rack 1.4.7 → 1.5.0.beta.1

data/lib/rack/response.rb

@@ -21,8 +21,7 @@ module Rack
 
     def initialize(body=[], status=200, header={})
       @status = status.to_i
-      @header = Utils::HeaderHash.new("Content-Type" => "text/html").
-                                      merge(header)
+      @header = Utils::HeaderHash.new.merge(header)
 
       @chunked = "chunked" == @header['Transfer-Encoding']
       @writer  = lambda { |x| @body << x }

data/lib/rack/sendfile.rb

@@ -89,13 +89,23 @@ module Rack
   #   RequestHeader Set X-Sendfile-Type X-Sendfile
   #   ProxyPassReverse / http://localhost:8001/
   #   XSendFile on
+  #
+  # === Mapping parameter
+  #
+  # The third parameter allows for an overriding extension of the
+  # X-Accel-Mapping header. Mappings should be provided in tuples of internal to
+  # external. The internal values may contain regular expression syntax, they
+  # will be matched with case indifference.
 
   class Sendfile
     F = ::File
 
-    def initialize(app, variation=nil)
+    def initialize(app, variation=nil, mappings=[])
       @app = app
       @variation = variation
+      @mappings = mappings.map do |internal, external|
+        [/^#{internal}/i, external]
+      end
     end
 
     def call(env)
@@ -107,6 +117,7 @@ module Rack
           if url = map_accel_path(env, path)
             headers['Content-Length'] = '0'
             headers[type] = url
+            body.close if body.respond_to?(:close)
             body = []
           else
             env['rack.errors'].puts "X-Accel-Mapping header missing"
@@ -115,6 +126,7 @@ module Rack
           path = F.expand_path(body.to_path)
           headers['Content-Length'] = '0'
           headers[type] = path
+          body.close if body.respond_to?(:close)
           body = []
         when '', nil
         else
@@ -131,10 +143,12 @@ module Rack
         env['HTTP_X_SENDFILE_TYPE']
     end
 
-    def map_accel_path(env, file)
-      if mapping = env['HTTP_X_ACCEL_MAPPING']
+    def map_accel_path(env, path)
+      if mapping = @mappings.find { |internal,_| internal =~ path }
+        path.sub(*mapping)
+      elsif mapping = env['HTTP_X_ACCEL_MAPPING']
         internal, external = mapping.split('=', 2).map{ |p| p.strip }
-        file.sub(/^#{internal}/i, external)
+        path.sub(/^#{internal}/i, external)
       end
     end
   end

data/lib/rack/server.rb

@@ -17,6 +17,10 @@ module Rack
             lineno += 1
           }
 
+          opts.on("-b", "--builder BUILDER_LINE", "evaluate a BUILDER_LINE of code as a builder script") { |line|
+            options[:builder] = line
+          }
+
           opts.on("-d", "--debug", "set debugging flags (set $DEBUG to true)") {
             options[:debug] = true
           }
@@ -36,7 +40,7 @@ module Rack
 
           opts.separator ""
           opts.separator "Rack options:"
-          opts.on("-s", "--server SERVER", "serve using SERVER (webrick/mongrel)") { |s|
+          opts.on("-s", "--server SERVER", "serve using SERVER (thin/puma/webrick/mongrel)") { |s|
             options[:server] = s
           }
 
@@ -192,15 +196,7 @@ module Rack
     end
 
     def app
-      @app ||= begin
-        if !::File.exist? options[:config]
-          abort "configuration #{options[:config]} not found"
-        end
-
-        app, options = Rack::Builder.parse_file(self.options[:config], opt_parser)
-        self.options.merge! options
-        app
-      end
+      @app ||= options[:builder] ? build_app_from_string : build_app_and_options_from_config
     end
 
     def self.logging_middleware
@@ -273,6 +269,20 @@ module Rack
     end
 
     private
+      def build_app_and_options_from_config
+        if !::File.exist? options[:config]
+          abort "configuration #{options[:config]} not found"
+        end
+
+        app, options = Rack::Builder.parse_file(self.options[:config], opt_parser)
+        self.options.merge! options
+        app
+      end
+
+      def build_app_from_string
+        Rack::Builder.new_from_string(self.options[:builder])
+      end
+
       def parse_options(args)
         options = default_options
 
@@ -337,8 +347,6 @@ module Rack
         return :exited unless ::File.exist?(options[:pid])
 
         pid = ::File.read(options[:pid]).to_i
-        return :dead if pid == 0
-
         Process.kill(0, pid)
         :running
       rescue Errno::ESRCH

data/lib/rack/session/abstract/id.rb

@@ -18,85 +18,85 @@ module Rack
       ENV_SESSION_KEY = 'rack.session'.freeze
       ENV_SESSION_OPTIONS_KEY = 'rack.session.options'.freeze
 
-      # Thin wrapper around Hash that allows us to lazily load session id into session_options.
+      # SessionHash is responsible to lazily load the session from store.
+
+      class SessionHash
+        include Enumerable
+        attr_writer :id
 
-      class OptionsHash < Hash #:nodoc:
-        def initialize(by, env, default_options)
-          @by = by
+        def initialize(store, env)
+          @store = store
           @env = env
-          @session_id_loaded = false
-          merge!(default_options)
+          @loaded = false
         end
 
-        def [](key)
-          load_session_id! if key == :id && session_id_not_loaded?
-          super
+        def id
+          return @id if @loaded or instance_variable_defined?(:@id)
+          @id = @store.send(:extract_session_id, @env)
         end
 
-      private
-
-        def session_id_not_loaded?
-          !(@session_id_loaded || key?(:id))
+        def options
+          @env[ENV_SESSION_OPTIONS_KEY]
         end
 
-        def load_session_id!
-          self[:id] = @by.send(:extract_session_id, @env)
-          @session_id_loaded = true
-        end
-      end
-
-      # SessionHash is responsible to lazily load the session from store.
-
-      class SessionHash < Hash
-        def initialize(by, env)
-          super()
-          @by = by
-          @env = env
-          @loaded = false
+        def each(&block)
+          load_for_read!
+          @data.each(&block)
         end
 
         def [](key)
           load_for_read!
-          super(key.to_s)
+          @data[key.to_s]
         end
+        alias :fetch :[]
 
         def has_key?(key)
           load_for_read!
-          super(key.to_s)
+          @data.has_key?(key.to_s)
         end
         alias :key? :has_key?
         alias :include? :has_key?
 
         def []=(key, value)
           load_for_write!
-          super(key.to_s, value)
+          @data[key.to_s] = value
         end
+        alias :store :[]=
 
         def clear
           load_for_write!
-          super
+          @data.clear
+        end
+
+        def destroy
+          clear
+          @id = @store.send(:destroy_session, @env, id, options)
         end
 
         def to_hash
           load_for_read!
-          h = {}.replace(self)
-          h.delete_if { |k,v| v.nil? }
-          h
+          @data.dup
         end
 
         def update(hash)
           load_for_write!
-          super(stringify_keys(hash))
+          @data.update(stringify_keys(hash))
+        end
+        alias :merge! :update
+
+        def replace(hash)
+          load_for_write!
+          @data.replace(stringify_keys(hash))
         end
 
         def delete(key)
           load_for_write!
-          super(key.to_s)
+          @data.delete(key.to_s)
         end
 
         def inspect
           if loaded?
-            super
+            @data.inspect
           else
             "#<#{self.class}:0x#{self.object_id.to_s(16)} not yet loaded>"
           end
@@ -104,7 +104,8 @@ module Rack
 
         def exists?
           return @exists if instance_variable_defined?(:@exists)
-          @exists = @by.send(:session_exists?, @env)
+          @data = {}
+          @exists = @store.send(:session_exists?, @env)
         end
 
         def loaded?
@@ -113,12 +114,7 @@ module Rack
 
         def empty?
           load_for_read!
-          super
-        end
-
-        def merge!(hash)
-          load_for_write!
-          super
+          @data.empty?
         end
 
       private
@@ -132,9 +128,8 @@ module Rack
         end
 
         def load!
-          id, session = @by.send(:load_session, @env)
-          @env[ENV_SESSION_OPTIONS_KEY][:id] = id
-          replace(stringify_keys(session))
+          @id, session = @store.send(:load_session, @env)
+          @data = stringify_keys(session)
           @loaded = true
         end
 
@@ -225,7 +220,7 @@ module Rack
 
         def generate_sid(secure = @sid_secure)
           if secure
-            SecureRandom.hex(@sid_length)
+            secure.hex(@sid_length)
           else
             "%0#{@sid_length}x" % Kernel.rand(2**@sidbits - 1)
           end
@@ -238,8 +233,8 @@ module Rack
 
         def prepare_session(env)
           session_was                  = env[ENV_SESSION_KEY]
-          env[ENV_SESSION_KEY]         = SessionHash.new(self, env)
-          env[ENV_SESSION_OPTIONS_KEY] = OptionsHash.new(self, env, @default_options)
+          env[ENV_SESSION_KEY]         = session_class.new(self, env)
+          env[ENV_SESSION_OPTIONS_KEY] = @default_options.dup
           env[ENV_SESSION_KEY].merge! session_was if session_was
         end
 
@@ -261,10 +256,10 @@ module Rack
           sid
         end
 
-        # Returns the current session id from the OptionsHash.
+        # Returns the current session id from the SessionHash.
 
         def current_session_id(env)
-          env[ENV_SESSION_OPTIONS_KEY][:id]
+          env[ENV_SESSION_KEY].id
         end
 
         # Check if the session exists or not.
@@ -287,7 +282,7 @@ module Rack
         end
 
         def loaded_session?(session)
-          !session.is_a?(SessionHash) || session.loaded?
+          !session.is_a?(session_class) || session.loaded?
         end
 
         def forced_session_update?(session, options)
@@ -310,21 +305,21 @@ module Rack
         # response with the session's id.
 
         def commit_session(env, status, headers, body)
-          session = env['rack.session']
-          options = env['rack.session.options']
+          session = env[ENV_SESSION_KEY]
+          options = session.options
 
           if options[:drop] || options[:renew]
-            session_id = destroy_session(env, options[:id] || generate_sid, options)
+            session_id = destroy_session(env, session.id || generate_sid, options)
             return [status, headers, body] unless session_id
           end
 
           return [status, headers, body] unless commit_session?(env, session, options)
 
           session.send(:load!) unless loaded_session?(session)
-          session = session.to_hash
-          session_id ||= options[:id] || generate_sid
+          session_id ||= session.id
+          session_data = session.to_hash.delete_if { |k,v| v.nil? }
 
-          if not data = set_session(env, session_id, session, options)
+          if not data = set_session(env, session_id, session_data, options)
             env["rack.errors"].puts("Warning! #{self.class.name} failed to save session. Content dropped.")
           elsif options[:defer] and not options[:renew]
             env["rack.errors"].puts("Defering cookie for #{session_id}") if $VERBOSE
@@ -348,6 +343,12 @@ module Rack
           end
         end
 
