activesupport 4.0.12 → 7.0.2.4

data/lib/active_support/reloader.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "active_support/execution_wrapper"
+require "active_support/executor"
+
+module ActiveSupport
+  #--
+  # This class defines several callbacks:
+  #
+  #   to_prepare -- Run once at application startup, and also from
+  #   +to_run+.
+  #
+  #   to_run -- Run before a work run that is reloading. If
+  #   +reload_classes_only_on_change+ is true (the default), the class
+  #   unload will have already occurred.
+  #
+  #   to_complete -- Run after a work run that has reloaded. If
+  #   +reload_classes_only_on_change+ is false, the class unload will
+  #   have occurred after the work run, but before this callback.
+  #
+  #   before_class_unload -- Run immediately before the classes are
+  #   unloaded.
+  #
+  #   after_class_unload -- Run immediately after the classes are
+  #   unloaded.
+  #
+  class Reloader < ExecutionWrapper
+    define_callbacks :prepare
+
+    define_callbacks :class_unload
+
+    # Registers a callback that will run once at application startup and every time the code is reloaded.
+    def self.to_prepare(*args, &block)
+      set_callback(:prepare, *args, &block)
+    end
+
+    # Registers a callback that will run immediately before the classes are unloaded.
+    def self.before_class_unload(*args, &block)
+      set_callback(:class_unload, *args, &block)
+    end
+
+    # Registers a callback that will run immediately after the classes are unloaded.
+    def self.after_class_unload(*args, &block)
+      set_callback(:class_unload, :after, *args, &block)
+    end
+
+    to_run(:after) { self.class.prepare! }
+
+    # Initiate a manual reload
+    def self.reload!
+      executor.wrap do
+        new.tap do |instance|
+          instance.run!
+        ensure
+          instance.complete!
+        end
+      end
+      prepare!
+    end
+
+    def self.run!(reset: false) # :nodoc:
+      if check!
+        super
+      else
+        Null
+      end
+    end
+
+    # Run the supplied block as a work unit, reloading code as needed
+    def self.wrap
+      executor.wrap do
+        super
+      end
+    end
+
+    class_attribute :executor, default: Executor
+    class_attribute :check, default: lambda { false }
+
+    def self.check! # :nodoc:
+      @should_reload ||= check.call
+    end
+
+    def self.reloaded! # :nodoc:
+      @should_reload = false
+    end
+
+    def self.prepare! # :nodoc:
+      new.run_callbacks(:prepare)
+    end
+
+    def initialize
+      super
+      @locked = false
+    end
+
+    # Acquire the ActiveSupport::Dependencies::Interlock unload lock,
+    # ensuring it will be released automatically
+    def require_unload_lock!
+      unless @locked
+        ActiveSupport::Dependencies.interlock.start_unloading
+        @locked = true
+      end
+    end
+
+    # Release the unload lock if it has been previously obtained
+    def release_unload_lock!
+      if @locked
+        @locked = false
+        ActiveSupport::Dependencies.interlock.done_unloading
+      end
+    end
+
+    def run! # :nodoc:
+      super
+      release_unload_lock!
+    end
+
+    def class_unload!(&block) # :nodoc:
+      require_unload_lock!
+      run_callbacks(:class_unload, &block)
+    end
+
+    def complete! # :nodoc:
+      super
+      self.class.reloaded!
+    ensure
+      release_unload_lock!
+    end
+  end
+end

data/lib/active_support/rescuable.rb

@@ -1,7 +1,8 @@
-require 'active_support/concern'
-require 'active_support/core_ext/class/attribute'
-require 'active_support/core_ext/string/inflections'
-require 'active_support/core_ext/array/extract_options'
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "active_support/core_ext/class/attribute"
+require "active_support/core_ext/string/inflections"
 
 module ActiveSupport
   # Rescuable module adds support for easier exception handling.
@@ -9,17 +10,16 @@ module ActiveSupport
     extend Concern
 
     included do
-      class_attribute :rescue_handlers
-      self.rescue_handlers = []
+      class_attribute :rescue_handlers, default: []
     end
 
