proscenium 0.25.1-arm64-darwin → 0.25.2-arm64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bc3aef9facc5a3b191a3852a5ce2f60bf8e1d4f0d49e38f1c11f9858be20a9c
-  data.tar.gz: 649ad1680c27ae342f07bddfcdd5f1d6295f646f3871f0a1a1eed5f5c8bc422e
+  metadata.gz: '03228ac8a2e5c1a00f2630b863476b247dcf8c99f02a804a3a20ff39b15629df'
+  data.tar.gz: 68eb0c62e40a34a30823a85b64cff6a8fdee905517df5b166ddcf7f9d8459c5c
 SHA512:
-  metadata.gz: 9fc0530ae677d835595137e2e7e8c9abeabc75cf9c83f7d77d522b5de3c634b40d4ab527c0228f15a83094c6bf1d63bbc595a3285877a4a8110c86a7f1e3de77
-  data.tar.gz: bc9425a4a5767894ead8126a5d7a890577e19d66af500564c467c08b2d463493ffbf1b63daa50062acbc489206dfe95b3d891eeca591338fd15608d808078dd6
+  metadata.gz: 0eec830d9fd1828ea56e3afc1c0261487677fa183ecb22df9bf0a75526472c8ea7c9c32bb3b20d248d1e81f635448955c9509a9b622bfb414b47a3389706a728
+  data.tar.gz: e63f4a68f5d1be4d443ae369d470eada7df6f3f276c040bf871cac9350dbabdcbcfbf1cd6a9d196e7a831813daccb2cb319ac2692925b73c73214b9f4bd33cdf

data/lib/proscenium/middleware/base.rb

@@ -14,22 +14,34 @@ module Proscenium
       end
 
       def renderable!
+        # The single funnel every subclass reaches, so the guard sits here rather than in
+        # `renderable?` - a subclass that overrides that (RubyGems does) cannot skip it.
+        return unless normalised_path
+
         renderable? ? self : nil
       end
 
       private
 
+      # The request path, decoded and with `.` and `..` segments resolved. Everything below is
+      # derived from this one value; see `Middleware.normalise_path` for why that matters.
+      def normalised_path
+        return @normalised_path if defined?(@normalised_path)
+
+        @normalised_path = Middleware.normalise_path(@request.path)
+      end
+
       def real_path
-        @real_path ||= @request.path
+        @real_path ||= normalised_path
       end
 
       # @return [String] the path to the file without the leading slash which will be built.
       def path_to_build
-        @path_to_build ||= @request.path[1..]
+        @path_to_build ||= normalised_path[1..]
       end
 
       def sourcemap?
-        @request.path.ends_with?('.map')
+        normalised_path.ends_with?('.map')
       end
 
       def renderable?
@@ -50,6 +62,9 @@ module Proscenium
         Rails.root
       end
 
+      # Secondary to `Middleware.normalise_path`, which every path here has already been through
+      # - this is idempotent on that output, and earns its keep by stripping the leading slash
+      # that the `join` above needs, and by handling the `.map`-stripped variant.
       def clean_path(file)
         path = Rack::Utils.unescape_path file.chomp('/').delete_prefix('/')
         Rack::Utils.clean_path_info path if Rack::Utils.valid_path? path

data/lib/proscenium/middleware/chunks.rb

@@ -10,17 +10,31 @@ module Proscenium
       def call(env)
         request = ActionDispatch::Request.new(env)
 
-        return @app.call(env) unless request.path.match?(CHUNKS_PATH)
+        # Decode and clean the path BEFORE deciding anything about it, then hand that same path
+        # to the file handler. `ActionDispatch::FileHandler` normalises `PATH_INFO` itself before
+        # it resolves a file, so a guard reading the raw path is not looking at the path that
+        # gets served: `/_asset_chunks/x-$FAKE$/%2e%2e/real-$ABC123$.js` passed both checks and
+        # then served `real-$ABC123$.js` tagged `FAKE`, and `x-$FAKE$/../../lib/foo.js` left the
+        # chunk directory altogether, since the handler's root is the whole output directory.
+        # Both under `immutable, max-age=100.years`, so a wrong ETag is not something a client
+        # can clear.
+        #
+        # The path also has to yield a content hash, not just match the prefix - `CHUNKS_PATH`
+        # checks only the latter, and `/_asset_chunks/nohash.js` used to index the nil match and
+        # return a 500 from here.
+        return @app.call(env) unless (path = Middleware.normalise_path(request.path)) &&
+                                     path.match?(CHUNKS_PATH) &&
+                                     (etag = path[/-\$([a-z0-9]+)\$/i, 1])
 
         ActionDispatch::FileHandler.new(
           Proscenium.config.output_path.to_s,
           headers: {
             'X-Proscenium-Middleware' => 'chunks',
-            'SourceMap' => "#{request.path}.map",
+            'SourceMap' => "#{path}.map",
             'Cache-Control' => "public, max-age=#{100.years}, immutable",
-            'ETag' => request.path.match(/-\$([a-z0-9]+)\$/i)[1]
+            'ETag' => etag
           }
-        ).attempt(request.env) || @app.call(env)
+        ).attempt(env.merge('PATH_INFO' => path)) || @app.call(env)
       end
     end
   end

data/lib/proscenium/middleware/ruby_gems.rb

@@ -7,6 +7,14 @@ module Proscenium
         @real_path ||= Pathname.new(gem_request_path.delete_prefix("#{gem_name}/")).to_s
       end
 
+      # An unknown gem is "not mine", the same answer a missing file under an app path gets from
+      # `Base#file_readable?`. Without this, `pathname_for!` raised out of the readability probe
+      # and a request for a gem that is not in the Gemfile 500'd, while the sibling app-path
+      # branch quietly passed the same shape of miss down the stack.
+      def renderable?
+        BundledGems.pathname_for(gem_name) && super
+      end
+
       def root_for_readable
         BundledGems.pathname_for!(gem_name)
       end
@@ -15,8 +23,14 @@ module Proscenium
         @gem_name ||= gem_request_path.split('/').first
       end
 
+      # Taken from the normalised path, so the gem name and the suffix describe the file that
+      # will actually be built. Read from the request verbatim, `@rubygems/gem1/../index.js`
+      # named gem1 and a suffix the readability probe then cleaned to `index.js` - approving
+      # `<gem1>/index.js` while the builder resolved `../index.js` and served the file BESIDE
+      # the gem root. Normalised, it names a gem called `index.js`, which is not bundled, so
+      # the request passes through.
       def gem_request_path
-        @gem_request_path ||= @request.path.delete_prefix('/node_modules/@rubygems/')
+        @gem_request_path ||= normalised_path.delete_prefix('/node_modules/@rubygems/')
       end
     end
   end

data/lib/proscenium/middleware/vendor.rb

@@ -13,15 +13,18 @@ module Proscenium
 
         return @app.call(env) unless pathname.fnmatch?(VENDOR_PATH_GLOB, File::FNM_EXTGLOB)
 
-        request.path_info = request.path.delete_prefix('/vendor')
-
+        # The prefix strip is an argument to the file lookup, not a rewrite of the request. It used
+        # to assign `request.path_info`, which writes `env['PATH_INFO']` - the same hash handed to
+        # `@app.call` on a miss - so `/vendor/lib/foo.js` with nothing under `vendor/` continued
+        # down the stack as `/lib/foo.js`, matched `APP_PATH_GLOB`, and was built and served from
+        # the app root under the URL the client had actually asked for.
         ActionDispatch::FileHandler.new(
           Rails.root.join('vendor').to_s,
           headers: {
             'X-Proscenium-Middleware' => 'vendor',
             'Cache-Control' => "public, max-age=#{100.years}, immutable"
           }
-        ).attempt(request.env) || @app.call(env)
+        ).attempt(env.merge('PATH_INFO' => request.path.delete_prefix('/vendor'))) || @app.call(env)
       end
     end
   end

data/lib/proscenium/middleware.rb

@@ -13,6 +13,22 @@ module Proscenium
     autoload :Chunks
     autoload :SilenceRequest
 
+    # The given request path, percent-decoded and with `.` and `..` segments resolved. Nil for a
+    # path Rack rejects outright, such as one containing a null byte.
+    #
+    # Every decision and every derived path in this subsystem is taken from this one form. The
+    # alternative was three derivations from the raw path that disagreed: `find_type` matched the
+    # allowed-directory glob against the request verbatim, `Base#file_readable?` normalised before
+    # probing the disk, and `Base#path_to_build` kept the request verbatim again - so a request
+    # could be routed by a directory it does not resolve to, approved against one file, and built
+    # as a third.
+    def self.normalise_path(path)
+      unescaped = Rack::Utils.unescape_path(path.chomp('/').delete_prefix('/'))
+      return unless Rack::Utils.valid_path?(unescaped)
+
+      "/#{Rack::Utils.clean_path_info(unescaped)}"
+    end
+
     def initialize(app)
       @app = app
     end
@@ -34,7 +50,12 @@ module Proscenium
     end
 
     def find_type(request)
-      pathname = Pathname.new(request.path)
+      # Matched against the normalised path, not the request, or the allowed-directory list is
+      # bypassable: `/lib/../public/x.js` matches `APP_PATH_GLOB` as written and resolves to
+      # `public/`, which is not an allowed directory - and it was built and served from there.
+      return unless (path = Middleware.normalise_path(request.path))
+
+      pathname = Pathname.new(path)
 
       if pathname.fnmatch?(GEMS_PATH_GLOB, File::FNM_EXTGLOB)
         RubyGems

data/lib/proscenium/monkey.rb

@@ -58,14 +58,18 @@ module Proscenium
            template.respond_to?(:type) && template.type == :html &&
            view.controller.respond_to?(:sideload_assets_options)
           options = view.controller.sideload_assets_options
-          sideload_template_assets layout, options if layout
-          sideload_template_assets template, options
+          sideload_template_assets layout, view.controller, options if layout
+          sideload_template_assets template, view.controller, options
         end
 
         result
       end
 
-      def sideload_template_assets(tpl, options)
+      # `controller` is passed in rather than read off `self`: unlike TemplateRenderer, an
+      # ActionView::PartialRenderer has no `controller` - so a Proc option reaching a partial
+      # raised NameError until it was threaded through here, as its TemplateRenderer twin
+      # already did.
+      def sideload_template_assets(tpl, controller, options)
         return unless (tpl_path = Pathname.new(tpl.identifier)).file?
 
         options = {} if options.nil?

data/lib/proscenium/runtime/server.rb

@@ -282,7 +282,7 @@ module Proscenium
       # because two of the places it ends up do not anchor it themselves. `File.join(Rails.root,
       # spec)` keeps a `..` verbatim, and `build_entry` hands the path to esbuild, which resolves
       # it relative to the app root and will happily climb out; the `serve` path is the only one
-      # that gets `Rack::Utils.clean_path_info` for free, via Middleware::Base. A traversal 404s
+      # that gets normalised for free, by `Middleware.normalise_path`. A traversal 404s
       # there and then lands in `build_entry`, so without this guard `/lib/../../../secrets.js`
       # reads and returns any file esbuild can load.
       #

data/lib/proscenium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Proscenium
-  VERSION = '0.25.1'
+  VERSION = '0.25.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: proscenium
 version: !ruby/object:Gem::Version
-  version: 0.25.1
+  version: 0.25.2
 platform: arm64-darwin
 authors:
 - Joel Moss