rack-sanitizer 2.0.3 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63f52a6acb6c9e0d966c5adf830bff54689e56eb8cea9c91a0fe7cc05a6786b4
-  data.tar.gz: 54f2453179ad918e01b70dc949d1c8685e77f74311fb14b1465b76c1a3ce6130
+  metadata.gz: fca030fbcd503f8e7a4f61ebd1286552baf24d3b1a8607af3c02ca12dd9533e0
+  data.tar.gz: 44770acabfcea4af68db609520fd158986c72e5a033151352384a08f16174cda
 SHA512:
-  metadata.gz: f1139b845eea460cdccb33e34acaa750b755a4a55729bc593a54650c0052f1a041e3d20987686abec16b2d2cf492128e0d0d9e9451756c54be97ee70eb07b032
-  data.tar.gz: bfe792b1c548442f0272ac47d975779a4f43b1ba958614bf5df4674f61cc9284e3ba6ed701629b2696aa9fd0b62b2240f3c5e0c8accba1ea8dca543bcd0c6d0e
+  metadata.gz: 0a88c1f9a8f7aa00cf4b7a6c2ad9306f53218d467177bc154efcb12a9cebf7c2bb79a7404dbd0c1a813929b426a5169d714149488e92318ce4b0b0c80067971e
+  data.tar.gz: 0fc65bc666ac425913aa02abb117545e29dc193961e41a91cf4f704be14567f2271e8e028527a3e0872c2d129029500880959a3058d36eedd3150b079fc4d781

data/.github/workflows/ci.yml

@@ -10,15 +10,22 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3", ruby-head, jruby-9.2, jruby-9.3, jruby-head]
+        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4", ruby-head, jruby-9.3, jruby-head]
+        rack: ["2.2", "3.0", "3.1", "3.2"]
+        include:
+          - ruby: "3.4"
+            rubyopt: "--enable-frozen-string-literal --debug-frozen-string-literal"
+
+    env:
+      BUNDLE_GEMFILE: gemfiles/rack_${{ matrix.rack }}.gemfile
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true # 'bundle install' and cache gems
         ruby-version: ${{ matrix.ruby }}
         bundler: latest
-    - name: Run tests
-      run: bundle exec rake
+    - name: Run tests on Rack ${{ matrix.rack }} ${{ matrix.rubyopt }}
+      run: bundle exec rake RUBYOPT="${{ matrix.rubyopt }}"

data/.github/workflows/release.yml

@@ -0,0 +1,24 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  release:
+    permissions:
+      contents: write
+      id-token: write
+
+    environment: release
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+      with:
+        bundler-cache: true
+        ruby-version: 3.4.4
+    - uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1.4.1

data/.gitignore

@@ -1,4 +1,5 @@
 *.gem
+/gemfiles/*.lock
 *.rbc
 .bundle
 .config

data/.rubocop.yml

@@ -0,0 +1,12 @@
+
+inherit_gem:
+  rubocop-shopify: rubocop.yml
+
+AllCops:
+  SuggestExtensions: false
+  TargetRubyVersion: 2.5
+  Exclude:
+    - bin/bacon
+
+Lint/Void:
+  Enabled: false

data/Gemfile

@@ -1,4 +1,10 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 # Specify your gem's dependencies in rack-sanitizer.gemspec
 gemspec
+
+gem 'rubocop-shopify'
+gem 'rake'
+gem 'ostruct'

data/Gemfile.lock

@@ -1,26 +1,57 @@
 PATH
   remote: .
   specs:
-    rack-sanitizer (2.0.3)
+    rack-sanitizer (2.1.0)
       rack (>= 1.0, < 4.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    bacon (1.2.0)
-    bacon-colored_output (1.1.1)
-      bacon
-    rack (3.0.10)
+    ast (2.4.3)
+    json (2.21.2)
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
+    ostruct (0.6.1)
+    parallel (2.1.0)
+    parser (3.3.12.0)
+      ast (~> 2.4.1)
+      racc
+    prism (1.9.0)
+    racc (1.8.1)
+    rack (3.1.21)
+    rainbow (3.1.1)
     rake (13.1.0)
+    regexp_parser (2.12.0)
+    rubocop (1.90.0)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-shopify (3.0.2)
+      lint_roller
+      rubocop (~> 1.72, >= 1.72.1)
+    ruby-progressbar (1.13.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  bacon
-  bacon-colored_output
+  ostruct
   rack-sanitizer!
   rake
+  rubocop-shopify
 
 BUNDLED WITH
    2.5.7

data/LICENSE.txt

@@ -1,3 +1,4 @@
+Copyright (c) 2026 Shopify Inc.
 Copyright (c) 2013 Peter Zotov
 
 MIT License
@@ -19,4 +20,4 @@ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -44,7 +44,7 @@ The generic sanitization algorithm is as follows:
       1. Force the encoding to ASCII8-BIT.
       2. Re-encode it as UTF-8, replacing invalid and undefined characters as U+FFFD.
 
-For fields with "raw data", the algorithm is applied once and the (UTF-8 encoded) result is left in the environment.
+For fields with "raw data", the algorithm is applied once. ASCII-only results remain UTF-8. Results with non-ASCII characters use ASCII-8BIT encoding to satisfy the Rack environment specification.
 
 For fields with "percent-encoded data", the algorithm is applied twice to catch both invalid characters appearing as-is and invalid characters appearing in the percent encoding. The percent encoded, ASCII-8BIT encoded result is left in the environment.
 

data/Rakefile

@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 require "bundler/gem_tasks"
 
