security_policy_report_only"
       NONCE_GENERATOR = "action_dispatch.content_security_policy_nonce_generator"
       NONCE = "action_dispatch.content_security_policy_nonce"
+      NONCE_DIRECTIVES = "action_dispatch.content_security_policy_nonce_directives"
 
       def content_security_policy
         get_header(POLICY)
@@ -80,6 +82,14 @@ module ActionDispatch #:nodoc:
         set_header(NONCE_GENERATOR, generator)
       end
 
+      def content_security_policy_nonce_directives
+        get_header(NONCE_DIRECTIVES)
+      end
+
+      def content_security_policy_nonce_directives=(generator)
+        set_header(NONCE_DIRECTIVES, generator)
+      end
+
       def content_security_policy_nonce
         if content_security_policy_nonce_generator
           if nonce = get_header(NONCE)
@@ -133,9 +143,9 @@ module ActionDispatch #:nodoc:
       worker_src:      "worker-src"
     }.freeze
 
-    NONCE_DIRECTIVES = %w[script-src style-src].freeze
+    DEFAULT_NONCE_DIRECTIVES = %w[script-src style-src].freeze
 
-    private_constant :MAPPINGS, :DIRECTIVES, :NONCE_DIRECTIVES
+    private_constant :MAPPINGS, :DIRECTIVES, :DEFAULT_NONCE_DIRECTIVES
 
     attr_reader :directives
 
@@ -204,8 +214,9 @@ module ActionDispatch #:nodoc:
       end
     end
 
-    def build(context = nil, nonce = nil)
-      build_directives(context, nonce).compact.join("; ")
+    def build(context = nil, nonce = nil, nonce_directives = nil)
+      nonce_directives = DEFAULT_NONCE_DIRECTIVES if nonce_directives.nil?
+      build_directives(context, nonce, nonce_directives).compact.join("; ")
     end
 
     private
@@ -228,10 +239,10 @@ module ActionDispatch #:nodoc:
         end
       end
 
-      def build_directives(context, nonce)
+      def build_directives(context, nonce, nonce_directives)
         @directives.map do |directive, sources|
           if sources.is_a?(Array)
-            if nonce && nonce_directive?(directive)
+            if nonce && nonce_directive?(directive, nonce_directives)
               "#{directive} #{build_directive(sources, context).join(' ')} 'nonce-#{nonce}'"
             else
               "#{directive} #{build_directive(sources, context).join(' ')}"
@@ -266,8 +277,8 @@ module ActionDispatch #:nodoc:
         end
       end
 
-      def nonce_directive?(directive)
-        NONCE_DIRECTIVES.include?(directive)
+      def nonce_directive?(directive, nonce_directives)
+        nonce_directives.include?(directive)
       end
   end
 end

data/lib/action_dispatch/http/response.rb

@@ -86,6 +86,7 @@ module ActionDispatch # :nodoc:
 
     cattr_accessor :default_charset, default: "utf-8"
     cattr_accessor :default_headers
+    cattr_accessor :return_only_media_type_on_content_type, default: false
 
     include Rack::Response::Helpers
     # Aliasing these off because AD::Http::Cache::Response defines them.
@@ -243,8 +244,22 @@ module ActionDispatch # :nodoc:
     end
 
     # Content type of response.
-    # It returns just MIME type and does NOT contain charset part.
     def content_type
+      if self.class.return_only_media_type_on_content_type
+        ActiveSupport::Deprecation.warn(
+          "Rails 6.1 will return Content-Type header without modification." \
+          " If you want just the MIME type, please use `#media_type` instead."
+        )
+
+        content_type = super
+        content_type ? content_type.split(/;\s*charset=/)[0].presence : content_type
+      else
+        super.presence
+      end
+    end
+
+    # Media type of response.
+    def media_type
       parsed_content_type_header.mime_type
     end
 
@@ -458,7 +473,7 @@ module ActionDispatch # :nodoc:
     end
 
     def assign_default_content_type_and_charset!
-      return if content_type
+      return if media_type
 
       ct = parsed_content_type_header
       set_content_type(ct.mime_type || Mime[:html].to_s,

data/lib/action_dispatch/journey/formatter.rb

@@ -67,7 +67,7 @@ module ActionDispatch
           parameterized_parts = recall.merge(options)
 
           keys_to_keep = route.parts.reverse_each.drop_while { |part|
-            !options.key?(part) || (options[part] || recall[part]).nil?
+            !(options.key?(part) || route.scope_options.key?(part)) || (options[part] || recall[part]).nil?
           } | route.required_parts
 
           parameterized_parts.delete_if do |bad_key, _|

data/lib/action_dispatch/journey/route.rb

@@ -4,9 +4,9 @@ module ActionDispatch
   # :stopdoc:
   module Journey
     class Route
-      attr_reader :app, :path, :defaults, :name, :precedence
+      attr_reader :app, :path, :defaults, :name, :precedence, :constraints,
+                  :internal, :scope_options
 
