actionpack_csi 2.3.5.p6

data/test/controller/send_file_test.rb

@@ -0,0 +1,171 @@
+# encoding: utf-8
+require 'abstract_unit'
+
+module TestFileUtils
+  def file_name() File.basename(__FILE__) end
+  def file_path() File.expand_path(__FILE__) end
+  def file_data() @data ||= File.open(file_path, 'rb') { |f| f.read } end
+end
+
+class SendFileController < ActionController::Base
+  include TestFileUtils
+  layout "layouts/standard" # to make sure layouts don't interfere
+
+  attr_writer :options
+  def options() @options ||= {} end
+
+  def file() send_file(file_path, options) end
+  def data() send_data(file_data, options) end
+  def multibyte_text_data() send_data("Кирилица\n祝您好運", options) end
+
+  def rescue_action(e) raise end
+end
+
+class SendFileTest < ActionController::TestCase
+  tests SendFileController
+  include TestFileUtils
+
+  Mime::Type.register "image/png", :png unless defined? Mime::PNG
+
+  def setup
+    @controller = SendFileController.new
+    @request = ActionController::TestRequest.new
+    @response = ActionController::TestResponse.new
+  end
+
+  def test_file_nostream
+    @controller.options = { :stream => false }
+    response = nil
+    assert_nothing_raised { response = process('file') }
+    assert_not_nil response
+    assert_kind_of String, response.body
+    assert_equal file_data, response.body
+  end
+
+  def test_file_stream
+    response = nil
+    assert_nothing_raised { response = process('file') }
+    assert_not_nil response
+    assert_kind_of Proc, response.body
+
+    require 'stringio'
+    output = StringIO.new
+    output.binmode
+    output.string.force_encoding(file_data.encoding) if output.string.respond_to?(:force_encoding)
+    assert_nothing_raised { response.body.call(response, output) }
+    assert_equal file_data, output.string
+  end
+
+  def test_file_url_based_filename
+    @controller.options = { :url_based_filename => true }
+    response = nil
+    assert_nothing_raised { response = process('file') }
+    assert_not_nil response
+    assert_equal "attachment", response.headers["Content-Disposition"]
+  end
+
+  def test_x_sendfile_header
+    @controller.options = { :x_sendfile => true }
+
+    response = nil
+    assert_nothing_raised { response = process('file') }
+    assert_not_nil response
+
+    assert_equal @controller.file_path, response.headers['X-Sendfile']
+    assert response.body.blank?
+    assert !response.etag?
+  end
+
+  def test_data
+    response = nil
+    assert_nothing_raised { response = process('data') }
+    assert_not_nil response
+
+    assert_kind_of String, response.body
+    assert_equal file_data, response.body
+  end
+
+  def test_headers_after_send_shouldnt_include_charset
+    response = process('data')
+    assert_equal "application/octet-stream", response.content_type
+
+    response = process('file')
+    assert_equal "application/octet-stream", response.content_type
+  end
+
+  # Test that send_file_headers! is setting the correct HTTP headers.
+  def test_send_file_headers!
+    options = {
+      :length => 1,
+      :type => Mime::PNG,
+      :disposition => 'disposition',
+      :filename => 'filename'
+    }
+
+    # Do it a few times: the resulting headers should be identical
+    # no matter how many times you send with the same options.
+    # Test resolving Ticket #458.
+    @controller.headers = {}
+    @controller.send(:send_file_headers!, options)
+    @controller.send(:send_file_headers!, options)
+    @controller.send(:send_file_headers!, options)
+
+    h = @controller.headers
+    assert_equal '1', h['Content-Length']
+    assert_equal 'image/png', h['Content-Type']
+    assert_equal 'disposition; filename="filename"', h['Content-Disposition']
+    assert_equal 'binary', h['Content-Transfer-Encoding']
+
+    # test overriding Cache-Control: no-cache header to fix IE open/save dialog
+    @controller.headers = { 'Cache-Control' => 'no-cache' }
+    @controller.send(:send_file_headers!, options)
+    h = @controller.headers
+    assert_equal 'private', h['Cache-Control']
+  end
+
+  def test_send_file_headers_with_mime_lookup_with_symbol
+    options = {
+      :length => 1,
+      :type => :png
+    }
+
+    @controller.headers = {}
+    @controller.send(:send_file_headers!, options)
+
+    headers = @controller.headers
+
+    assert_equal 'image/png', headers['Content-Type']
+  end
+  
+
+  def test_send_file_headers_with_bad_symbol
+    options = {
+      :length => 1,
+      :type => :this_type_is_not_registered
+    }
+
+    @controller.headers = {}
+    assert_raise(ArgumentError){ @controller.send(:send_file_headers!, options) }
+  end
+
+  %w(file data).each do |method|
+    define_method "test_send_#{method}_status" do
+      @controller.options = { :stream => false, :status => 500 }
+      assert_nothing_raised { assert_not_nil process(method) }
+      assert_equal '500 Internal Server Error', @response.status
+    end
+
+    define_method "test_default_send_#{method}_status" do
+      @controller.options = { :stream => false }
+      assert_nothing_raised { assert_not_nil process(method) }
+      assert_equal ActionController::Base::DEFAULT_RENDER_STATUS_CODE, @response.status
+    end
+  end
+
+  def test_send_data_content_length_header
+    @controller.headers = {}
+    @controller.options = { :type => :text, :filename => 'file_with_utf8_text' }
+    process('multibyte_text_data')
+    assert_equal '29', @controller.headers['Content-Length']
+  end
+end

