cuba 4.0.1 → 4.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72337c66b56fe3897868fbe795af8c70cb56d2f59078b2b25902760dd59c35c6
-  data.tar.gz: 18adfb8cdf0f1c05eb73ae51991201bbfae5b581e4c71fe8b0c0126940f79a53
+  metadata.gz: fdca6a9e01b7f7981cd430ed976c9d0822739895340549150e4d719196e059c0
+  data.tar.gz: 206b7ea5088509c073f6d69f9c72e07c066b0b043483d1ecd2b292e5a9dd9f2e
 SHA512:
-  metadata.gz: 28823a910b61fe95f1c195dc2647d170746b1e44176a5a44448b7cc7ffda34b311d3731eb8536faf144a6955e3580c410b6cc12f4e8b648d0f281cdf6c999d73
-  data.tar.gz: 62ccc633e87fb4695b9a0256ded29111554afd2b658cbae314d0a10f4ff2afb20fb1c06adee2d062d4a0929fa667644d6ed9ed969ea01d2d1861d0ad1372c7fc
+  metadata.gz: 36cd6bcfa37d6ab1c50b4235243143117be5de74cfa3d7a065c4434c2c4fd1bd064fd46df2f13d4578427d61c6ceda769566bd26152214787a7357779780f6f5
+  data.tar.gz: 64e6ce940c7f8004b88535cb6b8c938da8e0be6ccce33e544843fd97029bccb7763f9ded60860d2299c5632bc825cd7d688585ad37e7449bf42183cbc232f183

data/CHANGELOG

@@ -1,10 +1,14 @@
+4.0.3
+
+* Change secure headers to lowercase.
+
 3.9.0
 
-* Cache regular expressions
+* Cache regular expressions.
 
 3.8.1
 
-* Remove requirement on Time
+* Remove requirement on Time.
 
 3.8.0
 
@@ -64,4 +68,4 @@
 * Remove Cuba::VERSION.
 * Rename _call to call! (inspired from Sinatra).
 * Fix a memory leak with the caching used in Tilt.
-* Adding syntax highlighting to the README Code blocks
+* Adding syntax highlighting to the README Code blocks.

data/cuba.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name              = "cuba"
-  s.version           = "4.0.1"
+  s.version           = "4.0.3"
   s.summary           = "Microframework for web applications."
   s.description       = "Cuba is a microframework for web applications."
   s.authors           = ["Michel Martens"]

data/lib/cuba/render.rb

@@ -13,7 +13,7 @@ class Cuba
     end
 
     def render(template, locals = {}, layout = settings[:render][:layout])
-      res.headers["Content-Type"] ||= "text/html; charset=utf-8"
+      res.headers[Rack::CONTENT_TYPE] ||= "text/html; charset=utf-8"
       res.write(view(template, locals, layout))
     end
 

data/lib/cuba/safe/secure_headers.rb

@@ -10,6 +10,8 @@
 #   - X-Download-Options [6].
 #   - X-Permitted-Cross-Domain-Policies [7].
 #
+# Due to HTTP/2 specifications and Rack specifications, field names are applied in all lowercase.
+#
 # == References
 #
 # [1]: https://github.com/twitter/secureheaders
@@ -19,17 +21,18 @@
 # [5]: http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
 # [6]: http://msdn.microsoft.com/en-us/library/ie/jj542450(v=vs.85).aspx
 # [7]: https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
+# [8]: https://datatracker.ietf.org/doc/html/rfc9113#name-http-fields
 #
 class Cuba
   module Safe
     module SecureHeaders
       HEADERS = {
-        "X-Content-Type-Options" => "nosniff",
-        "X-Download-Options" => "noopen",
-        "X-Frame-Options" => "SAMEORIGIN",
-        "X-Permitted-Cross-Domain-Policies" => "none",
-        "X-XSS-Protection" => "1; mode=block",
-        "Strict-Transport-Security" => "max-age=2628000"
+        "x-content-type-options" => "nosniff",
+        "x-download-options" => "noopen",
+        "x-frame-options" => "SAMEORIGIN",
+        "x-permitted-cross-domain-policies" => "none",
+        "x-xss-protection" => "1; mode=block",
+        "strict-transport-security" => "max-age=2628000"
       }
 
       def self.setup(app)

data/lib/cuba.rb

@@ -10,7 +10,7 @@ class Cuba
   REGEXES = Hash.new { |h, pattern| h[pattern] = /\A\/(#{pattern})(\/|\z)/ }
 
   class Response
-    LOCATION = "Location".freeze
+    LOCATION = "location".freeze
 
     module ContentType
       HTML = "text/html".freeze        # :nodoc:
@@ -91,8 +91,8 @@ class Cuba
     @app ||= Rack::Builder.new
   end
 
-  def self.use(middleware, *args, &block)
-    app.use(middleware, *args, &block)
+  def self.use(middleware, *args, **kwargs, &block)
+    app.use(middleware, *args, **kwargs, &block)
   end
 
   def self.define(&block)

data/test/middleware.rb

@@ -1,8 +1,9 @@
 require File.expand_path("helper", File.dirname(__FILE__))
 
 class Shrimp
-  def initialize(app)
+  def initialize(app, foo:)
     @app = app
+    @foo = foo
   end
 
   def call(env)
@@ -17,7 +18,7 @@ end
 
 test do
   class API < Cuba
-    use Shrimp
+    use Shrimp, foo: 'bar'
 
     define do
       on "v1/test" do

data/test/redirect.rb

@@ -16,6 +16,6 @@ test "redirect" do
   status, headers, body = Cuba.call(env)
 
   assert_equal status, 302
-  assert_equal headers, { "Location" => "/hello" }
+  assert_equal headers, { "location" => "/hello" }
   assert_response body, []
 end

data/test/render.rb

@@ -124,5 +124,5 @@ test "ensures content-type header is set" do
 
   _, headers, _ = Cuba.call({})
 
-  assert_equal("text/html; charset=utf-8", headers["Content-Type"])
+  assert_equal("text/html; charset=utf-8", headers["content-type"])
 end

data/test/run.rb

@@ -17,7 +17,7 @@ test "redirect canonical example" do
 
   status, headers, resp = Cuba.call(env)
 
-  assert_equal "/login", headers["Location"]
+  assert_equal "/login", headers["location"]
   assert_equal 307, status
   assert_response resp, []
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cuba
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.0.3
 platform: ruby
 authors:
 - Michel Martens
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-02-19 00:00:00.000000000 Z
+date: 2024-01-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack