rack 1.1.6 → 1.6.9

data/lib/rack/auth/digest/params.rb

@@ -4,11 +4,10 @@ module Rack
       class Params < Hash
 
         def self.parse(str)
-          split_header_value(str).inject(new) do |header, param|
+          Params[*split_header_value(str).map do |param|
             k, v = param.split('=', 2)
-            header[k] = dequote(v)
-            header
-          end
+            [k, dequote(v)]
+          end.flatten]
         end
 
         def self.dequote(str) # From WEBrick::HTTPUtils
@@ -22,7 +21,7 @@ module Rack
         end
 
         def initialize
-          super
+          super()
 
           yield self if block_given?
         end
@@ -35,12 +34,11 @@ module Rack
           super k.to_s, v.to_s
         end
 
-        UNQUOTED = ['qop', 'nc', 'stale']
+        UNQUOTED = ['nc', 'stale']
 
         def to_s
-          inject([]) do |parts, (k, v)|
-            parts << "#{k}=" + (UNQUOTED.include?(k) ? v.to_s : quote(v))
-            parts
+          map do |k, v|
+            "#{k}=" + (UNQUOTED.include?(k) ? v.to_s : quote(v))
           end.join(', ')
         end
 

data/lib/rack/auth/digest/request.rb

@@ -6,17 +6,16 @@ module Rack
   module Auth
     module Digest
       class Request < Auth::AbstractRequest
-
         def method
-          @env['rack.methodoverride.original_method'] || @env['REQUEST_METHOD']
+          @env['rack.methodoverride.original_method'] || @env[REQUEST_METHOD]
         end
 
         def digest?
-          :digest == scheme
+          "digest" == scheme
         end
 
         def correct_uri?
-          (@env['SCRIPT_NAME'].to_s + @env['PATH_INFO'].to_s) == uri
+          request.fullpath == uri
         end
 
         def nonce
@@ -27,13 +26,15 @@ module Rack
           @params ||= Params.parse(parts.last)
         end
 
-        def method_missing(sym)
-          if params.has_key? key = sym.to_s
-            return params[key]
-          end
-          super
+        def respond_to?(sym, *)
+          super or params.has_key? sym.to_s
         end
 
+        def method_missing(sym, *args)
+          return super unless params.has_key?(key = sym.to_s)
+          return params[key] if args.size == 0
+          raise ArgumentError, "wrong number of arguments (#{args.size} for 0)"
+        end
       end
     end
   end

data/lib/rack/backports/uri/common_18.rb

@@ -0,0 +1,56 @@
+# :stopdoc:
+
+# Stolen from ruby core's uri/common.rb, with modifications to support 1.8.x
+#
+# https://github.com/ruby/ruby/blob/trunk/lib/uri/common.rb
+#
+#
+
+module URI
+  TBLENCWWWCOMP_ = {} # :nodoc:
+  256.times do |i|
+    TBLENCWWWCOMP_[i.chr] = '%%%02X' % i
+  end
+  TBLENCWWWCOMP_[' '] = '+'
+  TBLENCWWWCOMP_.freeze
+  TBLDECWWWCOMP_ = {} # :nodoc:
+  256.times do |i|
+    h, l = i>>4, i&15
+    TBLDECWWWCOMP_['%%%X%X' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%x%X' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%X%x' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%x%x' % [h, l]] = i.chr
+  end
+  TBLDECWWWCOMP_['+'] = ' '
+  TBLDECWWWCOMP_.freeze
+
+  # Encode given +s+ to URL-encoded form data.
+  #
+  # This method doesn't convert *, -, ., 0-9, A-Z, _, a-z, but does convert SP
+  # (ASCII space) to + and converts others to %XX.
+  #
+  # This is an implementation of
+  # http://www.w3.org/TR/html5/forms.html#url-encoded-form-data
+  #
+  # See URI.decode_www_form_component, URI.encode_www_form
+  def self.encode_www_form_component(s)
+    str = s.to_s
+    if RUBY_VERSION < "1.9" && $KCODE =~ /u/i
+      str.gsub(/([^ a-zA-Z0-9_.-]+)/) do
+        '%' + $1.unpack('H2' * Rack::Utils.bytesize($1)).join('%').upcase
+      end.tr(' ', '+')
+    else
+      str.gsub(/[^*\-.0-9A-Z_a-z]/) {|m| TBLENCWWWCOMP_[m]}
+    end
+  end
+
+  # Decode given +str+ of URL-encoded form data.
+  #
+  # This decodes + to SP.
+  #
+  # See URI.encode_www_form_component, URI.decode_www_form
+  def self.decode_www_form_component(str, enc=nil)
+    raise ArgumentError, "invalid %-encoding (#{str})" unless /\A(?:%[0-9a-fA-F]{2}|[^%])*\z/ =~ str
+    str.gsub(/\+|%[0-9a-fA-F]{2}/) {|m| TBLDECWWWCOMP_[m]}
+  end
+end

