omg-actionpack 8.0.0.alpha1

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  # # Action Dispatch HostAuthorization
+  #
+  # This middleware guards from DNS rebinding attacks by explicitly permitting the
+  # hosts a request can be sent to, and is passed the options set in
+  # `config.host_authorization`.
+  #
+  # Requests can opt-out of Host Authorization with `exclude`:
+  #
+  #     config.host_authorization = { exclude: ->(request) { request.path =~ /healthcheck/ } }
+  #
+  # When a request comes to an unauthorized host, the `response_app` application
+  # will be executed and rendered. If no `response_app` is given, a default one
+  # will run. The default response app logs blocked host info with level 'error'
+  # and responds with `403 Forbidden`. The body of the response contains debug
+  # info if `config.consider_all_requests_local` is set to true, otherwise the
+  # body is empty.
+  class HostAuthorization
+    ALLOWED_HOSTS_IN_DEVELOPMENT = [".localhost", ".test", IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")]
+    PORT_REGEX = /(?::\d+)/ # :nodoc:
+    SUBDOMAIN_REGEX = /(?:[a-z0-9-]+\.)/i # :nodoc:
+    IPV4_HOSTNAME = /(?<host>\d+\.\d+\.\d+\.\d+)#{PORT_REGEX}?/ # :nodoc:
+    IPV6_HOSTNAME = /(?<host>[a-f0-9]*:[a-f0-9.:]+)/i # :nodoc:
+    IPV6_HOSTNAME_WITH_PORT = /\[#{IPV6_HOSTNAME}\]#{PORT_REGEX}/i # :nodoc:
+    VALID_IP_HOSTNAME = Regexp.union( # :nodoc:
+      /\A#{IPV4_HOSTNAME}\z/,
+      /\A#{IPV6_HOSTNAME}\z/,
+      /\A#{IPV6_HOSTNAME_WITH_PORT}\z/,
+    )
+
+    class Permissions # :nodoc:
+      def initialize(hosts)
+        @hosts = sanitize_hosts(hosts)
+      end
+
+      def empty?
+        @hosts.empty?
+      end
+
+      def allows?(host)
+        @hosts.any? do |allowed|
+          if allowed.is_a?(IPAddr)
+            begin
+              allowed === extract_hostname(host)
+            rescue
+              # IPAddr#=== raises an error if you give it a hostname instead of IP. Treat
+              # similar errors as blocked access.
+              false
+            end
+          else
+            allowed === host
+          end
+        end
+      end
+
+      private
+        def sanitize_hosts(hosts)
+          Array(hosts).map do |host|
+            case host
+            when Regexp then sanitize_regexp(host)
+            when String then sanitize_string(host)
+            else host
+            end
+          end
+        end
+
+        def sanitize_regexp(host)
+          /\A#{host}#{PORT_REGEX}?\z/
+        end
+
+        def sanitize_string(host)
+          if host.start_with?(".")
+            /\A#{SUBDOMAIN_REGEX}?#{Regexp.escape(host[1..-1])}#{PORT_REGEX}?\z/i
+          else
+            /\A#{Regexp.escape host}#{PORT_REGEX}?\z/i
+          end
+        end
+
+        def extract_hostname(host)
+          host.slice(VALID_IP_HOSTNAME, "host") || host
+        end
+    end
+
+    class DefaultResponseApp # :nodoc:
+      RESPONSE_STATUS = 403
+
+      def call(env)
+        request = Request.new(env)
+        format = request.xhr? ? "text/plain" : "text/html"
+
+        log_error(request)
+        response(format, response_body(request))
+      end
+
+      private
+        def response_body(request)
+          return "" unless request.get_header("action_dispatch.show_detailed_exceptions")
+
+          template = DebugView.new(hosts: request.env["action_dispatch.blocked_hosts"])
+          template.render(template: "rescues/blocked_host", layout: "rescues/layout")
+        end
+
+        def response(format, body)
+          [RESPONSE_STATUS,
+           { Rack::CONTENT_TYPE => "#{format}; charset=#{Response.default_charset}",
+             Rack::CONTENT_LENGTH => body.bytesize.to_s },
+           [body]]
+        end
+
+        def log_error(request)
+          logger = available_logger(request)
+
+          return unless logger
+
+          logger.error("[#{self.class.name}] Blocked hosts: #{request.env["action_dispatch.blocked_hosts"].join(", ")}")
+        end
+
+        def available_logger(request)
+          request.logger || ActionView::Base.logger
+        end
+    end
+
+    def initialize(app, hosts, exclude: nil, response_app: nil)
+      @app = app
+      @permissions = Permissions.new(hosts)
+      @exclude = exclude
+
+      @response_app = response_app || DefaultResponseApp.new
+    end
+
+    def call(env)
+      return @app.call(env) if @permissions.empty?
+
+      request = Request.new(env)
+      hosts = blocked_hosts(request)
+
+      if hosts.empty? || excluded?(request)
+        mark_as_authorized(request)
+        @app.call(env)
+      else
+        env["action_dispatch.blocked_hosts"] = hosts
+        @response_app.call(env)
+      end
+    end
+
+    private
+      def blocked_hosts(request)
+        hosts = []
+
+        origin_host = request.get_header("HTTP_HOST")
+        hosts << origin_host unless @permissions.allows?(origin_host)
+
+        forwarded_host = request.x_forwarded_host&.split(/,\s?/)&.last
+        hosts << forwarded_host unless forwarded_host.blank? || @permissions.allows?(forwarded_host)
+
+        hosts
+      end
+
+      def excluded?(request)
+        @exclude && @exclude.call(request)
+      end
+
+      def mark_as_authorized(request)
+        request.set_header("action_dispatch.authorized_host", request.host)
+      end
+  end
+end

data/lib/action_dispatch/middleware/public_exceptions.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  # # Action Dispatch PublicExceptions
+  #
+  # When called, this middleware renders an error page. By default if an HTML
+  # response is expected it will render static error pages from the `/public`
+  # directory. For example when this middleware receives a 500 response it will
+  # render the template found in `/public/500.html`. If an internationalized
+  # locale is set, this middleware will attempt to render the template in
+  # `/public/500.<locale>.html`. If an internationalized template is not found it
+  # will fall back on `/public/500.html`.
+  #
+  # When a request with a content type other than HTML is made, this middleware
+  # will attempt to convert error information into the appropriate response type.
+  class PublicExceptions
+    attr_accessor :public_path
+
+    def initialize(public_path)
+      @public_path = public_path
+    end
+
+    def call(env)
+      request      = ActionDispatch::Request.new(env)
+      status       = request.path_info[1..-1].to_i
+      begin
+        content_type = request.formats.first
+      rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+        content_type = Mime[:text]
+      end
+      body = { status: status, error: Rack::Utils::HTTP_STATUS_CODES.fetch(status, Rack::Utils::HTTP_STATUS_CODES[500]) }
+
+      render(status, content_type, body)
+    end
+
+    private
+      def render(status, content_type, body)
+        format = "to_#{content_type.to_sym}" if content_type
+        if format && body.respond_to?(format)
+          render_format(status, content_type, body.public_send(format))
+        else
+          render_html(status)
+        end
+      end
+
+      def render_format(status, content_type, body)
+        [status, { Rack::CONTENT_TYPE => "#{content_type}; charset=#{ActionDispatch::Response.default_charset}",
+                  Rack::CONTENT_LENGTH => body.bytesize.to_s }, [body]]
+      end
+
+      def render_html(status)
+        path = "#{public_path}/#{status}.#{I18n.locale}.html"
+        path = "#{public_path}/#{status}.html" unless (found = File.exist?(path))
+
+        if found || File.exist?(path)
+          render_format(status, "text/html", File.read(path))
+        else
+          [404, { Constants::X_CASCADE => "pass" }, []]
+        end
+      end
+  end
+end

data/lib/action_dispatch/middleware/reloader.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  # # Action Dispatch Reloader
+  #
+  # ActionDispatch::Reloader wraps the request with callbacks provided by
+  # ActiveSupport::Reloader, intended to assist with code reloading during
+  # development.
+  #
+  # ActionDispatch::Reloader is included in the middleware stack only if reloading
+  # is enabled, which it is by the default in `development` mode.
+  class Reloader < Executor
+  end
+end

data/lib/action_dispatch/middleware/remote_ip.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "ipaddr"
+
+module ActionDispatch
+  # # Action Dispatch RemoteIp
+  #
+  # This middleware calculates the IP address of the remote client that is making
+  # the request. It does this by checking various headers that could contain the
+  # address, and then picking the last-set address that is not on the list of
+  # trusted IPs. This follows the precedent set by e.g. [the Tomcat
+  # server](https://issues.apache.org/bugzilla/show_bug.cgi?id=50453). A more
+  # detailed explanation of the algorithm is given at GetIp#calculate_ip.
+  #
+  # Some Rack servers concatenate repeated headers, like [HTTP RFC
+  # 2616](https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2) requires.
+  # Some Rack servers simply drop preceding headers, and only report the value
+  # that was [given in the last
+  # header](https://andre.arko.net/2011/12/26/repeated-headers-and-ruby-web-server
+  # s). If you are behind multiple proxy servers (like NGINX to HAProxy to
+  # Unicorn) then you should test your Rack server to make sure your data is good.
+  #
+  # IF YOU DON'T USE A PROXY, THIS MAKES YOU VULNERABLE TO IP SPOOFING. This
+  # middleware assumes that there is at least one proxy sitting around and setting
+  # headers with the client's remote IP address. If you don't use a proxy, because
+  # you are hosted on e.g. Heroku without SSL, any client can claim to have any IP
+  # address by setting the `X-Forwarded-For` header. If you care about that, then
+  # you need to explicitly drop or ignore those headers sometime before this
+  # middleware runs. Alternatively, remove this middleware to avoid inadvertently
+  # relying on it.
+  class RemoteIp
+    class IpSpoofAttackError < StandardError; end
+
+    # The default trusted IPs list simply includes IP addresses that are guaranteed
+    # by the IP specification to be private addresses. Those will not be the
+    # ultimate client IP in production, and so are discarded. See
+    # https://en.wikipedia.org/wiki/Private_network for details.
+    TRUSTED_PROXIES = [
+      "127.0.0.0/8",    # localhost IPv4 range, per RFC-3330
+      "::1",            # localhost IPv6
+      "fc00::/7",       # private IPv6 range fc00::/7
+      "10.0.0.0/8",     # private IPv4 range 10.x.x.x
+      "172.16.0.0/12",  # private IPv4 range 172.16.0.0 .. 172.31.255.255
+      "192.168.0.0/16", # private IPv4 range 192.168.x.x
+    ].map { |proxy| IPAddr.new(proxy) }
+
+    attr_reader :check_ip, :proxies
+
+    # Create a new `RemoteIp` middleware instance.
+    #
+    # The `ip_spoofing_check` option is on by default. When on, an exception is
+    # raised if it looks like the client is trying to lie about its own IP address.
+    # It makes sense to turn off this check on sites aimed at non-IP clients (like
+    # WAP devices), or behind proxies that set headers in an incorrect or confusing
+    # way (like AWS ELB).
+    #
+    # The `custom_proxies` argument can take an enumerable which will be used
+    # instead of `TRUSTED_PROXIES`. Any proxy setup will put the value you want in
+    # the middle (or at the beginning) of the `X-Forwarded-For` list, with your
+    # proxy servers after it. If your proxies aren't removed, pass them in via the
+    # `custom_proxies` parameter. That way, the middleware will ignore those IP
+    # addresses, and return the one that you want.
+    def initialize(app, ip_spoofing_check = true, custom_proxies = nil)
+      @app = app
+      @check_ip = ip_spoofing_check
+      @proxies = if custom_proxies.blank?
+        TRUSTED_PROXIES
+      elsif custom_proxies.respond_to?(:any?)
+        custom_proxies
+      else
+        raise(ArgumentError, <<~EOM)
+          Setting config.action_dispatch.trusted_proxies to a single value isn't
+          supported. Please set this to an enumerable instead. For
+          example, instead of:
+
+          config.action_dispatch.trusted_proxies = IPAddr.new("10.0.0.0/8")
+
+          Wrap the value in an Array:
+
+          config.action_dispatch.trusted_proxies = [IPAddr.new("10.0.0.0/8")]
+
+          Note that passing an enumerable will *replace* the default set of trusted proxies.
+        EOM
+      end
+    end
+
+    # Since the IP address may not be needed, we store the object here without
+    # calculating the IP to keep from slowing down the majority of requests. For
+    # those requests that do need to know the IP, the GetIp#calculate_ip method will
+    # calculate the memoized client IP address.
+    def call(env)
+      req = ActionDispatch::Request.new env
+      req.remote_ip = GetIp.new(req, check_ip, proxies)
+      @app.call(req.env)
+    end
+
+    # The GetIp class exists as a way to defer processing of the request data into
+    # an actual IP address. If the ActionDispatch::Request#remote_ip method is
+    # called, this class will calculate the value and then memoize it.
+    class GetIp
+      def initialize(req, check_ip, proxies)
+        @req      = req
+        @check_ip = check_ip
+        @proxies  = proxies
+      end
+
+      # Sort through the various IP address headers, looking for the IP most likely to
+      # be the address of the actual remote client making this request.
+      #
+      # REMOTE_ADDR will be correct if the request is made directly against the Ruby
+      # process, on e.g. Heroku. When the request is proxied by another server like
+      # HAProxy or NGINX, the IP address that made the original request will be put in
+      # an `X-Forwarded-For` header. If there are multiple proxies, that header may
+      # contain a list of IPs. Other proxy services set the `Client-Ip` header
+      # instead, so we check that too.
+      #
+      # As discussed in [this post about Rails IP
+      # Spoofing](https://web.archive.org/web/20170626095448/https://blog.gingerlime.c
+      # om/2012/rails-ip-spoofing-vulnerabilities-and-protection/), while the first IP
+      # in the list is likely to be the "originating" IP, it could also have been set
+      # by the client maliciously.
+      #
+      # In order to find the first address that is (probably) accurate, we take the
+      # list of IPs, remove known and trusted proxies, and then take the last address
+      # left, which was presumably set by one of those proxies.
+      def calculate_ip
+        # Set by the Rack web server, this is a single value.
+        remote_addr = ips_from(@req.remote_addr).last
+
+        # Could be a CSV list and/or repeated headers that were concatenated.
+        client_ips    = ips_from(@req.client_ip).reverse!
+        forwarded_ips = ips_from(@req.x_forwarded_for).reverse!
+
+        # `Client-Ip` and `X-Forwarded-For` should not, generally, both be set. If they
+        # are both set, it means that either:
+        #
+        # 1) This request passed through two proxies with incompatible IP header
+        #     conventions.
+        #
+        # 2) The client passed one of `Client-Ip` or `X-Forwarded-For`
+        #     (whichever the proxy servers weren't using) themselves.
+        #
+        # Either way, there is no way for us to determine which header is the right one
+        # after the fact. Since we have no idea, if we are concerned about IP spoofing
+        # we need to give up and explode. (If you're not concerned about IP spoofing you
+        # can turn the `ip_spoofing_check` option off.)
+        should_check_ip = @check_ip && client_ips.last && forwarded_ips.last
+        if should_check_ip && !forwarded_ips.include?(client_ips.last)
+          # We don't know which came from the proxy, and which from the user
+          raise IpSpoofAttackError, "IP spoofing attack?! " \
+            "HTTP_CLIENT_IP=#{@req.client_ip.inspect} " \
+            "HTTP_X_FORWARDED_FOR=#{@req.x_forwarded_for.inspect}"
+        end
+
+        # We assume these things about the IP headers:
+        #
+        #     - X-Forwarded-For will be a list of IPs, one per proxy, or blank
+        #     - Client-Ip is propagated from the outermost proxy, or is blank
+        #     - REMOTE_ADDR will be the IP that made the request to Rack
+        ips = forwarded_ips + client_ips
+        ips.compact!
+
+        # If every single IP option is in the trusted list, return the IP that's
+        # furthest away
+        filter_proxies(ips + [remote_addr]).first || ips.last || remote_addr
+      end
+
+      # Memoizes the value returned by #calculate_ip and returns it for
+      # ActionDispatch::Request to use.
+      def to_s
+        @ip ||= calculate_ip
+      end
+
+    private
+      def ips_from(header) # :doc:
+        return [] unless header
+        # Split the comma-separated list into an array of strings.
+        ips = header.strip.split(/[,\s]+/)
+        ips.select! do |ip|
+          # Only return IPs that are valid according to the IPAddr#new method.
+          range = IPAddr.new(ip).to_range
+          # We want to make sure nobody is sneaking a netmask in.
+          range.begin == range.end
+        rescue ArgumentError
+          nil
+        end
+        ips
+      end
+
+      def filter_proxies(ips) # :doc:
+        ips.reject do |ip|
+          @proxies.any? { |proxy| proxy === ip }
+        end
+      end
+    end
+  end
+end

data/lib/action_dispatch/middleware/request_id.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "securerandom"
+require "active_support/core_ext/string/access"
+
+module ActionDispatch
+  # # Action Dispatch RequestId
+  #
+  # Makes a unique request id available to the `action_dispatch.request_id` env
+  # variable (which is then accessible through ActionDispatch::Request#request_id
+  # or the alias ActionDispatch::Request#uuid) and sends the same id to the client
+  # via the `X-Request-Id` header.
+  #
+  # The unique request id is either based on the `X-Request-Id` header in the
+  # request, which would typically be generated by a firewall, load balancer, or
+  # the web server, or, if this header is not available, a random uuid. If the
+  # header is accepted from the outside world, we sanitize it to a max of 255
+  # chars and alphanumeric and dashes only.
+  #
+  # The unique request id can be used to trace a request end-to-end and would
+  # typically end up being part of log files from multiple pieces of the stack.
+  class RequestId
+    def initialize(app, header:)
+      @app = app
+      @header = header
+      @env_header = "HTTP_#{header.upcase.tr("-", "_")}"
+    end
+
+    def call(env)
+      req = ActionDispatch::Request.new env
+      req.request_id = make_request_id(req.get_header(@env_header))
+      @app.call(env).tap { |_status, headers, _body| headers[@header] = req.request_id }
+    end
+
+    private
+      def make_request_id(request_id)
+        if request_id.presence
+          request_id.gsub(/[^\w\-@]/, "").first(255)
+        else
+          internal_request_id
+        end
+      end
+
+      def internal_request_id
+        SecureRandom.uuid
+      end
+  end
+end

data/lib/action_dispatch/middleware/server_timing.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "active_support/notifications"
+
+module ActionDispatch
+  class ServerTiming
+    class Subscriber # :nodoc:
+      include Singleton
+      KEY = :action_dispatch_server_timing_events
+
+      def initialize
+        @mutex = Mutex.new
+      end
+
+      def call(event)
+        if events = ActiveSupport::IsolatedExecutionState[KEY]
+          events << event
+        end
+      end
+
+      def collect_events
+        events = []
+        ActiveSupport::IsolatedExecutionState[KEY] = events
+        yield
+        events
+      ensure
+        ActiveSupport::IsolatedExecutionState.delete(KEY)
+      end
+
+      def ensure_subscribed
+        @mutex.synchronize do
+          # Subscribe to all events, except those beginning with "!" Ideally we would be
+          # more selective of what is being measured
+          @subscriber ||= ActiveSupport::Notifications.subscribe(/\A[^!]/, self)
+        end
+      end
+
+      def unsubscribe
+        @mutex.synchronize do
+          ActiveSupport::Notifications.unsubscribe @subscriber
+          @subscriber = nil
+        end
+      end
+    end
+
+    def self.unsubscribe # :nodoc:
+      Subscriber.instance.unsubscribe
+    end
+
+    def initialize(app)
+      @app = app
+      @subscriber = Subscriber.instance
+      @subscriber.ensure_subscribed
+    end
+
+    def call(env)
+      response = nil
+      events = @subscriber.collect_events do
+        response = @app.call(env)
+      end
+
+      headers = response[1]
+
+      header_info = events.group_by(&:name).map do |event_name, events_collection|
+        "%s;dur=%.2f" % [event_name, events_collection.sum(&:duration)]
+      end
+
+      if headers[ActionDispatch::Constants::SERVER_TIMING].present?
+        header_info.prepend(headers[ActionDispatch::Constants::SERVER_TIMING])
+      end
+      headers[ActionDispatch::Constants::SERVER_TIMING] = header_info.join(", ")
+
+      response
+    end
+  end
+end

data/lib/action_dispatch/middleware/session/abstract_store.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "rack/utils"
+require "rack/request"
+require "rack/session/abstract/id"
+require "action_dispatch/middleware/cookies"
+require "action_dispatch/request/session"
+
+module ActionDispatch
+  module Session
+    class SessionRestoreError < StandardError # :nodoc:
+      def initialize
+        super("Session contains objects whose class definition isn't available.\n" \
+          "Remember to require the classes for all objects kept in the session.\n" \
+          "(Original exception: #{$!.message} [#{$!.class}])\n")
+        set_backtrace $!.backtrace
+      end
+    end
+
+    module Compatibility
+      def initialize(app, options = {})
+        options[:key] ||= "_session_id"
+        super
+      end
+
+      def generate_sid
+        sid = SecureRandom.hex(16)
+        sid.encode!(Encoding::UTF_8)
+        sid
+      end
+
+    private
+      def initialize_sid # :doc:
+        @default_options.delete(:sidbits)
+        @default_options.delete(:secure_random)
+      end
+
+      def make_request(env)
+        ActionDispatch::Request.new env
+      end
+    end
+
+    module StaleSessionCheck
+      def load_session(env)
+        stale_session_check! { super }
+      end
+
+      def extract_session_id(env)
+        stale_session_check! { super }
+      end
+
+      def stale_session_check!
+        yield
+      rescue ArgumentError => argument_error
+        if argument_error.message =~ %r{undefined class/module ([\w:]*\w)}
+          begin
+            # Note that the regexp does not allow $1 to end with a ':'.
+            $1.constantize
+          rescue LoadError, NameError
+            raise ActionDispatch::Session::SessionRestoreError
+          end
+          retry
+        else
+          raise
+        end
+      end
+    end
+
+    module SessionObject # :nodoc:
+      def commit_session(req, res)
+        req.commit_csrf_token
+        super(req, res)
+      end
+
+      def prepare_session(req)
+        Request::Session.create(self, req, @default_options)
+      end
+
+      def loaded_session?(session)
+        !session.is_a?(Request::Session) || session.loaded?
+      end
+    end
+
+    class AbstractStore < Rack::Session::Abstract::Persisted
+      include Compatibility
+      include StaleSessionCheck
+      include SessionObject
+
+      private
+        def set_cookie(request, response, cookie)
+          request.cookie_jar[key] = cookie
+        end
+    end
+
+    class AbstractSecureStore < Rack::Session::Abstract::PersistedSecure
+      include Compatibility
+      include StaleSessionCheck
+      include SessionObject
+
+      def generate_sid
+        Rack::Session::SessionId.new(super)
+      end
+
+      private
+        def set_cookie(request, response, cookie)
+          request.cookie_jar[key] = cookie
+        end
+    end
+  end
+end