rack-cors 1.0.6 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 617a90d9047dfbbe55196b77139e176298c20011ae3378e0f83dda392cd295b9
-  data.tar.gz: 72285f6b83f9daf70d46924344f5f3fabcedf3f2e68357d4824930de4f925769
+  metadata.gz: 8f879bc8ea95eac0ca9360c3a553084961d02944255f6ad380b64e855653b8b6
+  data.tar.gz: bd9478603340a1785324ab4f1db9517a8943fdcc1be13193e4d6b83b184fa032
 SHA512:
-  metadata.gz: c39a63b2f2b3046aa35d8c8a8d095ab9c8f5627bd1e78e07ca284b382ffd8cc5d02454ec1ab7ffaa158d70dba58ce9e6adeca51b86725c39fd265042e85832b9
-  data.tar.gz: 364a108b061a98c35d958a25ce9cabd88da14f1f7b212a50d437663fe8398a312f62924ac62bd82be8c70e9b952e431e905fa47661aa2cf299f6b0e5fcfaf422
+  metadata.gz: 12d13e99acef13b159595487b3c0198bc1a355371bdb149241d11e1d0715148e0749085d0f0c362d4defdec2e325b416b1e93aeb28be2d421516d4db8185fdac
+  data.tar.gz: a1f373194a95094f337c545e7751eac2c4d8500dfd607088a88e55774b755fa0ec659710319a2f7997e579231b7de806e63f2ce4a1639cdb732eed5bcbb743b9

data/CHANGELOG.md

@@ -1,6 +1,17 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 1.1.1 - 2019-12-29
+### Changed
+- Allow /<resource>/* to match /<resource>/ and /<resource> paths
+
+## 1.1.0 - 2019-11-19
+### Changed
+- Use Rack::Utils.escape_path instead of Rack::Utils.escape
+- Require Rack 2.0 for escape_path method
+- Don't try to clean path if invalid.
+- Return 400 (Bad Request) on preflights with invalid path
+
 ## 1.0.6 - 2019-11-14
 ### Changed
 - Use Rack::Utils.escape to make compat with Rack 1.6.0

data/lib/rack/cors/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Cors
-    VERSION = "1.0.6"
+    VERSION = "1.1.1"
   end
 end

data/lib/rack/cors.rb

@@ -76,7 +76,9 @@ module Rack
             "  Access-Control-Request-Headers: #{env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS]}"
             ].join("\n")
         end
-        if env[REQUEST_METHOD] == OPTIONS and env[HTTP_ACCESS_CONTROL_REQUEST_METHOD]
+
+        if env[REQUEST_METHOD] == OPTIONS && env[HTTP_ACCESS_CONTROL_REQUEST_METHOD]
+          return [400, {}, []] unless Rack::Utils.valid_path?(path)
           headers = process_preflight(env, path)
           debug(env) do
             "Preflight Headers:\n" +
@@ -152,7 +154,15 @@ module Rack
 
       def evaluate_path(env)
         path = env[PATH_INFO]
-        path = Rack::Utils.clean_path_info(Rack::Utils.unescape(path)) if path
+
+        if path
+          path = Rack::Utils.unescape_path(path)
+
+          if Rack::Utils.valid_path?(path)
+            path = Rack::Utils.clean_path_info(path)
+          end
+        end
+
         path
       end
 
@@ -437,8 +447,10 @@ module Rack
             if path.respond_to? :to_str
               special_chars = %w{. + ( )}
               pattern =
-                path.to_str.gsub(/((:\w+)|[\*#{special_chars.join}])/) do |match|
+                path.to_str.gsub(/((:\w+)|\/\*|[\*#{special_chars.join}])/) do |match|
                   case match
+                  when "/*"
+                    "\\/?(.*?)"
                   when "*"
                     "(.*?)"
                   when *special_chars

data/rack-cors.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "rack", ">= 1.6.0"
+  spec.add_dependency "rack", ">= 2.0.0"
   spec.add_development_dependency "bundler", ">= 1.16.0", '< 3'
   spec.add_development_dependency "rake", "~> 12.3.0"
   spec.add_development_dependency "minitest", "~> 5.11.0"

data/test/unit/cors_test.rb

@@ -341,13 +341,25 @@ describe Rack::Cors do
       last_response.must_render_cors_success
     end
 
-    it 'should * origin should allow any origin' do
+    it "should allow '*' origins to allow any origin" do
       preflight_request('http://locohost:3000', '/public')
       last_response.must_render_cors_success
       last_response.headers['Access-Control-Allow-Origin'].must_equal '*'
     end
 
-    it 'should * origin should allow any origin, and set * if no credentials required' do
+    it "should allow '/<path>/' resource if match pattern is /<path>/*" do
+      preflight_request('http://localhost:3000', '/wildcard/')
+      last_response.must_render_cors_success
+      last_response.headers['Access-Control-Allow-Origin'].wont_equal nil
+    end
+
+    it "should allow '/<path>' resource if match pattern is /<path>/*" do
+      preflight_request('http://localhost:3000', '/wildcard')
+      last_response.must_render_cors_success
+      last_response.headers['Access-Control-Allow-Origin'].wont_equal nil
+    end
+
+    it "should allow '*' origin to allow any origin, and set '*' if no credentials required" do
       preflight_request('http://locohost:3000', '/public_without_credentials')
       last_response.must_render_cors_success
       last_response.headers['Access-Control-Allow-Origin'].must_equal '*'

data/test/unit/test.ru

@@ -20,6 +20,7 @@ use Rack::Cors do
     resource '/conditional', :methods => :get, :if => proc { |env| !!env['HTTP_X_OK'] }
     resource '/vary_test', :methods => :get, :vary => %w{ Origin Host }
     resource '/patch_test', :methods => :patch
+    resource '/wildcard/*', :methods => :any
     # resource '/file/at/*',
     #     :methods => [:get, :post, :put, :delete],
     #     :headers => :any,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cors
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.1.1
 platform: ruby
 authors:
 - Calvin Yu
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-14 00:00:00.000000000 Z
+date: 2019-12-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 2.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 2.0.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Middleware for enabling Cross-Origin Resource Sharing in Rack apps