actionpack 8.1.4 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 188361aae9342d1758609c8aae8e654ed45555478396061ad363d516afaa9447
-  data.tar.gz: a327bf62a9c720d6507c3ab0523e10c27042bac1c94bdbb738bb6dcfcf9b2255
+  metadata.gz: b25f91effbacce23d46488213ff6dc4e2d652894ee983905b167f3ae1d6908fb
+  data.tar.gz: f59e9e73d8ffdce6011e0e25c07cc660c9bf448b73a093899dd24a6f542a1b56
 SHA512:
-  metadata.gz: aff62143454ada2ba6226b429126b4ec52aa8e55afd690e3e35db8f1add1a63e661ec837ced36660ed02f2bd2b094a516401238f8a959cf792a7e2afc57928c7
-  data.tar.gz: 32ff126c37ddfa3c381b374122cf4b636e6589d3cf16ca1cf4f231d0931d4ae0c0ef80ca13d5d2296988833a842b3b09d8ac89f22a72074230763b145758c3a2
+  metadata.gz: 26f0934c47f534dbf4739421b6661264a0d13d13d4e6cec16c3bf55708911cd146ff9b0ab07db125623367032e9ec68be4837d22982c1fc30c0d3f71af9d33e8
+  data.tar.gz: df92e22c98d46954a0064e3b62affa5b632f384a70ee00f750c45d375b61a553e95c859734fb9fd601bf35fe6b67247fade376d6a9dea355d133bd03b22082b4

data/CHANGELOG.md

@@ -1,3 +1,97 @@
+## Rails 8.1.4.1 (November 03, 2026) ##
+
+*   Apply `config.action_dispatch.cookies_same_site_protection` to every session
+    store.
+
+    `ActionDispatch::Session::CacheStore`, `MemCacheStore` and third-party
+    stores built on `AbstractStore` or the session mixins sent session cookies
+    with no `SameSite` attribute. Only `CookieStore` applied the configured
+    default.
+
+    [GHSA-gmj8-hvj3-49mw]
+
+    *Jean Boussier*
+
+*   Prevent `ActionController::Live` streams from blocking when a full buffer is
+    closed or aborted.
+
+    [GHSA-rwvh-fw6r-pwvp]
+
+    *Jeremy Daer*
+
+*   Set and extend the `Vary` header for rendered responses according to the
+    request headers used in format negotiation.
+
+    `Vary: Accept` was only added when the request carried a usable `Accept`
+    header. A response to a request without one, negotiated to HTML or
+    JavaScript, could be stored by a shared cache and served to later clients
+    that requested a different representation.
+
+    Responses now vary on `Accept` and `X-Requested-With` whenever the format is
+    not given by the URL. XHR requests without `Accept` also vary on
+    `Content-Type`, which Rails uses as a legacy format fallback. When
+    `config.action_dispatch.ignore_accept_header` is enabled, responses vary
+    only on `X-Requested-With`.
+
+    These fields are appended to an existing `Vary` value without duplicating
+    fields case-insensitively. `Vary: *` remains unchanged.
+
+    [GHSA-r9jg-fmfx-2gv6]
+
+    *Jeremy Daer*
+
+*   Skip writing a `CacheStore` session that another request deleted while this
+    one ran.
+
+    A request that loaded a session from `ActionDispatch::Session::CacheStore`
+    wrote it back when it finished, even after a concurrent `reset_session` or a
+    server-side delete had removed it, so the old session ID worked again.
+
+    [GHSA-2586-8ghr-69fj]
+
+    *Mike Dalessio*
+
+*   Don't write upgraded cookies to a response that skips the session.
+
+    Reading a signed or encrypted cookie written under a rotated secret, or in
+    the format a `:hybrid` serializer migrates from, writes it back in the
+    current format. That write ignored `request.session_options[:skip]`, so a
+    response that skips the session, such as the Active Storage proxy's
+    public, cacheable response, could still carry the session cookie in
+    `Set-Cookie`. Such a response now leaves the cookie unchanged, and a later
+    request that does not skip the session upgrades it. An application that
+    skips the session on every request no longer upgrades its signed or
+    encrypted cookies. Cookies the application sets are still written.
+
+    [GHSA-x6mj-8jx9-qhqv]
+
+    *Mike Dalessio*
+
+*   Detect conflicts between the `Forwarded` and `X-Forwarded-For` headers in
+    `ActionDispatch::RemoteIp`.
+
+    When `ip_spoofing_check` is enabled (the default), requests carrying both
+    headers with conflicting client addresses now raise
+    `ActionDispatch::RemoteIp::IpSpoofAttackError`.
+
+    [GHSA-2gff-2mmg-m73p]
+
+    *Gannon McGibbon*, *Mike Dalessio*
+
+*   `ActionController::Parameters#each_key` returns `self` when given a block.
+
+    It returned the internal `ActiveSupport::HashWithIndifferentAccess`, which
+    does not respond to `permitted?`, so passing that return value to mass
+    assignment skipped the Strong Parameters check. `each`, `each_pair` and
+    `each_value` already return `self`.
+
+    Document that `ActionController::Parameters#as_json` returns every
+    parameter, permitted or not, in a hash that mass assignment does not check.
+
+    [GHSA-wm3x-v3qw-4jh3]
+
+    *Mike Dalessio*
+
 ## Rails 8.1.4 (September 24, 2026) ##
 
 *   Fix the debug error page to not attempt to read source fragments from

data/lib/action_controller/metal/live.rb

@@ -221,7 +221,11 @@ module ActionController
           @response.delete_header "Content-Length"
         end
 
-        super
+        begin
+          super
+        rescue ClosedQueueError
+          raise IOError, "closed stream" if connected?
+        end
 
         unless connected?
           @buf.clear
@@ -241,14 +245,14 @@ module ActionController
         write string.end_with?("\n") ? string : "#{string}\n"
       end
 
-      # Write a 'close' event to the buffer; the producer/writing thread uses this to
-      # notify us that it's finished supplying content.
+      # Close the buffer; the producer/writing thread uses this to notify us that
+      # it's finished supplying content.
       #
       # See also #abort.
       def close
         synchronize do
           super
-          @buf.push nil
+          @buf.close
           @cv.broadcast
         end
       end
@@ -260,7 +264,9 @@ module ActionController
       def abort
         synchronize do
           @aborted = true
+          @buf.close
           @buf.clear
+          @cv.broadcast
         end
       end
 

data/lib/action_controller/metal/rendering.rb

@@ -224,8 +224,15 @@ module ActionController
       end
 
       def _set_vary_header
-        if response.headers["Vary"].blank? && request.should_apply_vary_header?
-          response.headers["Vary"] = "Accept"
+        if request.should_apply_vary_header?
+          vary_headers = response.headers["Vary"].to_s.split(",").map(&:strip).reject(&:blank?)
+
+          unless vary_headers.include?("*")
+            request.vary_headers.each do |header|
+              vary_headers << header unless vary_headers.any? { |existing| existing.casecmp?(header) }
+            end
+            response.headers["Vary"] = vary_headers.join(", ")
+          end
         end
       end
 

data/lib/action_controller/metal/strong_parameters.rb

@@ -197,15 +197,14 @@ module ActionController
     #     as_json(options=nil)
     #
     # Returns a hash that can be used as the JSON representation for the parameters.
-
-    ##
-    # :method: each_key
     #
-    # :call-seq:
-    #     each_key(&block)
+    # Like `#to_unsafe_h`, the hash holds every parameter, permitted or not, and
+    # mass assignment does not check it. Do not pass it to a model.
     #
-    # Calls block once for each key in the parameters, passing the key. If no block
-    # is given, an enumerator is returned instead.
+    #     params = ActionController::Parameters.new(name: "Bob", admin: true)
+    #     params.as_json           # => {"name" => "Bob", "admin" => true}
+    #     User.new(params)         # => ActiveModel::ForbiddenAttributesError
+    #     User.new(params.as_json) # => #<User name: "Bob", admin: true>
 
     ##
     # :method: empty?
@@ -248,7 +247,7 @@ module ActionController
     # Returns the content of the parameters as a string.
 
