jets 1.9.7 → 1.9.8

data/vendor/rails/actionpack/test/controller/render_xml_test.rb

@@ -1,102 +0,0 @@
-# frozen_string_literal: true
-
-require "abstract_unit"
-require "controller/fake_models"
-require "pathname"
-
-class RenderXmlTest < ActionController::TestCase
-  class XmlRenderable
-    def to_xml(options)
-      options[:root] ||= "i-am-xml"
-      "<#{options[:root]}/>"
-    end
-  end
-
-  class TestController < ActionController::Base
-    protect_from_forgery
-
-    def self.controller_path
-      "test"
-    end
-
-    def render_with_location
-      render xml: "<hello/>", location: "http://example.com", status: 201
-    end
-
-    def render_with_object_location
-      customer = Customer.new("Some guy", 1)
-      render xml: "<customer/>", location: customer, status: :created
-    end
-
-    def render_with_to_xml
-      render xml: XmlRenderable.new
-    end
-
-    def formatted_xml_erb
-    end
-
-    def render_xml_with_custom_content_type
-      render xml: "<blah/>", content_type: "application/atomsvc+xml"
-    end
-
-    def render_xml_with_custom_options
-      render xml: XmlRenderable.new, root: "i-am-THE-xml"
-    end
-  end
-
-  tests TestController
-
-  def setup
-    # enable a logger so that (e.g.) the benchmarking stuff runs, so we can get
-    # a more accurate simulation of what happens in "real life".
-    super
-    @controller.logger = ActiveSupport::Logger.new(nil)
-
-    @request.host = "www.nextangle.com"
-  end
-
-  def test_rendering_with_location_should_set_header
-    get :render_with_location
-    assert_equal "http://example.com", @response.headers["Location"]
-  end
-
-  def test_rendering_xml_should_call_to_xml_if_possible
-    get :render_with_to_xml
-    assert_equal "<i-am-xml/>", @response.body
-  end
-
-  def test_rendering_xml_should_call_to_xml_with_extra_options
-    get :render_xml_with_custom_options
-    assert_equal "<i-am-THE-xml/>", @response.body
-  end
-
-  def test_rendering_with_object_location_should_set_header_with_url_for
-    with_routing do |set|
-      set.draw do
-        resources :customers
-
-        ActiveSupport::Deprecation.silence do
-          get ":controller/:action"
-        end
-      end
-
-      get :render_with_object_location
-      assert_equal "http://www.nextangle.com/customers/1", @response.headers["Location"]
-    end
-  end
-
-  def test_should_render_formatted_xml_erb_template
-    get :formatted_xml_erb, format: :xml
-    assert_equal "<test>passed formatted xml erb</test>", @response.body
-  end
-
-  def test_should_render_xml_but_keep_custom_content_type
-    get :render_xml_with_custom_content_type
-    assert_equal "application/atomsvc+xml", @response.content_type
-  end
-
-  def test_should_use_implicit_content_type
-    get :implicit_content_type, format: "atom"
-    assert_equal Mime[:atom], @response.content_type
-  end
-end

data/vendor/rails/actionpack/test/controller/renderer_test.rb

@@ -1,136 +0,0 @@
-# frozen_string_literal: true
-
-require "abstract_unit"
-
-class RendererTest < ActiveSupport::TestCase
-  test "action controller base has a renderer" do
-    assert ActionController::Base.renderer
-  end
-
-  test "creating with a controller" do
-    controller = CommentsController
-    renderer   = ActionController::Renderer.for controller
-
-    assert_equal controller, renderer.controller
-  end
-
-  test "creating from a controller" do
-    controller = AccountsController
-    renderer   = controller.renderer
-
-    assert_equal controller, renderer.controller
-  end
-
-  test "creating with new defaults" do
-    renderer = ApplicationController.renderer
-
-    new_defaults = { https: true }
-    new_renderer = renderer.with_defaults(new_defaults).new
-    content = new_renderer.render(inline: "<%= request.ssl? %>")
-
-    assert_equal "true", content
-  end
-
-  test "rendering with a class renderer" do
-    renderer = ApplicationController.renderer
-    content  = renderer.render template: "ruby_template"
-
-    assert_equal "Hello from Ruby code", content
-  end
-
-  test "rendering with an instance renderer" do
-    renderer = ApplicationController.renderer.new
-    content  = renderer.render file: "test/hello_world"
-
-    assert_equal "Hello world!", content
-  end
-
-  test "rendering with a controller class" do
-    assert_equal "Hello world!", ApplicationController.render("test/hello_world")
-  end
-
-  test "rendering with locals" do
-    renderer = ApplicationController.renderer
-    content  = renderer.render template: "test/render_file_with_locals",
-                               locals: { secret: "bar" }
-
-    assert_equal "The secret is bar\n", content
-  end
-
-  test "rendering with assigns" do
-    renderer = ApplicationController.renderer
-    content  = renderer.render template: "test/render_file_with_ivar",
-                               assigns: { secret: "foo" }
-
-    assert_equal "The secret is foo\n", content
-  end
-
-  test "rendering with custom env" do
-    renderer = ApplicationController.renderer.new method: "post"
-    content  = renderer.render inline: "<%= request.post? %>"
-
-    assert_equal "true", content
-  end
-
-  test "rendering with custom env using a key that is not in RACK_KEY_TRANSLATION" do
-    value    = "warden is here"
-    renderer = ApplicationController.renderer.new warden: value
-    content  = renderer.render inline: "<%= request.env['warden'] %>"
-
-    assert_equal value, content
-  end
-
-  test "rendering with defaults" do
-    renderer = ApplicationController.renderer.new https: true
-    content = renderer.render inline: "<%= request.ssl? %>"
-
-    assert_equal "true", content
-  end
-
-  test "same defaults from the same controller" do
-    renderer_defaults = ->(controller) { controller.renderer.defaults }
-
-    assert_equal renderer_defaults[AccountsController], renderer_defaults[AccountsController]
-    assert_equal renderer_defaults[AccountsController], renderer_defaults[CommentsController]
-  end
-
-  test "rendering with different formats" do
-    html = "Hello world!"
