rack 1.3.10 → 1.4.0

data/lib/rack/mock.rb

@@ -57,6 +57,7 @@ module Rack
     def post(uri, opts={})   request("POST", uri, opts)   end
     def put(uri, opts={})    request("PUT", uri, opts)    end
     def delete(uri, opts={}) request("DELETE", uri, opts) end
+    def head(uri, opts={})   request("HEAD", uri, opts)   end
 
     def request(method="GET", uri="", opts={})
       env = self.class.env_for(uri, opts.merge(:method => method))
@@ -182,7 +183,7 @@ module Rack
     end
 
     def empty?
-      [201, 204, 304].include? status
+      [201, 204, 205, 304].include? status
     end
   end
 end

data/lib/rack/multipart.rb

@@ -12,7 +12,7 @@ module Rack
     MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|n
     TOKEN = /[^\s()<>,;:\\"\/\[\]?=]+/
     CONDISP = /Content-Disposition:\s*#{TOKEN}\s*/i
-    DISPPARM = /;\s*(#{TOKEN})=("(?:\\"|[^"])*"|#{TOKEN})/
+    DISPPARM = /;\s*(#{TOKEN})=("(?:\\"|[^"])*"|#{TOKEN})*/
     RFC2183 = /^#{CONDISP}(#{DISPPARM})+$/i
     BROKEN_QUOTED = /^#{CONDISP}.*;\sfilename="(.*?)"(?:\s*$|\s*;\s*#{TOKEN}=)/i
     BROKEN_UNQUOTED = /^#{CONDISP}.*;\sfilename=(#{TOKEN})/i
@@ -31,4 +31,4 @@ module Rack
     end
 
   end
-end
+end

data/lib/rack/multipart/parser.rb

@@ -78,16 +78,9 @@ module Rack
 
       def fast_forward_to_first_boundary
         loop do
-          content = @io.read(BUFSIZE)
-          raise EOFError, "bad content body" unless content
-          @buf << content
-
-          while @buf.gsub!(/\A([^\n]*\n)/, '')
-            read_buffer = $1
-            return if read_buffer == full_boundary
-          end
-
-          raise EOFError, "bad content body" if Utils.bytesize(@buf) >= BUFSIZE
+          read_buffer = @io.gets
+          break if read_buffer == full_boundary
+          raise EOFError, "bad content body" if read_buffer.nil?
         end
       end
 

data/lib/rack/reloader.rb

@@ -101,7 +101,7 @@ module Rack
         return unless file
         stat = ::File.stat(file)
         return file, stat if stat.file?
-      rescue Errno::ENOENT, Errno::ENOTDIR, Errno::ESRCH
+      rescue Errno::ENOENT, Errno::ENOTDIR
         @cache.delete(file) and false
       end
     end

data/lib/rack/request.rb

@@ -72,6 +72,8 @@ module Rack
         'https'
       elsif @env['HTTP_X_FORWARDED_SSL'] == 'on'
         'https'
+      elsif @env['HTTP_X_FORWARDED_SCHEME']
+        @env['HTTP_X_FORWARDED_SCHEME']
       elsif @env['HTTP_X_FORWARDED_PROTO']
         @env['HTTP_X_FORWARDED_PROTO'].split(',')[0]
       else
@@ -113,15 +115,32 @@ module Rack
     def script_name=(s); @env["SCRIPT_NAME"] = s.to_s             end
     def path_info=(s);   @env["PATH_INFO"] = s.to_s               end
 
+
+    # Checks the HTTP request method (or verb) to see if it was of type DELETE
     def delete?;  request_method == "DELETE"  end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type GET
     def get?;     request_method == "GET"     end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type HEAD
     def head?;    request_method == "HEAD"    end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type OPTIONS
     def options?; request_method == "OPTIONS" end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type PATCH
     def patch?;   request_method == "PATCH"   end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type POST
     def post?;    request_method == "POST"    end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type PUT
     def put?;     request_method == "PUT"     end
+    
+    # Checks the HTTP request method (or verb) to see if it was of type TRACE
     def trace?;   request_method == "TRACE"   end
 
+
     # The set of form-data media-types. Requests that do not indicate
     # one of the media types presents in this list will not be eligible
     # for form-data / param parsing.
@@ -233,8 +252,8 @@ module Rack
       hash   = @env["rack.request.cookie_hash"] ||= {}
       string = @env["HTTP_COOKIE"]
 
-      hash.clear unless string
       return hash if string == @env["rack.request.cookie_string"]
+      hash.clear
 
