activesupport 4.2.11.1 → 6.0.3.1

data/lib/active_support/parameter_filter.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/object/duplicable"
+require "active_support/core_ext/array/extract"
+
+module ActiveSupport
+  # +ParameterFilter+ allows you to specify keys for sensitive data from
+  # hash-like object and replace corresponding value. Filtering only certain
+  # sub-keys from a hash is possible by using the dot notation:
+  # 'credit_card.number'. If a proc is given, each key and value of a hash and
+  # all sub-hashes are passed to it, where the value or the key can be replaced
+  # using String#replace or similar methods.
+  #
+  #   ActiveSupport::ParameterFilter.new([:password])
+  #   => replaces the value to all keys matching /password/i with "[FILTERED]"
+  #
+  #   ActiveSupport::ParameterFilter.new([:foo, "bar"])
+  #   => replaces the value to all keys matching /foo|bar/i with "[FILTERED]"
+  #
+  #   ActiveSupport::ParameterFilter.new(["credit_card.code"])
+  #   => replaces { credit_card: {code: "xxxx"} } with "[FILTERED]", does not
+  #   change { file: { code: "xxxx"} }
+  #
+  #   ActiveSupport::ParameterFilter.new([-> (k, v) do
+  #     v.reverse! if k =~ /secret/i
+  #   end])
+  #   => reverses the value to all keys matching /secret/i
+  class ParameterFilter
+    FILTERED = "[FILTERED]" # :nodoc:
+
+    # Create instance with given filters. Supported type of filters are +String+, +Regexp+, and +Proc+.
+    # Other types of filters are treated as +String+ using +to_s+.
+    # For +Proc+ filters, key, value, and optional original hash is passed to block arguments.
+    #
+    # ==== Options
+    #
+    # * <tt>:mask</tt> - A replaced object when filtered. Defaults to +"[FILTERED]"+
+    def initialize(filters = [], mask: FILTERED)
+      @filters = filters
+      @mask = mask
+    end
+
+    # Mask value of +params+ if key matches one of filters.
+    def filter(params)
+      compiled_filter.call(params)
+    end
+
+    # Returns filtered value for given key. For +Proc+ filters, third block argument is not populated.
+    def filter_param(key, value)
+      @filters.empty? ? value : compiled_filter.value_for_key(key, value)
+    end
+
+  private
+    def compiled_filter
+      @compiled_filter ||= CompiledFilter.compile(@filters, mask: @mask)
+    end
+
+    class CompiledFilter # :nodoc:
+      def self.compile(filters, mask:)
+        return lambda { |params| params.dup } if filters.empty?
+
+        strings, regexps, blocks = [], [], []
+
+        filters.each do |item|
+          case item
+          when Proc
+            blocks << item
+          when Regexp
+            regexps << item
+          else
+            strings << Regexp.escape(item.to_s)
+          end
+        end
+
+        deep_regexps = regexps.extract! { |r| r.to_s.include?("\\.") }
+        deep_strings = strings.extract! { |s| s.include?("\\.") }
+
+        regexps << Regexp.new(strings.join("|"), true) unless strings.empty?
+        deep_regexps << Regexp.new(deep_strings.join("|"), true) unless deep_strings.empty?
+
+        new regexps, deep_regexps, blocks, mask: mask
+      end
+
+      attr_reader :regexps, :deep_regexps, :blocks
+
+      def initialize(regexps, deep_regexps, blocks, mask:)
+        @regexps = regexps
+        @deep_regexps = deep_regexps.any? ? deep_regexps : nil
+        @blocks = blocks
+        @mask = mask
+      end
+
+      def call(params, parents = [], original_params = params)
+        filtered_params = params.class.new
+
+        params.each do |key, value|
+          filtered_params[key] = value_for_key(key, value, parents, original_params)
+        end
+
+        filtered_params
+      end
+
+      def value_for_key(key, value, parents = [], original_params = nil)
+        parents.push(key) if deep_regexps
+        if regexps.any? { |r| r.match?(key.to_s) }
+          value = @mask
+        elsif deep_regexps && (joined = parents.join(".")) && deep_regexps.any? { |r| r.match?(joined) }
+          value = @mask
+        elsif value.is_a?(Hash)
+          value = call(value, parents, original_params)
+        elsif value.is_a?(Array)
+          # If we don't pop the current parent it will be duplicated as we
+          # process each array value.
+          parents.pop if deep_regexps
+          value = value.map { |v| value_for_key(key, v, parents, original_params) }
+          # Restore the parent stack after processing the array.
+          parents.push(key) if deep_regexps
+        elsif blocks.any?
+          key = key.dup if key.duplicable?
+          value = value.dup if value.duplicable?
+          blocks.each { |b| b.arity == 2 ? b.call(key, value) : b.call(key, value, original_params) }
+        end
+        parents.pop if deep_regexps
+        value
+      end
+    end
+  end
+end