data/lib/rack/backports/uri/common_192.rb

@@ -0,0 +1,52 @@
+# :stopdoc:
+
+# Stolen from ruby core's uri/common.rb @32618ba to fix DoS issues in 1.9.2
+#
+# https://github.com/ruby/ruby/blob/32618ba7438a2247042bba9b5d85b5d49070f5e5/lib/uri/common.rb
+#
+# Issue:
+# http://redmine.ruby-lang.org/issues/5149
+#
+# Relevant Fixes:
+# https://github.com/ruby/ruby/commit/b5f91deee04aa6ccbe07c23c8222b937c22a799b
+# https://github.com/ruby/ruby/commit/93177c1e5c3906abf14472ae0b905d8b5c72ce1b
+#
+# This should probably be removed once there is a Ruby 1.9.2 patch level that
+# includes this fix.
+
+require 'uri/common'
+
+module URI
+  TBLDECWWWCOMP_ = {} unless const_defined?(:TBLDECWWWCOMP_)  #:nodoc:
+  if TBLDECWWWCOMP_.empty?
+    256.times do |i|
+      h, l = i>>4, i&15
+      TBLDECWWWCOMP_['%%%X%X' % [h, l]] = i.chr
+      TBLDECWWWCOMP_['%%%x%X' % [h, l]] = i.chr
+      TBLDECWWWCOMP_['%%%X%x' % [h, l]] = i.chr
+      TBLDECWWWCOMP_['%%%x%x' % [h, l]] = i.chr
+    end
+    TBLDECWWWCOMP_['+'] = ' '
+    TBLDECWWWCOMP_.freeze
+  end
+
+  def self.decode_www_form(str, enc=Encoding::UTF_8)
+    return [] if str.empty?
+    unless /\A#{WFKV_}=#{WFKV_}(?:[;&]#{WFKV_}=#{WFKV_})*\z/o =~ str
+      raise ArgumentError, "invalid data of application/x-www-form-urlencoded (#{str})"
+    end
+    ary = []
+    $&.scan(/([^=;&]+)=([^;&]*)/) do
+      ary << [decode_www_form_component($1, enc), decode_www_form_component($2, enc)]
+    end
+    ary
+  end
+
+  def self.decode_www_form_component(str, enc=Encoding::UTF_8)
+    raise ArgumentError, "invalid %-encoding (#{str})" unless /\A[^%]*(?:%\h\h[^%]*)*\z/ =~ str
+    str.gsub(/\+|%\h\h/, TBLDECWWWCOMP_).force_encoding(enc)
+  end
+
+  remove_const :WFKV_ if const_defined?(:WFKV_)
+  WFKV_ = '(?:[^%#=;&]*(?:%\h\h[^%#=;&]*)*)' # :nodoc:
+end

data/lib/rack/backports/uri/common_193.rb

@@ -0,0 +1,29 @@
+# :stopdoc:
+
+require 'uri/common'
+
+# Issue:
+# http://bugs.ruby-lang.org/issues/5925
+#
+# Relevant commit:
+# https://github.com/ruby/ruby/commit/edb7cdf1eabaff78dfa5ffedfbc2e91b29fa9ca1
+
+module URI
+  256.times do |i|
+    TBLENCWWWCOMP_[i.chr] = '%%%02X' % i
+  end
+  TBLENCWWWCOMP_[' '] = '+'
+  TBLENCWWWCOMP_.freeze
+
+  256.times do |i|
+    h, l = i>>4, i&15
+    TBLDECWWWCOMP_['%%%X%X' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%x%X' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%X%x' % [h, l]] = i.chr
+    TBLDECWWWCOMP_['%%%x%x' % [h, l]] = i.chr
+  end
+  TBLDECWWWCOMP_['+'] = ' '
+  TBLDECWWWCOMP_.freeze
+end
+
+# :startdoc:

