rack 2.1.3 → 2.2.1

data/lib/rack/rewindable_input.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require 'tempfile'
-require 'rack/utils'
 
 module Rack
   # Class which can make any IO object rewindable, including non-rewindable ones. It does

data/lib/rack/runtime.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'rack/utils'
-
 module Rack
   # Sets an "X-Runtime" response header, indicating the response
   # time of the request, in seconds
@@ -22,9 +20,11 @@ module Rack
     def call(env)
       start_time = Utils.clock_time
       status, headers, body = @app.call(env)
+      headers = Utils::HeaderHash[headers]
+
       request_time = Utils.clock_time - start_time
 
-      unless headers.has_key?(@header_name)
+      unless headers.key?(@header_name)
         headers[@header_name] = FORMAT_STRING % request_time
       end
 

data/lib/rack/sendfile.rb

@@ -1,8 +1,5 @@
 # frozen_string_literal: true
 
-require 'rack/files'
-require 'rack/body_proxy'
-
 module Rack
 
   # = Sendfile

data/lib/rack/server.rb

@@ -3,12 +3,10 @@
 require 'optparse'
 require 'fileutils'
 
-require_relative 'core_ext/regexp'
-
 module Rack
 
   class Server
-    using ::Rack::RegexpExtensions
+    (require_relative 'core_ext/regexp'; using ::Rack::RegexpExtensions) if RUBY_VERSION < '2.4'
 
     class Options
       def parse!(args)
@@ -42,7 +40,7 @@ module Rack
 
           opts.on("-r", "--require LIBRARY",
                   "require the library, before executing your script") { |library|
-            options[:require] = library
+            (options[:require] ||= []) << library
           }
 
           opts.separator ""
@@ -143,7 +141,7 @@ module Rack
             return "" if !has_options
           end
           info.join("\n")
-        rescue NameError
+        rescue NameError, LoadError
           return "Warning: Could not find handler specified (#{options[:server] || 'default'}) to determine handler-specific options"
         end
       end
@@ -285,7 +283,7 @@ module Rack
       self.class.middleware
     end
 
-    def start &blk
+    def start(&block)
       if options[:warn]
         $-w = true
       end
@@ -294,7 +292,7 @@ module Rack
         $LOAD_PATH.unshift(*includes)
       end
 
-      if library = options[:require]
+      Array(options[:require]).each do |library|
         require library
       end
 
@@ -326,7 +324,7 @@ module Rack
         end
       end
 
-      server.run wrapped_app, options, &blk
+      server.run(wrapped_app, **options, &block)
     end
 
     def server
@@ -425,7 +423,10 @@ module Rack
       end
 
       def daemonize_app
+        # Cannot be covered as it forks
+        # :nocov:
         Process.daemon
+        # :nocov:
       end
 
       def write_pid

data/lib/rack/session/abstract/id.rb

@@ -3,10 +3,8 @@
 # AUTHOR: blink <blinketje@gmail.com>; blink#ruby-lang@irc.freenode.net
 # bugrep: Andreas Zehnder
 
-require 'rack'
+require_relative '../../../rack'
 require 'time'
-require 'rack/request'
-require 'rack/response'
 require 'securerandom'
 require 'digest/sha2'
 
@@ -44,18 +42,6 @@ module Rack
       # SessionHash is responsible to lazily load the session from store.
 
       class SessionHash
-        using Module.new {
-          refine Hash do
-            def transform_keys(&block)
-              hash = {}
-              each do |key, value|
-                hash[block.call(key)] = value
-              end
-              hash
-            end
-          end
-        } unless {}.respond_to?(:transform_keys)
-
         include Enumerable
         attr_writer :id
 
@@ -98,6 +84,11 @@ module Rack
           @data[key.to_s]
         end
 
+        def dig(key, *keys)
+          load_for_read!
+          @data.dig(key.to_s, *keys)
+        end
+
         def fetch(key, default = Unspecified, &block)
           load_for_read!
           if default == Unspecified
@@ -201,14 +192,19 @@ module Rack
         end
 
         def stringify_keys(other)
-          other.to_hash.transform_keys(&:to_s)
+          # Use transform_keys after dropping Ruby 2.4 support
+          hash = {}
+          other.to_hash.each do |key, value|
+            hash[key.to_s] = value
+          end
+          hash
         end
       end
 