data/lib/active_support/per_thread_registry.rb

@@ -1,6 +1,11 @@
-require 'active_support/core_ext/module/delegation'
+# frozen_string_literal: true
+
+require "active_support/core_ext/module/delegation"
 
 module ActiveSupport
+  # NOTE: This approach has been deprecated for end-user code in favor of {thread_mattr_accessor}[rdoc-ref:Module#thread_mattr_accessor] and friends.
+  # Please use that approach instead.
+  #
   # This module is used to encapsulate access to thread local variables.
   #
   # Instead of polluting the thread locals namespace:
@@ -35,15 +40,15 @@ module ActiveSupport
   # If the class has an initializer, it must accept no arguments.
   module PerThreadRegistry
     def self.extended(object)
-      object.instance_variable_set '@per_thread_registry_key', object.name.freeze
+      object.instance_variable_set "@per_thread_registry_key", object.name.freeze
     end
 
     def instance
       Thread.current[@per_thread_registry_key] ||= new
     end
 
-    protected
-      def method_missing(name, *args, &block) # :nodoc:
+    private
+      def method_missing(name, *args, &block)
         # Caches the method definition as a singleton method of the receiver.
         #
         # By letting #delegate handle it, we avoid an enclosure that'll capture args.

data/lib/active_support/proxy_object.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveSupport
   # A class with no predefined methods that behaves similarly to Builder's
   # BlankSlate. Used for proxy classes.

data/lib/active_support/rails.rb

@@ -1,27 +1,29 @@
+# frozen_string_literal: true
+
 # This is private interface.
 #
 # Rails components cherry pick from Active Support as needed, but there are a
-# few features that are used for sure some way or another and it is not worth
-# to put individual requires absolutely everywhere. Think blank? for example.
+# few features that are used for sure in some way or another and it is not worth
+# putting individual requires absolutely everywhere. Think blank? for example.
 #
 # This file is loaded by every Rails component except Active Support itself,
 # but it does not belong to the Rails public interface. It is internal to
 # Rails and can change anytime.
 
 # Defines Object#blank? and Object#present?.
-require 'active_support/core_ext/object/blank'
+require "active_support/core_ext/object/blank"
 
 # Rails own autoload, eager_load, etc.
-require 'active_support/dependencies/autoload'
+require "active_support/dependencies/autoload"
 
 # Support for ClassMethods and the included macro.
-require 'active_support/concern'
+require "active_support/concern"
 
 # Defines Class#class_attribute.
-require 'active_support/core_ext/class/attribute'
+require "active_support/core_ext/class/attribute"
 
 # Defines Module#delegate.
-require 'active_support/core_ext/module/delegation'
+require "active_support/core_ext/module/delegation"
 
 # Defines ActiveSupport::Deprecation.
-require 'active_support/deprecation'
+require "active_support/deprecation"

data/lib/active_support/railtie.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support"
 require "active_support/i18n_railtie"
 
@@ -7,6 +9,21 @@ module ActiveSupport
 
     config.eager_load_namespaces << ActiveSupport
 
+    initializer "active_support.set_authenticated_message_encryption" do |app|
+      config.after_initialize do
+        unless app.config.active_support.use_authenticated_message_encryption.nil?
+          ActiveSupport::MessageEncryptor.use_authenticated_message_encryption =
+            app.config.active_support.use_authenticated_message_encryption
+        end
+      end
+    end
+
+    initializer "active_support.reset_all_current_attributes_instances" do |app|
+      app.reloader.before_class_unload { ActiveSupport::CurrentAttributes.clear_all }
+      app.executor.to_run              { ActiveSupport::CurrentAttributes.reset_all }
+      app.executor.to_complete         { ActiveSupport::CurrentAttributes.reset_all }
+    end
+
     initializer "active_support.deprecation_behavior" do |app|
       if deprecation = app.config.active_support.deprecation
         ActiveSupport::Deprecation.behavior = deprecation
@@ -16,31 +33,48 @@ module ActiveSupport
     # Sets the default value for Time.zone
     # If assigned value cannot be matched to a TimeZone, an exception will be raised.
     initializer "active_support.initialize_time_zone" do |app|
-      require 'active_support/core_ext/time/zones'
-      zone_default = Time.find_zone!(app.config.time_zone)
-
-      unless zone_default
-        raise 'Value assigned to config.time_zone not recognized. ' \
-          'Run "rake -D time" for a list of tasks for finding appropriate time zone names.'
+      begin
+        TZInfo::DataSource.get
+      rescue TZInfo::DataSourceNotFound => e
+        raise e.exception "tzinfo-data is not present. Please add gem 'tzinfo-data' to your Gemfile and run bundle install"
       end
-
-      Time.zone_default = zone_default
+      require "active_support/core_ext/time/zones"
+      Time.zone_default = Time.find_zone!(app.config.time_zone)
     end
 
     # Sets the default week start
     # If assigned value is not a valid day symbol (e.g. :sunday, :monday, ...), an exception will be raised.
     initializer "active_support.initialize_beginning_of_week" do |app|
-      require 'active_support/core_ext/date/calculations'
+      require "active_support/core_ext/date/calculations"
       beginning_of_week_default = Date.find_beginning_of_week!(app.config.beginning_of_week)
 
       Date.beginning_of_week_default = beginning_of_week_default
     end
 
+    initializer "active_support.require_master_key" do |app|
+      if app.config.respond_to?(:require_master_key) && app.config.require_master_key
+        begin
+          app.credentials.key
+        rescue ActiveSupport::EncryptedFile::MissingKeyError => error
+          $stderr.puts error.message
+          exit 1
+        end
+      end
+    end
+
     initializer "active_support.set_configs" do |app|
       app.config.active_support.each do |k, v|
         k = "#{k}="
         ActiveSupport.send(k, v) if ActiveSupport.respond_to? k
       end
     end
+
+    initializer "active_support.set_hash_digest_class" do |app|
+      config.after_initialize do
+        if app.config.active_support.use_sha1_digests
+          ActiveSupport::Digest.hash_digest_class = ::Digest::SHA1
+        end
+      end
+    end
   end
 end

data/lib/active_support/reloader.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "active_support/execution_wrapper"
+require "active_support/executor"
+
+module ActiveSupport
+  #--
+  # This class defines several callbacks:
+  #
+  #   to_prepare -- Run once at application startup, and also from
+  #   +to_run+.
+  #
+  #   to_run -- Run before a work run that is reloading. If
+  #   +reload_classes_only_on_change+ is true (the default), the class
+  #   unload will have already occurred.
+  #
+  #   to_complete -- Run after a work run that has reloaded. If
+  #   +reload_classes_only_on_change+ is false, the class unload will
+  #   have occurred after the work run, but before this callback.
+  #
+  #   before_class_unload -- Run immediately before the classes are
+  #   unloaded.
+  #
+  #   after_class_unload -- Run immediately after the classes are
+  #   unloaded.
+  #
+  class Reloader < ExecutionWrapper
+    define_callbacks :prepare
+
+    define_callbacks :class_unload
+
+    # Registers a callback that will run once at application startup and every time the code is reloaded.
+    def self.to_prepare(*args, &block)
+      set_callback(:prepare, *args, &block)
+    end
+
+    # Registers a callback that will run immediately before the classes are unloaded.
+    def self.before_class_unload(*args, &block)
+      set_callback(:class_unload, *args, &block)
+    end
+
+    # Registers a callback that will run immediately after the classes are unloaded.
+    def self.after_class_unload(*args, &block)
+      set_callback(:class_unload, :after, *args, &block)
+    end
+
+    to_run(:after) { self.class.prepare! }
+
+    # Initiate a manual reload
+    def self.reload!
+      executor.wrap do
+        new.tap do |instance|
+          instance.run!
+        ensure
+          instance.complete!
+        end
+      end
+      prepare!
+    end
+
+    def self.run! # :nodoc:
+      if check!
+        super
+      else
+        Null
+      end
+    end
+
+    # Run the supplied block as a work unit, reloading code as needed
+    def self.wrap
+      executor.wrap do
+        super
+      end
+    end
+
+    class_attribute :executor, default: Executor
+    class_attribute :check, default: lambda { false }
+
+    def self.check! # :nodoc:
+      @should_reload ||= check.call
+    end
+
+    def self.reloaded! # :nodoc:
+      @should_reload = false
+    end
+
+    def self.prepare! # :nodoc:
+      new.run_callbacks(:prepare)
+    end
+
+    def initialize
+      super
+      @locked = false
+    end
+
+    # Acquire the ActiveSupport::Dependencies::Interlock unload lock,
+    # ensuring it will be released automatically
+    def require_unload_lock!
+      unless @locked
+        ActiveSupport::Dependencies.interlock.start_unloading
+        @locked = true
+      end
+    end
+
+    # Release the unload lock if it has been previously obtained
+    def release_unload_lock!
+      if @locked
+        @locked = false
+        ActiveSupport::Dependencies.interlock.done_unloading
+      end
+    end
+
+    def run! # :nodoc:
+      super
+      release_unload_lock!
+    end
+
+    def class_unload!(&block) # :nodoc:
+      require_unload_lock!
+      run_callbacks(:class_unload, &block)
+    end
+
+    def complete! # :nodoc:
+      super
+      self.class.reloaded!
+    ensure
+      release_unload_lock!
+    end
+  end
+end

data/lib/active_support/rescuable.rb

@@ -1,7 +1,8 @@
-require 'active_support/concern'
-require 'active_support/core_ext/class/attribute'
-require 'active_support/core_ext/string/inflections'
-require 'active_support/core_ext/array/extract_options'
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "active_support/core_ext/class/attribute"
+require "active_support/core_ext/string/inflections"
 
 module ActiveSupport
   # Rescuable module adds support for easier exception handling.
@@ -9,8 +10,7 @@ module ActiveSupport
     extend Concern
 
     included do
-      class_attribute :rescue_handlers
-      self.rescue_handlers = []
+      class_attribute :rescue_handlers, default: []
     end
 
     module ClassMethods
@@ -37,7 +37,7 @@ module ActiveSupport
       #       render xml: exception, status: 500
       #     end
       #
-      #     protected
+      #     private
       #       def deny_access
       #         ...
       #       end
@@ -48,72 +48,127 @@ module ActiveSupport
       #   end
       #
       # Exceptions raised inside exception handlers are not propagated up.
-      def rescue_from(*klasses, &block)
-        options = klasses.extract_options!
-
-        unless options.has_key?(:with)
+      def rescue_from(*klasses, with: nil, &block)
+        unless with
           if block_given?
-            options[:with] = block
+            with = block
           else
-            raise ArgumentError, "Need a handler. Supply an options hash that has a :with key as the last argument."
+            raise ArgumentError, "Need a handler. Pass the with: keyword argument or provide a block."
           end
         end
 
         klasses.each do |klass|
-          key = if klass.is_a?(Class) && klass <= Exception
+          key = if klass.is_a?(Module) && klass.respond_to?(:===)
             klass.name
           elsif klass.is_a?(String)
             klass
           else
-            raise ArgumentError, "#{klass} is neither an Exception nor a String"
+            raise ArgumentError, "#{klass.inspect} must be an Exception class or a String referencing an Exception class"
           end
 
-          # put the new handler at the end because the list is read in reverse
-          self.rescue_handlers += [[key, options[:with]]]
+          # Put the new handler at the end because the list is read in reverse.
+          self.rescue_handlers += [[key, with]]
         end
       end
-    end
 
-    # Tries to rescue the exception by looking up and calling a registered handler.
-    def rescue_with_handler(exception)
-      if handler = handler_for_rescue(exception)
-        handler.arity != 0 ? handler.call(exception) : handler.call
-        true # don't rely on the return value of the handler
-      end
-    end
+      # Matches an exception to a handler based on the exception class.
+      #
+      # If no handler matches the exception, check for a handler matching the
+      # (optional) exception.cause. If no handler matches the exception or its
+      # cause, this returns +nil+, so you can deal with unhandled exceptions.
+      # Be sure to re-raise unhandled exceptions if this is what you expect.
+      #
+      #     begin
+      #       …
+      #     rescue => exception
+      #       rescue_with_handler(exception) || raise
+      #     end
+      #
+      # Returns the exception if it was handled and +nil+ if it was not.
+      def rescue_with_handler(exception, object: self, visited_exceptions: [])
+        visited_exceptions << exception
 
-    def handler_for_rescue(exception)
-      # We go from right to left because pairs are pushed onto rescue_handlers
-      # as rescue_from declarations are found.
-      _, rescuer = self.class.rescue_handlers.reverse.detect do |klass_name, handler|
-        # The purpose of allowing strings in rescue_from is to support the
-        # declaration of handler associations for exception classes whose
-        # definition is yet unknown.
-        #
-        # Since this loop needs the constants it would be inconsistent to
-        # assume they should exist at this point. An early raised exception
-        # could trigger some other handler and the array could include
-        # precisely a string whose corresponding constant has not yet been
-        # seen. This is why we are tolerant to unknown constants.
-        #
-        # Note that this tolerance only matters if the exception was given as
-        # a string, otherwise a NameError will be raised by the interpreter
-        # itself when rescue_from CONSTANT is executed.
-        klass = self.class.const_get(klass_name) rescue nil
-        klass ||= klass_name.constantize rescue nil
-        exception.is_a?(klass) if klass
+        if handler = handler_for_rescue(exception, object: object)
+          handler.call exception
+          exception
+        elsif exception
+          if visited_exceptions.include?(exception.cause)
+            nil
+          else
+            rescue_with_handler(exception.cause, object: object, visited_exceptions: visited_exceptions)
+          end
+        end
       end
 
-      case rescuer
-      when Symbol
-        method(rescuer)
-      when Proc
-        if rescuer.arity == 0
-          Proc.new { instance_exec(&rescuer) }
-        else
-          Proc.new { |_exception| instance_exec(_exception, &rescuer) }
+      def handler_for_rescue(exception, object: self) #:nodoc:
+        case rescuer = find_rescue_handler(exception)
+        when Symbol
+          method = object.method(rescuer)
+          if method.arity == 0
+            -> e { method.call }
+          else
+            method
+          end
+        when Proc
+          if rescuer.arity == 0
+            -> e { object.instance_exec(&rescuer) }
+          else
+            -> e { object.instance_exec(e, &rescuer) }
+          end
         end
       end
+
+      private
+        def find_rescue_handler(exception)
+          if exception
+            # Handlers are in order of declaration but the most recently declared
+            # is the highest priority match, so we search for matching handlers
+            # in reverse.
+            _, handler = rescue_handlers.reverse_each.detect do |class_or_name, _|
+              if klass = constantize_rescue_handler_class(class_or_name)
+                klass === exception
+              end
+            end
+
+            handler
+          end
+        end
+
+        def constantize_rescue_handler_class(class_or_name)
+          case class_or_name
+          when String, Symbol
+            begin
+              # Try a lexical lookup first since we support
+              #
+              #     class Super
+              #       rescue_from 'Error', with: …
+              #     end
+              #
+              #     class Sub
+              #       class Error < StandardError; end
+              #     end
+              #
+              # so an Error raised in Sub will hit the 'Error' handler.
+              const_get class_or_name
+            rescue NameError
+              class_or_name.safe_constantize
+            end
+          else
+            class_or_name
+          end
+        end
+    end
+
+    # Delegates to the class method, but uses the instance as the subject for
+    # rescue_from handlers (method calls, instance_exec blocks).
+    def rescue_with_handler(exception)
+      self.class.rescue_with_handler exception, object: self
+    end
+
+    # Internal handler lookup. Delegates to class method. Some libraries call
+    # this directly, so keeping it around for compatibility.
+    def handler_for_rescue(exception) #:nodoc:
+      self.class.handler_for_rescue exception, object: self
     end
   end
 end

data/lib/active_support/security_utils.rb

@@ -1,15 +1,15 @@
-require 'digest'
+# frozen_string_literal: true
+
+require "digest/sha2"
 
 module ActiveSupport
   module SecurityUtils
-    # Constant time string comparison.
+    # Constant time string comparison, for fixed length strings.
     #
     # The values compared should be of fixed length, such as strings
-    # that have already been processed by HMAC. This should not be used
-    # on variable length plaintext strings because it could leak length info
-    # via timing attacks.
-    def secure_compare(a, b)
-      return false unless a.bytesize == b.bytesize
+    # that have already been processed by HMAC. Raises in case of length mismatch.
+    def fixed_length_secure_compare(a, b)
+      raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
 
       l = a.unpack "C#{a.bytesize}"
 
@@ -17,11 +17,15 @@ module ActiveSupport
       b.each_byte { |byte| res |= byte ^ l.shift }
       res == 0
     end
-    module_function :secure_compare
+    module_function :fixed_length_secure_compare
 
-    def variable_size_secure_compare(a, b) # :nodoc:
-      secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
+    # Constant time string comparison, for variable length strings.
+    #
+    # The values are first processed by SHA256, so that we don't leak length info
+    # via timing attacks.
+    def secure_compare(a, b)
+      fixed_length_secure_compare(::Digest::SHA256.digest(a), ::Digest::SHA256.digest(b)) && a == b
     end
-    module_function :variable_size_secure_compare
+    module_function :secure_compare
   end
 end