data/test/controller/session/cookie_store_test.rb

@@ -0,0 +1,216 @@
+require 'abstract_unit'
+require 'stringio'
+
+class CookieStoreTest < ActionController::IntegrationTest
+  SessionKey = '_myapp_session'
+  SessionSecret = 'b3c631c314c0bbca50c1b2843150fe33'
+
+  DispatcherApp = ActionController::Dispatcher.new
+  CookieStoreApp = ActionController::Session::CookieStore.new(DispatcherApp, :key => SessionKey, :secret => SessionSecret)
+
+  Verifier = ActiveSupport::MessageVerifier.new(SessionSecret, 'SHA1')
+
+  SignedBar = "BAh7BjoIZm9vIghiYXI%3D--fef868465920f415f2c0652d6910d3af288a0367"
+
+  class TestController < ActionController::Base
+    def no_session_access
+      head :ok
+    end
+
+    def persistent_session_id
+      render :text => session[:session_id]
+    end
+
+    def set_session_value
+      session[:foo] = "bar"
+      render :text => Rack::Utils.escape(Verifier.generate(session.to_hash))
+    end
+
+    def get_session_value
+      render :text => "foo: #{session[:foo].inspect}"
+    end
+
+    def get_session_id
+      render :text => "foo: #{session[:foo].inspect}; id: #{request.session_options[:id]}"
+    end
+
+    def call_reset_session
+      reset_session
+      head :ok
+    end
+
+    def raise_data_overflow
+      session[:foo] = 'bye!' * 1024
+      head :ok
+    end
+
+    def rescue_action(e) raise end
+  end
+
+  def setup
+    @integration_session = open_session(CookieStoreApp)
+  end
+
+  def test_raises_argument_error_if_missing_session_key
+    assert_raise(ArgumentError, nil.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+        :key => nil, :secret => SessionSecret)
+    }
+
+    assert_raise(ArgumentError, ''.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+        :key => '', :secret => SessionSecret)
+    }
+  end
+
+  def test_raises_argument_error_if_missing_secret
+    assert_raise(ArgumentError, nil.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => nil)
+    }
+
+    assert_raise(ArgumentError, ''.inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => '')
+    }
+  end
+
+  def test_raises_argument_error_if_secret_is_probably_insecure
+    assert_raise(ArgumentError, "password".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "password")
+    }
+
+    assert_raise(ArgumentError, "secret".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "secret")
+    }
+
+    assert_raise(ArgumentError, "12345678901234567890123456789".inspect) {
+      ActionController::Session::CookieStore.new(nil,
+       :key => SessionKey, :secret => "12345678901234567890123456789")
+    }
+  end
+
+  def test_setting_session_value
+    with_test_route_set do
+      get '/set_session_value'
+      assert_response :success
+      assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
+        headers['Set-Cookie']
+   end
+  end
+
+  def test_getting_session_value
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: "bar"', response.body
+   end