     module ClassMethods
-      # Rescue exceptions raised in controller actions.
+      # Registers exception classes with a handler to be called by <tt>rescue_with_handler</tt>.
       #
       # <tt>rescue_from</tt> receives a series of exception classes or class
-      # names, and a trailing <tt>:with</tt> option with the name of a method
-      # or a Proc object to be called to handle them. Alternatively a block can
-      # be given.
+      # names, and an exception handler specified by a trailing <tt>:with</tt>
+      # option containing the name of a method or a Proc object. Alternatively, a block
+      # can be given as the handler.
       #
       # Handlers that take one argument will be called with the exception, so
       # that the exception can be inspected when dealing with it.
@@ -37,7 +37,7 @@ module ActiveSupport
       #       render xml: exception, status: 500
       #     end
       #
-      #     protected
+      #     private
       #       def deny_access
       #         ...
       #       end
@@ -48,72 +48,127 @@ module ActiveSupport
       #   end
       #
       # Exceptions raised inside exception handlers are not propagated up.
-      def rescue_from(*klasses, &block)
-        options = klasses.extract_options!
-
-        unless options.has_key?(:with)
+      def rescue_from(*klasses, with: nil, &block)
+        unless with
           if block_given?
-            options[:with] = block
+            with = block
           else
-            raise ArgumentError, "Need a handler. Supply an options hash that has a :with key as the last argument."
+            raise ArgumentError, "Need a handler. Pass the with: keyword argument or provide a block."
           end
         end
 
         klasses.each do |klass|
-          key = if klass.is_a?(Class) && klass <= Exception
+          key = if klass.is_a?(Module) && klass.respond_to?(:===)
             klass.name
           elsif klass.is_a?(String)
             klass
           else
-            raise ArgumentError, "#{klass} is neither an Exception nor a String"
+            raise ArgumentError, "#{klass.inspect} must be an Exception class or a String referencing an Exception class"
           end
 
-          # put the new handler at the end because the list is read in reverse
-          self.rescue_handlers += [[key, options[:with]]]
+          # Put the new handler at the end because the list is read in reverse.
+          self.rescue_handlers += [[key, with]]
         end
       end
-    end
 
-    # Tries to rescue the exception by looking up and calling a registered handler.
-    def rescue_with_handler(exception)
-      if handler = handler_for_rescue(exception)
-        handler.arity != 0 ? handler.call(exception) : handler.call
-        true # don't rely on the return value of the handler
-      end
-    end
+      # Matches an exception to a handler based on the exception class.
+      #
+      # If no handler matches the exception, check for a handler matching the
+      # (optional) exception.cause. If no handler matches the exception or its
+      # cause, this returns +nil+, so you can deal with unhandled exceptions.
+      # Be sure to re-raise unhandled exceptions if this is what you expect.
+      #
+      #     begin
+      #       …
+      #     rescue => exception
+      #       rescue_with_handler(exception) || raise
+      #     end
+      #
+      # Returns the exception if it was handled and +nil+ if it was not.
+      def rescue_with_handler(exception, object: self, visited_exceptions: [])
+        visited_exceptions << exception
 
-    def handler_for_rescue(exception)
-      # We go from right to left because pairs are pushed onto rescue_handlers
-      # as rescue_from declarations are found.
-      _, rescuer = self.class.rescue_handlers.reverse.detect do |klass_name, handler|
-        # The purpose of allowing strings in rescue_from is to support the
-        # declaration of handler associations for exception classes whose
-        # definition is yet unknown.
-        #
-        # Since this loop needs the constants it would be inconsistent to
-        # assume they should exist at this point. An early raised exception
-        # could trigger some other handler and the array could include
-        # precisely a string whose corresponding constant has not yet been
-        # seen. This is why we are tolerant to unknown constants.
-        #
-        # Note that this tolerance only matters if the exception was given as
-        # a string, otherwise a NameError will be raised by the interpreter
-        # itself when rescue_from CONSTANT is executed.
-        klass = self.class.const_get(klass_name) rescue nil
-        klass ||= klass_name.constantize rescue nil
-        exception.is_a?(klass) if klass
+        if handler = handler_for_rescue(exception, object: object)
+          handler.call exception
+          exception
+        elsif exception
+          if visited_exceptions.include?(exception.cause)
+            nil
+          else
+            rescue_with_handler(exception.cause, object: object, visited_exceptions: visited_exceptions)
+          end
+        end
       end
 
