activesupport 6.0.3.6 → 6.1.1

data/lib/active_support/railtie.rb

@@ -22,12 +22,25 @@ module ActiveSupport
       app.reloader.before_class_unload { ActiveSupport::CurrentAttributes.clear_all }
       app.executor.to_run              { ActiveSupport::CurrentAttributes.reset_all }
       app.executor.to_complete         { ActiveSupport::CurrentAttributes.reset_all }
+
+      ActiveSupport.on_load(:active_support_test_case) do
+        require "active_support/current_attributes/test_helper"
+        include ActiveSupport::CurrentAttributes::TestHelper
+      end
     end
 
     initializer "active_support.deprecation_behavior" do |app|
       if deprecation = app.config.active_support.deprecation
         ActiveSupport::Deprecation.behavior = deprecation
       end
+
+      if disallowed_deprecation = app.config.active_support.disallowed_deprecation
+        ActiveSupport::Deprecation.disallowed_behavior = disallowed_deprecation
+      end
+
+      if disallowed_warnings = app.config.active_support.disallowed_deprecation_warnings
+        ActiveSupport::Deprecation.disallowed_warnings = disallowed_warnings
+      end
     end
 
     # Sets the default value for Time.zone
@@ -65,15 +78,24 @@ module ActiveSupport
     initializer "active_support.set_configs" do |app|
       app.config.active_support.each do |k, v|
         k = "#{k}="
-        ActiveSupport.send(k, v) if ActiveSupport.respond_to? k
+        ActiveSupport.public_send(k, v) if ActiveSupport.respond_to? k
       end
     end
 
     initializer "active_support.set_hash_digest_class" do |app|
       config.after_initialize do
         if app.config.active_support.use_sha1_digests
+          ActiveSupport::Deprecation.warn(<<-MSG.squish)
+            config.active_support.use_sha1_digests is deprecated and will
+            be removed from Rails 6.2. Use
+            config.active_support.hash_digest_class = ::Digest::SHA1 instead.
+          MSG
           ActiveSupport::Digest.hash_digest_class = ::Digest::SHA1
         end
+
+        if klass = app.config.active_support.hash_digest_class
+          ActiveSupport::Digest.hash_digest_class = klass
+        end
       end
     end
   end

data/lib/active_support/rescuable.rb

@@ -14,12 +14,12 @@ module ActiveSupport
     end
 
     module ClassMethods
-      # Rescue exceptions raised in controller actions.
+      # Registers exception classes with a handler to be called by <tt>rescue_with_handler</tt>.
       #
       # <tt>rescue_from</tt> receives a series of exception classes or class
-      # names, and a trailing <tt>:with</tt> option with the name of a method
-      # or a Proc object to be called to handle them. Alternatively a block can
-      # be given.
+      # names, and an exception handler specified by a trailing <tt>:with</tt>
+      # option containing the name of a method or a Proc object. Alternatively, a block
+      # can be given as the handler.
       #
       # Handlers that take one argument will be called with the exception, so
       # that the exception can be inspected when dealing with it.

data/lib/active_support/secure_compare_rotator.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "active_support/security_utils"
+require "active_support/messages/rotator"
+
+module ActiveSupport
+  # The ActiveSupport::SecureCompareRotator is a wrapper around +ActiveSupport::SecurityUtils.secure_compare+
+  # and allows you to rotate a previously defined value to a new one.
+  #
+  # It can be used as follow:
+  #
+  #   rotator = ActiveSupport::SecureCompareRotator.new('new_production_value')
+  #   rotator.rotate('previous_production_value')
+  #   rotator.secure_compare!('previous_production_value')
+  #
+  # One real use case example would be to rotate a basic auth credentials:
+  #
+  #   class MyController < ApplicationController
+  #     def authenticate_request
+  #       rotator = ActiveSupport::SecureComparerotator.new('new_password')
+  #       rotator.rotate('old_password')
+  #
+  #       authenticate_or_request_with_http_basic do |username, password|
+  #         rotator.secure_compare!(password)
+  #       rescue ActiveSupport::SecureCompareRotator::InvalidMatch
+  #         false
+  #       end
+  #     end
+  #   end
+  class SecureCompareRotator
+    include SecurityUtils
+    prepend Messages::Rotator
+
+    InvalidMatch = Class.new(StandardError)
+
+    def initialize(value, **_options)
+      @value = value
+    end
+
+    def secure_compare!(other_value, on_rotation: @on_rotation)
+      secure_compare(@value, other_value) ||
+        run_rotations(on_rotation) { |wrapper| wrapper.secure_compare!(other_value) } ||
+        raise(InvalidMatch)
+    end
+
+    private
+      def build_rotation(previous_value, _options)
+        self.class.new(previous_value)
+      end
+  end
+end

data/lib/active_support/security_utils.rb

@@ -1,30 +1,37 @@
 # frozen_string_literal: true
 
-require "digest/sha2"
-
 module ActiveSupport
   module SecurityUtils
     # Constant time string comparison, for fixed length strings.
     #
     # The values compared should be of fixed length, such as strings
     # that have already been processed by HMAC. Raises in case of length mismatch.
-    def fixed_length_secure_compare(a, b)
-      raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
 