+        # Allow subclasses to prepare_session for different Session classes
+
+        def session_class
+          SessionHash
+        end
+
         # All thread safety and session retrival proceedures should occur here.
         # Should return [session_id, session].
         # If nil is provided as the session id, generation of a new valid id

data/lib/rack/session/cookie.rb

@@ -61,6 +61,7 @@ module Rack
           end
 
           def decode(str)
+            return unless str
             ::Marshal.load(super(str)) rescue nil
           end
         end
@@ -97,7 +98,7 @@ module Rack
 
       private
 
-      def load_session(env)
+      def get_session(env, sid)
         data = unpacked_cookie_data(env)
         data = persistent_session_id!(data)
         [data["session_id"], data]
@@ -114,14 +115,7 @@ module Rack
 
           if @secrets.size > 0 && session_data
             session_data, digest = session_data.split("--")
-
-            if session_data && digest
-              ok = @secrets.any? do |secret|
-                secret && Rack::Utils.secure_compare(digest, generate_hmac(session_data, secret))
-              end
-            end
-
-            session_data = nil unless ok
+            session_data = nil unless digest_match?(session_data, digest)
           end
 
           coder.decode(session_data) || {}
@@ -134,18 +128,12 @@ module Rack
         data
       end
 
-      # Overwrite set cookie to bypass content equality and always stream the cookie.
-
-      def set_cookie(env, headers, cookie)
-        Utils.set_cookie_header!(headers, @key, cookie)
-      end
-
       def set_session(env, session_id, session, options)
         session = session.merge("session_id" => session_id)
         session_data = coder.encode(session)
 
         if @secrets.first
-          session_data = "#{session_data}--#{generate_hmac(session_data, @secrets.first)}"
+          session_data << "--#{generate_hmac(session_data, @secrets.first)}"
         end
 
         if session_data.size > (4096 - @key.size)
@@ -161,6 +149,13 @@ module Rack
         generate_sid unless options[:drop]
       end
 
+      def digest_match?(data, digest)
+        return unless data && digest
+        @secrets.any? do |secret|
+          digest == generate_hmac(data, secret)
+        end
+      end
+
       def generate_hmac(data, secret)
         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, secret, data)
       end

data/lib/rack/utils.rb

@@ -51,23 +51,12 @@ module Rack
 
     class << self
       attr_accessor :key_space_limit
-      attr_accessor :param_depth_limit
-      attr_accessor :multipart_part_limit
     end
 
     # The default number of bytes to allow parameter keys to take up.
     # This helps prevent a rogue client from flooding a Request.
     self.key_space_limit = 65536
 
-    # Default depth at which the parameter parser will raise an exception for
-    # being too deep.  This helps prevent SystemStackErrors
-    self.param_depth_limit = 100
-    #
-    # The maximum number of parts a request can contain. Accepting to many part
-    # can lead to the server running out of file handles.
-    # Set to `0` for no limit.
-    self.multipart_part_limit = (ENV['RACK_MULTIPART_PART_LIMIT'] || 128).to_i
-
     # Stolen from Mongrel, with some small modifications:
     # Parses a query string by breaking it up at the '&'
     # and ';' characters.  You can also use this to parse
@@ -111,9 +100,7 @@ module Rack
     end
     module_function :parse_nested_query
 
-    def normalize_params(params, name, v = nil, depth = Utils.param_depth_limit)
-      raise RangeError if depth <= 0
-
+    def normalize_params(params, name, v = nil)
       name =~ %r(\A[\[\]]*([^\[\]]+)\]*)
       k = $1 || ''
       after = $' || ''
@@ -131,14 +118,14 @@ module Rack
         params[k] ||= []
         raise TypeError, "expected Array (got #{params[k].class.name}) for param `#{k}'" unless params[k].is_a?(Array)
         if params_hash_type?(params[k].last) && !params[k].last.key?(child_key)
-          normalize_params(params[k].last, child_key, v, depth - 1)
+          normalize_params(params[k].last, child_key, v)
         else
-          params[k] << normalize_params(params.class.new, child_key, v, depth - 1)
+          params[k] << normalize_params(params.class.new, child_key, v)
         end
       else
         params[k] ||= params.class.new
         raise TypeError, "expected Hash (got #{params[k].class.name}) for param `#{k}'" unless params_hash_type?(params[k])
-        params[k] = normalize_params(params[k], after, v, depth - 1)
+        params[k] = normalize_params(params[k], after, v)
       end
 
       return params
@@ -180,6 +167,31 @@ module Rack
     end
     module_function :build_nested_query
 
+    def q_values(q_value_header)
+      q_value_header.to_s.split(/\s*,\s*/).map do |part|
+        value, parameters = part.split(/\s*;\s*/, 2)
+        quality = 1.0
+        if md = /\Aq=([\d.]+)/.match(parameters)
+          quality = md[1].to_f
+        end
+        [value, quality]
+      end
+    end
+    module_function :q_values
+
+    def best_q_match(q_value_header, available_mimes)
+      values = q_values(q_value_header)
+
+      values.map do |req_mime, quality|
+        match = available_mimes.first { |am| Rack::Mime.match?(am, req_mime) }
+        next unless match
+        [match, quality]
+      end.compact.sort_by do |match, quality|
+        (match.split('/', 2).count('*') * -10) + quality
+      end.last.first
+    end
+    module_function :best_q_match
+
     ESCAPE_HTML = {
       "&" => "&amp;",
       "<" => "&lt;",
@@ -237,6 +249,7 @@ module Rack
       when Hash
         domain  = "; domain="  + value[:domain] if value[:domain]
         path    = "; path="    + value[:path]   if value[:path]
+        max_age = "; max-age=" + value[:max_age] if value[:max_age]
         # According to RFC 2109, we need dashes here.
         # N.B.: cgi.rb uses spaces...
         expires = "; expires=" +
@@ -248,7 +261,7 @@ module Rack
       value = [value] unless Array === value
       cookie = escape(key) + "=" +
         value.map { |v| escape v }.join("&") +
-        "#{domain}#{path}#{expires}#{secure}#{httponly}"
+        "#{domain}#{path}#{max_age}#{expires}#{secure}#{httponly}"
 
       case header["Set-Cookie"]
       when nil, ''
@@ -287,6 +300,7 @@ module Rack
 
       set_cookie_header!(header, key,
                  {:value => '', :path => nil, :domain => nil,
+                   :max_age => '0',
                    :expires => Time.at(0) }.merge(value))
 
       nil
@@ -355,18 +369,6 @@ module Rack
     end
     module_function :byte_ranges
 
-    # Constant time string comparison.
-    def secure_compare(a, b)
-      return false unless bytesize(a) == bytesize(b)
-
-      l = a.unpack("C*")
-
-      r, i = 0, -1
-      b.each_byte { |v| r |= v ^ l[i+=1] }
-      r == 0
-    end
-    module_function :secure_compare
-
     # Context allows the use of a compatible middleware at different points
     # in a request handling stack. A compatible middleware must define
     # #context which should take the arguments env and app. The first of which
@@ -498,62 +500,72 @@ module Rack
 
     # Every standard HTTP code mapped to the appropriate message.
     # Generated with:
-    #   curl -s http://www.iana.org/assignments/http-status-codes | \
-    #     ruby -ane 'm = /^(\d{3}) +(\S[^\[(]+)/.match($_) and
-    #                puts "      #{m[1]}  => \x27#{m[2].strip}x27,"'
+    # irb -ropen-uri -rnokogiri
+    # > Nokogiri::XML(open("http://www.iana.org/assignments/http-status-codes/http-status-codes.xml")).css("record").each{|r|
+    #         puts "#{r.css('value').text} => '#{r.css('description').text}'"}
     HTTP_STATUS_CODES = {
-      100  => 'Continue',
-      101  => 'Switching Protocols',
-      102  => 'Processing',
-      200  => 'OK',
-      201  => 'Created',
-      202  => 'Accepted',
-      203  => 'Non-Authoritative Information',
-      204  => 'No Content',
-      205  => 'Reset Content',
-      206  => 'Partial Content',
-      207  => 'Multi-Status',
-      226  => 'IM Used',
-      300  => 'Multiple Choices',
-      301  => 'Moved Permanently',
-      302  => 'Found',
-      303  => 'See Other',
-      304  => 'Not Modified',
-      305  => 'Use Proxy',
-      306  => 'Reserved',
-      307  => 'Temporary Redirect',
-      400  => 'Bad Request',
-      401  => 'Unauthorized',
-      402  => 'Payment Required',
-      403  => 'Forbidden',
-      404  => 'Not Found',
-      405  => 'Method Not Allowed',
-      406  => 'Not Acceptable',
-      407  => 'Proxy Authentication Required',
-      408  => 'Request Timeout',
-      409  => 'Conflict',
-      410  => 'Gone',
-      411  => 'Length Required',
-      412  => 'Precondition Failed',
-      413  => 'Request Entity Too Large',
-      414  => 'Request-URI Too Long',
-      415  => 'Unsupported Media Type',
-      416  => 'Requested Range Not Satisfiable',
-      417  => 'Expectation Failed',
-      418  => "I'm a Teapot",
-      422  => 'Unprocessable Entity',
-      423  => 'Locked',
-      424  => 'Failed Dependency',
-      426  => 'Upgrade Required',
-      500  => 'Internal Server Error',
-      501  => 'Not Implemented',
-      502  => 'Bad Gateway',
-      503  => 'Service Unavailable',
-      504  => 'Gateway Timeout',
-      505  => 'HTTP Version Not Supported',
-      506  => 'Variant Also Negotiates',
-      507  => 'Insufficient Storage',
-      510  => 'Not Extended',
+      100 => 'Continue',
+      101 => 'Switching Protocols',
+      102 => 'Processing',
+      200 => 'OK',
+      201 => 'Created',
+      202 => 'Accepted',
+      203 => 'Non-Authoritative Information',
+      204 => 'No Content',
+      205 => 'Reset Content',
+      206 => 'Partial Content',
+      207 => 'Multi-Status',
+      208 => 'Already Reported',
+      226 => 'IM Used',
+      300 => 'Multiple Choices',
+      301 => 'Moved Permanently',
+      302 => 'Found',
+      303 => 'See Other',
+      304 => 'Not Modified',
+      305 => 'Use Proxy',
+      306 => 'Reserved',
+      307 => 'Temporary Redirect',
+      308 => 'Permanent Redirect',
+      400 => 'Bad Request',
+      401 => 'Unauthorized',
+      402 => 'Payment Required',
+      403 => 'Forbidden',
+      404 => 'Not Found',
+      405 => 'Method Not Allowed',
+      406 => 'Not Acceptable',
+      407 => 'Proxy Authentication Required',
+      408 => 'Request Timeout',
+      409 => 'Conflict',
+      410 => 'Gone',
+      411 => 'Length Required',
+      412 => 'Precondition Failed',
+      413 => 'Request Entity Too Large',
+      414 => 'Request-URI Too Long',
+      415 => 'Unsupported Media Type',
+      416 => 'Requested Range Not Satisfiable',
+      417 => 'Expectation Failed',
+      422 => 'Unprocessable Entity',
+      423 => 'Locked',
+      424 => 'Failed Dependency',
+      425 => 'Reserved for WebDAV advanced collections expired proposal',
+      426 => 'Upgrade Required',
+      427 => 'Unassigned',
+      428 => 'Precondition Required',
+      429 => 'Too Many Requests',
+      430 => 'Unassigned',
+      431 => 'Request Header Fields Too Large',
+      500 => 'Internal Server Error',
+      501 => 'Not Implemented',
+      502 => 'Bad Gateway',
+      503 => 'Service Unavailable',
+      504 => 'Gateway Timeout',
+      505 => 'HTTP Version Not Supported',
+      506 => 'Variant Also Negotiates (Experimental)',
+      507 => 'Insufficient Storage',
+      508 => 'Loop Detected',
+      509 => 'Unassigned',
+      510 => 'Not Extended',
+      511 => 'Network Authentication Required'
     }
 
     # Responses with HTTP status codes that should not have an entity body