     delegate :keys, :empty?, :exclude?, :include?,
-      :as_json, :to_s, :each_key, to: :@parameters
+      :as_json, :to_s, to: :@parameters
 
     alias_method :has_key?, :include?
     alias_method :key?, :include?
@@ -420,6 +419,15 @@ module ActionController
       self
     end
 
+    # Calls block once for each key in the parameters, passing the key. If no block
+    # is given, an enumerator is returned instead.
+    def each_key(&block)
+      return to_enum(:each_key) unless block_given?
+      @parameters.each_key(&block)
+
+      self
+    end
+
     # Returns a new array of the values of the parameters.
     def values
       to_enum(:each_value).to_a

data/lib/action_dispatch/http/mime_negotiation.rb

@@ -212,7 +212,17 @@ module ActionDispatch
       end
 
       def should_apply_vary_header?
-        !params_readable? && use_accept_header && valid_accept_header
+        !params_readable?
+      end
+
+      def vary_headers # :nodoc:
+        if use_accept_header
+          headers = ["Accept", "X-Requested-With"]
+          headers.insert(1, "Content-Type") if xhr? && accept.blank?
+          headers
+        else
+          ["X-Requested-With"]
+        end
       end
 
       private

data/lib/action_dispatch/middleware/cookies.rb

@@ -324,6 +324,7 @@ module ActionDispatch
       def initialize(request)
         @set_cookies = {}
         @delete_cookies = {}
+        @upgraded_cookies = Set.new
         @request = request
         @cookies = {}
         @committed = false
@@ -386,6 +387,7 @@ module ActionDispatch
         end
 
         handle_options(options)
+        @upgraded_cookies.delete(name.to_s)
 
         if @cookies[name.to_s] != value || options[:expires]
           @cookies[name.to_s] = value
@@ -426,8 +428,14 @@ module ActionDispatch
         @cookies.each_key { |k| delete(k, options) }
       end
 
+      def upgraded(name)
+        @upgraded_cookies << name.to_s
+      end
+
       def write(response)
         @set_cookies.each do |name, value|
+          next if @upgraded_cookies.include?(name) && request.session_options[:skip]
+
           if write_cookie?(value)
             response.set_cookie(name, value)
           end
@@ -533,6 +541,10 @@ module ActionDispatch
         @parent_jar[name] = options
       end
 
+      def upgraded(name)
+        @parent_jar.upgraded(name)
+      end
+
       protected
         def request; @parent_jar.request; end
 
@@ -599,7 +611,10 @@ module ActionDispatch
               return
             end
 
-            self[name] = { value: value } if force_reserialize || reserialize?(dumped)
+            if force_reserialize || reserialize?(dumped)
+              self[name] = { value: value }
+              upgraded(name)
+            end
 
             value
           end

data/lib/action_dispatch/middleware/remote_ip.rb

@@ -26,10 +26,10 @@ module ActionDispatch
   # middleware assumes that there is at least one proxy sitting around and setting
   # headers with the client's remote IP address. If you don't use a proxy, because
   # you are hosted on e.g. Heroku without SSL, any client can claim to have any IP
-  # address by setting the `X-Forwarded-For` header. If you care about that, then
-  # you need to explicitly drop or ignore those headers sometime before this
-  # middleware runs. Alternatively, remove this middleware to avoid inadvertently
-  # relying on it.
+  # address by setting the `Forwarded` or `X-Forwarded-For` header. If you care
+  # about that, then you need to explicitly drop or ignore those headers sometime
+  # before this middleware runs. Alternatively, remove this middleware to avoid
+  # inadvertently relying on it.
   class RemoteIp
     class IpSpoofAttackError < StandardError; end
 