-      l = a.unpack "C#{a.bytesize}"
+    if defined?(OpenSSL.fixed_length_secure_compare)
+      def fixed_length_secure_compare(a, b)
+        OpenSSL.fixed_length_secure_compare(a, b)
+      end
+    else
+      def fixed_length_secure_compare(a, b)
+        raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
+
+        l = a.unpack "C#{a.bytesize}"
 
-      res = 0
-      b.each_byte { |byte| res |= byte ^ l.shift }
-      res == 0
+        res = 0
+        b.each_byte { |byte| res |= byte ^ l.shift }
+        res == 0
+      end
     end
     module_function :fixed_length_secure_compare
 
-    # Constant time string comparison, for variable length strings.
+    # Secure string comparison for strings of variable length.
     #
-    # The values are first processed by SHA256, so that we don't leak length info
-    # via timing attacks.
+    # While a timing attack would not be able to discern the content of
+    # a secret compared via secure_compare, it is possible to determine
+    # the secret length. This should be considered when using secure_compare
+    # to compare weak, short secrets to user input.
     def secure_compare(a, b)
-      fixed_length_secure_compare(::Digest::SHA256.digest(a), ::Digest::SHA256.digest(b)) && a == b
+      a.length == b.length && fixed_length_secure_compare(a, b)
     end
     module_function :secure_compare
   end

data/lib/active_support/string_inquirer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/symbol/starts_ends_with"
+
 module ActiveSupport
   # Wrapping a string in this class gives you a prettier way to test
   # for equality. The value returned by <tt>Rails.env</tt> is wrapped
@@ -19,11 +21,11 @@ module ActiveSupport
   class StringInquirer < String
     private
       def respond_to_missing?(method_name, include_private = false)
-        (method_name[-1] == "?") || super
+        method_name.end_with?("?") || super
       end
 
       def method_missing(method_name, *arguments)
-        if method_name[-1] == "?"
+        if method_name.end_with?("?")
           self == method_name[0..-2]
         else
           super

data/lib/active_support/subscriber.rb

@@ -31,15 +31,16 @@ module ActiveSupport
   class Subscriber
     class << self
       # Attach the subscriber to a namespace.
-      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications)
+      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications, inherit_all: false)
         @namespace  = namespace
         @subscriber = subscriber
         @notifier   = notifier
+        @inherit_all = inherit_all
 
         subscribers << subscriber
 
         # Add event subscribers for all existing methods on the class.
-        subscriber.public_methods(false).each do |event|
+        fetch_public_methods(subscriber, inherit_all).each do |event|
           add_event_subscriber(event)
         end
       end
@@ -55,7 +56,7 @@ module ActiveSupport
         subscribers.delete(subscriber)
 
         # Remove event subscribers of all existing methods on the class.
-        subscriber.public_methods(false).each do |event|
+        fetch_public_methods(subscriber, true).each do |event|
           remove_event_subscriber(event)
         end
 
@@ -81,18 +82,18 @@ module ActiveSupport
         attr_reader :subscriber, :notifier, :namespace
 
         def add_event_subscriber(event) # :doc:
-          return if invalid_event?(event.to_s)
+          return if invalid_event?(event)
 
           pattern = prepare_pattern(event)
 
-          # Don't add multiple subscribers (eg. if methods are redefined).
+          # Don't add multiple subscribers (e.g. if methods are redefined).
           return if pattern_subscribed?(pattern)
 
           subscriber.patterns[pattern] = notifier.subscribe(pattern, subscriber)
         end
 
         def remove_event_subscriber(event) # :doc:
-          return if invalid_event?(event.to_s)
+          return if invalid_event?(event)
 
           pattern = prepare_pattern(event)
 
