otto 2.11.0 → 2.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ci.yml +1 -1
- data/.github/workflows/claude-code-review.yml +1 -1
- data/.github/workflows/claude.yml +1 -1
- data/.github/workflows/code-smells.yml +2 -2
- data/.github/workflows/release-gem.yml +1 -1
- data/.github/workflows/ruby-lint.yml +1 -1
- data/.github/workflows/yardoc.yml +1 -1
- data/.rubocop_todo.yml +2 -2
- data/CHANGELOG.rst +100 -0
- data/Gemfile +2 -2
- data/Gemfile.lock +8 -8
- data/README.md +6 -0
- data/docs/guides/forwarded-authority.md +5 -1
- data/docs/guides/privacy.md +5 -0
- data/docs/guides/routing.md +68 -5
- data/docs/guides/testing-guide.md +115 -2
- data/lib/otto/caddy_tls/localhost_guard.rb +6 -6
- data/lib/otto/core/configuration.rb +5 -3
- data/lib/otto/core/router.rb +16 -20
- data/lib/otto/env_keys.rb +2 -1
- data/lib/otto/privacy/config.rb +19 -13
- data/lib/otto/response.rb +5 -2
- data/lib/otto/route.rb +1 -1
- data/lib/otto/route_handlers/base.rb +1 -1
- data/lib/otto/route_handlers/logic_class.rb +86 -34
- data/lib/otto/security/config.rb +349 -303
- data/lib/otto/security/configurator.rb +82 -45
- data/lib/otto/security/core.rb +4 -2
- data/lib/otto/security/csp/report_middleware.rb +17 -1
- data/lib/otto/security/middleware/ip_privacy_middleware.rb +3 -5
- data/lib/otto/security/rate_limiter.rb +8 -5
- data/lib/otto/security/trusted_proxy_config.rb +396 -0
- data/lib/otto/static.rb +7 -6
- data/lib/otto/testing.rb +148 -0
- data/lib/otto/utils.rb +63 -14
- data/lib/otto/version.rb +1 -1
- data/lib/otto.rb +7 -2
- metadata +4 -2
data/lib/otto.rb
CHANGED
|
@@ -386,7 +386,8 @@ class Otto
|
|
|
386
386
|
# {#fallback_call_args}); a static triple is used as-is. Either way the
|
|
387
387
|
# result is copied (see {Otto::Static.copy_response}) so the Rack stack
|
|
388
388
|
# never receives a container shared with the configuration or with another
|
|
389
|
-
# request.
|
|
389
|
+
# request. Configured security headers then fill any fields the fallback did
|
|
390
|
+
# not set explicitly.
|
|
390
391
|
#
|
|
391
392
|
# @param name [Symbol] the setting name, for the error message
|
|
392
393
|
# @param fallback [Array, #call] the configured value
|
|
@@ -400,7 +401,11 @@ class Otto
|
|
|
400
401
|
"#{name} callable must return a Rack triple [status, headers, body], got #{response.inspect}"
|
|
401
402
|
end
|
|
402
403
|
|
|
403
|
-
Otto::Static.copy_response(response)
|
|
404
|
+
copied = Otto::Static.copy_response(response)
|
|
405
|
+
@security_config.security_headers.each_pair do |header, value|
|
|
406
|
+
copied[1][header] = value unless copied[1].key?(header)
|
|
407
|
+
end
|
|
408
|
+
copied
|
|
404
409
|
end
|
|
405
410
|
|
|
406
411
|
# Trim +args+ to the positional parameters +callable+ declares, so a lambda
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: otto
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.
|
|
4
|
+
version: 2.12.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Delano Mandelbaum
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2026-09-
|
|
11
|
+
date: 2026-09-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: concurrent-ruby
|
|
@@ -314,8 +314,10 @@ files:
|
|
|
314
314
|
- lib/otto/security/middleware/validation_middleware.rb
|
|
315
315
|
- lib/otto/security/rate_limiter.rb
|
|
316
316
|
- lib/otto/security/rate_limiting.rb
|
|
317
|
+
- lib/otto/security/trusted_proxy_config.rb
|
|
317
318
|
- lib/otto/security/validator.rb
|
|
318
319
|
- lib/otto/static.rb
|
|
320
|
+
- lib/otto/testing.rb
|
|
319
321
|
- lib/otto/utils.rb
|
|
320
322
|
- lib/otto/version.rb
|
|
321
323
|
- otto.gemspec
|