proscenium 0.25.1 → 0.25.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 473861b638ff85fc16abdeda10ae458b1494e2861efe19dd9c4c05cc7c3974a4
-  data.tar.gz: 8ef0da8222fb0cc3365082af2e95979bb02362c290271f4a83039a20df2f1d6d
+  metadata.gz: a41356f4c86df48cf657fe9c7a030aad7fbd5b4e6521d58afd73d835097648c7
+  data.tar.gz: 0b33accaba8356175250da5c57c5f12c939c2f9646b8bf020dab984bb2ab8a3a
 SHA512:
-  metadata.gz: c4f1e194204cd9a5576da6058cd3c8a28ca5ed80218e051ce963336f95f15c54e0e422c55c42b26376c15589989e59351e5b527a43dea3fda7545353d4092cad
-  data.tar.gz: 64fec228d710125050f521ff5c7e5c591b1047a32b2983266160dd8c1d1b636e6e2094d5373d5020d35b589a135034eb942dd1187a64cadc595bbae92fa8e43d
+  metadata.gz: 4fbe6585929d0fc321c2452b2743df39bd5bea72bb6248d1d973d5ca65326f3b7eb66bf0939d59481948852ab01b6d1377520392d8535b4d6467e5cd1cff0626
+  data.tar.gz: 31af1466da5b9a85527d062e73941b76a9e52d013e88319b45410958eecd1328f170f05ecb52e4039f6cd38c6937ec1653d7e5c451d574434058805cddb758b0

data/lib/proscenium/middleware/base.rb

@@ -14,22 +14,34 @@ module Proscenium
       end
 
       def renderable!
+        # The single funnel every subclass reaches, so the guard sits here rather than in
+        # `renderable?` - a subclass that overrides that (RubyGems does) cannot skip it.
+        return unless normalised_path
+
         renderable? ? self : nil
       end
 
       private
 
+      # The request path, decoded and with `.` and `..` segments resolved. Everything below is
+      # derived from this one value; see `Middleware.normalise_path` for why that matters.
+      def normalised_path
+        return @normalised_path if defined?(@normalised_path)
+
+        @normalised_path = Middleware.normalise_path(@request.path)
+      end
+
       def real_path
-        @real_path ||= @request.path
+        @real_path ||= normalised_path
       end
 
       # @return [String] the path to the file without the leading slash which will be built.
       def path_to_build
-        @path_to_build ||= @request.path[1..]
+        @path_to_build ||= normalised_path[1..]
       end
 
       def sourcemap?
-        @request.path.ends_with?('.map')
+        normalised_path.ends_with?('.map')
       end
 
       def renderable?
@@ -50,6 +62,9 @@ module Proscenium
         Rails.root
       end
 
+      # Secondary to `Middleware.normalise_path`, which every path here has already been through
+      # - this is idempotent on that output, and earns its keep by stripping the leading slash
+      # that the `join` above needs, and by handling the `.map`-stripped variant.
       def clean_path(file)
         path = Rack::Utils.unescape_path file.chomp('/').delete_prefix('/')
         Rack::Utils.clean_path_info path if Rack::Utils.valid_path? path

data/lib/proscenium/middleware/chunks.rb

@@ -10,17 +10,31 @@ module Proscenium
       def call(env)
         request = ActionDispatch::Request.new(env)
 
-        return @app.call(env) unless request.path.match?(CHUNKS_PATH)
+        # Decode and clean the path BEFORE deciding anything about it, then hand that same path
+        # to the file handler. `ActionDispatch::FileHandler` normalises `PATH_INFO` itself before
+        # it resolves a file, so a guard reading the raw path is not looking at the path that
+        # gets served: `/_asset_chunks/x-$FAKE$/%2e%2e/real-$ABC123$.js` passed both checks and
+        # then served `real-$ABC123$.js` tagged `FAKE`, and `x-$FAKE$/../../lib/foo.js` left the
+        # chunk directory altogether, since the handler's root is the whole output directory.
+        # Both under `immutable, max-age=100.years`, so a wrong ETag is not something a client
+        # can clear.
+        #
+        # The path also has to yield a content hash, not just match the prefix - `CHUNKS_PATH`
+        # checks only the latter, and `/_asset_chunks/nohash.js` used to index the nil match and
+        # return a 500 from here.
+        return @app.call(env) unless (path = Middleware.normalise_path(request.path)) &&
+                                     path.match?(CHUNKS_PATH) &&
+                                     (etag = path[/-\$([a-z0-9]+)\$/i, 1])
 
         ActionDispatch::FileHandler.new(
           Proscenium.config.output_path.to_s,
           headers: {
             'X-Proscenium-Middleware' => 'chunks',
-            'SourceMap' => "#{request.path}.map",
+            'SourceMap' => "#{path}.map",
             'Cache-Control' => "public, max-age=#{100.years}, immutable",
-            'ETag' => request.path.match(/-\$([a-z0-9]+)\$/i)[1]
+            'ETag' => etag
           }
-        ).attempt(request.env) || @app.call(env)
+        ).attempt(env.merge('PATH_INFO' => path)) || @app.call(env)
       end
     end
   end

data/lib/proscenium/middleware/ruby_gems.rb

@@ -7,6 +7,14 @@ module Proscenium
         @real_path ||= Pathname.new(gem_request_path.delete_prefix("#{gem_name}/")).to_s
       end
 
+      # An unknown gem is "not mine", the same answer a missing file under an app path gets from
+      # `Base#file_readable?`. Without this, `pathname_for!` raised out of the readability probe
+      # and a request for a gem that is not in the Gemfile 500'd, while the sibling app-path
+      # branch quietly passed the same shape of miss down the stack.
+      def renderable?
+        BundledGems.pathname_for(gem_name) && super
+      end
+
       def root_for_readable
         BundledGems.pathname_for!(gem_name)
       end
@@ -15,8 +23,14 @@ module Proscenium
         @gem_name ||= gem_request_path.split('/').first
       end
 
+      # Taken from the normalised path, so the gem name and the suffix describe the file that
+      # will actually be built. Read from the request verbatim, `@rubygems/gem1/../index.js`
+      # named gem1 and a suffix the readability probe then cleaned to `index.js` - approving
+      # `<gem1>/index.js` while the builder resolved `../index.js` and served the file BESIDE
+      # the gem root. Normalised, it names a gem called `index.js`, which is not bundled, so
+      # the request passes through.
       def gem_request_path
-        @gem_request_path ||= @request.path.delete_prefix('/node_modules/@rubygems/')
+        @gem_request_path ||= normalised_path.delete_prefix('/node_modules/@rubygems/')
       end
     end
   end

data/lib/proscenium/middleware/vendor.rb

@@ -13,15 +13,18 @@ module Proscenium
 
         return @app.call(env) unless pathname.fnmatch?(VENDOR_PATH_GLOB, File::FNM_EXTGLOB)
 
-        request.path_info = request.path.delete_prefix('/vendor')
-
+        # The prefix strip is an argument to the file lookup, not a rewrite of the request. It used
+        # to assign `request.path_info`, which writes `env['PATH_INFO']` - the same hash handed to
+        # `@app.call` on a miss - so `/vendor/lib/foo.js` with nothing under `vendor/` continued
+        # down the stack as `/lib/foo.js`, matched `APP_PATH_GLOB`, and was built and served from
+        # the app root under the URL the client had actually asked for.
         ActionDispatch::FileHandler.new(
           Rails.root.join('vendor').to_s,
           headers: {
             'X-Proscenium-Middleware' => 'vendor',
             'Cache-Control' => "public, max-age=#{100.years}, immutable"
           }
-        ).attempt(request.env) || @app.call(env)
+        ).attempt(env.merge('PATH_INFO' => request.path.delete_prefix('/vendor'))) || @app.call(env)
       end
     end
   end

data/lib/proscenium/middleware.rb

@@ -13,6 +13,22 @@ module Proscenium
     autoload :Chunks
     autoload :SilenceRequest
 
+    # The given request path, percent-decoded and with `.` and `..` segments resolved. Nil for a
+    # path Rack rejects outright, such as one containing a null byte.
+    #
+    # Every decision and every derived path in this subsystem is taken from this one form. The
+    # alternative was three derivations from the raw path that disagreed: `find_type` matched the
+    # allowed-directory glob against the request verbatim, `Base#file_readable?` normalised before
+    # probing the disk, and `Base#path_to_build` kept the request verbatim again - so a request
+    # could be routed by a directory it does not resolve to, approved against one file, and built
+    # as a third.
+    def self.normalise_path(path)
+      unescaped = Rack::Utils.unescape_path(path.chomp('/').delete_prefix('/'))
+      return unless Rack::Utils.valid_path?(unescaped)
+
+      "/#{Rack::Utils.clean_path_info(unescaped)}"
+    end
+
     def initialize(app)
       @app = app
     end
@@ -34,7 +50,12 @@ module Proscenium
     end
 
     def find_type(request)
-      pathname = Pathname.new(request.path)
+      # Matched against the normalised path, not the request, or the allowed-directory list is
+      # bypassable: `/lib/../public/x.js` matches `APP_PATH_GLOB` as written and resolves to
+      # `public/`, which is not an allowed directory - and it was built and served from there.
+      return unless (path = Middleware.normalise_path(request.path))
+
+      pathname = Pathname.new(path)
 
       if pathname.fnmatch?(GEMS_PATH_GLOB, File::FNM_EXTGLOB)
         RubyGems

data/lib/proscenium/monkey.rb

@@ -58,14 +58,18 @@ module Proscenium
            template.respond_to?(:type) && template.type == :html &&
            view.controller.respond_to?(:sideload_assets_options)
           options = view.controller.sideload_assets_options
-          sideload_template_assets layout, options if layout
-          sideload_template_assets template, options
+          sideload_template_assets layout, view.controller, options if layout
+          sideload_template_assets template, view.controller, options
         end
 
         result
       end
 
-      def sideload_template_assets(tpl, options)
+      # `controller` is passed in rather than read off `self`: unlike TemplateRenderer, an
+      # ActionView::PartialRenderer has no `controller` - so a Proc option reaching a partial
+      # raised NameError until it was threaded through here, as its TemplateRenderer twin
+      # already did.
+      def sideload_template_assets(tpl, controller, options)
         return unless (tpl_path = Pathname.new(tpl.identifier)).file?
 
         options = {} if options.nil?

data/lib/proscenium/runtime/server.rb

@@ -282,7 +282,7 @@ module Proscenium
       # because two of the places it ends up do not anchor it themselves. `File.join(Rails.root,
       # spec)` keeps a `..` verbatim, and `build_entry` hands the path to esbuild, which resolves
       # it relative to the app root and will happily climb out; the `serve` path is the only one
-      # that gets `Rack::Utils.clean_path_info` for free, via Middleware::Base. A traversal 404s
+      # that gets normalised for free, by `Middleware.normalise_path`. A traversal 404s
       # there and then lands in `build_entry`, so without this guard `/lib/../../../secrets.js`
       # reads and returns any file esbuild can load.
       #

data/lib/proscenium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Proscenium
-  VERSION = '0.25.1'
+  VERSION = '0.25.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: proscenium
 version: !ruby/object:Gem::Version
-  version: 0.25.1
+  version: 0.25.2
 platform: ruby
 authors:
 - Joel Moss