omg-actionpack 8.0.0.alpha1

data/lib/action_dispatch/http/parameters.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  module Http
+    module Parameters
+      extend ActiveSupport::Concern
+
+      PARAMETERS_KEY = "action_dispatch.request.path_parameters"
+
+      DEFAULT_PARSERS = {
+        Mime[:json].symbol => -> (raw_post) {
+          data = ActiveSupport::JSON.decode(raw_post)
+          data.is_a?(Hash) ? data : { _json: data }
+        }
+      }
+
+      # Raised when raw data from the request cannot be parsed by the parser defined
+      # for request's content MIME type.
+      class ParseError < StandardError
+        def initialize(message = $!.message)
+          super(message)
+        end
+      end
+
+      included do
+        class << self
+          # Returns the parameter parsers.
+          attr_reader :parameter_parsers
+        end
+
+        self.parameter_parsers = DEFAULT_PARSERS
+      end
+
+      module ClassMethods
+        # Configure the parameter parser for a given MIME type.
+        #
+        # It accepts a hash where the key is the symbol of the MIME type and the value
+        # is a proc.
+        #
+        #     original_parsers = ActionDispatch::Request.parameter_parsers
+        #     xml_parser = -> (raw_post) { Hash.from_xml(raw_post) || {} }
+        #     new_parsers = original_parsers.merge(xml: xml_parser)
+        #     ActionDispatch::Request.parameter_parsers = new_parsers
+        def parameter_parsers=(parsers)
+          @parameter_parsers = parsers.transform_keys { |key| key.respond_to?(:symbol) ? key.symbol : key }
+        end
+      end
+
+      # Returns both GET and POST parameters in a single hash.
+      def parameters
+        params = get_header("action_dispatch.request.parameters")
+        return params if params
+
+        params = begin
+                   request_parameters.merge(query_parameters)
+                 rescue EOFError
+                   query_parameters.dup
+                 end
+        params.merge!(path_parameters)
+        set_header("action_dispatch.request.parameters", params)
+        params
+      end
+      alias :params :parameters
+
+      def path_parameters=(parameters) # :nodoc:
+        delete_header("action_dispatch.request.parameters")
+
+        parameters = Request::Utils.set_binary_encoding(self, parameters, parameters[:controller], parameters[:action])
+        # If any of the path parameters has an invalid encoding then raise since it's
+        # likely to trigger errors further on.
+        Request::Utils.check_param_encoding(parameters)
+
+        set_header PARAMETERS_KEY, parameters
+      rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
+        raise ActionController::BadRequest.new("Invalid path parameters: #{e.message}")
+      end
+
+      # Returns a hash with the parameters used to form the path of the request.
+      # Returned hash keys are symbols:
+      #
+      #     { action: "my_action", controller: "my_controller" }
+      def path_parameters
+        get_header(PARAMETERS_KEY) || set_header(PARAMETERS_KEY, {})
+      end
+
+      private
+        def parse_formatted_parameters(parsers)
+          return yield if content_length.zero? || content_mime_type.nil?
+
+          strategy = parsers.fetch(content_mime_type.symbol) { return yield }
+
+          begin
+            strategy.call(raw_post)
+          rescue # JSON or Ruby code block errors.
+            log_parse_error_once
+            raise ParseError, "Error occurred while parsing request parameters"
+          end
+        end
+
+        def log_parse_error_once
+          @parse_error_logged ||= begin
+            parse_logger = logger || ActiveSupport::Logger.new($stderr)
+            parse_logger.debug <<~MSG.chomp
+              Error occurred while parsing request parameters.
+              Contents:
+
+              #{raw_post}
+            MSG
+          end
+        end
+
+        def params_parsers
+          ActionDispatch::Request.parameter_parsers
+        end
+    end
+  end
+end