data/lib/rack/body_proxy.rb

@@ -0,0 +1,39 @@
+module Rack
+  class BodyProxy
+    def initialize(body, &block)
+      @body, @block, @closed = body, block, false
+    end
+
+    def respond_to?(*args)
+      return false if args.first.to_s =~ /^to_ary$/
+      super or @body.respond_to?(*args)
+    end
+
+    def close
+      return if @closed
+      @closed = true
+      begin
+        @body.close if @body.respond_to? :close
+      ensure
+        @block.call
+      end
+    end
+
+    def closed?
+      @closed
+    end
+
+    # N.B. This method is a special case to address the bug described by #434.
+    # We are applying this special case for #each only. Future bugs of this
+    # class will be handled by requesting users to patch their ruby
+    # implementation, to save adding too many methods in this class.
+    def each(*args, &block)
+      @body.each(*args, &block)
+    end
+
+    def method_missing(*args, &block)
+      super if args.first.to_s =~ /^to_ary$/
+      @body.__send__(*args, &block)
+    end
+  end
+end

data/lib/rack/builder.rb

@@ -4,23 +4,28 @@ module Rack
   #
   # Example:
   #
-  #  app = Rack::Builder.new {
+  #  require 'rack/lobster'
+  #  app = Rack::Builder.new do
   #    use Rack::CommonLogger
   #    use Rack::ShowExceptions
   #    map "/lobster" do
   #      use Rack::Lint
   #      run Rack::Lobster.new
   #    end
-  #  }
+  #  end
+  #
+  #  run app
   #
   # Or
   #
   #  app = Rack::Builder.app do
   #    use Rack::CommonLogger
-  #    lambda { |env| [200, {'Content-Type' => 'text/plain'}, 'OK'] }
+  #    run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['OK']] }
   #  end
   #
-  # +use+ adds a middleware to the stack, +run+ dispatches to an application.
+  #  run app
+  #
+  # +use+ adds middleware to the stack, +run+ dispatches to an application.
   # You can use +map+ to construct a Rack::URLMap in a convenient way.
 
   class Builder
@@ -31,9 +36,8 @@ module Rack
         if cfgfile[/^#\\(.*)/] && opts
           options = opts.parse! $1.split(/\s+/)
         end
-        cfgfile.sub!(/^__END__\n.*/, '')
-        app = eval "Rack::Builder.new {( " + cfgfile + "\n )}.to_app",
-          TOPLEVEL_BINDING, config
+        cfgfile.sub!(/^__END__\n.*\Z/m, '')
+        app = new_from_string cfgfile, config
       else
         require config
         app = Object.const_get(::File.basename(config, '.rb').capitalize)
@@ -41,40 +45,120 @@ module Rack
       return app, options
     end
 
-    def initialize(&block)
-      @ins = []
+    def self.new_from_string(builder_script, file="(rackup)")
+      eval "Rack::Builder.new {\n" + builder_script + "\n}.to_app",
+        TOPLEVEL_BINDING, file, 0
+    end
+
+    def initialize(default_app = nil,&block)
+      @use, @map, @run, @warmup = [], nil, default_app, nil
       instance_eval(&block) if block_given?
     end
 
-    def self.app(&block)
-      self.new(&block).to_app
+    def self.app(default_app = nil, &block)
+      self.new(default_app, &block).to_app
     end
 
+    # Specifies middleware to use in a stack.
+    #
+    #   class Middleware
+    #     def initialize(app)
+    #       @app = app
+    #     end
+    #
+    #     def call(env)
+    #       env["rack.some_header"] = "setting an example"
+    #       @app.call(env)
+    #     end
+    #   end
+    #
+    #   use Middleware
+    #   run lambda { |env| [200, { "Content-Type" => "text/plain" }, ["OK"]] }
+    #
+    # All requests through to this application will first be processed by the middleware class.
+    # The +call+ method in this example sets an additional environment key which then can be
+    # referenced in the application if required.
     def use(middleware, *args, &block)
-      @ins << lambda { |app| middleware.new(app, *args, &block) }
+      if @map
+        mapping, @map = @map, nil
+        @use << proc { |app| generate_map app, mapping }
+      end
+      @use << proc { |app| middleware.new(app, *args, &block) }
     end
 
+    # Takes an argument that is an object that responds to #call and returns a Rack response.
+    # The simplest form of this is a lambda object:
+    #
+    #   run lambda { |env| [200, { "Content-Type" => "text/plain" }, ["OK"]] }
+    #
+    # However this could also be a class:
+    #
+    #   class Heartbeat
+    #     def self.call(env)
+    #      [200, { "Content-Type" => "text/plain" }, ["OK"]]
+    #    end
+    #   end
+    #
+    #   run Heartbeat
     def run(app)
-      @ins << app #lambda { |nothing| app }
+      @run = app
     end
 
+    # Takes a lambda or block that is used to warm-up the application.
+    #
+    #   warmup do |app|
+    #     client = Rack::MockRequest.new(app)
+    #     client.get('/')
+    #   end
+    #
+    #   use SomeMiddleware
+    #   run MyApp
+    def warmup(prc=nil, &block)
+      @warmup = prc || block
+    end
+
+    # Creates a route within the application.
+    #
+    #   Rack::Builder.app do
+    #     map '/' do
+    #       run Heartbeat
+    #     end
+    #   end
+    #
+    # The +use+ method can also be used here to specify middleware to run under a specific path:
+    #
+    #   Rack::Builder.app do
+    #     map '/' do
+    #       use Middleware
+    #       run Heartbeat
+    #     end
+    #   end
+    #
+    # This example includes a piece of middleware which will run before requests hit +Heartbeat+.
+    #
     def map(path, &block)
-      if @ins.last.kind_of? Hash
-        @ins.last[path] = self.class.new(&block).to_app
-      else
-        @ins << {}
-        map(path, &block)
-      end
+      @map ||= {}
+      @map[path] = block
     end
 
     def to_app
-      @ins[-1] = Rack::URLMap.new(@ins.last)  if Hash === @ins.last
-      inner_app = @ins.last
-      @ins[0...-1].reverse.inject(inner_app) { |a, e| e.call(a) }
+      app = @map ? generate_map(@run, @map) : @run
+      fail "missing run or map statement" unless app
+      app = @use.reverse.inject(app) { |a,e| e[a] }
+      @warmup.call(app) if @warmup
+      app
     end
 
     def call(env)
       to_app.call(env)
     end
+
+    private
+
+    def generate_map(default_app, mapping)
+      mapped = default_app ? {'/' => default_app} : {}
+      mapping.each { |r,b| mapped[r] = self.class.new(default_app, &b).to_app }
+      URLMap.new(mapped)
+    end
   end
 end

data/lib/rack/cascade.rb

@@ -1,14 +1,14 @@
 module Rack
-  # Rack::Cascade tries an request on several apps, and returns the
-  # first response that is not 404 (or in a list of configurable
+  # Rack::Cascade tries a request on several apps, and returns the
+  # first response that is not 404 or 405 (or in a list of configurable
   # status codes).
 
   class Cascade
-    NotFound = [404, {}, []]
+    NotFound = [404, {CONTENT_TYPE => "text/plain"}, []]
 
     attr_reader :apps
 
-    def initialize(apps, catch=404)
+    def initialize(apps, catch=[404, 405])
       @apps = []; @has_app = {}
       apps.each { |app| add app }
 
@@ -19,20 +19,31 @@ module Rack
     def call(env)
       result = NotFound
 
+      last_body = nil
+
       @apps.each do |app|
+        # The SPEC says that the body must be closed after it has been iterated
+        # by the server, or if it is replaced by a middleware action. Cascade
+        # replaces the body each time a cascade happens. It is assumed that nil
+        # does not respond to close, otherwise the previous application body
+        # will be closed. The final application body will not be closed, as it
+        # will be passed to the server as a result.
+        last_body.close if last_body.respond_to? :close
+
         result = app.call(env)
+        last_body = result[2]
         break unless @catch.include?(result[0].to_i)
       end
 
       result
     end
 
-    def add app
+    def add(app)
       @has_app[app] = true
       @apps << app
     end
 
-    def include? app
+    def include?(app)
       @has_app.include? app
     end
 

data/lib/rack/chunked.rb

@@ -7,43 +7,63 @@ module Rack
   class Chunked
     include Rack::Utils
 
+    # A body wrapper that emits chunked responses
+    class Body
+      TERM = "\r\n"
+      TAIL = "0#{TERM}#{TERM}"
+
+      include Rack::Utils
+
+      def initialize(body)
+        @body = body
+      end
+
+      def each
+        term = TERM
+        @body.each do |chunk|
+          size = bytesize(chunk)
+          next if size == 0
+
+          chunk = chunk.dup.force_encoding(Encoding::BINARY) if chunk.respond_to?(:force_encoding)
+          yield [size.to_s(16), term, chunk, term].join
+        end
+        yield TAIL
+      end
+
+      def close
+        @body.close if @body.respond_to?(:close)
+      end
+    end
+
     def initialize(app)
       @app = app
     end
 
+    # pre-HTTP/1.0 (informally "HTTP/0.9") HTTP requests did not have
+    # a version (nor response headers)
+    def chunkable_version?(ver)
+      case ver
+      when "HTTP/1.0", nil, "HTTP/0.9"
+        false
+      else
+        true
+      end
+    end
+
     def call(env)
       status, headers, body = @app.call(env)
       headers = HeaderHash.new(headers)
 
-      if env['HTTP_VERSION'] == 'HTTP/1.0' ||
+      if ! chunkable_version?(env['HTTP_VERSION']) ||
          STATUS_WITH_NO_ENTITY_BODY.include?(status) ||
-         headers['Content-Length'] ||
+         headers[CONTENT_LENGTH] ||
          headers['Transfer-Encoding']
         [status, headers, body]
       else
-        dup.chunk(status, headers, body)
-      end
-    end
-
-    def chunk(status, headers, body)
-      @body = body
-      headers.delete('Content-Length')
-      headers['Transfer-Encoding'] = 'chunked'
-      [status, headers, self]
-    end
-
-    def each
-      term = "\r\n"
-      @body.each do |chunk|
-        size = bytesize(chunk)
-        next if size == 0
-        yield [size.to_s(16), term, chunk, term].join
+        headers.delete(CONTENT_LENGTH)
+        headers['Transfer-Encoding'] = 'chunked'
+        [status, headers, Body.new(body)]
       end
-      yield ["0", term, "", term].join
-    end
-
-    def close
-      @body.close if @body.respond_to?(:close)
     end
   end
 end

data/lib/rack/commonlogger.rb

@@ -1,11 +1,26 @@
+require 'rack/body_proxy'
+
 module Rack
-  # Rack::CommonLogger forwards every request to an +app+ given, and
-  # logs a line in the Apache common log format to the +logger+, or
-  # rack.errors by default.
+  # Rack::CommonLogger forwards every request to the given +app+, and
+  # logs a line in the
+  # {Apache common log format}[http://httpd.apache.org/docs/1.3/logs.html#common]
+  # to the +logger+.
+  #
+  # If +logger+ is nil, CommonLogger will fall back +rack.errors+, which is
+  # an instance of Rack::NullLogger.
+  #
+  # +logger+ can be any class, including the standard library Logger, and is
+  # expected to have either +write+ or +<<+ method, which accepts the CommonLogger::FORMAT.
+  # According to the SPEC, the error stream must also respond to +puts+
+  # (which takes a single argument that responds to +to_s+), and +flush+
+  # (which is called without arguments in order to make the error appear for
+  # sure)
   class CommonLogger
     # Common Log Format: http://httpd.apache.org/docs/1.3/logs.html#common
-    # lilith.local - - [07/Aug/2006 23:58:02] "GET / HTTP/1.1" 500 -
-    #             %{%s - %s [%s] "%s %s%s %s" %d %s\n} %
+    #
+    #   lilith.local - - [07/Aug/2006 23:58:02 -0400] "GET / HTTP/1.1" 500 -
+    #
+    #   %{%s - %s [%s] "%s %s%s %s" %d %s\n} %
     FORMAT = %{%s - %s [%s] "%s %s%s %s" %d %s %0.4f\n}
 
     def initialize(app, logger=nil)
@@ -17,7 +32,7 @@ module Rack
       began_at = Time.now
       status, header, body = @app.call(env)
       header = Utils::HeaderHash.new(header)
-      log(env, status, header, began_at)
+      body = BodyProxy.new(body) { log(env, status, header, began_at) }
       [status, header, body]
     end
 
@@ -27,22 +42,30 @@ module Rack
       now = Time.now
       length = extract_content_length(header)
 
-      logger = @logger || env['rack.errors']
-      logger.write FORMAT % [
+      msg = FORMAT % [
         env['HTTP_X_FORWARDED_FOR'] || env["REMOTE_ADDR"] || "-",
         env["REMOTE_USER"] || "-",
-        now.strftime("%d/%b/%Y %H:%M:%S"),
-        env["REQUEST_METHOD"],
-        env["PATH_INFO"],
-        env["QUERY_STRING"].empty? ? "" : "?"+env["QUERY_STRING"],
+        now.strftime("%d/%b/%Y:%H:%M:%S %z"),
+        env[REQUEST_METHOD],
+        env[PATH_INFO],
+        env[QUERY_STRING].empty? ? "" : "?"+env[QUERY_STRING],
         env["HTTP_VERSION"],
         status.to_s[0..3],
         length,
         now - began_at ]
+
+      logger = @logger || env['rack.errors']
+      # Standard library logger doesn't support write but it supports << which actually
+      # calls to write on the log device without formatting
+      if logger.respond_to?(:write)
+        logger.write(msg)
+      else
+        logger << msg
+      end
     end
 
     def extract_content_length(headers)
-      value = headers['Content-Length'] or return '-'
+      value = headers[CONTENT_LENGTH] or return '-'
       value.to_s == '0' ? '-' : value
     end
   end