@@ -107,7 +108,7 @@ module ActiveSupport
         end
 
         def invalid_event?(event)
-          %w{ start finish }.include?(event.to_s)
+          %i{ start finish }.include?(event.to_sym)
         end
 
         def prepare_pattern(event)
@@ -117,6 +118,10 @@ module ActiveSupport
         def pattern_subscribed?(pattern)
           subscriber.patterns.key?(pattern)
         end
+
+        def fetch_public_methods(subscriber, inherit_all)
+          subscriber.public_methods(inherit_all) - Subscriber.public_instance_methods(true)
+        end
     end
 
     attr_reader :patterns # :nodoc:

data/lib/active_support/tagged_logging.rb

@@ -8,11 +8,20 @@ require "active_support/logger"
 module ActiveSupport
   # Wraps any standard Logger object to provide tagging capabilities.
   #
+  # May be called with a block:
+  #
   #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
   #   logger.tagged('BCX') { logger.info 'Stuff' }                            # Logs "[BCX] Stuff"
   #   logger.tagged('BCX', "Jason") { logger.info 'Stuff' }                   # Logs "[BCX] [Jason] Stuff"
   #   logger.tagged('BCX') { logger.tagged('Jason') { logger.info 'Stuff' } } # Logs "[BCX] [Jason] Stuff"
   #
+  # If called without a block, a new logger will be returned with applied tags:
+  #
+  #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
+  #   logger.tagged("BCX").info "Stuff"                 # Logs "[BCX] Stuff"
+  #   logger.tagged("BCX", "Jason").info "Stuff"        # Logs "[BCX] [Jason] Stuff"
+  #   logger.tagged("BCX").tagged("Jason").info "Stuff" # Logs "[BCX] [Jason] Stuff"
+  #
   # This is used by the default Rails.logger as configured by Railties to make
   # it easy to stamp log lines with subdomains, request ids, and anything else
   # to aid debugging of multi-user production applications.
@@ -31,9 +40,10 @@ module ActiveSupport
       end
 
       def push_tags(*tags)
-        tags.flatten.reject(&:blank?).tap do |new_tags|
-          current_tags.concat new_tags
-        end
+        tags.flatten!
+        tags.reject!(&:blank?)
+        current_tags.concat tags
+        tags
       end
 
       def pop_tags(size = 1)
@@ -60,6 +70,14 @@ module ActiveSupport
       end
     end
 
+    module LocalTagStorage # :nodoc:
+      attr_accessor :current_tags
+
+      def self.extended(base)
+        base.current_tags = []
+      end
+    end
+
     def self.new(logger)
       logger = logger.dup
 
@@ -77,7 +95,14 @@ module ActiveSupport
     delegate :push_tags, :pop_tags, :clear_tags!, to: :formatter
 
     def tagged(*tags)
-      formatter.tagged(*tags) { yield self }
+      if block_given?
+        formatter.tagged(*tags) { yield self }
+      else
+        logger = ActiveSupport::TaggedLogging.new(self)
+        logger.formatter.extend LocalTagStorage
+        logger.push_tags(*formatter.current_tags, *tags)
+        logger
+      end
     end
 
     def flush

data/lib/active_support/testing/assertions.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/enumerable"
+
 module ActiveSupport
   module Testing
     module Assertions
@@ -30,6 +32,8 @@ module ActiveSupport
       #   end
       def assert_nothing_raised
         yield
+      rescue => error
+        raise Minitest::UnexpectedError.new(error)
       end
 
       # Test numeric difference between the return value of an expression as a
@@ -87,7 +91,7 @@ module ActiveSupport
           else
             difference = args[0] || 1
             message = args[1]
-            Hash[Array(expression).map { |e| [e, difference] }]
+            Array(expression).index_with(difference)
           end
 
         exps = expressions.keys.map { |e|
@@ -95,7 +99,7 @@ module ActiveSupport
         }
         before = exps.map(&:call)
 
-        retval = yield
+        retval = assert_nothing_raised(&block)
 
         expressions.zip(exps, before) do |(code, diff), exp, before_value|
           error  = "#{code.inspect} didn't change by #{diff}"
@@ -172,10 +176,10 @@ module ActiveSupport
         exp = expression.respond_to?(:call) ? expression : -> { eval(expression.to_s, block.binding) }
 
         before = exp.call
-        retval = yield
+        retval = assert_nothing_raised(&block)
 
         unless from == UNTRACKED
-          error = "#{expression.inspect} isn't #{from.inspect}"
+          error = "Expected change from #{from.inspect}"
           error = "#{message}.\n#{error}" if message
           assert from === before, error
         end
@@ -185,12 +189,10 @@ module ActiveSupport
         error = "#{expression.inspect} didn't change"
         error = "#{error}. It was already #{to}" if before == to
         error = "#{message}.\n#{error}" if message
-        assert before != after, error
+        assert_not_equal before, after, error
 
         unless to == UNTRACKED
-          error = "#{expression.inspect} didn't change to as expected\n"
-          error = "#{error}Expected: #{to.inspect}\n"
-          error = "#{error}  Actual: #{after.inspect}"
+          error = "Expected change to #{to}\n"
           error = "#{message}.\n#{error}" if message
           assert to === after, error
         end
@@ -214,12 +216,17 @@ module ActiveSupport
         exp = expression.respond_to?(:call) ? expression : -> { eval(expression.to_s, block.binding) }
 
         before = exp.call
-        retval = yield
+        retval = assert_nothing_raised(&block)
         after = exp.call
 
-        error = "#{expression.inspect} did change to #{after}"
+        error = "#{expression.inspect} changed"
         error = "#{message}.\n#{error}" if message
-        assert before == after, error
+
+        if before.nil?
+          assert_nil after, error
+        else
+          assert_equal before, after, error
+        end
 
         retval
       end

data/lib/active_support/testing/parallelization.rb

@@ -3,37 +3,12 @@
 require "drb"
 require "drb/unix" unless Gem.win_platform?
 require "active_support/core_ext/module/attribute_accessors"
+require "active_support/testing/parallelization/server"
+require "active_support/testing/parallelization/worker"
 
 module ActiveSupport
   module Testing
     class Parallelization # :nodoc:
-      class Server
-        include DRb::DRbUndumped
-
-        def initialize
-          @queue = Queue.new
-        end
-
-        def record(reporter, result)
-          raise DRb::DRbConnError if result.is_a?(DRb::DRbUnknown)
-
-          reporter.synchronize do
-            reporter.record(result)
-          end
-        end
-
-        def <<(o)
-          o[2] = DRbObject.new(o[2]) if o
-          @queue << o
-        end
-
-        def length
-          @queue.length
-        end
-
-        def pop; @queue.pop; end
-      end
-
       @@after_fork_hooks = []
 
       def self.after_fork_hook(&blk)
@@ -50,85 +25,27 @@ module ActiveSupport
 
       cattr_reader :run_cleanup_hooks
 
-      def initialize(queue_size)
-        @queue_size = queue_size
-        @queue      = Server.new
-        @pool       = []
-
-        @url = DRb.start_service("drbunix:", @queue).uri
-      end
-
-      def after_fork(worker)
-        self.class.after_fork_hooks.each do |cb|
-          cb.call(worker)
-        end
-      end
-
-      def run_cleanup(worker)
-        self.class.run_cleanup_hooks.each do |cb|
-          cb.call(worker)
-        end
+      def initialize(worker_count)
+        @worker_count = worker_count
+        @queue_server = Server.new
+        @worker_pool = []
+        @url = DRb.start_service("drbunix:", @queue_server).uri
       end
 
       def start
-        @pool = @queue_size.times.map do |worker|
-          fork do
-            DRb.stop_service
-
-            begin
-              after_fork(worker)
-            rescue => setup_exception; end
-
-            queue = DRbObject.new_with_uri(@url)
-
-            while job = queue.pop
-              klass    = job[0]
-              method   = job[1]
-              reporter = job[2]
-              result = klass.with_info_handler reporter do
-                Minitest.run_one_method(klass, method)
-              end
-
-              add_setup_exception(result, setup_exception) if setup_exception
-
-              begin
-                queue.record(reporter, result)
-              rescue DRb::DRbConnError
-                result.failures.map! do |failure|
-                  if failure.respond_to?(:error)
-                    # minitest >5.14.0
-                    error = DRb::DRbRemoteError.new(failure.error)
-                  else
-                    error = DRb::DRbRemoteError.new(failure.exception)
-                  end
-                  Minitest::UnexpectedError.new(error)
-                end
-                queue.record(reporter, result)
-              end
-            end
-          ensure
-            run_cleanup(worker)
-          end
+        @worker_pool = @worker_count.times.map do |worker|
+          Worker.new(worker, @url).start
         end
       end
 
       def <<(work)
-        @queue << work
+        @queue_server << work
       end
 
       def shutdown
-        @queue_size.times { @queue << nil }
-        @pool.each { |pid| Process.waitpid pid }
-
-        if @queue.length > 0
-          raise "Queue not empty, but all workers have finished. This probably means that a worker crashed and #{@queue.length} tests were missed."
-        end
+        @queue_server.shutdown
+        @worker_pool.each { |pid| Process.waitpid pid }
       end
-
-      private
-        def add_setup_exception(result, setup_exception)
-          result.failures.prepend Minitest::UnexpectedError.new(setup_exception)
-        end
     end
   end
 end