-task :default => :spec
+task default: :spec
 
 desc "Run tests"
 task :spec do
-  sh 'bacon -a'
+  sh 'bin/bacon -a'
 end

data/bin/bacon

@@ -0,0 +1,488 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+# -*- ruby -*-
+
+# Bacon -- small RSpec clone.
+#
+# "Truth will sooner come out from error than from confusion." ---Francis Bacon
+
+# Copyright (C) 2007, 2008, 2012 Christian Neukirchen <purl.org/net/chneukirchen>
+#
+# Bacon is freely distributable under the terms of an MIT-style license.
+# See COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+module Bacon
+  VERSION = "1.2"
+
+  Counter = Hash.new(0)
+  ErrorLog = +""
+  Shared = Hash.new { |_, name|
+    raise NameError, "no such context: #{name.inspect}"
+  }
+
+  RestrictName    = //  unless defined? RestrictName
+  RestrictContext = //  unless defined? RestrictContext
+
+  Backtraces = true  unless defined? Backtraces
+
+  def self.summary_on_exit
+    return  if Counter[:installed_summary] > 0
+    @timer = Time.now
+    at_exit {
+      handle_summary
+      if $!
+        raise $!
+      elsif Counter[:errors] + Counter[:failed] > 0
+        exit 1
+      end
+    }
+    Counter[:installed_summary] += 1
+  end
+  class <<self; alias summary_at_exit summary_on_exit; end
+
+  module SpecDoxOutput
+    def handle_specification(name)
+      puts spaces + name
+      yield
+      puts if Counter[:context_depth] == 1
+    end
+
+    def handle_requirement(description)
+      print "#{spaces}  - #{description}"
+      error = yield
+      puts error.empty? ? "" : " [#{error}]"
+    end
+
+    def handle_summary
+      print ErrorLog  if Backtraces
+      puts "%d specifications (%d requirements), %d failures, %d errors" %
+        Counter.values_at(:specifications, :requirements, :failed, :errors)
+    end
+
+    def spaces
+      "  " * (Counter[:context_depth] - 1)
+    end
+  end
+
+  module TestUnitOutput
+    def handle_specification(name)  yield  end
+
+    def handle_requirement(description)
+      error = yield
+      if error.empty?
+        print "."
+      else
+        print error[0..0]
+      end
+    end
+
+    def handle_summary
+      puts "", "Finished in #{Time.now - @timer} seconds."
+      puts ErrorLog  if Backtraces
+      puts "%d tests, %d assertions, %d failures, %d errors" %
+        Counter.values_at(:specifications, :requirements, :failed, :errors)
+    end
+  end
+
+  module TapOutput
+    def handle_specification(name)  yield  end
+
+    def handle_requirement(description)
+      ErrorLog.replace ""
+      error = yield
+      if error.empty?
+        puts "ok %-3d - %s" % [Counter[:specifications], description]
+      else
+        puts "not ok %d - %s: %s" %
+          [Counter[:specifications], description, error]
+        puts ErrorLog.strip.gsub(/^/, '# ')  if Backtraces
+      end
+    end
+
+    def handle_summary
+      puts "1..#{Counter[:specifications]}"
+      puts "# %d tests, %d assertions, %d failures, %d errors" %
+        Counter.values_at(:specifications, :requirements, :failed, :errors)
+    end
+  end
+
+  module KnockOutput
+    def handle_specification(name)  yield  end
+
+    def handle_requirement(description)
+      ErrorLog.replace ""
+      error = yield
+      if error.empty?
+        puts "ok - %s" % [description]
+      else
+        puts "not ok - %s: %s" % [description, error]
+        puts ErrorLog.strip.gsub(/^/, '# ')  if Backtraces
+      end
+    end
+
+    def handle_summary;  end
+  end
+
+  extend SpecDoxOutput          # default
+
+  class Error < RuntimeError
+    attr_accessor :count_as
+
+    def initialize(count_as, message)
+      @count_as = count_as
+      super message
+    end
+  end
+
+  class Context
+    attr_reader :name, :block
+
+    def initialize(name, &block)
+      @name = name
+      @before, @after = [], []
+      @block = block
+    end
+
+    def run
+      return  unless name =~ RestrictContext
+      Counter[:context_depth] += 1
+      Bacon.handle_specification(name) { instance_eval(&block) }
+      Counter[:context_depth] -= 1
+      self
+    end
+
+    def before(&block); @before << block; end
+    def after(&block);  @after << block; end
+
+    def behaves_like(*names)
+      names.each { |name| instance_eval(&Shared[name]) }
+    end
+
+    def it(description, &block)
+      return  unless description =~ RestrictName
+      block ||= lambda { should.flunk "not implemented" }
+      Counter[:specifications] += 1
+      run_requirement description, block
+    end
+
+    def should(*args, &block)
+      if Counter[:depth]==0
+        it('should '+args.first,&block)
+      else
+        super(*args,&block)
+      end
+    end
+
+    def run_requirement(description, spec)
+      Bacon.handle_requirement description do
+        begin
+          Counter[:depth] += 1
+          rescued = false
+          begin
+            @before.each { |block| instance_eval(&block) }
+            prev_req = Counter[:requirements]
+            instance_eval(&spec)
+          rescue Object => e
+            rescued = true
+            raise e
+          ensure
+            if Counter[:requirements] == prev_req and not rescued
+              raise Error.new(:missing,
+                              "empty specification: #{@name} #{description}")
+            end
+            begin
+              @after.each { |block| instance_eval(&block) }
+            rescue Object => e
+              raise e  unless rescued
+            end
+          end
+        rescue Object => e
+          ErrorLog << "#{e.class}: #{e.message}\n"
+          e.backtrace.find_all { |line| line !~ /bin\/bacon|\/bacon\.rb:\d+/ }.
+            each_with_index { |line, i|
+            ErrorLog << "\t#{line}#{i==0 ? ": #@name - #{description}" : ""}\n"
+          }
+          ErrorLog << "\n"
+
+          if e.kind_of? Error
+            Counter[e.count_as] += 1
+            e.count_as.to_s.upcase
+          else
+            Counter[:errors] += 1
+            "ERROR: #{e.class}"
+          end
+        else
+          ""
+        ensure
+          Counter[:depth] -= 1
+        end
+      end
+    end
+
+    def describe(*args, &block)
+      context = Bacon::Context.new(args.join(' '), &block)
+      (parent_context = self).methods(false).each {|e|
+        class<<context; self end.send(:define_method, e) {|*args| parent_context.send(e, *args)}
+      }
+      @before.each { |b| context.before(&b) }
+      @after.each { |b| context.after(&b) }
+      context.run
+    end
+
+    def raise?(*args, &block); block.raise?(*args); end
+    def throw?(*args, &block); block.throw?(*args); end
+    def change?(&block); lambda{}.change?(&block); end
+  end
+
+  module ColoredOutput
+    def handle_requirement(*args)
+      error = yield
+
+      print error.empty? ? color("\e[32m") : color("\e[1;31m")
+      super(*args) { error }
+      print color("\e[0m")
+    end
+
+    def color(escape_seq)
+      if $stdout.respond_to?(:tty?) && $stdout.tty?
+        escape_seq
+      else
+        ""
+      end
+    end
+  end
+
+  extend ColoredOutput
+end
+
+
+class Object
+  def true?; false; end
+  def false?; false; end
+end
+
+class TrueClass
+  def true?; true; end
+end
+
+class FalseClass
+  def false?; true; end
+end
+
+class Proc
+  def raise?(*exceptions)
+    call
+  rescue *(exceptions.empty? ? RuntimeError : exceptions) => e
+    e
+  else
+    false
+  end
+
+  def throw?(sym)
+    catch(sym) {
+      call
+      return false
+    }
+    return true
+  end
+
+  def change?
+    pre_result = yield
+    call
+    post_result = yield
+    pre_result != post_result
+  end
+end
+
+class Numeric
+  def close?(to, delta)
+    (to.to_f - self).abs <= delta.to_f  rescue false
+  end
+end
+
+
+class Object
+  def should(*args, &block)    Should.new(self).be(*args, &block)             end
+end
+
+module Kernel
+  private
+  def describe(*args, &block) Bacon::Context.new(args.join(' '), &block).run  end
+  def shared(name, &block)    Bacon::Shared[name] = block                     end
+end
+
+class Should
+  # Kills ==, ===, =~, eql?, equal?, frozen?, instance_of?, is_a?,
+  # kind_of?, nil?, respond_to?, tainted?
+  instance_methods.each { |name| undef_method name  if name =~ /\?|^\W+$/ }
+
+  def initialize(object)
+    @object = object
+    @negated = false
+  end
+
+  def not(*args, &block)
+    @negated = !@negated
+
+    if args.empty?
+      self
+    else
+      be(*args, &block)
+    end
+  end
+
+  def be(*args, &block)
+    if args.empty?
+      self
+    else
+      block = args.shift  unless block_given?
+      satisfy(*args, &block)
+    end
+  end
+
+  alias a  be
+  alias an be
+
+  def satisfy(description="", &block)
+    r = yield(@object)
+    if Bacon::Counter[:depth] > 0
+      Bacon::Counter[:requirements] += 1
+      raise Bacon::Error.new(:failed, description)  unless @negated ^ r
+      r
+    else
+      @negated ? !r : !!r
+    end
+  end
+
+  def method_missing(name, *args, &block)
+    name = "#{name}?"  if name.to_s =~ /\w[^?]\z/
+
+    desc = @negated ? "not ".dup : "".dup
+    desc << @object.inspect << "." << name.to_s
+    desc << "(" << args.map{|x|x.inspect}.join(", ") << ") failed"
+
+    satisfy(desc) { |x| x.__send__(name, *args, &block) }
+  end
+
+  def equal(value)         self == value      end
+  def match(value)         self =~ value      end
+  def identical_to(value)  self.equal? value  end
+  alias same_as identical_to
+
+  def flunk(reason="Flunked")
+    raise Bacon::Error.new(:failed, reason)
+  end
+end
+
+require 'optparse'
+$LOAD_PATH.unshift File.join(File.dirname(__FILE__), '../lib/')
+module Bacon; end
+
+automatic = false
+output = 'SpecDoxOutput'
+
+opts = OptionParser.new("", 24, '  ') { |opts|
+  opts.banner = "Usage: bacon [options] [files | -a] [-- untouched arguments]"
+
+  opts.separator ""
+  opts.separator "Ruby options:"
+
+  lineno = 1
+  opts.on("-e", "--eval LINE", "evaluate a LINE of code") { |line|
+    eval line, TOPLEVEL_BINDING, "-e", lineno
+    lineno += 1
+  }
+
+  opts.on("-d", "--debug", "set debugging flags (set $DEBUG to true)") {
+    $DEBUG = true
+  }
+  opts.on("-w", "--warn", "turn warnings on for your script") {
+    $-w = true
+  }
+
+  opts.on("-I", "--include PATH",
+          "specify $LOAD_PATH (may be used more than once)") { |path|
+    $LOAD_PATH.unshift(*path.split(":"))
+  }
+
+  opts.on("-r", "--require LIBRARY",
+          "require the library, before executing your script") { |library|
+    require library
+  }
+
+  opts.separator ""
+  opts.separator "bacon options:"
+
+  opts.on("-s", "--specdox", "do AgileDox-like output (default)") {
+    output = 'SpecDoxOutput'
+  }
+  opts.on("-q", "--quiet",   "do Test::Unit-like non-verbose output") {
+    output = 'TestUnitOutput'
+  }
+  opts.on("-p", "--tap",     "do TAP (Test Anything Protocol) output") {
+    output = 'TapOutput'
+  }
+  opts.on("-k", "--knock",   "do Knock output") {
+    output = 'KnockOutput'
+  }
+
+  opts.on("-o", "--output FORMAT",
+          "do FORMAT (SpecDox/TestUnit/Tap) output") { |format|
+    output = format + "Output" 
+  }
+  opts.on("-Q", "--no-backtrace", "don't print backtraces") {
+    Bacon.const_set :Backtraces, false
+  }
+
+  opts.on("-a", "--automatic", "gather tests from ./test/, include ./lib/") {
+    $LOAD_PATH.unshift "lib"  if File.directory? "lib"
+    automatic = true
+  }
+
+  opts.on('-n', '--name NAME', String,
+          "runs tests matching regexp NAME") { |n|
+    Bacon.const_set :RestrictName, Regexp.new(n)
+  }
+  
+  opts.on('-t', '--testcase TESTCASE', String,
+          "runs tests in TestCases matching regexp TESTCASE") { |t|
+    Bacon.const_set :RestrictContext, Regexp.new(t)
+  }
+
+  opts.separator ""
+  opts.separator "Common options:"
+
+  opts.on_tail("-h", "--help", "Show this message") do
+    puts opts
+    exit
+  end
+
+  opts.on_tail("--version", "Show version") do
+    require 'bacon'
+    puts "bacon #{Bacon::VERSION}"
+    exit
+  end
+
+  opts.parse! ARGV
+}
+
+files = ARGV
+
+if automatic
+  files.concat Dir["test/**/test_*.rb"]
+  files.concat Dir["test/**/spec_*.rb"]
+  files.concat Dir["spec/**/spec_*.rb"]
+  files.concat Dir["spec/**/*_spec.rb"]
+end
+
+if files.empty?
+  puts opts.banner
+  exit 1
+end
+
+Bacon.extend Bacon.const_get(output) rescue abort "No such formatter: #{output}"
+Bacon.summary_on_exit
+
+files.each { |file|
+  load file
+}