       # According to RFC 2109:
       #   If multiple cookies satisfy the criteria above, they are ordered in
@@ -245,7 +264,8 @@ module Rack
       @env["rack.request.cookie_string"] = string
       hash
     rescue => error
-      raise error.class, "cannot parse Cookie header: #{error.message}"
+      error.message.replace "cannot parse Cookie header: #{error.message}"
+      raise
     end
 
     def xhr?
@@ -278,23 +298,35 @@ module Rack
     end
 
     def accept_encoding
-      @env["HTTP_ACCEPT_ENCODING"].to_s.split(/,\s*/).map do |part|
-        m = /^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$/.match(part) # From WEBrick
-
-        if m
-          [m[1], (m[2] || 1.0).to_f]
-        else
-          raise "Invalid value for Accept-Encoding: #{part.inspect}"
+      @env["HTTP_ACCEPT_ENCODING"].to_s.split(/\s*,\s*/).map do |part|
+        encoding, parameters = part.split(/\s*;\s*/, 2)
+        quality = 1.0
+        if parameters and /\Aq=([\d.]+)/ =~ parameters
+          quality = $1.to_f
         end
+        [encoding, quality]
       end
     end
 
+    def trusted_proxy?(ip)
+      ip =~ /^127\.0\.0\.1$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\.|^::1$|^fd[0-9a-f]{2}:.+|^localhost$/i
+    end
+
     def ip
-      if addr = @env['HTTP_X_FORWARDED_FOR']
-        (addr.split(',').grep(/\d\./).first || @env['REMOTE_ADDR']).to_s.strip
-      else
-        @env['REMOTE_ADDR']
+      remote_addrs = @env['REMOTE_ADDR'] ? @env['REMOTE_ADDR'].split(/[,\s]+/) : []
+      remote_addrs.reject! { |addr| trusted_proxy?(addr) }
+      
+      return remote_addrs.first if remote_addrs.any?
+
+      forwarded_ips = @env['HTTP_X_FORWARDED_FOR'] ? @env['HTTP_X_FORWARDED_FOR'].strip.split(/[,\s]+/) : []
+
+      if client_ip = @env['HTTP_CLIENT_IP']
+        # If forwarded_ips doesn't include the client_ip, it might be an
+        # ip spoofing attempt, so we ignore HTTP_CLIENT_IP
+        return client_ip if forwarded_ips.include?(client_ip)
       end
+
+      return forwarded_ips.reject { |ip| trusted_proxy?(ip) }.last || @env["REMOTE_ADDR"]
     end
 
     protected

data/lib/rack/response.rb

@@ -19,7 +19,7 @@ module Rack
   class Response
     attr_accessor :length
 
-    def initialize(body=[], status=200, header={}, &block)
+    def initialize(body=[], status=200, header={})
       @status = status.to_i
       @header = Utils::HeaderHash.new("Content-Type" => "text/html").
                                       merge(header)
@@ -71,13 +71,12 @@ module Rack
     def finish(&block)
       @block = block
 
-      if [204, 304].include?(status.to_i)
+      if [204, 205, 304].include?(status.to_i)
         header.delete "Content-Type"
         header.delete "Content-Length"
-        close
         [status.to_i, header, []]
       else
-        [status.to_i, header, BodyProxy.new(self){}]
+        [status.to_i, header, self]
       end
     end
     alias to_a finish           # For *response
@@ -113,19 +112,21 @@ module Rack
     alias headers header
 
     module Helpers
-      def invalid?;       @status < 100 || @status >= 600;       end
+      def invalid?;       status < 100 || status >= 600;        end
 
-      def informational?; @status >= 100 && @status < 200;       end
-      def successful?;    @status >= 200 && @status < 300;       end
-      def redirection?;   @status >= 300 && @status < 400;       end
-      def client_error?;  @status >= 400 && @status < 500;       end
-      def server_error?;  @status >= 500 && @status < 600;       end
+      def informational?; status >= 100 && status < 200;        end
+      def successful?;    status >= 200 && status < 300;        end
+      def redirection?;   status >= 300 && status < 400;        end
+      def client_error?;  status >= 400 && status < 500;        end
+      def server_error?;  status >= 500 && status < 600;        end
 
-      def ok?;            @status == 200;                        end
-      def forbidden?;     @status == 403;                        end
-      def not_found?;     @status == 404;                        end
+      def ok?;            status == 200;                        end
+      def bad_request?;   status == 400;                        end
+      def forbidden?;     status == 403;                        end
+      def not_found?;     status == 404;                        end
+      def unprocessable?; status == 422;                        end
 
-      def redirect?;      [301, 302, 303, 307].include? @status; end
+      def redirect?;      [301, 302, 303, 307].include? status; end
 
       # Headers
       attr_reader :headers, :original_headers

data/lib/rack/sendfile.rb

@@ -46,10 +46,11 @@ module Rack
   #     proxy_pass         http://127.0.0.1:8080/;
   #   }
   #
-  # Note that the X-Sendfile-Type header must be set exactly as shown above. The
-  # X-Accel-Mapping header should specify the internal URI path, followed by an
-  # equals sign (=), followed name of the location in the file system that it maps
-  # to. The middleware performs a simple substitution on the resulting path.
+  # Note that the X-Sendfile-Type header must be set exactly as shown above.
+  # The X-Accel-Mapping header should specify the location on the file system,
+  # followed by an equals sign (=), followed name of the private URL pattern
+  # that it maps to. The middleware performs a simple substitution on the
+  # resulting path.
   #
   # See Also: http://wiki.codemongers.com/NginxXSendfile
   #
@@ -104,10 +105,11 @@ module Rack
         when 'X-Accel-Redirect'
           path = F.expand_path(body.to_path)
           if url = map_accel_path(env, path)
+            headers['Content-Length'] = '0'
             headers[type] = url
             body = []
           else
-            env['rack.errors'] << "X-Accel-Mapping header missing"
+            env['rack.errors'].puts "X-Accel-Mapping header missing"
           end
         when 'X-Sendfile', 'X-Lighttpd-Send-File'
           path = F.expand_path(body.to_path)
@@ -116,7 +118,7 @@ module Rack
           body = []
         when '', nil
         else
-          env['rack.errors'] << "Unknown x-sendfile variation: '#{variation}'.\n"
+          env['rack.errors'].puts "Unknown x-sendfile variation: '#{variation}'.\n"
         end
       end
       [status, headers, body]

data/lib/rack/server.rb

@@ -26,7 +26,7 @@ module Rack
 
           opts.on("-I", "--include PATH",
                   "specify $LOAD_PATH (may be used more than once)") { |path|
-            (options[:include] ||= []).concat(path.split(":"))
+            options[:include] = path.split(":")
           }
 
           opts.on("-r", "--require LIBRARY",
@@ -226,7 +226,7 @@ module Rack
       self.class.middleware
     end
 
-    def start
+    def start &blk
       if options[:warn]
         $-w = true
       end
@@ -247,14 +247,11 @@ module Rack
         pp app
       end
 
-      check_pid! if options[:pid]
-
       # Touch the wrapped app, so that the config.ru is loaded before
       # daemonization (i.e. before chdir, etc).
       wrapped_app
 
       daemonize_app if options[:daemonize]
-
       write_pid if options[:pid]
 
       trap(:INT) do
@@ -265,7 +262,7 @@ module Rack
         end
       end
 
-      server.run wrapped_app, options
+      server.run wrapped_app, options, &blk
     end
 
     def server
@@ -277,7 +274,7 @@ module Rack
         options = default_options
 
         # Don't evaluate CGI ISINDEX parameters.
-        # http://www.meb.uni-bonn.de/docs/cgi/cl.html
+        # http://hoohoo.ncsa.uiuc.edu/cgi/cl.html
         args.clear if ENV.include?("REQUEST_METHOD")
 
         options.merge! opt_parser.parse!(args)
@@ -322,28 +319,5 @@ module Rack
         ::File.open(options[:pid], 'w'){ |f| f.write("#{Process.pid}") }
         at_exit { ::File.delete(options[:pid]) if ::File.exist?(options[:pid]) }
       end
-
-      def check_pid!
-        case pidfile_process_status
-        when :running, :not_owned
-          $stderr.puts "A server is already running. Check #{options[:pid]}."
-          exit(1)
-        when :dead
-          ::File.delete(options[:pid])
-        end
-      end
-
-      def pidfile_process_status
-        return :exited unless ::File.exist?(options[:pid])
-
-        pid = ::File.read(options[:pid]).to_i
-        Process.kill(0, pid)
-        :running
-      rescue Errno::ESRCH
-        :dead
-      rescue Errno::EPERM
-        :not_owned
-      end
-
   end
 end

data/lib/rack/session/abstract/id.rb

@@ -95,8 +95,11 @@ module Rack
         end
 
         def inspect
-          load_for_read!
-          super
+          if loaded?
+            super
+          else
+            "#<#{self.class}:0x#{self.object_id.to_s(16)} not yet loaded>"
+          end
         end
 