-      case rescuer
-      when Symbol
-        method(rescuer)
-      when Proc
-        if rescuer.arity == 0
-          Proc.new { instance_exec(&rescuer) }
-        else
-          Proc.new { |_exception| instance_exec(_exception, &rescuer) }
+      def handler_for_rescue(exception, object: self) # :nodoc:
+        case rescuer = find_rescue_handler(exception)
+        when Symbol
+          method = object.method(rescuer)
+          if method.arity == 0
+            -> e { method.call }
+          else
+            method
+          end
+        when Proc
+          if rescuer.arity == 0
+            -> e { object.instance_exec(&rescuer) }
+          else
+            -> e { object.instance_exec(e, &rescuer) }
+          end
         end
       end
+
+      private
+        def find_rescue_handler(exception)
+          if exception
+            # Handlers are in order of declaration but the most recently declared
+            # is the highest priority match, so we search for matching handlers
+            # in reverse.
+            _, handler = rescue_handlers.reverse_each.detect do |class_or_name, _|
+              if klass = constantize_rescue_handler_class(class_or_name)
+                klass === exception
+              end
+            end
+
+            handler
+          end
+        end
+
+        def constantize_rescue_handler_class(class_or_name)
+          case class_or_name
+          when String, Symbol
+            begin
+              # Try a lexical lookup first since we support
+              #
+              #     class Super
+              #       rescue_from 'Error', with: …
+              #     end
+              #
+              #     class Sub
+              #       class Error < StandardError; end
+              #     end
+              #
+              # so an Error raised in Sub will hit the 'Error' handler.
+              const_get class_or_name
+            rescue NameError
+              class_or_name.safe_constantize
+            end
+          else
+            class_or_name
+          end
+        end
+    end
+
+    # Delegates to the class method, but uses the instance as the subject for
+    # rescue_from handlers (method calls, instance_exec blocks).
+    def rescue_with_handler(exception)
+      self.class.rescue_with_handler exception, object: self
+    end
+
+    # Internal handler lookup. Delegates to class method. Some libraries call
+    # this directly, so keeping it around for compatibility.
+    def handler_for_rescue(exception) # :nodoc:
+      self.class.handler_for_rescue exception, object: self
     end
   end
 end

data/lib/active_support/ruby_features.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module ActiveSupport
+  module RubyFeatures # :nodoc:
+    CLASS_SUBCLASSES = Class.method_defined?(:subclasses) # RUBY_VERSION >= "3.1"
+  end
+end

data/lib/active_support/secure_compare_rotator.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "active_support/security_utils"
+require "active_support/messages/rotator"
+
+module ActiveSupport
+  # The ActiveSupport::SecureCompareRotator is a wrapper around +ActiveSupport::SecurityUtils.secure_compare+
+  # and allows you to rotate a previously defined value to a new one.
+  #
+  # It can be used as follow:
+  #
+  #   rotator = ActiveSupport::SecureCompareRotator.new('new_production_value')
+  #   rotator.rotate('previous_production_value')
+  #   rotator.secure_compare!('previous_production_value')
+  #
+  # One real use case example would be to rotate a basic auth credentials:
+  #
+  #   class MyController < ApplicationController
+  #     def authenticate_request
+  #       rotator = ActiveSupport::SecureCompareRotator.new('new_password')
+  #       rotator.rotate('old_password')
+  #
+  #       authenticate_or_request_with_http_basic do |username, password|
+  #         rotator.secure_compare!(password)
+  #       rescue ActiveSupport::SecureCompareRotator::InvalidMatch
+  #         false
+  #       end
+  #     end
+  #   end
+  class SecureCompareRotator
+    include SecurityUtils
+    prepend Messages::Rotator
+
+    InvalidMatch = Class.new(StandardError)
+
+    def initialize(value, **_options)
+      @value = value
+    end
+
+    def secure_compare!(other_value, on_rotation: @on_rotation)
+      secure_compare(@value, other_value) ||
+        run_rotations(on_rotation) { |wrapper| wrapper.secure_compare!(other_value) } ||
+        raise(InvalidMatch)
+    end
+
+    private
+      def build_rotation(previous_value, _options)
+        self.class.new(previous_value)
+      end
+  end
+end

data/lib/active_support/security_utils.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module ActiveSupport
+  module SecurityUtils
+    # Constant time string comparison, for fixed length strings.
+    #
+    # The values compared should be of fixed length, such as strings
+    # that have already been processed by HMAC. Raises in case of length mismatch.
+
+    if defined?(OpenSSL.fixed_length_secure_compare)
+      def fixed_length_secure_compare(a, b)
+        OpenSSL.fixed_length_secure_compare(a, b)
+      end
+    else
+      def fixed_length_secure_compare(a, b)
+        raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
+
+        l = a.unpack "C#{a.bytesize}"
+
+        res = 0
+        b.each_byte { |byte| res |= byte ^ l.shift }
+        res == 0
+      end
+    end
+    module_function :fixed_length_secure_compare
+
+    # Secure string comparison for strings of variable length.
+    #
+    # While a timing attack would not be able to discern the content of
+    # a secret compared via secure_compare, it is possible to determine
+    # the secret length. This should be considered when using secure_compare
+    # to compare weak, short secrets to user input.
+    def secure_compare(a, b)
+      a.bytesize == b.bytesize && fixed_length_secure_compare(a, b)
+    end
+    module_function :secure_compare
+  end
+end

data/lib/active_support/string_inquirer.rb

@@ -1,22 +1,29 @@
+# frozen_string_literal: true
+
 module ActiveSupport
   # Wrapping a string in this class gives you a prettier way to test
   # for equality. The value returned by <tt>Rails.env</tt> is wrapped
-  # in a StringInquirer object so instead of calling this:
+  # in a StringInquirer object, so instead of calling this:
   #
   #   Rails.env == 'production'
   #
   # you can call this:
   #
   #   Rails.env.production?
+  #
+  # == Instantiating a new StringInquirer
+  #
+  #   vehicle = ActiveSupport::StringInquirer.new('car')
+  #   vehicle.car?   # => true
+  #   vehicle.bike?  # => false
   class StringInquirer < String
     private
-
       def respond_to_missing?(method_name, include_private = false)
-        method_name[-1] == '?'
+        method_name.end_with?("?") || super
       end
 
       def method_missing(method_name, *arguments)
-        if method_name[-1] == '?'
+        if method_name.end_with?("?")
           self == method_name[0..-2]
         else
           super

data/lib/active_support/subscriber.rb

@@ -1,93 +1,163 @@
-require 'active_support/per_thread_registry'
+# frozen_string_literal: true
+
+require "active_support/notifications"
 
 module ActiveSupport
   # ActiveSupport::Subscriber is an object set to consume
   # ActiveSupport::Notifications. The subscriber dispatches notifications to
   # a registered object based on its given namespace.
   #
-  # An example would be Active Record subscriber responsible for collecting
+  # An example would be an Active Record subscriber responsible for collecting
   # statistics about queries:
   #
   #   module ActiveRecord
   #     class StatsSubscriber < ActiveSupport::Subscriber
+  #       attach_to :active_record
+  #
   #       def sql(event)
   #         Statsd.timing("sql.#{event.payload[:name]}", event.duration)
   #       end
   #     end
   #   end
   #
-  # And it's finally registered as:
-  #
-  #   ActiveRecord::StatsSubscriber.attach_to :active_record
-  #
-  # Since we need to know all instance methods before attaching the log
-  # subscriber, the line above should be called after your subscriber definition.
-  #
   # After configured, whenever a "sql.active_record" notification is published,
   # it will properly dispatch the event (ActiveSupport::Notifications::Event) to
   # the +sql+ method.
+  #
+  # We can detach a subscriber as well:
+  #
+  #   ActiveRecord::StatsSubscriber.detach_from(:active_record)
   class Subscriber
     class << self
-
       # Attach the subscriber to a namespace.
-      def attach_to(namespace, subscriber=new, notifier=ActiveSupport::Notifications)
+      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications, inherit_all: false)
+        @namespace  = namespace
+        @subscriber = subscriber
+        @notifier   = notifier
+        @inherit_all = inherit_all
+
         subscribers << subscriber
 