       # ID sets up a basic framework for implementing an id based sessioning
       # service. Cookies sent to the client for maintaining sessions will only
-      # contain an id reference. Only #find_session and #write_session are
-      # required to be overwritten.
+      # contain an id reference. Only #find_session, #write_session and
+      # #delete_session are required to be overwritten.
       #
       # All parameters are optional.
       # * :key determines the name of the cookie, by default it is
@@ -397,6 +393,12 @@ module Rack
             cookie[:value] = cookie_value(data)
             cookie[:expires] = Time.now + options[:expire_after] if options[:expire_after]
             cookie[:expires] = Time.now + options[:max_age] if options[:max_age]
+
+            if @same_site.respond_to? :call
+              cookie[:same_site] = @same_site.call(req, res)
+            else
+              cookie[:same_site] = @same_site
+            end
             set_cookie(req, res, cookie.merge!(options))
           end
         end

data/lib/rack/session/cookie.rb

@@ -2,9 +2,7 @@
 
 require 'openssl'
 require 'zlib'
-require 'rack/request'
-require 'rack/response'
-require 'rack/session/abstract/id'
+require_relative 'abstract/id'
 require 'json'
 require 'base64'
 
@@ -120,6 +118,7 @@ module Rack
         Called from: #{caller[0]}.
         MSG
         @coder = options[:coder] ||= Base64::Marshal.new
+        @same_site = options.delete :same_site
         super(app, options.merge!(cookie_only: true))
       end
 

data/lib/rack/session/pool.rb

@@ -5,7 +5,7 @@
 #   apeiros, for session id generation, expiry setup, and threadiness
 #   sergio, threadiness and bugreps
 
-require 'rack/session/abstract/id'
+require_relative 'abstract/id'
 require 'thread'
 
 module Rack

data/lib/rack/show_exceptions.rb

@@ -2,8 +2,6 @@
 
 require 'ostruct'
 require 'erb'
-require 'rack/request'
-require 'rack/utils'
 
 module Rack
   # Rack::ShowExceptions catches all exceptions raised from the app it
@@ -313,7 +311,7 @@ module Rack
         <% end %>
 
         <h3 id="post-info">POST</h3>
-        <% if req.POST and not req.POST.empty? %>
+        <% if ((req.POST and not req.POST.empty?) rescue (no_post_data = "Invalid POST data"; nil)) %>
           <table class="req">
             <thead>
               <tr>
@@ -331,7 +329,7 @@ module Rack
             </tbody>
           </table>
         <% else %>
-          <p>No POST data.</p>
+          <p><%= no_post_data || "No POST data" %>.</p>
         <% end %>
 
 

data/lib/rack/show_status.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require 'erb'
-require 'rack/request'
-require 'rack/utils'
 
 module Rack
   # Rack::ShowStatus catches all empty responses and replaces them
@@ -20,7 +18,7 @@ module Rack
 
     def call(env)
       status, headers, body = @app.call(env)
-      headers = Utils::HeaderHash.new(headers)
+      headers = Utils::HeaderHash[headers]
       empty = headers[CONTENT_LENGTH].to_i <= 0
 
       # client or server error, or explicit message

data/lib/rack/static.rb

@@ -1,10 +1,5 @@
 # frozen_string_literal: true
 
-require "rack/files"
-require "rack/utils"
-
-require_relative 'core_ext/regexp'
-
 module Rack
 
   # The Rack::Static middleware intercepts requests for static files
@@ -19,6 +14,11 @@ module Rack
   #
   #     use Rack::Static, :urls => ["/media"]
   #
+  # Same as previous, but instead of returning 404 for missing files under
+  # /media, call the next middleware:
+  #
+  #     use Rack::Static, :urls => ["/media"], :cascade => true
+  #
   # Serve all requests beginning with /css or /images from the folder "public"
   # in the current directory (ie public/css/* and public/images/*):
   #
@@ -86,13 +86,14 @@ module Rack
   #         ]
   #
   class Static
-    using ::Rack::RegexpExtensions
+    (require_relative 'core_ext/regexp'; using ::Rack::RegexpExtensions) if RUBY_VERSION < '2.4'
 
     def initialize(app, options = {})
       @app = app
       @urls = options[:urls] || ["/favicon.ico"]
       @index = options[:index]
       @gzip = options[:gzip]
+      @cascade = options[:cascade]
       root = options[:root] || Dir.pwd
 
       # HTTP Headers
@@ -133,6 +134,8 @@ module Rack
 
           if response[0] == 404
             response = nil
+          elsif response[0] == 304
+            # Do nothing, leave headers as is
           else
             if mime_type = Mime.mime_type(::File.extname(path), 'text/plain')
               response[1][CONTENT_TYPE] = mime_type
@@ -144,6 +147,10 @@ module Rack
         path = env[PATH_INFO]
         response ||= @file_server.call(env)
 
+        if @cascade && response[0] == 404
+          return @app.call(env)
+        end
+
         headers = response[1]
         applicable_rules(path).each do |rule, new_headers|
           new_headers.each { |field, content| headers[field] = content }

data/lib/rack/tempfile_reaper.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'rack/body_proxy'
-
 module Rack
 
   # Middleware tracks and cleans Tempfiles created throughout a request (i.e. Rack::Multipart)

data/lib/rack/urlmap.rb

@@ -16,9 +16,6 @@ module Rack
   # first, since they are most specific.
 
   class URLMap
-    NEGATIVE_INFINITY = -1.0 / 0.0
-    INFINITY = 1.0 / 0.0
-
     def initialize(map = {})
       remap(map)
     end
@@ -42,7 +39,7 @@ module Rack
 
         [host, location, match, app]
       }.sort_by do |(host, location, _, _)|
-        [host ? -host.size : INFINITY, -location.size]
+        [host ? -host.size : Float::INFINITY, -location.size]
       end
     end
 

data/lib/rack/utils.rb

@@ -5,17 +5,16 @@ require 'uri'
 require 'fileutils'
 require 'set'
 require 'tempfile'
-require 'rack/query_parser'
 require 'time'
 
-require_relative 'core_ext/regexp'
+require_relative 'query_parser'
 
 module Rack
   # Rack::Utils contains a grab-bag of useful methods for writing web
   # applications adopted from all kinds of Ruby libraries.
 
   module Utils
-    using ::Rack::RegexpExtensions
+    (require_relative 'core_ext/regexp'; using ::Rack::RegexpExtensions) if RUBY_VERSION < '2.4'
 
     ParameterTypeError = QueryParser::ParameterTypeError
     InvalidParameterError = QueryParser::InvalidParameterError
@@ -30,33 +29,30 @@ module Rack
     # This helps prevent a rogue client from flooding a Request.
     self.default_query_parser = QueryParser.make_default(65536, 100)
 
+    module_function
+
     # URI escapes. (CGI style space to +)
     def escape(s)
       URI.encode_www_form_component(s)
     end
-    module_function :escape
 
     # Like URI escaping, but with %20 instead of +. Strictly speaking this is
     # true URI escaping.
     def escape_path(s)
       ::URI::DEFAULT_PARSER.escape s
     end
-    module_function :escape_path
 
     # Unescapes the **path** component of a URI.  See Rack::Utils.unescape for
     # unescaping query parameters or form components.
     def unescape_path(s)
       ::URI::DEFAULT_PARSER.unescape s
     end
-    module_function :unescape_path
-
 
     # Unescapes a URI escaped string with +encoding+. +encoding+ will be the
     # target encoding of the string returned, and it defaults to UTF-8
     def unescape(s, encoding = Encoding::UTF_8)
       URI.decode_www_form_component(s, encoding)
     end
-    module_function :unescape
 
     class << self
       attr_accessor :multipart_part_limit
@@ -88,21 +84,20 @@ module Rack
         Process.clock_gettime(Process::CLOCK_MONOTONIC)
       end
     else
+      # :nocov:
       def clock_time
         Time.now.to_f
       end
+      # :nocov:
     end
-    module_function :clock_time
 
     def parse_query(qs, d = nil, &unescaper)
       Rack::Utils.default_query_parser.parse_query(qs, d, &unescaper)
     end
-    module_function :parse_query
 
     def parse_nested_query(qs, d = nil)
       Rack::Utils.default_query_parser.parse_nested_query(qs, d)
     end
-    module_function :parse_nested_query
 
     def build_query(params)
       params.map { |k, v|
@@ -113,7 +108,6 @@ module Rack
         end
       }.join("&")
     end
-    module_function :build_query
 
     def build_nested_query(value, prefix = nil)
       case value
@@ -132,7 +126,6 @@ module Rack
         "#{prefix}=#{escape(value)}"
       end
     end
-    module_function :build_nested_query
 
     def q_values(q_value_header)
       q_value_header.to_s.split(/\s*,\s*/).map do |part|
@@ -144,8 +137,11 @@ module Rack
         [value, quality]
       end
     end
-    module_function :q_values
 