@@ -53,10 +53,11 @@ module ActionDispatch
     # Create a new `RemoteIp` middleware instance.
     #
     # The `ip_spoofing_check` option is on by default. When on, an exception is
-    # raised if it looks like the client is trying to lie about its own IP address.
-    # It makes sense to turn off this check on sites aimed at non-IP clients (like
-    # WAP devices), or behind proxies that set headers in an incorrect or confusing
-    # way (like AWS ELB).
+    # raised if it looks like the client is trying to lie about its own IP address,
+    # such as when the request carries conflicting `Forwarded`, `X-Forwarded-For`,
+    # or `Client-Ip` headers. It makes sense to turn off this check on sites aimed
+    # at non-IP clients (like WAP devices), or behind proxies that set headers in
+    # an incorrect or confusing way (like AWS ELB).
     #
     # The `custom_proxies` argument can take an enumerable which will be used
     # instead of `TRUSTED_PROXIES`. Any proxy setup will put the value you want in
@@ -102,6 +103,14 @@ module ActionDispatch
     # an actual IP address. If the ActionDispatch::Request#remote_ip method is
     # called, this class will calculate the value and then memoize it.
     class GetIp
+      # Parses X-Forwarded-For as Rack does, whatever `Rack::Request.forwarded_priority` says.
+      class XForwardedForParser < Rack::Request # :nodoc:
+        private
+          def forwarded_priority
+            [:x_forwarded]
+          end
+      end
+
       def initialize(req, check_ip, proxies)
         @req      = req
         @check_ip = check_ip
@@ -134,27 +143,20 @@ module ActionDispatch
         client_ips    = sanitize_ips(ips_from(@req.client_ip)).reverse!
         forwarded_ips = sanitize_ips(@req.forwarded_for || []).reverse!
 
-        # `Client-Ip` and `X-Forwarded-For` should not, generally, both be set. If they
-        # are both set, it means that either:
+        # `Client-Ip`, `Forwarded`, and `X-Forwarded-For` should not, generally, all
+        # be set. If several of them are set, it means that either:
         #
-        # 1) This request passed through two proxies with incompatible IP header
+        # 1) This request passed through proxies with incompatible IP header
         #     conventions.
         #
-        # 2) The client passed one of `Client-Ip` or `X-Forwarded-For`
-        #     (whichever the proxy servers weren't using) themselves.
+        # 2) The client passed the headers the proxy servers weren't using
+        #     themselves.
         #
         # Either way, there is no way for us to determine which header is the right one
         # after the fact. Since we have no idea, if we are concerned about IP spoofing
         # we need to give up and explode. (If you're not concerned about IP spoofing you
         # can turn the `ip_spoofing_check` option off.)
-        should_check_ip = @check_ip && client_ips.last && forwarded_ips.last
-        if should_check_ip && !forwarded_ips.include?(client_ips.last)
-          # We don't know which came from the proxy, and which from the user
-          raise IpSpoofAttackError, "IP spoofing attack?! " \
-            "HTTP_CLIENT_IP=#{@req.client_ip.inspect} " \
-            "HTTP_X_FORWARDED_FOR=#{@req.x_forwarded_for.inspect}" \
-            " HTTP_FORWARDED=" + @req.forwarded_for.map { "for=#{_1}" }.join(", ").inspect if @req.forwarded_for.any?
-        end
+        check_ip(client_ips, forwarded_ips) if @check_ip
 
         # We assume these things about the IP headers:
         #
@@ -182,6 +184,35 @@ module ActionDispatch
         header.strip.split(/[,\s]+/)
       end
 
+      def raise_spoofing_error
+        message = +"IP spoofing attack?! " \
+          "HTTP_CLIENT_IP=#{@req.client_ip.inspect} " \
+          "HTTP_X_FORWARDED_FOR=#{@req.x_forwarded_for.inspect}"
+        if forwarded = @req.get_header("HTTP_FORWARDED")
+          message << " HTTP_FORWARDED=#{forwarded.inspect}"
+        end
+        raise IpSpoofAttackError, message
+      end
+
+      def check_ip(client_ips, forwarded_ips)
+        if client_ips.last && forwarded_ips.last && !forwarded_ips.include?(client_ips.last)
+          # We don't know which came from the proxy, and which from the user
+          raise_spoofing_error
+        end
+
+        if @req.get_header("HTTP_FORWARDED") && @req.x_forwarded_for
+          x_forwarded_ips = XForwardedForParser.new("HTTP_X_FORWARDED_FOR" => @req.x_forwarded_for).forwarded_for || []
+          x_forwarded_client = filter_proxies(sanitize_ips(x_forwarded_ips).reverse!).first
+          forwarded_client = filter_proxies(forwarded_ips).first
+
+          # Compare strings, not parsed addresses, so the client cannot choose how its
+          # own address is spelled.
+          if x_forwarded_client && x_forwarded_client != forwarded_client
+            raise_spoofing_error
+          end
+        end
+      end
+
       def sanitize_ips(ips) # :doc:
         ips.select! do |ip|
           # Only return IPs that are valid according to the IPAddr#new method.