+  end
+
+  def test_getting_session_id
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/persistent_session_id'
+      assert_response :success
+      assert_equal response.body.size, 32
+      session_id = response.body
+
+      get '/get_session_id'
+      assert_response :success
+      assert_equal "foo: \"bar\"; id: #{session_id}", response.body
+    end
+  end
+
+  def test_disregards_tampered_sessions
+    with_test_route_set do
+      cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--123456780"
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body
+    end
+  end
+
+  def test_close_raises_when_data_overflows
+    with_test_route_set do
+      assert_raise(ActionController::Session::CookieStore::CookieOverflow) {
+        get '/raise_data_overflow'
+      }
+    end
+  end
+
+  def test_doesnt_write_session_cookie_if_session_is_not_accessed
+    with_test_route_set do
+      get '/no_session_access'
+      assert_response :success
+      assert_equal "", headers['Set-Cookie']
+    end
+  end
+
+  def test_doesnt_write_session_cookie_if_session_is_unchanged
+    with_test_route_set do
+      cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--" +
+        "fef868465920f415f2c0652d6910d3af288a0367"
+      get '/no_session_access'
+      assert_response :success
+      assert_equal "", headers['Set-Cookie']
+    end
+  end
+
+  def test_setting_session_value_after_session_reset
+    with_test_route_set do
+      get '/set_session_value'
+      assert_response :success
+      session_payload = response.body
+      assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
+        headers['Set-Cookie']
+
+      get '/call_reset_session'
+      assert_response :success
+      assert_not_equal [], headers['Set-Cookie']
+      assert_not_equal session_payload, cookies[SessionKey]
+
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body
+    end
+  end
+
+  def test_persistent_session_id
+    with_test_route_set do
+      cookies[SessionKey] = SignedBar
+      get '/persistent_session_id'
+      assert_response :success
+      assert_equal response.body.size, 32
+      session_id = response.body
+      get '/persistent_session_id'
+      assert_equal session_id, response.body
+      reset!
+      get '/persistent_session_id'
+      assert_not_equal session_id, response.body
+    end
+  end
+
+  private
+    def with_test_route_set
+      with_routing do |set|
+        set.draw do |map|
+          map.with_options :controller => "cookie_store_test/test" do |c|
+            c.connect "/:action"
+          end
+        end
+        yield
+      end
+    end
+
+    def unmarshal_session(cookie_string)
+      session = Rack::Utils.parse_query(cookie_string, ';,').inject({}) {|h,(k,v)|
+        h[k] = Array === v ? v.first : v
+        h
+      }[SessionKey]
+      verifier = ActiveSupport::MessageVerifier.new(SessionSecret, 'SHA1')
+      verifier.verify(session)
+    end
+end

data/test/controller/session/mem_cache_store_test.rb

@@ -0,0 +1,127 @@
+require 'abstract_unit'
+
+# You need to start a memcached server inorder to run these tests
+class MemCacheStoreTest < ActionController::IntegrationTest
+  class TestController < ActionController::Base
+    def no_session_access
+      head :ok
+    end
+
+    def set_session_value
+      session[:foo] = "bar"
+      head :ok
+    end
+
+    def get_session_value
+      render :text => "foo: #{session[:foo].inspect}"
+    end
+
+    def get_session_id
+      session[:foo]
+      render :text => "#{request.session_options[:id]}"
+    end
+
+    def call_reset_session
+      session[:bar]
+      reset_session
+      session[:bar] = "baz"
+      head :ok
+    end
+
+    def rescue_action(e) raise end
+  end
+
+  begin
+    DispatcherApp = ActionController::Dispatcher.new
+    MemCacheStoreApp = ActionController::Session::MemCacheStore.new(
+                         DispatcherApp, :key => '_session_id')
+
+
+    def setup
+      @integration_session = open_session(MemCacheStoreApp)
+    end
+
+    def test_setting_and_getting_session_value
+      with_test_route_set do
+        get '/set_session_value'
+        assert_response :success
+        assert cookies['_session_id']
+
+        get '/get_session_value'
+        assert_response :success
+        assert_equal 'foo: "bar"', response.body
+      end
+    end
+
+    def test_getting_nil_session_value
+      with_test_route_set do
+        get '/get_session_value'
+        assert_response :success
+        assert_equal 'foo: nil', response.body
+      end
+    end
+
+    def test_setting_session_value_after_session_reset
+      with_test_route_set do
+        get '/set_session_value'
+        assert_response :success
+        assert cookies['_session_id']
+        session_id = cookies['_session_id']
+
+        get '/call_reset_session'
+        assert_response :success
+        assert_not_equal [], headers['Set-Cookie']
+
+        get '/get_session_value'
+        assert_response :success
+        assert_equal 'foo: nil', response.body
+
+        get '/get_session_id'
+        assert_response :success
+        assert_not_equal session_id, response.body
+      end
+    end
+
+    def test_getting_session_id
+      with_test_route_set do
+        get '/set_session_value'
+        assert_response :success
+        assert cookies['_session_id']
+        session_id = cookies['_session_id']
+
+        get '/get_session_id'
+        assert_response :success
+        assert_equal session_id, response.body
+      end
+    end
+
+    def test_prevents_session_fixation
+      with_test_route_set do
+        get '/get_session_value'
+        assert_response :success
+        assert_equal 'foo: nil', response.body
+        session_id = cookies['_session_id']
+
+        reset!
+
+        get '/set_session_value', :_session_id => session_id
+        assert_response :success
+        assert_equal nil, cookies['_session_id']
+      end
+    end
+  rescue LoadError, RuntimeError
+    $stderr.puts "Skipping MemCacheStoreTest tests. Start memcached and try again."
+  end
+
+  private
+    def with_test_route_set
+      with_routing do |set|
+        set.draw do |map|
+          map.with_options :controller => "mem_cache_store_test/test" do |c|
+            c.connect "/:action"
+          end
+        end
+        yield
+      end
+    end
+end

data/test/controller/session/test_session_test.rb

@@ -0,0 +1,58 @@
+require 'abstract_unit'
+require 'stringio'
+
+class ActionController::TestSessionTest < ActiveSupport::TestCase
+  
+  def test_calling_delete_without_parameters_raises_deprecation_warning_and_calls_to_clear_test_session
+    assert_deprecated(/use clear instead/){ ActionController::TestSession.new.delete }
+  end
+  
+  def test_calling_update_without_parameters_raises_deprecation_warning_and_calls_to_clear_test_session
+    assert_deprecated(/use replace instead/){ ActionController::TestSession.new.update }
+  end
+  
+  def test_calling_close_raises_deprecation_warning
+    assert_deprecated(/sessions should no longer be closed/){ ActionController::TestSession.new.close }
+  end
+  
+  def test_defaults
+    session = ActionController::TestSession.new
+    assert_equal({}, session.data)
+    assert_equal('', session.session_id)
+  end
+  
+  def test_ctor_allows_setting
+    session = ActionController::TestSession.new({:one => 'one', :two => 'two'})
+    assert_equal('one', session[:one])
+    assert_equal('two', session[:two])
+  end
+  
+  def test_setting_session_item_sets_item
+    session = ActionController::TestSession.new
+    session[:key] = 'value'
+    assert_equal('value', session[:key])
+  end
+  
+  def test_calling_delete_removes_item_and_returns_its_value
+    session = ActionController::TestSession.new
+    session[:key] = 'value'
+    assert_equal('value', session[:key])
+    assert_equal('value', session.delete(:key))
+    assert_nil(session[:key])
+  end
+  
+  def test_calling_update_with_params_passes_to_attributes
+    session = ActionController::TestSession.new()
+    session.update('key' => 'value')
+    assert_equal('value', session[:key])
+  end
+  
+  def test_clear_emptys_session
+    params = {:one => 'one', :two => 'two'}
+    session = ActionController::TestSession.new({:one => 'one', :two => 'two'})
+    session.clear
+    assert_nil(session[:one])
+    assert_nil(session[:two])
+  end
+  
+end