-      attr_reader :constraints, :internal
       alias :conditions :constraints
 
       module VerbMatchers
@@ -51,13 +51,13 @@ module ActionDispatch
 
       def self.build(name, app, path, constraints, required_defaults, defaults)
         request_method_match = verb_matcher(constraints.delete(:request_method))
-        new name, app, path, constraints, required_defaults, defaults, request_method_match, 0
+        new name, app, path, constraints, required_defaults, defaults, request_method_match, 0, {}
       end
 
       ##
       # +path+ is a path constraint.
       # +constraints+ is a hash of constraints to be applied to this route.
-      def initialize(name, app, path, constraints, required_defaults, defaults, request_method_match, precedence, internal = false)
+      def initialize(name, app, path, constraints, required_defaults, defaults, request_method_match, precedence, scope_options, internal = false)
         @name        = name
         @app         = app
         @path        = path
@@ -72,6 +72,7 @@ module ActionDispatch
         @decorated_ast     = nil
         @precedence        = precedence
         @path_formatter    = @path.build_formatter
+        @scope_options     = scope_options
         @internal          = internal
       end
 

data/lib/action_dispatch/middleware/debug_view.rb

@@ -56,5 +56,13 @@ module ActionDispatch
     def protect_against_forgery?
       false
     end
+
+    def params_valid?
+      begin
+        @request.parameters
+      rescue ActionController::BadRequest
+        false
+      end
+    end
   end
 end

data/lib/action_dispatch/middleware/stack.rb

@@ -34,7 +34,11 @@ module ActionDispatch
       end
 
       def build(app)
-        InstrumentationProxy.new(klass.new(app, *args, &block), inspect)
+        klass.new(app, *args, &block)
+      end
+
+      def build_instrumented(app)
+        InstrumentationProxy.new(build(app), inspect)
       end
     end
 
@@ -119,7 +123,14 @@ module ActionDispatch
     end
 
     def build(app = nil, &block)
-      middlewares.freeze.reverse.inject(app || block) { |a, e| e.build(a) }
+      instrumenting = ActiveSupport::Notifications.notifier.listening?(InstrumentationProxy::EVENT_NAME)
+      middlewares.freeze.reverse.inject(app || block) do |a, e|
+        if instrumenting
+          e.build_instrumented(a)
+        else
+          e.build(a)
+        end
+      end
     end
 
     private

data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb

@@ -6,7 +6,9 @@
 <% end %>
 
 <h2 style="margin-top: 30px">Request</h2>
-<p><b>Parameters</b>:</p> <pre><%= debug_params(@request.filtered_parameters) %></pre>
+<% if params_valid? %>
+  <p><b>Parameters</b>:</p> <pre><%= debug_params(@request.filtered_parameters) %></pre>
+<% end %>
 
 <div class="details">
   <div class="summary"><a href="#" onclick="return toggleSessionDump()">Toggle session dump</a></div>

data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.text.erb

@@ -1,5 +1,5 @@
 <%
-  clean_params = @request.filtered_parameters.clone
+  clean_params = params_valid? ? @request.filtered_parameters.clone : {}
   clean_params.delete("action")
   clean_params.delete("controller")
 

data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb

@@ -1,7 +1,7 @@
 <header>
   <h1>
     <%= @exception.class.to_s %>
-    <% if @request.parameters['controller'] %>
+    <% if params_valid? && @request.parameters['controller'] %>
       in <%= @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%= @request.parameters['action'] %><% end %>
     <% end %>
   </h1>

data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb

@@ -1,5 +1,5 @@
 <%= @exception.class.to_s %><%
-  if @request.parameters['controller']
+  if params_valid? && @request.parameters['controller']
 %> in <%= @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%= @request.parameters['action'] %><% end %>
 <% end %>
 

data/lib/action_dispatch/railtie.rb

@@ -23,6 +23,7 @@ module ActionDispatch
     config.action_dispatch.use_authenticated_cookie_encryption = false
     config.action_dispatch.use_cookies_with_metadata = false
     config.action_dispatch.perform_deep_munge = true
+    config.action_dispatch.return_only_media_type_on_content_type = true
 
     config.action_dispatch.default_headers = {
       "X-Frame-Options" => "SAMEORIGIN",
@@ -43,6 +44,7 @@ module ActionDispatch
       ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge
       ActionDispatch::Response.default_charset = app.config.action_dispatch.default_charset || app.config.encoding
       ActionDispatch::Response.default_headers = app.config.action_dispatch.default_headers
+      ActionDispatch::Response.return_only_media_type_on_content_type = app.config.action_dispatch.return_only_media_type_on_content_type
 
       ActionDispatch::ExceptionWrapper.rescue_responses.merge!(config.action_dispatch.rescue_responses)
       ActionDispatch::ExceptionWrapper.rescue_templates.merge!(config.action_dispatch.rescue_templates)

data/lib/action_dispatch/routing/mapper.rb

@@ -70,17 +70,17 @@ module ActionDispatch
         ANCHOR_CHARACTERS_REGEX = %r{\A(\\A|\^)|(\\Z|\\z|\$)\Z}
         OPTIONAL_FORMAT_REGEX = %r{(?:\(\.:format\)+|\.:format|/)\Z}
 