data/lib/action_dispatch/middleware/session/abstract_store.rb

@@ -20,8 +20,13 @@ module ActionDispatch
     end
 
     module Compatibility
+      DEFAULT_SAME_SITE = proc { |request| request.cookies_same_site_protection } # :nodoc:
+
       def initialize(app, options = {})
         options[:key] ||= "_session_id"
+        unless options.key?(:same_site) || self.class::DEFAULT_OPTIONS.key?(:same_site)
+          options = options.merge(same_site: DEFAULT_SAME_SITE)
+        end
         super
       end
 

data/lib/action_dispatch/middleware/session/cache_store.rb

@@ -24,6 +24,8 @@ module ActionDispatch
     #     By default, it is set to `false` to avoid additional cache write operations.
     #
     class CacheStore < AbstractSecureStore
+      LOADED_SESSION_ID = "action_dispatch.session.cache_store.loaded_session_id" # :nodoc:
+
       def initialize(app, options = {})
         @cache = options[:cache] || Rails.cache
         options[:expire_after] ||= @cache.options[:expires_in]
@@ -32,17 +34,20 @@ module ActionDispatch
       end
 
       # Get a session from the cache.
-      def find_session(env, sid)
-        unless sid && (session = get_session_with_fallback(sid))
+      def find_session(req, sid)
+        if sid && (session = get_session_with_fallback(sid))
+          req.set_header(LOADED_SESSION_ID, sid.private_id)
+        else
           sid, session = generate_sid, {}
         end
         [sid, session]
       end
 
       # Set a session in the cache.
-      def write_session(env, sid, session, options)
+      def write_session(req, sid, session, options)
         key = cache_key(sid.private_id)
         if session
+          return false if destroyed_since_loaded?(req, sid)
           @cache.write(key, session, expires_in: options[:expire_after])
         else
           @cache.delete(key)
@@ -67,6 +72,24 @@ module ActionDispatch
           @cache.read(cache_key(sid.private_id)) || @cache.read(cache_key(sid.public_id))
         end
 
+        # Writing back a session that another request deleted, such as on logout,
+        # would restore it.
+        def destroyed_since_loaded?(req, sid)
+          req.get_header(LOADED_SESSION_ID) == sid.private_id &&
+            !exist_in_backend?(cache_key(sid.private_id)) &&
+            !exist_in_backend?(cache_key(sid.public_id))
+        end
+
+        # The request-local cache still holds the entry this request loaded, so
+        # a lookup through it cannot see a delete made by another request.
+        def exist_in_backend?(key)
+          if @cache.respond_to?(:with_local_cache)
+            @cache.with_local_cache { @cache.exist?(key) }
+          else
+            @cache.exist?(key)
+          end
+        end
+
         def generate_sid
           if @check_collisions
             loop do

data/lib/action_dispatch/middleware/session/cookie_store.rb

@@ -59,11 +59,8 @@ module ActionDispatch
         end
       end
 
-      DEFAULT_SAME_SITE = proc { |request| request.cookies_same_site_protection } # :nodoc:
-
       def initialize(app, options = {})
         options[:cookie_only] = true
-        options[:same_site] = DEFAULT_SAME_SITE if !options.key?(:same_site)
         super
       end
 

data/lib/action_pack/gem_version.rb

@@ -12,7 +12,7 @@ module ActionPack
     MAJOR = 8
     MINOR = 1
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 8.1.4
+  version: 8.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -127,28 +127,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -352,10 +352,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.4/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4.1/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.4/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4.1/actionpack
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: