activesupport 6.0.6.1 → 7.1.3.2

data/lib/active_support/secure_compare_rotator.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "active_support/security_utils"
+require "active_support/messages/rotator"
+
+module ActiveSupport
+  # = Secure Compare Rotator
+  #
+  # The ActiveSupport::SecureCompareRotator is a wrapper around ActiveSupport::SecurityUtils.secure_compare
+  # and allows you to rotate a previously defined value to a new one.
+  #
+  # It can be used as follow:
+  #
+  #   rotator = ActiveSupport::SecureCompareRotator.new('new_production_value')
+  #   rotator.rotate('previous_production_value')
+  #   rotator.secure_compare!('previous_production_value')
+  #
+  # One real use case example would be to rotate a basic auth credentials:
+  #
+  #   class MyController < ApplicationController
+  #     def authenticate_request
+  #       rotator = ActiveSupport::SecureCompareRotator.new('new_password')
+  #       rotator.rotate('old_password')
+  #
+  #       authenticate_or_request_with_http_basic do |username, password|
+  #         rotator.secure_compare!(password)
+  #       rescue ActiveSupport::SecureCompareRotator::InvalidMatch
+  #         false
+  #       end
+  #     end
+  #   end
+  class SecureCompareRotator
+    include SecurityUtils
+
+    InvalidMatch = Class.new(StandardError)
+
+    def initialize(value, on_rotation: nil)
+      @value = value
+      @rotate_values = []
+      @on_rotation = on_rotation
+    end
+
+    def rotate(previous_value)
+      @rotate_values << previous_value
+    end
+
+    def secure_compare!(other_value, on_rotation: @on_rotation)
+      if secure_compare(@value, other_value)
+        true
+      elsif @rotate_values.any? { |value| secure_compare(value, other_value) }
+        on_rotation&.call
+        true
+      else
+        raise InvalidMatch
+      end
+    end
+  end
+end

data/lib/active_support/security_utils.rb

@@ -1,30 +1,37 @@
 # frozen_string_literal: true
 
-require "digest/sha2"
-
 module ActiveSupport
   module SecurityUtils
     # Constant time string comparison, for fixed length strings.
     #
     # The values compared should be of fixed length, such as strings
     # that have already been processed by HMAC. Raises in case of length mismatch.
-    def fixed_length_secure_compare(a, b)
-      raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
 
-      l = a.unpack "C#{a.bytesize}"
+    if defined?(OpenSSL.fixed_length_secure_compare)
+      def fixed_length_secure_compare(a, b)
+        OpenSSL.fixed_length_secure_compare(a, b)
+      end
+    else
+      def fixed_length_secure_compare(a, b)
+        raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
+
+        l = a.unpack "C#{a.bytesize}"
 
-      res = 0
-      b.each_byte { |byte| res |= byte ^ l.shift }
-      res == 0
+        res = 0
+        b.each_byte { |byte| res |= byte ^ l.shift }
+        res == 0
+      end
     end
     module_function :fixed_length_secure_compare
 
-    # Constant time string comparison, for variable length strings.
+    # Secure string comparison for strings of variable length.
     #
-    # The values are first processed by SHA256, so that we don't leak length info
-    # via timing attacks.
+    # While a timing attack would not be able to discern the content of
+    # a secret compared via secure_compare, it is possible to determine
+    # the secret length. This should be considered when using secure_compare
+    # to compare weak, short secrets to user input.
     def secure_compare(a, b)
-      fixed_length_secure_compare(::Digest::SHA256.digest(a), ::Digest::SHA256.digest(b)) && a == b
+      a.bytesize == b.bytesize && fixed_length_secure_compare(a, b)
     end
     module_function :secure_compare
   end

data/lib/active_support/string_inquirer.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActiveSupport
+  # = \String Inquirer
+  #
   # Wrapping a string in this class gives you a prettier way to test
   # for equality. The value returned by <tt>Rails.env</tt> is wrapped
   # in a StringInquirer object, so instead of calling this:
@@ -11,7 +13,7 @@ module ActiveSupport
   #
   #   Rails.env.production?
   #
-  # == Instantiating a new StringInquirer
+  # == Instantiating a new \StringInquirer
   #
   #   vehicle = ActiveSupport::StringInquirer.new('car')
   #   vehicle.car?   # => true
@@ -19,11 +21,11 @@ module ActiveSupport
   class StringInquirer < String
     private
       def respond_to_missing?(method_name, include_private = false)
-        (method_name[-1] == "?") || super
+        method_name.end_with?("?") || super
       end
 
       def method_missing(method_name, *arguments)
-        if method_name[-1] == "?"
+        if method_name.end_with?("?")
           self == method_name[0..-2]
         else
           super

data/lib/active_support/subscriber.rb

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
-require "active_support/per_thread_registry"
 require "active_support/notifications"
 
 module ActiveSupport
-  # ActiveSupport::Subscriber is an object set to consume
+  # = Active Support \Subscriber
+  #
+  # +ActiveSupport::Subscriber+ is an object set to consume
   # ActiveSupport::Notifications. The subscriber dispatches notifications to
   # a registered object based on its given namespace.
   #
@@ -21,9 +22,9 @@ module ActiveSupport
   #     end
   #   end
   #
-  # After configured, whenever a "sql.active_record" notification is published,
-  # it will properly dispatch the event (ActiveSupport::Notifications::Event) to
-  # the +sql+ method.
+  # After configured, whenever a <tt>"sql.active_record"</tt> notification is
+  # published, it will properly dispatch the event
+  # (ActiveSupport::Notifications::Event) to the +sql+ method.
   #
   # We can detach a subscriber as well:
   #
@@ -31,15 +32,16 @@ module ActiveSupport
   class Subscriber
     class << self
       # Attach the subscriber to a namespace.
-      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications)
+      def attach_to(namespace, subscriber = new, notifier = ActiveSupport::Notifications, inherit_all: false)
         @namespace  = namespace
         @subscriber = subscriber
         @notifier   = notifier
+        @inherit_all = inherit_all
 
         subscribers << subscriber
 
         # Add event subscribers for all existing methods on the class.
-        subscriber.public_methods(false).each do |event|
+        fetch_public_methods(subscriber, inherit_all).each do |event|
           add_event_subscriber(event)
         end
       end
@@ -55,7 +57,7 @@ module ActiveSupport
         subscribers.delete(subscriber)
 
         # Remove event subscribers of all existing methods on the class.
-        subscriber.public_methods(false).each do |event|
+        fetch_public_methods(subscriber, true).each do |event|
           remove_event_subscriber(event)
         end
 
@@ -81,18 +83,18 @@ module ActiveSupport
         attr_reader :subscriber, :notifier, :namespace
 
         def add_event_subscriber(event) # :doc:
-          return if invalid_event?(event.to_s)
+          return if invalid_event?(event)
 
           pattern = prepare_pattern(event)
 
-          # Don't add multiple subscribers (eg. if methods are redefined).
+          # Don't add multiple subscribers (e.g. if methods are redefined).
           return if pattern_subscribed?(pattern)
 
           subscriber.patterns[pattern] = notifier.subscribe(pattern, subscriber)
         end
 
         def remove_event_subscriber(event) # :doc:
-          return if invalid_event?(event.to_s)
+          return if invalid_event?(event)
 
           pattern = prepare_pattern(event)
 
@@ -107,7 +109,7 @@ module ActiveSupport
         end
 
         def invalid_event?(event)
-          %w{ start finish }.include?(event.to_s)
+          %i{ start finish }.include?(event.to_sym)
         end
 
         def prepare_pattern(event)
@@ -117,53 +119,27 @@ module ActiveSupport
         def pattern_subscribed?(pattern)
           subscriber.patterns.key?(pattern)
         end
+
+        def fetch_public_methods(subscriber, inherit_all)
+          subscriber.public_methods(inherit_all) - Subscriber.public_instance_methods(true)
+        end
     end
 
     attr_reader :patterns # :nodoc:
 
     def initialize
-      @queue_key = [self.class.name, object_id].join "-"
       @patterns  = {}
       super
     end
 
-    def start(name, id, payload)
-      event = ActiveSupport::Notifications::Event.new(name, nil, nil, id, payload)
-      event.start!
-      parent = event_stack.last
-      parent << event if parent
-
-      event_stack.push event
-    end
-
-    def finish(name, id, payload)
-      event = event_stack.pop
-      event.finish!
-      event.payload.merge!(payload)
-
-      method = name.split(".").first
+    def call(event)
+      method = event.name[0, event.name.index(".")]
       send(method, event)
     end
 
-    private
-      def event_stack
-        SubscriberQueueRegistry.instance.get_queue(@queue_key)
-      end
-  end
-
-  # This is a registry for all the event stacks kept for subscribers.
-  #
-  # See the documentation of <tt>ActiveSupport::PerThreadRegistry</tt>
-  # for further details.
-  class SubscriberQueueRegistry # :nodoc:
-    extend PerThreadRegistry
-
-    def initialize
-      @registry = {}
-    end
-
-    def get_queue(queue_key)
-      @registry[queue_key] ||= []
+    def publish_event(event) # :nodoc:
+      method = event.name[0, event.name.index(".")]
+      send(method, event)
     end
   end
 end

data/lib/active_support/syntax_error_proxy.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "delegate"
+
+module ActiveSupport
+  # This is a class for wrapping syntax errors.  The purpose of this class
+  # is to enhance the backtraces on SyntaxError exceptions to include the
+  # source location of the syntax error.  That way we can display the error
+  # source on error pages in development.
+  class SyntaxErrorProxy < DelegateClass(SyntaxError) # :nodoc:
+    def backtrace
+      parse_message_for_trace + super
+    end
+
+    class BacktraceLocation < Struct.new(:path, :lineno, :to_s) # :nodoc:
+      def spot(_)
+      end
+
+      def label
+      end
+    end
+
+    class BacktraceLocationProxy < DelegateClass(Thread::Backtrace::Location) # :nodoc:
+      def initialize(loc, ex)
+        super(loc)
+        @ex = ex
+      end
+
+      def spot(_)
+        super(@ex.__getobj__)
+      end
+    end
+
+    def backtrace_locations
+      return nil if super.nil?
+
+      parse_message_for_trace.map { |trace|
+        file, line = trace.match(/^(.+?):(\d+).*$/, &:captures) || trace
+        BacktraceLocation.new(file, line.to_i, trace)
+        # We have to wrap these backtrace locations because we need the
+        # spot information to come from the originating exception, not the
+        # proxy object that's generating these
+      } + super.map { |loc| BacktraceLocationProxy.new(loc, self) }
+    end
+
+    private
+      def parse_message_for_trace
+        if source_location_eval?
+          # If the exception is coming from a call to eval, we need to keep
+          # the path of the file in which eval was called to ensure we can
+          # return the right source fragment to show the location of the
+          # error
+          location = __getobj__.backtrace_locations[0]
+          ["#{location.path}:#{location.lineno}: #{__getobj__}"]
+        else
+          __getobj__.to_s.split("\n")
+        end
+      end
+
+      if SyntaxError.method_defined?(:path) # Ruby 3.3+
+        def source_location_eval?
+          __getobj__.path.start_with?("(eval")
+        end
+      else # 3.2 and older versions of Ruby
+        def source_location_eval?
+          __getobj__.to_s.start_with?("(eval")
+        end
+      end
+  end
+end

data/lib/active_support/tagged_logging.rb

@@ -6,12 +6,23 @@ require "logger"
 require "active_support/logger"
 
 module ActiveSupport
+  # = Active Support Tagged Logging
+  #
   # Wraps any standard Logger object to provide tagging capabilities.
   #
+  # May be called with a block:
+  #
   #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
-  #   logger.tagged('BCX') { logger.info 'Stuff' }                            # Logs "[BCX] Stuff"
-  #   logger.tagged('BCX', "Jason") { logger.info 'Stuff' }                   # Logs "[BCX] [Jason] Stuff"
-  #   logger.tagged('BCX') { logger.tagged('Jason') { logger.info 'Stuff' } } # Logs "[BCX] [Jason] Stuff"
+  #   logger.tagged('BCX') { logger.info 'Stuff' }                                  # Logs "[BCX] Stuff"
+  #   logger.tagged('BCX', "Jason") { |tagged_logger| tagged_logger.info 'Stuff' }  # Logs "[BCX] [Jason] Stuff"
+  #   logger.tagged('BCX') { logger.tagged('Jason') { logger.info 'Stuff' } }       # Logs "[BCX] [Jason] Stuff"
+  #
+  # If called without a block, a new logger will be returned with applied tags:
+  #
+  #   logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
+  #   logger.tagged("BCX").info "Stuff"                 # Logs "[BCX] Stuff"
+  #   logger.tagged("BCX", "Jason").info "Stuff"        # Logs "[BCX] [Jason] Stuff"
+  #   logger.tagged("BCX").tagged("Jason").info "Stuff" # Logs "[BCX] [Jason] Stuff"
   #
   # This is used by the default Rails.logger as configured by Railties to make
   # it easy to stamp log lines with subdomains, request ids, and anything else
@@ -20,51 +31,94 @@ module ActiveSupport
     module Formatter # :nodoc:
       # This method is invoked when a log event occurs.
       def call(severity, timestamp, progname, msg)
-        super(severity, timestamp, progname, "#{tags_text}#{msg}")
+        super(severity, timestamp, progname, tag_stack.format_message(msg))
       end
 