-        attr_reader :requirements, :defaults
-        attr_reader :to, :default_controller, :default_action
-        attr_reader :required_defaults, :ast
+        attr_reader :requirements, :defaults, :to, :default_controller,
+                    :default_action, :required_defaults, :ast, :scope_options
 
         def self.build(scope, set, ast, controller, default_action, to, via, formatted, options_constraints, anchor, options)
           options = scope[:options].merge(options) if scope[:options]
 
           defaults = (scope[:defaults] || {}).dup
           scope_constraints = scope[:constraints] || {}
+          scope_options = scope[:options] || {}
 
-          new set, ast, defaults, controller, default_action, scope[:module], to, formatted, scope_constraints, scope[:blocks] || [], via, options_constraints, anchor, options
+          new set, ast, defaults, controller, default_action, scope[:module], to, formatted, scope_constraints, scope_options, scope[:blocks] || [], via, options_constraints, anchor, options
         end
 
         def self.check_via(via)
@@ -111,7 +111,7 @@ module ActionDispatch
           format != false && path !~ OPTIONAL_FORMAT_REGEX
         end
 
-        def initialize(set, ast, defaults, controller, default_action, modyoule, to, formatted, scope_constraints, blocks, via, options_constraints, anchor, options)
+        def initialize(set, ast, defaults, controller, default_action, modyoule, to, formatted, scope_constraints, scope_options, blocks, via, options_constraints, anchor, options)
           @defaults = defaults
           @set = set
 
@@ -122,6 +122,7 @@ module ActionDispatch
           @anchor             = anchor
           @via                = via
           @internal           = options.delete(:internal)
+          @scope_options      = scope_options
 
           path_params = ast.find_all(&:symbol?).map(&:to_sym)
 
@@ -161,7 +162,7 @@ module ActionDispatch
 
         def make_route(name, precedence)
           Journey::Route.new(name, application, path, conditions, required_defaults,
-                             defaults, request_method, precedence, @internal)
+                             defaults, request_method, precedence, scope_options, @internal)
         end
 
         def application

data/lib/action_dispatch/system_test_case.rb

@@ -4,6 +4,7 @@ gem "capybara", ">= 2.15"
 
 require "capybara/dsl"
 require "capybara/minitest"
+require "selenium/webdriver"
 require "action_controller"
 require "action_dispatch/system_testing/driver"
 require "action_dispatch/system_testing/browser"

data/lib/action_dispatch/system_testing/browser.rb

@@ -39,6 +39,29 @@ module ActionDispatch
           end
       end
 
+      # driver_path can be configured as a proc. The webdrivers gem uses this
+      # proc to update web drivers. Running this proc early allows us to only
+      # update the webdriver once and avoid race conditions when using
+      # parallel tests.
+      def preload
+        case type
+        when :chrome
+          if ::Selenium::WebDriver::Service.respond_to? :driver_path=
+            ::Selenium::WebDriver::Chrome::Service.driver_path.try(:call)
+          else
+            # Selenium <= v3.141.0
+            ::Selenium::WebDriver::Chrome.driver_path
+          end
+        when :firefox
+          if ::Selenium::WebDriver::Service.respond_to? :driver_path=
+            ::Selenium::WebDriver::Firefox::Service.driver_path.try(:call)
+          else
+            # Selenium <= v3.141.0
+            ::Selenium::WebDriver::Firefox.driver_path
+          end
+        end
+      end
+
       private
         def headless_chrome_browser_options
           capabilities.args << "--headless"

data/lib/action_dispatch/system_testing/driver.rb

@@ -9,6 +9,8 @@ module ActionDispatch
         @screen_size = options[:screen_size]
         @options = options[:options]
         @capabilities = capabilities
+
+        @browser.preload
       end
 
       def use

data/lib/action_dispatch/testing/assertions.rb

@@ -14,7 +14,7 @@ module ActionDispatch
     include Rails::Dom::Testing::Assertions
 
     def html_document
-      @html_document ||= if @response.content_type.to_s.end_with?("xml")
+      @html_document ||= if @response.media_type.to_s.end_with?("xml")
         Nokogiri::XML::Document.parse(@response.body)
       else
         Nokogiri::HTML::Document.parse(@response.body)

data/lib/action_dispatch/testing/test_response.rb

@@ -19,7 +19,7 @@ module ActionDispatch
     end
 
     def response_parser
-      @response_parser ||= RequestEncoder.parser(content_type)
+      @response_parser ||= RequestEncoder.parser(media_type)
     end
   end
 end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 0
     TINY  = 0
-    PRE   = "rc1"
+    PRE   = "rc2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.0.0.rc1
+  version: 6.0.0.rc2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-24 00:00:00.000000000 Z
+date: 2019-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc1
+        version: 6.0.0.rc2
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -304,8 +304,8 @@ homepage: https://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.0.rc1/actionpack
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.0.rc1/actionpack/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.0.rc2/actionpack
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.0.rc2/actionpack/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths: