activesupport 5.1.1 → 6.1.1

data/lib/active_support/secure_compare_rotator.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "active_support/security_utils"
+require "active_support/messages/rotator"
+
+module ActiveSupport
+  # The ActiveSupport::SecureCompareRotator is a wrapper around +ActiveSupport::SecurityUtils.secure_compare+
+  # and allows you to rotate a previously defined value to a new one.
+  #
+  # It can be used as follow:
+  #
+  #   rotator = ActiveSupport::SecureCompareRotator.new('new_production_value')
+  #   rotator.rotate('previous_production_value')
+  #   rotator.secure_compare!('previous_production_value')
+  #
+  # One real use case example would be to rotate a basic auth credentials:
+  #
+  #   class MyController < ApplicationController
+  #     def authenticate_request
+  #       rotator = ActiveSupport::SecureComparerotator.new('new_password')
+  #       rotator.rotate('old_password')
+  #
+  #       authenticate_or_request_with_http_basic do |username, password|
+  #         rotator.secure_compare!(password)
+  #       rescue ActiveSupport::SecureCompareRotator::InvalidMatch
+  #         false
+  #       end
+  #     end
+  #   end
+  class SecureCompareRotator
+    include SecurityUtils
+    prepend Messages::Rotator
+
+    InvalidMatch = Class.new(StandardError)
+
+    def initialize(value, **_options)
+      @value = value
+    end
+
+    def secure_compare!(other_value, on_rotation: @on_rotation)
+      secure_compare(@value, other_value) ||
+        run_rotations(on_rotation) { |wrapper| wrapper.secure_compare!(other_value) } ||
+        raise(InvalidMatch)
+    end
+
+    private
+      def build_rotation(previous_value, _options)
+        self.class.new(previous_value)
+      end
+  end
+end

data/lib/active_support/security_utils.rb

@@ -1,27 +1,38 @@
-require "digest"
+# frozen_string_literal: true
 
 module ActiveSupport
   module SecurityUtils
-    # Constant time string comparison.
+    # Constant time string comparison, for fixed length strings.
     #
     # The values compared should be of fixed length, such as strings
-    # that have already been processed by HMAC. This should not be used
-    # on variable length plaintext strings because it could leak length info
-    # via timing attacks.
-    def secure_compare(a, b)
-      return false unless a.bytesize == b.bytesize
+    # that have already been processed by HMAC. Raises in case of length mismatch.
+
+    if defined?(OpenSSL.fixed_length_secure_compare)
+      def fixed_length_secure_compare(a, b)
+        OpenSSL.fixed_length_secure_compare(a, b)
+      end
+    else
+      def fixed_length_secure_compare(a, b)
+        raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
 
-      l = a.unpack "C#{a.bytesize}"
+        l = a.unpack "C#{a.bytesize}"
 
-      res = 0
-      b.each_byte { |byte| res |= byte ^ l.shift }
-      res == 0
+        res = 0
+        b.each_byte { |byte| res |= byte ^ l.shift }
+        res == 0
+      end
     end
-    module_function :secure_compare
+    module_function :fixed_length_secure_compare
 
-    def variable_size_secure_compare(a, b) # :nodoc:
-      secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
+    # Secure string comparison for strings of variable length.
+    #
+    # While a timing attack would not be able to discern the content of
+    # a secret compared via secure_compare, it is possible to determine
+    # the secret length. This should be considered when using secure_compare
+    # to compare weak, short secrets to user input.
+    def secure_compare(a, b)
+      a.length == b.length && fixed_length_secure_compare(a, b)
     end
-    module_function :variable_size_secure_compare
+    module_function :secure_compare
   end
 end

data/lib/active_support/string_inquirer.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/symbol/starts_ends_with"
+
 module ActiveSupport
   # Wrapping a string in this class gives you a prettier way to test
   # for equality. The value returned by <tt>Rails.env</tt> is wrapped
@@ -16,13 +20,12 @@ module ActiveSupport
   #   vehicle.bike?  # => false
   class StringInquirer < String
     private
-
       def respond_to_missing?(method_name, include_private = false)
-        (method_name[-1] == "?") || super
+        method_name.end_with?("?") || super
       end
 
       def method_missing(method_name, *arguments)
-        if method_name[-1] == "?"
+        if method_name.end_with?("?")
           self == method_name[0..-2]
         else
           super

data/lib/active_support/subscriber.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/per_thread_registry"
 require "active_support/notifications"
 
@@ -22,22 +24,46 @@ module ActiveSupport
   # After configured, whenever a "sql.active_record" notification is published,
   # it will properly dispatch the event (ActiveSupport::Notifications::Event) to
   # the +sql+ method.
+  #
+  # We can detach a subscriber as well:
+  #
+  #   ActiveRecord::StatsSubscriber.detach_from(:active_record)
   class Subscriber
     class << self
       # Attach the subscriber to a namespace.
-      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications)
+      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications, inherit_all: false)
         @namespace  = namespace
         @subscriber = subscriber
         @notifier   = notifier
+        @inherit_all = inherit_all
 
         subscribers << subscriber
 
         # Add event subscribers for all existing methods on the class.
-        subscriber.public_methods(false).each do |event|
+        fetch_public_methods(subscriber, inherit_all).each do |event|
           add_event_subscriber(event)
         end
       end
 
+      # Detach the subscriber from a namespace.
+      def detach_from(namespace, notifier = ActiveSupport::Notifications)
+        @namespace  = namespace
+        @subscriber = find_attached_subscriber
+        @notifier   = notifier
+
+        return unless subscriber
+
+        subscribers.delete(subscriber)
+
+        # Remove event subscribers of all existing methods on the class.
+        fetch_public_methods(subscriber, true).each do |event|
+          remove_event_subscriber(event)
+        end
+
+        # Reset notifier so that event subscribers will not add for new methods added to the class.
+        @notifier = nil
+      end
+
       # Adds event subscribers for all new methods added to the class.
       def method_added(event)
         # Only public methods are added as subscribers, and only if a notifier
@@ -52,55 +78,79 @@ module ActiveSupport
         @@subscribers ||= []
       end
 
-      # TODO Change this to private once we've dropped Ruby 2.2 support.
-      # Workaround for Ruby 2.2 "private attribute?" warning.
-      protected
+      private
+        attr_reader :subscriber, :notifier, :namespace
 
-      attr_reader :subscriber, :notifier, :namespace
+        def add_event_subscriber(event) # :doc:
+          return if invalid_event?(event)
 
-      private
+          pattern = prepare_pattern(event)
+
+          # Don't add multiple subscribers (e.g. if methods are redefined).
+          return if pattern_subscribed?(pattern)
 
-      def add_event_subscriber(event) # :doc:
-        return if %w{ start finish }.include?(event.to_s)
+          subscriber.patterns[pattern] = notifier.subscribe(pattern, subscriber)
+        end
 
-        pattern = "#{event}.#{namespace}"
+        def remove_event_subscriber(event) # :doc:
+          return if invalid_event?(event)
 
-        # Don't add multiple subscribers (eg. if methods are redefined).
-        return if subscriber.patterns.include?(pattern)
+          pattern = prepare_pattern(event)
 
-        subscriber.patterns << pattern
-        notifier.subscribe(pattern, subscriber)
-      end
+          return unless pattern_subscribed?(pattern)
+
+          notifier.unsubscribe(subscriber.patterns[pattern])
+          subscriber.patterns.delete(pattern)
+        end
+
+        def find_attached_subscriber
+          subscribers.find { |attached_subscriber| attached_subscriber.instance_of?(self) }
+        end
+
+        def invalid_event?(event)
+          %i{ start finish }.include?(event.to_sym)
+        end
+
+        def prepare_pattern(event)
+          "#{event}.#{namespace}"
+        end
+
+        def pattern_subscribed?(pattern)
+          subscriber.patterns.key?(pattern)
+        end
+
+        def fetch_public_methods(subscriber, inherit_all)
+          subscriber.public_methods(inherit_all) - Subscriber.public_instance_methods(true)
+        end
     end
 
     attr_reader :patterns # :nodoc:
 
     def initialize
       @queue_key = [self.class.name, object_id].join "-"
-      @patterns  = []
+      @patterns  = {}
       super
     end
 
     def start(name, id, payload)
-      e = ActiveSupport::Notifications::Event.new(name, Time.now, nil, id, payload)
+      event = ActiveSupport::Notifications::Event.new(name, nil, nil, id, payload)
+      event.start!
       parent = event_stack.last
-      parent << e if parent
+      parent << event if parent
 
-      event_stack.push e
+      event_stack.push event
     end
 
     def finish(name, id, payload)
-      finished  = Time.now
-      event     = event_stack.pop
-      event.end = finished
+      event = event_stack.pop
+      event.finish!
       event.payload.merge!(payload)
 
-      method = name.split(".".freeze).first
+      method = name.split(".").first
       send(method, event)
     end
 
     private
-
       def event_stack
         SubscriberQueueRegistry.instance.get_queue(@queue_key)
       end

data/lib/active_support/tagged_logging.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/module/delegation"
 require "active_support/core_ext/object/blank"
 require "logger"
@@ -6,11 +8,20 @@ require "active_support/logger"
 module ActiveSupport
   # Wraps any standard Logger object to provide tagging capabilities.
   #
+  # May be called with a block:
+  #
   #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
   #   logger.tagged('BCX') { logger.info 'Stuff' }                            # Logs "[BCX] Stuff"
   #   logger.tagged('BCX', "Jason") { logger.info 'Stuff' }                   # Logs "[BCX] [Jason] Stuff"
   #   logger.tagged('BCX') { logger.tagged('Jason') { logger.info 'Stuff' } } # Logs "[BCX] [Jason] Stuff"
   #
+  # If called without a block, a new logger will be returned with applied tags:
+  #
+  #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
+  #   logger.tagged("BCX").info "Stuff"                 # Logs "[BCX] Stuff"
+  #   logger.tagged("BCX", "Jason").info "Stuff"        # Logs "[BCX] [Jason] Stuff"
+  #   logger.tagged("BCX").tagged("Jason").info "Stuff" # Logs "[BCX] [Jason] Stuff"
+  #
   # This is used by the default Rails.logger as configured by Railties to make
   # it easy to stamp log lines with subdomains, request ids, and anything else
   # to aid debugging of multi-user production applications.
@@ -29,9 +40,10 @@ module ActiveSupport
       end
 
       def push_tags(*tags)
-        tags.flatten.reject(&:blank?).tap do |new_tags|
-          current_tags.concat new_tags
-        end
+        tags.flatten!
+        tags.reject!(&:blank?)
+        current_tags.concat tags
+        tags
       end
 
       def pop_tags(size = 1)
@@ -44,21 +56,38 @@ module ActiveSupport
 
       def current_tags
         # We use our object ID here to avoid conflicting with other instances
-        thread_key = @thread_key ||= "activesupport_tagged_logging_tags:#{object_id}".freeze
+        thread_key = @thread_key ||= "activesupport_tagged_logging_tags:#{object_id}"
         Thread.current[thread_key] ||= []
       end
 
       def tags_text
         tags = current_tags
-        if tags.any?
+        if tags.one?
+          "[#{tags[0]}] "
+        elsif tags.any?
           tags.collect { |tag| "[#{tag}] " }.join
         end
       end
     end
 
+    module LocalTagStorage # :nodoc:
+      attr_accessor :current_tags
+
+      def self.extended(base)
+        base.current_tags = []
+      end
+    end
+
     def self.new(logger)
-      # Ensure we set a default formatter so we aren't extending nil!
-      logger.formatter ||= ActiveSupport::Logger::SimpleFormatter.new
+      logger = logger.dup
+
+      if logger.formatter
+        logger.formatter = logger.formatter.dup
+      else
+        # Ensure we set a default formatter so we aren't extending nil!
+        logger.formatter = ActiveSupport::Logger::SimpleFormatter.new
+      end
+
       logger.formatter.extend Formatter
       logger.extend(self)
     end
@@ -66,7 +95,14 @@ module ActiveSupport
     delegate :push_tags, :pop_tags, :clear_tags!, to: :formatter
 
     def tagged(*tags)
-      formatter.tagged(*tags) { yield self }
+      if block_given?
+        formatter.tagged(*tags) { yield self }
+      else
+        logger = ActiveSupport::TaggedLogging.new(self)
+        logger.formatter.extend LocalTagStorage
+        logger.push_tags(*formatter.current_tags, *tags)
+        logger
+      end
     end
 
     def flush

data/lib/active_support/test_case.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 gem "minitest" # make sure we get the gem, not stdlib
 require "minitest"
 require "active_support/testing/tagged_logging"
@@ -9,7 +11,8 @@ require "active_support/testing/isolation"
 require "active_support/testing/constant_lookup"
 require "active_support/testing/time_helpers"
 require "active_support/testing/file_fixtures"
-require "active_support/core_ext/kernel/reporting"
+require "active_support/testing/parallelization"
+require "concurrent/utility/processor_counter"
 
 module ActiveSupport
   class TestCase < ::Minitest::Test
@@ -38,12 +41,101 @@ module ActiveSupport
       def test_order
         ActiveSupport.test_order ||= :random
       end
+
+      # Parallelizes the test suite.
+      #
+      # Takes a +workers+ argument that controls how many times the process
+      # is forked. For each process a new database will be created suffixed
+      # with the worker number.
+      #
+      #   test-database-0
+      #   test-database-1
+      #
+      # If <tt>ENV["PARALLEL_WORKERS"]</tt> is set the workers argument will be ignored
+      # and the environment variable will be used instead. This is useful for CI
+      # environments, or other environments where you may need more workers than
+      # you do for local testing.
+      #
+      # If the number of workers is set to +1+ or fewer, the tests will not be
+      # parallelized.
+      #
+      # If +workers+ is set to +:number_of_processors+, the number of workers will be
+      # set to the actual core count on the machine you are on.
+      #
+      # The default parallelization method is to fork processes. If you'd like to
+      # use threads instead you can pass <tt>with: :threads</tt> to the +parallelize+
+      # method. Note the threaded parallelization does not create multiple
+      # database and will not work with system tests at this time.
+      #
+      #   parallelize(workers: :number_of_processors, with: :threads)
+      #
+      # The threaded parallelization uses minitest's parallel executor directly.
+      # The processes parallelization uses a Ruby DRb server.
+      def parallelize(workers: :number_of_processors, with: :processes)
+        workers = Concurrent.physical_processor_count if workers == :number_of_processors
+        workers = ENV["PARALLEL_WORKERS"].to_i if ENV["PARALLEL_WORKERS"]
+
+        return if workers <= 1
+
+        executor = case with
+                   when :processes
+                     Testing::Parallelization.new(workers)
+                   when :threads
+                     Minitest::Parallel::Executor.new(workers)
+                   else
+                     raise ArgumentError, "#{with} is not a supported parallelization executor."
+        end
+
+        self.lock_threads = false if defined?(self.lock_threads) && with == :threads
+
+        Minitest.parallel_executor = executor
+
+        parallelize_me!
+      end
+
+      # Set up hook for parallel testing. This can be used if you have multiple
+      # databases or any behavior that needs to be run after the process is forked
+      # but before the tests run.
+      #
+      # Note: this feature is not available with the threaded parallelization.
+      #
+      # In your +test_helper.rb+ add the following:
+      #
+      #   class ActiveSupport::TestCase
+      #     parallelize_setup do
+      #       # create databases
+      #     end
+      #   end
+      def parallelize_setup(&block)
+        ActiveSupport::Testing::Parallelization.after_fork_hook do |worker|
+          yield worker
+        end
+      end
+
+      # Clean up hook for parallel testing. This can be used to drop databases
+      # if your app uses multiple write/read databases or other clean up before
+      # the tests finish. This runs before the forked process is closed.
+      #
+      # Note: this feature is not available with the threaded parallelization.
+      #
+      # In your +test_helper.rb+ add the following:
+      #
+      #   class ActiveSupport::TestCase
+      #     parallelize_teardown do
+      #       # drop databases
+      #     end
+      #   end
+      def parallelize_teardown(&block)
+        ActiveSupport::Testing::Parallelization.run_cleanup_hook do |worker|
+          yield worker
+        end
+      end
     end
 
     alias_method :method_name, :name
 
     include ActiveSupport::Testing::TaggedLogging
-    include ActiveSupport::Testing::SetupAndTeardown
+    prepend ActiveSupport::Testing::SetupAndTeardown
     include ActiveSupport::Testing::Assertions
     include ActiveSupport::Testing::Deprecation
     include ActiveSupport::Testing::TimeHelpers

data/lib/active_support/testing/assertions.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/enumerable"
+
 module ActiveSupport
   module Testing
     module Assertions
@@ -28,6 +32,8 @@ module ActiveSupport
       #   end
       def assert_nothing_raised
         yield
+      rescue => error
+        raise Minitest::UnexpectedError.new(error)
       end
 
       # Test numeric difference between the return value of an expression as a
@@ -56,6 +62,12 @@ module ActiveSupport
       #     post :create, params: { article: {...} }
       #   end
       #
+      # A hash of expressions/numeric differences can also be passed in and evaluated.
+      #
+      #   assert_difference ->{ Article.count } => 1, ->{ Notification.count } => 2 do
+      #     post :create, params: { article: {...} }
+      #   end
+      #
       # A lambda or a list of lambdas can be passed in and evaluated:
       #
       #   assert_difference ->{ Article.count }, 2 do
@@ -71,20 +83,28 @@ module ActiveSupport
       #   assert_difference 'Article.count', -1, 'An Article should be destroyed' do
       #     post :delete, params: { id: ... }
       #   end
-      def assert_difference(expression, difference = 1, message = nil, &block)
-        expressions = Array(expression)
-
-        exps = expressions.map { |e|
+      def assert_difference(expression, *args, &block)
+        expressions =
+          if expression.is_a?(Hash)
+            message = args[0]
+            expression
+          else
+            difference = args[0] || 1
+            message = args[1]
+            Array(expression).index_with(difference)
+          end
+
+        exps = expressions.keys.map { |e|
           e.respond_to?(:call) ? e : lambda { eval(e, block.binding) }
         }
         before = exps.map(&:call)
 
-        retval = yield
+        retval = assert_nothing_raised(&block)
 
-        expressions.zip(exps).each_with_index do |(code, e), i|
-          error  = "#{code.inspect} didn't change by #{difference}"
+        expressions.zip(exps, before) do |(code, diff), exp, before_value|
+          error  = "#{code.inspect} didn't change by #{diff}"
           error  = "#{message}.\n#{error}" if message
-          assert_equal(before[i] + difference, e.call, error)
+          assert_equal(before_value + diff, exp.call, error)
         end
 
         retval
@@ -97,11 +117,23 @@ module ActiveSupport
       #     post :create, params: { article: invalid_attributes }
       #   end
       #
+      # A lambda can be passed in and evaluated.
+      #
+      #   assert_no_difference -> { Article.count } do
+      #     post :create, params: { article: invalid_attributes }
+      #   end
+      #
       # An error message can be specified.
       #
       #   assert_no_difference 'Article.count', 'An Article should not be created' do
       #     post :create, params: { article: invalid_attributes }
       #   end
+      #
+      # An array of expressions can also be passed in and evaluated.
+      #
+      #   assert_no_difference [ 'Article.count', -> { Post.count } ] do
+      #     post :create, params: { article: invalid_attributes }
+      #   end
       def assert_no_difference(expression, message = nil, &block)
         assert_difference expression, 0, message, &block
       end
@@ -144,22 +176,23 @@ module ActiveSupport
         exp = expression.respond_to?(:call) ? expression : -> { eval(expression.to_s, block.binding) }
 
         before = exp.call
-        retval = yield
+        retval = assert_nothing_raised(&block)
 
         unless from == UNTRACKED
-          error = "#{expression.inspect} isn't #{from.inspect}"
+          error = "Expected change from #{from.inspect}"
           error = "#{message}.\n#{error}" if message
           assert from === before, error
         end
 
         after = exp.call
 
-        if to == UNTRACKED
-          error = "#{expression.inspect} didn't changed"
-          error = "#{message}.\n#{error}" if message
-          assert_not_equal before, after, error
-        else
-          error = "#{expression.inspect} didn't change to #{to}"
+        error = "#{expression.inspect} didn't change"
+        error = "#{error}. It was already #{to}" if before == to
+        error = "#{message}.\n#{error}" if message
+        assert_not_equal before, after, error
+
+        unless to == UNTRACKED
+          error = "Expected change to #{to}\n"
           error = "#{message}.\n#{error}" if message
           assert to === after, error
         end
@@ -167,7 +200,7 @@ module ActiveSupport
         retval
       end
 
-      # Assertion that the result of evaluating an expression is changed before
+      # Assertion that the result of evaluating an expression is not changed before
       # and after invoking the passed in block.
       #
       #   assert_no_changes 'Status.all_good?' do
@@ -183,12 +216,17 @@ module ActiveSupport
         exp = expression.respond_to?(:call) ? expression : -> { eval(expression.to_s, block.binding) }
 
         before = exp.call
-        retval = yield
+        retval = assert_nothing_raised(&block)
         after = exp.call
 
-        error = "#{expression.inspect} did change to #{after}"
+        error = "#{expression.inspect} changed"
         error = "#{message}.\n#{error}" if message
-        assert_equal before, after, error
+
+        if before.nil?
+          assert_nil after, error
+        else
+          assert_equal before, after, error
+        end
 
         retval
       end

data/lib/active_support/testing/autorun.rb

@@ -1,9 +1,7 @@
+# frozen_string_literal: true
+
 gem "minitest"
 
 require "minitest"
 
-if Minitest.respond_to?(:run_via) && !Minitest.run_via.set?
-  Minitest.run_via = :ruby
-end
-
 Minitest.autorun

data/lib/active_support/testing/constant_lookup.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/concern"
 require "active_support/inflector"
 

data/lib/active_support/testing/declarative.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveSupport
   module Testing
     module Declarative