-        subscriber.public_methods(false).each do |event|
-          next if %w{ start finish }.include?(event.to_s)
+        # Add event subscribers for all existing methods on the class.
+        fetch_public_methods(subscriber, inherit_all).each do |event|
+          add_event_subscriber(event)
+        end
+      end
+
+      # Detach the subscriber from a namespace.
+      def detach_from(namespace, notifier = ActiveSupport::Notifications)
+        @namespace  = namespace
+        @subscriber = find_attached_subscriber
+        @notifier   = notifier
+
+        return unless subscriber
 
-          notifier.subscribe("#{event}.#{namespace}", subscriber)
+        subscribers.delete(subscriber)
+
+        # Remove event subscribers of all existing methods on the class.
+        fetch_public_methods(subscriber, true).each do |event|
+          remove_event_subscriber(event)
+        end
+
+        # Reset notifier so that event subscribers will not add for new methods added to the class.
+        @notifier = nil
+      end
+
+      # Adds event subscribers for all new methods added to the class.
+      def method_added(event)
+        # Only public methods are added as subscribers, and only if a notifier
+        # has been set up. This means that subscribers will only be set up for
+        # classes that call #attach_to.
+        if public_method_defined?(event) && notifier
+          add_event_subscriber(event)
         end
       end
 
       def subscribers
         @@subscribers ||= []
       end
+
+      private
+        attr_reader :subscriber, :notifier, :namespace
+
+        def add_event_subscriber(event) # :doc:
+          return if invalid_event?(event)
+
+          pattern = prepare_pattern(event)
+
+          # Don't add multiple subscribers (e.g. if methods are redefined).
+          return if pattern_subscribed?(pattern)
+
+          subscriber.patterns[pattern] = notifier.subscribe(pattern, subscriber)
+        end
+
+        def remove_event_subscriber(event) # :doc:
+          return if invalid_event?(event)
+
+          pattern = prepare_pattern(event)
+
+          return unless pattern_subscribed?(pattern)
+
+          notifier.unsubscribe(subscriber.patterns[pattern])
+          subscriber.patterns.delete(pattern)
+        end
+
+        def find_attached_subscriber
+          subscribers.find { |attached_subscriber| attached_subscriber.instance_of?(self) }
+        end
+
+        def invalid_event?(event)
+          %i{ start finish }.include?(event.to_sym)
+        end
+
+        def prepare_pattern(event)
+          "#{event}.#{namespace}"
+        end
+
+        def pattern_subscribed?(pattern)
+          subscriber.patterns.key?(pattern)
+        end
+
+        def fetch_public_methods(subscriber, inherit_all)
+          subscriber.public_methods(inherit_all) - Subscriber.public_instance_methods(true)
+        end
     end
 
+    attr_reader :patterns # :nodoc:
+
     def initialize
       @queue_key = [self.class.name, object_id].join "-"
+      @patterns  = {}
       super
     end
 
     def start(name, id, payload)
-      e = ActiveSupport::Notifications::Event.new(name, Time.now, nil, id, payload)
+      event = ActiveSupport::Notifications::Event.new(name, nil, nil, id, payload)
+      event.start!
       parent = event_stack.last
-      parent << e if parent
+      parent << event if parent
 
-      event_stack.push e
+      event_stack.push event
     end
 
     def finish(name, id, payload)
-      finished  = Time.now
-      event     = event_stack.pop
-      event.end = finished
+      event = event_stack.pop
+      event.finish!
       event.payload.merge!(payload)
 
-      method = name.split('.').first
+      method = name.split(".").first
       send(method, event)
     end
 
-    private
+    def publish_event(event) # :nodoc:
+      method = event.name.split(".").first
+      send(method, event)
+    end
 
+    private
       def event_stack
-        SubscriberQueueRegistry.get_queue(@queue_key)
+        registry = ActiveSupport::IsolatedExecutionState[:active_support_subscriber_queue_registry] ||= {}
+        registry[@queue_key] ||= []
       end
   end
-
-  # This is a registry for all the event stacks kept for subscribers.
-  #
-  # See the documentation of <tt>ActiveSupport::PerThreadRegistry</tt>
-  # for further details.
-  class SubscriberQueueRegistry # :nodoc:
-    extend PerThreadRegistry
-
-    def initialize
-      @registry = {}
-    end
-
-    def get_queue(queue_key)
-      @registry[queue_key] ||= []
-    end
-  end
 end