-    xml  = "<p>Hello world!</p>\n"
-
-    assert_equal html, render["respond_to/using_defaults"]
-    assert_equal xml,  render["respond_to/using_defaults.xml.builder"]
-    assert_equal xml,  render["respond_to/using_defaults", formats: :xml]
-  end
-
-  test "rendering with helpers" do
-    assert_equal "<p>1\n<br />2</p>", render[inline: '<%= simple_format "1\n2" %>']
-  end
-
-  test "rendering with user specified defaults" do
-    ApplicationController.renderer.defaults.merge!(hello: "hello", https: true)
-    renderer = ApplicationController.renderer.new
-    content = renderer.render inline: "<%= request.ssl? %>"
-
-    assert_equal "true", content
-  end
-
-  test "return valid asset url with defaults" do
-    renderer = ApplicationController.renderer
-    content  = renderer.render inline: "<%= asset_url 'asset.jpg' %>"
-
-    assert_equal "http://example.org/asset.jpg", content
-  end
-
-  test "return valid asset url when https is true" do
-    renderer = ApplicationController.renderer.new https: true
-    content  = renderer.render inline: "<%= asset_url 'asset.jpg' %>"
-
-    assert_equal "https://example.org/asset.jpg", content
-  end
-
-  private
-    def render
-      @render ||= ApplicationController.renderer.method(:render)
-    end
-end

data/vendor/rails/actionpack/test/controller/renderers_test.rb

@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-require "abstract_unit"
-require "controller/fake_models"
-require "active_support/logger"
-
-class RenderersTest < ActionController::TestCase
-  class XmlRenderable
-    def to_xml(options)
-      options[:root] ||= "i-am-xml"
-      "<#{options[:root]}/>"
-    end
-  end
-  class JsonRenderable
-    def as_json(options = {})
-      hash = { a: :b, c: :d, e: :f }
-      hash.except!(*options[:except]) if options[:except]
-      hash
-    end
-
-    def to_json(options = {})
-      super except: [:c, :e]
-    end
-  end
-  class CsvRenderable
-    def to_csv
-      "c,s,v"
-    end
-  end
-  class TestController < ActionController::Base
-    def render_simon_says
-      render simon: "foo"
-    end
-
-    def respond_to_mime
-      respond_to do |type|
-        type.json do
-          render json: JsonRenderable.new
-        end
-        type.js   { render json: "JS", callback: "alert" }
-        type.csv  { render csv: CsvRenderable.new    }
-        type.xml  { render xml: XmlRenderable.new     }
-        type.html { render body: "HTML"    }
-        type.rss  { render body: "RSS"     }
-        type.all  { render body: "Nothing" }
-        type.any(:js, :xml) { render body: "Either JS or XML" }
-      end
-    end
-  end
-
-  tests TestController
-
-  def setup
-    # enable a logger so that (e.g.) the benchmarking stuff runs, so we can get
-    # a more accurate simulation of what happens in "real life".
-    super
-    @controller.logger = ActiveSupport::Logger.new(nil)
-  end
-
-  def test_using_custom_render_option
-    ActionController.add_renderer :simon do |says, options|
-      self.content_type  = Mime[:text]
-      self.response_body = "Simon says: #{says}"
-    end
-
-    get :render_simon_says
-    assert_equal "Simon says: foo", @response.body
-  ensure
-    ActionController.remove_renderer :simon
-  end
-
-  def test_raises_missing_template_no_renderer
-    assert_raise ActionView::MissingTemplate do
-      get :respond_to_mime, format: "csv"
-    end
-    assert_equal Mime[:csv], @response.content_type
-    assert_equal "", @response.body
-  end
-
-  def test_adding_csv_rendering_via_renderers_add
-    ActionController::Renderers.add :csv do |value, options|
-      send_data value.to_csv, type: Mime[:csv]
-    end
-    @request.accept = "text/csv"
-    get :respond_to_mime, format: "csv"
-    assert_equal Mime[:csv], @response.content_type
-    assert_equal "c,s,v", @response.body
-  ensure
-    ActionController::Renderers.remove :csv
-  end
-end

data/vendor/rails/actionpack/test/controller/request/test_request_test.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-require "abstract_unit"
-require "stringio"
-
-class ActionController::TestRequestTest < ActionController::TestCase
-  def test_test_request_has_session_options_initialized
-    assert @request.session_options
-  end
-
-  def test_mutating_session_options_does_not_affect_default_options
-    @request.session_options[:myparam] = 123
-    assert_nil ActionController::TestSession::DEFAULT_OPTIONS[:myparam]
-  end
-
-  def test_content_length_has_bytes_count_value
-    non_ascii_parameters = { data: { content: "Latin + Кириллица" } }
-    @request.set_header "REQUEST_METHOD", "POST"
-    @request.set_header "CONTENT_TYPE", "application/json"
-    @request.assign_parameters(@routes, "test", "create", non_ascii_parameters,
-                               "/test", [:data, :controller, :action])
-    assert_equal(StringIO.new(non_ascii_parameters.to_json).length.to_s,
-                 @request.get_header("CONTENT_LENGTH"))
-  end
-
-  ActionDispatch::Session::AbstractStore::DEFAULT_OPTIONS.each_pair do |key, value|
-    test "rack default session options #{key} exists in session options and is default" do
-      if value.nil?
-        assert_nil(@request.session_options[key],
-                   "Missing rack session default option #{key} in request.session_options")
-      else
-        assert_equal(value, @request.session_options[key],
-                     "Missing rack session default option #{key} in request.session_options")
-      end
-    end
-
-    test "rack default session options #{key} exists in session options" do
-      assert(@request.session_options.has_key?(key),
-                   "Missing rack session option #{key} in request.session_options")
-    end
-  end
-end

data/vendor/rails/actionpack/test/controller/request_forgery_protection_test.rb

@@ -1,1013 +0,0 @@
-# frozen_string_literal: true
-
-require "abstract_unit"
-require "active_support/log_subscriber/test_helper"
-require "active_support/messages/rotation_configuration"
-
-# common controller actions
-module RequestForgeryProtectionActions
-  def index
-    render inline: "<%= form_tag('/') {} %>"
-  end
-
-  def show_button
-    render inline: "<%= button_to('New', '/') %>"
-  end
-
-  def unsafe
-    render plain: "pwn"
-  end
-
-  def meta
-    render inline: "<%= csrf_meta_tags %>"
-  end
-
-  def form_for_remote
-    render inline: "<%= form_for(:some_resource, :remote => true ) {} %>"
-  end
-
-  def form_for_remote_with_token
-    render inline: "<%= form_for(:some_resource, :remote => true, :authenticity_token => true ) {} %>"
-  end
-
-  def form_for_with_token
-    render inline: "<%= form_for(:some_resource, :authenticity_token => true ) {} %>"
-  end
-
-  def form_for_remote_with_external_token
-    render inline: "<%= form_for(:some_resource, :remote => true, :authenticity_token => 'external_token') {} %>"
-  end
-
-  def form_with_remote
-    render inline: "<%= form_with(scope: :some_resource) {} %>"
-  end
-
-  def form_with_remote_with_token
-    render inline: "<%= form_with(scope: :some_resource, authenticity_token: true) {} %>"
-  end
-
-  def form_with_local_with_token
-    render inline: "<%= form_with(scope: :some_resource, local: true, authenticity_token: true) {} %>"
-  end
-
-  def form_with_remote_with_external_token
-    render inline: "<%= form_with(scope: :some_resource, authenticity_token: 'external_token') {} %>"
-  end
-
-  def same_origin_js
-    render js: "foo();"
-  end
-
-  def negotiate_same_origin
-    respond_to do |format|
-      format.js { same_origin_js }
-    end
-  end
-
-  def cross_origin_js
-    same_origin_js
-  end
-
-  def negotiate_cross_origin
-    negotiate_same_origin
-  end
-end
-
-# sample controllers
-class RequestForgeryProtectionControllerUsingResetSession < ActionController::Base
-  include RequestForgeryProtectionActions
-  protect_from_forgery only: %w(index meta same_origin_js negotiate_same_origin), with: :reset_session
-end
-
-class RequestForgeryProtectionControllerUsingException < ActionController::Base
-  include RequestForgeryProtectionActions
-  protect_from_forgery only: %w(index meta same_origin_js negotiate_same_origin), with: :exception
-end
-
-class RequestForgeryProtectionControllerUsingNullSession < ActionController::Base
-  protect_from_forgery with: :null_session
-
-  def signed
-    cookies.signed[:foo] = "bar"
-    head :ok
-  end
-
-  def encrypted
-    cookies.encrypted[:foo] = "bar"
-    head :ok
-  end
-
-  def try_to_reset_session
-    reset_session
-    head :ok
-  end
-end
-
-class PrependProtectForgeryBaseController < ActionController::Base
-  before_action :custom_action
-  attr_accessor :called_callbacks
-
-  def index
-    render inline: "OK"
-  end
-
-  private
-
-    def add_called_callback(name)
-      @called_callbacks ||= []
-      @called_callbacks << name
-    end
-
-    def custom_action
-      add_called_callback("custom_action")
-    end
-
-    def verify_authenticity_token
-      add_called_callback("verify_authenticity_token")
-    end
-end
-
-class FreeCookieController < RequestForgeryProtectionControllerUsingResetSession
-  self.allow_forgery_protection = false
-
-  def index
-    render inline: "<%= form_tag('/') {} %>"
-  end
-
-  def show_button
-    render inline: "<%= button_to('New', '/') %>"
-  end
-end
-
-class CustomAuthenticityParamController < RequestForgeryProtectionControllerUsingResetSession
-  def form_authenticity_param
-    "foobar"
-  end
-end
-
-class PerFormTokensController < ActionController::Base
-  protect_from_forgery with: :exception
-  self.per_form_csrf_tokens = true
-
-  def index
-    render inline: "<%= form_tag (params[:form_path] || '/per_form_tokens/post_one'), method: params[:form_method] %>"
-  end
-
-  def button_to
-    render inline: "<%= button_to 'Button', (params[:form_path] || '/per_form_tokens/post_one'), method: params[:form_method] %>"
-  end
-
-  def post_one
-    render plain: ""
-  end
-
-  def post_two
-    render plain: ""
-  end
-end
-
-class SkipProtectionController < ActionController::Base
-  include RequestForgeryProtectionActions
-  protect_from_forgery with: :exception
-  skip_forgery_protection if: :skip_requested
-  attr_accessor :skip_requested
-end
-
-# common test methods
-module RequestForgeryProtectionTests
-  def setup
-    @token = Base64.strict_encode64("railstestrailstestrailstestrails")
-    @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
-    ActionController::Base.request_forgery_protection_token = :custom_authenticity_token
-  end
-
-  def teardown
-    ActionController::Base.request_forgery_protection_token = @old_request_forgery_protection_token
-  end
-
-  def test_should_render_form_with_token_tag
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :index
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_button_to_with_token_tag
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :show_button
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_form_without_token_tag_if_remote
-    assert_not_blocked do
-      get :form_for_remote
-    end
-    assert_no_match(/authenticity_token/, response.body)
-  end
-
-  def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_on
-    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
-      assert_not_blocked do
-        get :form_for_remote
-      end
-      assert_match(/authenticity_token/, response.body)
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
-    end
-  end
-
-  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_on
-    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
-      assert_not_blocked do
-        get :form_for_remote_with_external_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", "external_token"
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
-    end
-  end
-
-  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_remote_with_external_token
-    end
-    assert_select "form>input[name=?][value=?]", "custom_authenticity_token", "external_token"
-  end
-
-  def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :form_for_remote_with_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_form_with_token_tag_with_authenticity_token_requested
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :form_for_with_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_form_with_with_token_tag_if_remote
-    assert_not_blocked do
-      get :form_with_remote
-    end
-    assert_match(/authenticity_token/, response.body)
-  end
-
-  def test_should_render_form_with_without_token_tag_if_remote_and_embedding_token_is_off
-    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
-      assert_not_blocked do
-        get :form_with_remote
-      end
-      assert_no_match(/authenticity_token/, response.body)
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
-    end
-  end
-
-  def test_should_render_form_with_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_on
-    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
-      assert_not_blocked do
-        get :form_with_remote_with_external_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", "external_token"
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
-    end
-  end
-
-  def test_should_render_form_with_with_token_tag_if_remote_and_external_authenticity_token_requested
-    assert_not_blocked do
-      get :form_with_remote_with_external_token
-    end
-    assert_select "form>input[name=?][value=?]", "custom_authenticity_token", "external_token"
-  end
-
-  def test_should_render_form_with_with_token_tag_if_remote_and_authenticity_token_requested
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :form_with_remote_with_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_form_with_with_token_tag_with_authenticity_token_requested
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked do
-        get :form_with_local_with_token
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    end
-  end
-
-  def test_should_render_form_with_with_token_tag_if_remote_and_embedding_token_is_on
-    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
-
-      @controller.stub :form_authenticity_token, @token do
-        assert_not_blocked do
-          get :form_with_remote
-        end
-      end
-      assert_select "form>input[name=?][value=?]", "custom_authenticity_token", @token
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
-    end
-  end
-
-  def test_should_allow_get
-    assert_not_blocked { get :index }
-  end
-
-  def test_should_allow_head
-    assert_not_blocked { head :index }
-  end
-
-  def test_should_allow_post_without_token_on_unsafe_action
-    assert_not_blocked { post :unsafe }
-  end
-
-  def test_should_not_allow_post_without_token
-    assert_blocked { post :index }
-  end
-
-  def test_should_not_allow_post_without_token_irrespective_of_format
-    assert_blocked { post :index, format: "xml" }
-  end
-
-  def test_should_not_allow_patch_without_token
-    assert_blocked { patch :index }
-  end
-
-  def test_should_not_allow_put_without_token
-    assert_blocked { put :index }
-  end
-
-  def test_should_not_allow_delete_without_token
-    assert_blocked { delete :index }
-  end
-
-  def test_should_not_allow_xhr_post_without_token
-    assert_blocked { post :index, xhr: true }
-  end
-
-  def test_should_allow_post_with_token
-    session[:_csrf_token] = @token
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked { post :index, params: { custom_authenticity_token: @token } }
-    end
-  end
-
-  def test_should_allow_patch_with_token
-    session[:_csrf_token] = @token
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked { patch :index, params: { custom_authenticity_token: @token } }
-    end
-  end
-
-  def test_should_allow_put_with_token
-    session[:_csrf_token] = @token
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked { put :index, params: { custom_authenticity_token: @token } }
-    end
-  end
-
-  def test_should_allow_delete_with_token
-    session[:_csrf_token] = @token
-    @controller.stub :form_authenticity_token, @token do
-      assert_not_blocked { delete :index, params: { custom_authenticity_token: @token } }
-    end
-  end
-
-  def test_should_allow_post_with_token_in_header
-    session[:_csrf_token] = @token
-    @request.env["HTTP_X_CSRF_TOKEN"] = @token
-    assert_not_blocked { post :index }
-  end
-
-  def test_should_allow_delete_with_token_in_header
-    session[:_csrf_token] = @token
-    @request.env["HTTP_X_CSRF_TOKEN"] = @token
-    assert_not_blocked { delete :index }
-  end
-
-  def test_should_allow_patch_with_token_in_header
-    session[:_csrf_token] = @token
-    @request.env["HTTP_X_CSRF_TOKEN"] = @token
-    assert_not_blocked { patch :index }
-  end
-
-  def test_should_allow_put_with_token_in_header
-    session[:_csrf_token] = @token
-    @request.env["HTTP_X_CSRF_TOKEN"] = @token
-    assert_not_blocked { put :index }
-  end
-
-  def test_should_allow_post_with_origin_checking_and_correct_origin
-    forgery_protection_origin_check do
-      session[:_csrf_token] = @token
-      @controller.stub :form_authenticity_token, @token do
-        assert_not_blocked do
-          @request.set_header "HTTP_ORIGIN", "http://test.host"
-          post :index, params: { custom_authenticity_token: @token }
-        end
-      end
-    end
-  end
-
-  def test_should_allow_post_with_origin_checking_and_no_origin
-    forgery_protection_origin_check do
-      session[:_csrf_token] = @token
-      @controller.stub :form_authenticity_token, @token do
-        assert_not_blocked do
-          post :index, params: { custom_authenticity_token: @token }
-        end
-      end
-    end
-  end
-
-  def test_should_raise_for_post_with_null_origin
-    forgery_protection_origin_check do
-      session[:_csrf_token] = @token
-      @controller.stub :form_authenticity_token, @token do
-        exception = assert_raises(ActionController::InvalidAuthenticityToken) do
-          @request.set_header "HTTP_ORIGIN", "null"
-          post :index, params: { custom_authenticity_token: @token }
-        end
-        assert_match "The browser returned a 'null' origin for a request", exception.message
-      end
-    end
-  end
-
-  def test_should_block_post_with_origin_checking_and_wrong_origin
-    old_logger = ActionController::Base.logger
-    logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    ActionController::Base.logger = logger
-
-    forgery_protection_origin_check do
-      session[:_csrf_token] = @token
-      @controller.stub :form_authenticity_token, @token do
-        assert_blocked do
-          @request.set_header "HTTP_ORIGIN", "http://bad.host"
-          post :index, params: { custom_authenticity_token: @token }
-        end
-      end
-    end
-
-    assert_match(
-      "HTTP Origin header (http://bad.host) didn't match request.base_url (http://test.host)",
-      logger.logged(:warn).last
-    )
-  ensure
-    ActionController::Base.logger = old_logger
-  end
-
-  def test_should_warn_on_missing_csrf_token
-    old_logger = ActionController::Base.logger
-    logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    ActionController::Base.logger = logger
-
-    begin
-      assert_blocked { post :index }
-
-      assert_equal 1, logger.logged(:warn).size
-      assert_match(/CSRF token authenticity/, logger.logged(:warn).last)
-    ensure
-      ActionController::Base.logger = old_logger
-    end
-  end
-
-  def test_should_not_warn_if_csrf_logging_disabled
-    old_logger = ActionController::Base.logger
-    logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    ActionController::Base.logger = logger
-    ActionController::Base.log_warning_on_csrf_failure = false
-
-    begin
-      assert_blocked { post :index }
-
-      assert_equal 0, logger.logged(:warn).size
-    ensure
-      ActionController::Base.logger = old_logger
-      ActionController::Base.log_warning_on_csrf_failure = true
-    end
-  end
-
-  def test_should_only_allow_same_origin_js_get_with_xhr_header
-    assert_cross_origin_blocked { get :same_origin_js }
-    assert_cross_origin_blocked { get :same_origin_js, format: "js" }
-    assert_cross_origin_blocked do
-      @request.accept = "text/javascript"
-      get :negotiate_same_origin
-    end
-
-    assert_cross_origin_not_blocked { get :same_origin_js, xhr: true }
-    assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: "js" }
-    assert_cross_origin_not_blocked do
-      @request.accept = "text/javascript"
-      get :negotiate_same_origin, xhr: true
-    end
-  end
-
-  def test_should_warn_on_not_same_origin_js
-    old_logger = ActionController::Base.logger
-    logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    ActionController::Base.logger = logger
-
-    begin
-      assert_cross_origin_blocked { get :same_origin_js }
-
-      assert_equal 1, logger.logged(:warn).size
-      assert_match(/<script> tag on another site requested protected JavaScript/, logger.logged(:warn).last)
-    ensure
-      ActionController::Base.logger = old_logger
-    end
-  end
-
-  def test_should_not_warn_if_csrf_logging_disabled_and_not_same_origin_js
-    old_logger = ActionController::Base.logger
-    logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    ActionController::Base.logger = logger
-    ActionController::Base.log_warning_on_csrf_failure = false
-
-    begin
-      assert_cross_origin_blocked { get :same_origin_js }
-
-      assert_equal 0, logger.logged(:warn).size
-    ensure
-      ActionController::Base.logger = old_logger
-      ActionController::Base.log_warning_on_csrf_failure = true
-    end
-  end
-
-  # Allow non-GET requests since GET is all a remote <script> tag can muster.
-  def test_should_allow_non_get_js_without_xhr_header
-    session[:_csrf_token] = @token
-    assert_cross_origin_not_blocked { post :same_origin_js, params: { custom_authenticity_token: @token } }
-    assert_cross_origin_not_blocked { post :same_origin_js, params: { format: "js", custom_authenticity_token: @token } }
-    assert_cross_origin_not_blocked do
-      @request.accept = "text/javascript"
-      post :negotiate_same_origin, params: { custom_authenticity_token: @token }
-    end
-  end
-
-  def test_should_only_allow_cross_origin_js_get_without_xhr_header_if_protection_disabled
-    assert_cross_origin_not_blocked { get :cross_origin_js }
-    assert_cross_origin_not_blocked { get :cross_origin_js, format: "js" }
-    assert_cross_origin_not_blocked do
-      @request.accept = "text/javascript"
-      get :negotiate_cross_origin
-    end
-
-    assert_cross_origin_not_blocked { get :cross_origin_js, xhr: true }
-    assert_cross_origin_not_blocked { get :cross_origin_js, xhr: true, format: "js" }
-    assert_cross_origin_not_blocked do
-      @request.accept = "text/javascript"
-      get :negotiate_cross_origin, xhr: true
-    end
-  end
-
-  def test_should_not_raise_error_if_token_is_not_a_string
-    assert_blocked do
-      patch :index, params: { custom_authenticity_token: { foo: "bar" } }
-    end
-  end
-
-  def assert_blocked
-    session[:something_like_user_id] = 1
-    yield
-    assert_nil session[:something_like_user_id], "session values are still present"
-    assert_response :success
-  end
-
-  def assert_not_blocked
-    assert_nothing_raised { yield }
-    assert_response :success
-  end
-
-  def assert_cross_origin_blocked
-    assert_raises(ActionController::InvalidCrossOriginRequest) do
-      yield
-    end
-  end
-
-  def assert_cross_origin_not_blocked
-    assert_not_blocked { yield }
-  end
-
-  def forgery_protection_origin_check
-    old_setting = ActionController::Base.forgery_protection_origin_check
-    ActionController::Base.forgery_protection_origin_check = true
-    begin
-      yield
-    ensure
-      ActionController::Base.forgery_protection_origin_check = old_setting
-    end
-  end
-end
-
-# OK let's get our test on
-
-class RequestForgeryProtectionControllerUsingResetSessionTest < ActionController::TestCase
-  include RequestForgeryProtectionTests
-
-  test "should emit a csrf-param meta tag and a csrf-token meta tag" do
-    @controller.stub :form_authenticity_token, @token + "<=?" do
-      get :meta
-      assert_select "meta[name=?][content=?]", "csrf-param", "custom_authenticity_token"
-      assert_select "meta[name=?]", "csrf-token"
-      regexp = "#{@token}&lt;=\?"
-      assert_match(/#{regexp}/, @response.body)
-    end
-  end
-end
-
-class RequestForgeryProtectionControllerUsingNullSessionTest < ActionController::TestCase
-  class NullSessionDummyKeyGenerator
-    def generate_key(secret, length = nil)
-      "03312270731a2ed0d11ed091c2338a06"
-    end
-  end
-
-  def setup
-    @request.env[ActionDispatch::Cookies::GENERATOR_KEY] = NullSessionDummyKeyGenerator.new
-    @request.env[ActionDispatch::Cookies::COOKIES_ROTATIONS] = ActiveSupport::Messages::RotationConfiguration.new
-  end
-
-  test "should allow to set signed cookies" do
-    post :signed
-    assert_response :ok
-  end
-
-  test "should allow to set encrypted cookies" do
-    post :encrypted
-    assert_response :ok
-  end
-
-  test "should allow reset_session" do
-    post :try_to_reset_session
-    assert_response :ok
-  end
-end
-
-class RequestForgeryProtectionControllerUsingExceptionTest < ActionController::TestCase
-  include RequestForgeryProtectionTests
-  def assert_blocked
-    assert_raises(ActionController::InvalidAuthenticityToken) do
-      yield
-    end
-  end
-end
-
-class PrependProtectForgeryBaseControllerTest < ActionController::TestCase
-  PrependTrueController = Class.new(PrependProtectForgeryBaseController) do
-    protect_from_forgery prepend: true
-  end
-
-  PrependFalseController = Class.new(PrependProtectForgeryBaseController) do
-    protect_from_forgery prepend: false
-  end
-
-  PrependDefaultController = Class.new(PrependProtectForgeryBaseController) do
-    protect_from_forgery
-  end
-
-  def test_verify_authenticity_token_is_prepended
-    @controller = PrependTrueController.new
-    get :index
-    expected_callback_order = ["verify_authenticity_token", "custom_action"]
-    assert_equal(expected_callback_order, @controller.called_callbacks)
-  end
-
-  def test_verify_authenticity_token_is_not_prepended
-    @controller = PrependFalseController.new
-    get :index
-    expected_callback_order = ["custom_action", "verify_authenticity_token"]
-    assert_equal(expected_callback_order, @controller.called_callbacks)
-  end
-
-  def test_verify_authenticity_token_is_not_prepended_by_default
-    @controller = PrependDefaultController.new
-    get :index
-    expected_callback_order = ["custom_action", "verify_authenticity_token"]
-    assert_equal(expected_callback_order, @controller.called_callbacks)
-  end
-end
-
-class FreeCookieControllerTest < ActionController::TestCase
-  def setup
-    @controller = FreeCookieController.new
-    @token      = "cf50faa3fe97702ca1ae"
-    super
-  end
-
-  def test_should_not_render_form_with_token_tag
-    SecureRandom.stub :base64, @token do
-      get :index
-      assert_select "form>div>input[name=?][value=?]", "authenticity_token", @token, false
-    end
-  end
-
-  def test_should_not_render_button_to_with_token_tag
-    SecureRandom.stub :base64, @token do
-      get :show_button
-      assert_select "form>div>input[name=?][value=?]", "authenticity_token", @token, false
-    end
-  end
-
-  def test_should_allow_all_methods_without_token
-    SecureRandom.stub :base64, @token do
-      [:post, :patch, :put, :delete].each do |method|
-        assert_nothing_raised { send(method, :index) }
-      end
-    end
-  end
-
-  test "should not emit a csrf-token meta tag" do
-    SecureRandom.stub :base64, @token do
-      get :meta
-      assert_predicate @response.body, :blank?
-    end
-  end
-end
-
-class CustomAuthenticityParamControllerTest < ActionController::TestCase
-  def setup
-    super
-    @old_logger = ActionController::Base.logger
-    @logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    @token = Base64.strict_encode64(SecureRandom.random_bytes(32))
-    @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
-    ActionController::Base.request_forgery_protection_token = @token
-  end
-
-  def teardown
-    ActionController::Base.request_forgery_protection_token = @old_request_forgery_protection_token
-    super
-  end
-
-  def test_should_not_warn_if_form_authenticity_param_matches_form_authenticity_token
-    ActionController::Base.logger = @logger
-    begin
-      @controller.stub :valid_authenticity_token?, :true do
-        post :index, params: { custom_token_name: "foobar" }
-        assert_equal 0, @logger.logged(:warn).size
-      end
-    ensure
-      ActionController::Base.logger = @old_logger
-    end
-  end
-
-  def test_should_warn_if_form_authenticity_param_does_not_match_form_authenticity_token
-    ActionController::Base.logger = @logger
-
-    begin
-      post :index, params: { custom_token_name: "bazqux" }
-      assert_equal 1, @logger.logged(:warn).size
-    ensure
-      ActionController::Base.logger = @old_logger
-    end
-  end
-end
-
-class PerFormTokensControllerTest < ActionController::TestCase
-  def setup
-    @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
-    ActionController::Base.request_forgery_protection_token = :custom_authenticity_token
-  end
-
-  def teardown
-    ActionController::Base.request_forgery_protection_token = @old_request_forgery_protection_token
-  end
-
-  def test_per_form_token_is_same_size_as_global_token
-    get :index
-    expected = ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH
-    actual = @controller.send(:per_form_csrf_token, session, "/path", "post").size
-    assert_equal expected, actual
-  end
-
-  def test_accepts_token_for_correct_path_and_method
-    get :index
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-    assert_response :success
-  end
-
-  def test_rejects_token_for_incorrect_path
-    get :index
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_two"
-    assert_raises(ActionController::InvalidAuthenticityToken) do
-      post :post_two, params: { custom_authenticity_token: form_token }
-    end
-  end
-
-  def test_rejects_token_for_incorrect_method
-    get :index
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_raises(ActionController::InvalidAuthenticityToken) do
-      patch :post_one, params: { custom_authenticity_token: form_token }
-    end
-  end
-
-  def test_rejects_token_for_incorrect_method_button_to
-    get :button_to, params: { form_method: "delete" }
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token, "delete"
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_raises(ActionController::InvalidAuthenticityToken) do
-      patch :post_one, params: { custom_authenticity_token: form_token }
-    end
-  end
-
-  test "Accepts proper token for implicit post method on button_to tag" do
-    get :button_to
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token, "post"
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-  end
-
-  %w{delete post patch}.each do |verb|
-    test "Accepts proper token for #{verb} method on button_to tag" do
-      get :button_to, params: { form_method: verb }
-
-      form_token = assert_presence_and_fetch_form_csrf_token
-
-      assert_matches_session_token_on_server form_token, verb
-
-      # This is required because PATH_INFO isn't reset between requests.
-      @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-      assert_nothing_raised do
-        send verb, :post_one, params: { custom_authenticity_token: form_token }
-      end
-    end
-  end
-
-  def test_accepts_global_csrf_token
-    get :index
-
-    token = @controller.send(:form_authenticity_token)
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: token }
-    end
-    assert_response :success
-  end
-
-  def test_ignores_params
-    get :index, params: { form_path: "/per_form_tokens/post_one?foo=bar" }
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    assert_matches_session_token_on_server form_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one?foo=baz"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token, baz: "foo" }
-    end
-    assert_response :success
-  end
-
-  def test_ignores_trailing_slash_during_generation
-    get :index, params: { form_path: "/per_form_tokens/post_one/" }
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-    assert_response :success
-  end
-
-  def test_ignores_origin_during_generation
-    get :index, params: { form_path: "https://example.com/per_form_tokens/post_one/" }
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-    assert_response :success
-  end
-
-  def test_ignores_trailing_slash_during_validation
-    get :index
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one/"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-    assert_response :success
-  end
-
-  def test_method_is_case_insensitive
-    get :index, params: { form_method: "POST" }
-
-    form_token = assert_presence_and_fetch_form_csrf_token
-    # This is required because PATH_INFO isn't reset between requests.
-    @request.env["PATH_INFO"] = "/per_form_tokens/post_one/"
-    assert_nothing_raised do
-      post :post_one, params: { custom_authenticity_token: form_token }
-    end
-    assert_response :success
-  end
-
-  private
-    def assert_presence_and_fetch_form_csrf_token
-      assert_select 'input[name="custom_authenticity_token"]' do |input|
-        form_csrf_token = input.first["value"]
-        assert_not_nil form_csrf_token
-        return form_csrf_token
-      end
-    end
-
-    def assert_matches_session_token_on_server(form_token, method = "post")
-      actual = @controller.send(:unmask_token, Base64.strict_decode64(form_token))
-      expected = @controller.send(:per_form_csrf_token, session, "/per_form_tokens/post_one", method)
-      assert_equal expected, actual
-    end
-end
-
-class SkipProtectionControllerTest < ActionController::TestCase
-  def test_should_not_allow_post_without_token_when_not_skipping
-    @controller.skip_requested = false
-    assert_blocked { post :index }
-  end
-
-  def test_should_allow_post_without_token_when_skipping
-    @controller.skip_requested = true
-    assert_not_blocked { post :index }
-  end
-
-  def assert_blocked
-    assert_raises(ActionController::InvalidAuthenticityToken) do
-      yield
-    end
-  end
-
-  def assert_not_blocked
-    assert_nothing_raised { yield }
-    assert_response :success
-  end
-end