data/lib/action_dispatch/http/permissions_policy.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "active_support/core_ext/object/deep_dup"
+
+module ActionDispatch # :nodoc:
+  # # Action Dispatch PermissionsPolicy
+  #
+  # Configures the HTTP
+  # [Feature-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
+  # response header to specify which browser features the current
+  # document and its iframes can use.
+  #
+  # Example global policy:
+  #
+  #     Rails.application.config.permissions_policy do |policy|
+  #       policy.camera      :none
+  #       policy.gyroscope   :none
+  #       policy.microphone  :none
+  #       policy.usb         :none
+  #       policy.fullscreen  :self
+  #       policy.payment     :self, "https://secure.example.com"
+  #     end
+  #
+  # The Feature-Policy header has been renamed to Permissions-Policy. The
+  # Permissions-Policy requires a different implementation and isn't yet supported
+  # by all browsers. To avoid having to rename this middleware in the future we
+  # use the new name for the middleware but keep the old header name and
+  # implementation for now.
+  class PermissionsPolicy
+    class Middleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        _, headers, _ = response = @app.call(env)
+
+        return response if policy_present?(headers)
+
+        request = ActionDispatch::Request.new(env)
+
+        if policy = request.permissions_policy
+          headers[ActionDispatch::Constants::FEATURE_POLICY] = policy.build(request.controller_instance)
+        end
+
+        if policy_empty?(policy)
+          headers.delete(ActionDispatch::Constants::FEATURE_POLICY)
+        end
+
+        response
+      end
+
+      private
+        def policy_present?(headers)
+          headers[ActionDispatch::Constants::FEATURE_POLICY]
+        end
+
+        def policy_empty?(policy)
+          policy&.directives&.empty?
+        end
+    end
+
+    module Request
+      POLICY = "action_dispatch.permissions_policy"
+
+      def permissions_policy
+        get_header(POLICY)
+      end
+
+      def permissions_policy=(policy)
+        set_header(POLICY, policy)
+      end
+    end
+
+    MAPPINGS = {
+      self: "'self'",
+      none: "'none'",
+    }.freeze
+
+    # List of available permissions can be found at
+    # https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md#policy-controlled-features
+    DIRECTIVES = {
+      accelerometer:        "accelerometer",
+      ambient_light_sensor: "ambient-light-sensor",
+      autoplay:             "autoplay",
+      camera:               "camera",
+      display_capture:      "display-capture",
+      encrypted_media:      "encrypted-media",
+      fullscreen:           "fullscreen",
+      geolocation:          "geolocation",
+      gyroscope:            "gyroscope",
+      hid:                  "hid",
+      idle_detection:       "idle-detection",
+      keyboard_map:         "keyboard-map",
+      magnetometer:         "magnetometer",
+      microphone:           "microphone",
+      midi:                 "midi",
+      payment:              "payment",
+      picture_in_picture:   "picture-in-picture",
+      screen_wake_lock:     "screen-wake-lock",
+      serial:               "serial",
+      sync_xhr:             "sync-xhr",
+      usb:                  "usb",
+      web_share:            "web-share",
+    }.freeze
+
+    private_constant :MAPPINGS, :DIRECTIVES
+
+    attr_reader :directives
+
+    def initialize
+      @directives = {}
+      yield self if block_given?
+    end
+
+    def initialize_copy(other)
+      @directives = other.directives.deep_dup
+    end
+
+    DIRECTIVES.each do |name, directive|
+      define_method(name) do |*sources|
+        if sources.first
+          @directives[directive] = apply_mappings(sources)
+        else
+          @directives.delete(directive)
+        end
+      end
+    end
+
+    def build(context = nil)
+      build_directives(context).compact.join("; ")
+    end
+
+    private
+      def apply_mappings(sources)
+        sources.map do |source|
+          case source
+          when Symbol
+            apply_mapping(source)
+          when String, Proc
+            source
+          else
+            raise ArgumentError, "Invalid HTTP permissions policy source: #{source.inspect}"
+          end
+        end
+      end
+
+      def apply_mapping(source)
+        MAPPINGS.fetch(source) do
+          raise ArgumentError, "Unknown HTTP permissions policy source mapping: #{source.inspect}"
+        end
+      end
+
+      def build_directives(context)
+        @directives.map do |directive, sources|
+          if sources.is_a?(Array)
+            "#{directive} #{build_directive(sources, context).join(' ')}"
+          elsif sources
+            directive
+          else
+            nil
+          end
+        end
+      end
+
+      def build_directive(sources, context)
+        sources.map { |source| resolve_source(source, context) }
+      end
+
+      def resolve_source(source, context)
+        case source
+        when String
+          source
+        when Symbol
+          source.to_s
+        when Proc
+          if context.nil?
+            raise RuntimeError, "Missing context for the dynamic permissions policy source: #{source.inspect}"
+          else
+            context.instance_exec(&source)
+          end
+        else
+          raise RuntimeError, "Unexpected permissions policy source: #{source.inspect}"
+        end
+      end
+  end
+end

data/lib/action_dispatch/http/rack_cache.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# :enddoc:
+
+# :markup: markdown
+
+require "rack/cache"
+require "rack/cache/context"
+require "active_support/cache"
+
+module ActionDispatch
+  class RailsMetaStore < Rack::Cache::MetaStore
+    def self.resolve(uri)
+      new
+    end
+
+    def initialize(store = Rails.cache)
+      @store = store
+    end
+
+    def read(key)
+      if data = @store.read(key)
+        Marshal.load(data)
+      else
+        []
+      end
+    end
+
+    def write(key, value)
+      @store.write(key, Marshal.dump(value))
+    end
+
+    ::Rack::Cache::MetaStore::RAILS = self
+  end
+
+  class RailsEntityStore < Rack::Cache::EntityStore
+    def self.resolve(uri)
+      new
+    end
+
+    def initialize(store = Rails.cache)
+      @store = store
+    end
+
+    def exist?(key)
+      @store.exist?(key)
+    end
+
+    def open(key)
+      @store.read(key)
+    end
+
+    def read(key)
+      body = open(key)
+      body.join if body
+    end
+
+    def write(body)
+      buf = []
+      key, size = slurp(body) { |part| buf << part }
+      @store.write(key, buf)
+      [key, size]
+    end
+
+    ::Rack::Cache::EntityStore::RAILS = self
+  end
+end