actionpack 7.2.0.beta1 → 7.2.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0123bbeea23e6d62a0290acc58bad6fbe553c2166462201e5468df2de56a57ac
-  data.tar.gz: e9241af2c4cb05c18c6bb5c3bf7da08fa814f592a1ecaace52b925a7a8906780
+  metadata.gz: fba22bfa740eaf52af14cc4f253b413c214c7d0361fd2b62360e4fcb4cf0b9c9
+  data.tar.gz: 8759e30d54569185f3b6d6a02fec6cc9edb4d1147c3ce623a67f8909f4b6fbc7
 SHA512:
-  metadata.gz: eb26162552c078839c11acb547fd122c5f8436271305f9372f267532706ab2d5b2862d00055f184f744351fd4ef73f744b173e63d9646af2c56d8f66bdee7454
-  data.tar.gz: 411d83ea88d757b9a86002e009d4d243f6cd5ac9dac6929a43324d595a275fa9abcdbbf53d1e291b38a090a9e1d7c39d5a140099012a6268dd681447c7132884
+  metadata.gz: 3cc6ac8ca0074fb51eeb0af110f0c10bbf41fa5c5f1c843bf22e49fcc93b54e19d4f29a10a3f5d9984b1e3aba8fbacc87f0cddfaab1fc7ab201d6aaab94cfd50
+  data.tar.gz: 5f1438d0e91c7571bd661d4c9fad2bf112f6808efda565694cafdb045cca1ce2e75cc1a671796f310cb1abdac804bc189d7eb096aced1a89731ae2dc7c686b87

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Rails 7.2.0.beta2 (June 04, 2024) ##
+
+*   Include the HTTP Permissions-Policy on non-HTML Content-Types
+    [CVE-2024-28103]
+
+
 ## Rails 7.2.0.beta1 (May 29, 2024) ##
 
 *   Fix `Mime::Type.parse` handling type parameters for HTTP Accept headers.

data/lib/action_controller/base.rb

@@ -185,8 +185,8 @@ module ActionController
   #
   # ## Calling multiple redirects or renders
   #
-  # An action may contain only a single render or a single redirect. Attempting to
-  # try to do either again will result in a DoubleRenderError:
+  # An action may perform only a single render or a single redirect. Attempting to
+  # do either again will result in a DoubleRenderError:
   #
   #     def do_something
   #       redirect_to action: "elsewhere"
@@ -194,10 +194,13 @@ module ActionController
   #     end
   #
   # If you need to redirect on the condition of something, then be sure to add
-  # "and return" to halt execution.
+  # "return" to halt execution.
   #
   #     def do_something
-  #       redirect_to(action: "elsewhere") and return if monkeys.nil?
+  #       if monkeys.nil?
+  #         redirect_to(action: "elsewhere")
+  #         return
+  #       end
   #       render action: "overthere" # won't be called if monkeys is nil
   #     end
   #

data/lib/action_controller/metal/strong_parameters.rb

@@ -253,14 +253,14 @@ module ActionController
       def allow_deprecated_parameters_hash_equality
         ActionController.deprecator.warn <<-WARNING.squish
           `Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality` is
-          deprecated and will be removed in Rails 7.3.
+          deprecated and will be removed in Rails 8.0.
         WARNING
       end
 
       def allow_deprecated_parameters_hash_equality=(value)
         ActionController.deprecator.warn <<-WARNING.squish
           `Rails.application.config.action_controller.allow_deprecated_parameters_hash_equality`
-          is deprecated and will be removed in Rails 7.3.
+          is deprecated and will be removed in Rails 8.0.
         WARNING
       end
 

data/lib/action_dispatch/http/permissions_policy.rb

@@ -37,7 +37,6 @@ module ActionDispatch # :nodoc:
       def call(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         request = ActionDispatch::Request.new(env)
@@ -54,12 +53,6 @@ module ActionDispatch # :nodoc:
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[Rack::CONTENT_TYPE]
-            content_type.include?("html")
-          end
-        end
-
         def policy_present?(headers)
           headers[ActionDispatch::Constants::FEATURE_POLICY]
         end

data/lib/action_dispatch/http/request.rb

@@ -230,11 +230,11 @@ module ActionDispatch
     # start making preparations for processing the final response.
     #
     # If the env contains `rack.early_hints` then the server accepts HTTP2 push for
-    # Link headers.
+    # link headers.
     #
     # The `send_early_hints` method accepts a hash of links as follows:
     #
-    #     send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
+    #     send_early_hints("link" => "</style.css>; rel=preload; as=style,</script.js>; rel=preload")
     #
     # If you are using `javascript_include_tag` or `stylesheet_link_tag` the Early
     # Hints headers are included by default if supported.

data/lib/action_dispatch/routing/mapper.rb

@@ -714,7 +714,7 @@ module ActionDispatch
               def optimize_routes_generation?; false; end
 
               define_method :find_script_name do |options|
-                if options.key? :script_name
+                if options.key?(:script_name) && options[:script_name].present?
                   super(options)
                 else
                   script_namer.call(options)

data/lib/action_pack/gem_version.rb

@@ -12,7 +12,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 2
     TINY  = 0
-    PRE   = "beta1"
+    PRE   = "beta2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.2.0.beta1
+  version: 7.2.0.beta2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-29 00:00:00.000000000 Z
+date: 2024-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -142,28 +142,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.0.beta1
+        version: 7.2.0.beta2
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -363,10 +363,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.2.0.beta1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.2.0.beta1/
+  changelog_uri: https://github.com/rails/rails/blob/v7.2.0.beta2/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.2.0.beta2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.2.0.beta1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.2.0.beta2/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -379,12 +379,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements:
 - none
-rubygems_version: 3.5.10
+rubygems_version: 3.3.27
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).