         def exists?
@@ -108,6 +111,11 @@ module Rack
           @loaded
         end
 
+        def empty?
+          load_for_read!
+          super
+        end
+
       private
 
         def load_for_read!
@@ -144,7 +152,9 @@ module Rack
       #   'rack.session'
       # * :path, :domain, :expire_after, :secure, and :httponly set the related
       #   cookie options as by Rack::Response#add_cookie
-      # * :defer will not set a cookie in the response.
+      # * :skip will not a set a cookie in the response nor update the session state
+      # * :defer will not set a cookie in the response but still update the session
+      #   state if it is used with a backend
       # * :renew (implementation dependent) will prompt the generation of a new
       #   session id, and migration of data to be referenced at the new id. If
       #   :defer is set, it will be overridden and the cookie will be set.
@@ -260,21 +270,30 @@ module Rack
         end
 
         # Session should be commited if it was loaded, any of specific options like :renew, :drop
-        # or :expire_after was given and the security permissions match.
+        # or :expire_after was given and the security permissions match. Skips if skip is given.
 
         def commit_session?(env, session, options)
-          (loaded_session?(session) || force_options?(options)) && secure_session?(env, options)
+          if options[:skip]
+            false
+          else
+            has_session = loaded_session?(session) || forced_session_update?(session, options)
+            has_session && security_matches?(env, options)
+          end
         end
 
         def loaded_session?(session)
           !session.is_a?(SessionHash) || session.loaded?
         end
 
+        def forced_session_update?(session, options)
+          force_options?(options) && session && !session.empty?
+        end
+
         def force_options?(options)
           options.values_at(:renew, :drop, :defer, :expire_after).any?
         end
 
-        def secure_session?(env, options)
+        def security_matches?(env, options)
           return true unless options[:secure]
           request = Rack::Request.new(env)
           request.ssl?

data/lib/rack/session/cookie.rb

@@ -14,6 +14,7 @@ module Rack
     # Both methods must take a string and return a string.
     #
     # When the secret key is set, cookie data is checked for data integrity.
+    # The old secret key is also accepted and allows graceful secret rotation.
     #
     # Example:
     #
@@ -21,14 +22,15 @@ module Rack
     #                                :domain => 'foo.com',
     #                                :path => '/',
     #                                :expire_after => 2592000,
-    #                                :secret => 'change_me'
+    #                                :secret => 'change_me',
+    #                                :old_secret => 'also_change_me'
     #
     #     All parameters are optional.
     #
     # Example of a cookie with no encoding:
     #
     #   Rack::Session::Cookie.new(application, {
-    #     :coder => Racke::Session::Cookie::Identity.new
+    #     :coder => Rack::Session::Cookie::Identity.new
     #   })
     #
     # Example of a cookie with custom encoding:
@@ -80,15 +82,7 @@ module Rack
 
       def initialize(app, options={})
         @secret = options[:secret]
-        warn <<-MSG unless @secret
-        SECURITY WARNING: No secret option provided to Rack::Session::Cookie.
-        This poses a security threat. It is strongly recommended that you
-        provide a secret to prevent exploits that may be possible from crafted
-        cookies. This will not be supported in future versions of Rack, and
-        future versions will even invalidate your existing user cookies.
-
-        Called from: #{caller[0]}.
-        MSG
+        @old_secret = options[:old_secret]
         @coder  = options[:coder] ||= Base64::Marshal.new
         super(app, options.merge!(:cookie_only => true))
       end
@@ -110,9 +104,11 @@ module Rack
           request = Rack::Request.new(env)
           session_data = request.cookies[@key]
 
-          if @secret && session_data
+          if (@secret || @old_secret) && session_data
             session_data, digest = session_data.split("--")
-            session_data = nil  unless Rack::Utils.secure_compare(digest, generate_hmac(session_data))
+            if (digest != generate_hmac(session_data, @secret)) && (digest != generate_hmac(session_data, @old_secret))
+              session_data = nil
+            end
           end
 
           coder.decode(session_data) || {}
@@ -136,7 +132,7 @@ module Rack
         session_data = coder.encode(session)
 
         if @secret
-          session_data = "#{session_data}--#{generate_hmac(session_data)}"
+          session_data = "#{session_data}--#{generate_hmac(session_data, @secret)}"
         end
 
         if session_data.size > (4096 - @key.size)
@@ -152,8 +148,8 @@ module Rack
         generate_sid unless options[:drop]
       end
 
-      def generate_hmac(data)
-        OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, @secret, data)
+      def generate_hmac(data, secret)
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, secret, data)
       end
 
     end