       def tagged(*tags)
-        new_tags = push_tags(*tags)
+        pushed_count = tag_stack.push_tags(tags).size
         yield self
       ensure
-        pop_tags(new_tags.size)
+        pop_tags(pushed_count)
       end
 
       def push_tags(*tags)
-        tags.flatten.reject(&:blank?).tap do |new_tags|
-          current_tags.concat new_tags
-        end
+        tag_stack.push_tags(tags)
       end
 
-      def pop_tags(size = 1)
-        current_tags.pop size
+      def pop_tags(count = 1)
+        tag_stack.pop_tags(count)
       end
 
       def clear_tags!
-        current_tags.clear
+        tag_stack.clear
       end
 
-      def current_tags
+      def tag_stack
         # We use our object ID here to avoid conflicting with other instances
-        thread_key = @thread_key ||= "activesupport_tagged_logging_tags:#{object_id}"
-        Thread.current[thread_key] ||= []
+        @thread_key ||= "activesupport_tagged_logging_tags:#{object_id}"
+        IsolatedExecutionState[@thread_key] ||= TagStack.new
+      end
+
+      def current_tags
+        tag_stack.tags
       end
 
       def tags_text
-        tags = current_tags
-        if tags.one?
-          "[#{tags[0]}] "
-        elsif tags.any?
-          tags.collect { |tag| "[#{tag}] " }.join
+        tag_stack.format_message("")
+      end
+    end
+
+    class TagStack # :nodoc:
+      attr_reader :tags
+
+      def initialize
+        @tags = []
+        @tags_string = nil
+      end
+
+      def push_tags(tags)
+        @tags_string = nil
+        tags.flatten!
+        tags.reject!(&:blank?)
+        @tags.concat(tags)
+        tags
+      end
+
+      def pop_tags(count)
+        @tags_string = nil
+        @tags.pop(count)
+      end
+
+      def clear
+        @tags_string = nil
+        @tags.clear
+      end
+
+      def format_message(message)
+        if @tags.empty?
+          message
+        elsif @tags.size == 1
+          "[#{@tags[0]}] #{message}"
+        else
+          @tags_string ||= "[#{@tags.join("] [")}] "
+          "#{@tags_string}#{message}"
         end
       end
     end
 
+    module LocalTagStorage # :nodoc:
+      attr_accessor :tag_stack
+
+      def self.extended(base)
+        base.tag_stack = TagStack.new
+      end
+    end
+
     def self.new(logger)
-      logger = logger.dup
+      logger = logger.clone
 
       if logger.formatter
-        logger.formatter = logger.formatter.dup
+        logger.formatter = logger.formatter.clone
       else
         # Ensure we set a default formatter so we aren't extending nil!
         logger.formatter = ActiveSupport::Logger::SimpleFormatter.new
@@ -77,7 +131,14 @@ module ActiveSupport
     delegate :push_tags, :pop_tags, :clear_tags!, to: :formatter
 
     def tagged(*tags)
-      formatter.tagged(*tags) { yield self }
+      if block_given?
+        formatter.tagged(*tags) { yield self }
+      else
+        logger = ActiveSupport::TaggedLogging.new(self)
+        logger.formatter.extend LocalTagStorage
+        logger.push_tags(*formatter.current_tags, *tags)
+        logger
+      end
     end
 
     def flush