+    # Return best accept value to use, based on the algorithm
+    # in RFC 2616 Section 14.  If there are multiple best
+    # matches (same specificity and quality), the value returned
+    # is arbitrary.
     def best_q_match(q_value_header, available_mimes)
       values = q_values(q_value_header)
 
@@ -158,7 +154,6 @@ module Rack
       end.last
       matches && matches.first
     end
-    module_function :best_q_match
 
     ESCAPE_HTML = {
       "&" => "&amp;",
@@ -175,22 +170,27 @@ module Rack
     def escape_html(string)
       string.to_s.gsub(ESCAPE_HTML_PATTERN){|c| ESCAPE_HTML[c] }
     end
-    module_function :escape_html
 
     def select_best_encoding(available_encodings, accept_encoding)
       # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
 
-      expanded_accept_encoding =
-        accept_encoding.each_with_object([]) do |(m, q), list|
-          if m == "*"
-            (available_encodings - accept_encoding.map(&:first))
-              .each { |m2| list << [m2, q] }
-          else
-            list << [m, q]
+      expanded_accept_encoding = []
+
+      accept_encoding.each do |m, q|
+        preference = available_encodings.index(m) || available_encodings.size
+
+        if m == "*"
+          (available_encodings - accept_encoding.map(&:first)).each do |m2|
+            expanded_accept_encoding << [m2, q, preference]
           end
+        else
+          expanded_accept_encoding << [m, q, preference]
         end
+      end
 
-      encoding_candidates = expanded_accept_encoding.sort_by { |_, q| -q }.map!(&:first)
+      encoding_candidates = expanded_accept_encoding
+        .sort_by { |_, q, p| [-q, p] }
+        .map!(&:first)
 
       unless encoding_candidates.include?("identity")
         encoding_candidates.push("identity")
@@ -202,23 +202,19 @@ module Rack
 
       (encoding_candidates & available_encodings)[0]
     end
-    module_function :select_best_encoding
 
     def parse_cookies(env)
       parse_cookies_header env[HTTP_COOKIE]
     end
-    module_function :parse_cookies
 
     def parse_cookies_header(header)
-      # According to RFC 2109:
-      #   If multiple cookies satisfy the criteria above, they are ordered in
-      #   the Cookie header such that those with more specific Path attributes
-      #   precede those with less specific.  Ordering with respect to other
-      #   attributes (e.g., Domain) is unspecified.
-      cookies = parse_query(header, ';,') { |s| unescape(s) rescue s }
+      # According to RFC 6265:
+      # The syntax for cookie headers only supports semicolons
+      # User Agent -> Server ==
+      # Cookie: SID=31d4d96e407aad42; lang=en-US
+      cookies = parse_query(header, ';') { |s| unescape(s) rescue s }
       cookies.each_with_object({}) { |(k, v), hash| hash[k] = Array === v ? v.first : v }
     end
-    module_function :parse_cookies_header
 
     def add_cookie_to_header(header, key, value)
       case value
@@ -260,13 +256,11 @@ module Rack
         raise ArgumentError, "Unrecognized cookie header value. Expected String, Array, or nil, got #{header.inspect}"
       end
     end
-    module_function :add_cookie_to_header
 
     def set_cookie_header!(header, key, value)
       header[SET_COOKIE] = add_cookie_to_header(header[SET_COOKIE], key, value)
       nil
     end
-    module_function :set_cookie_header!
 
     def make_delete_cookie_header(header, key, value)
       case header
@@ -278,25 +272,30 @@ module Rack
         cookies = header
       end
 
-      regexp = if value[:domain]
-                 /\A#{escape(key)}=.*domain=#{value[:domain]}/
-               elsif value[:path]
-                 /\A#{escape(key)}=.*path=#{value[:path]}/
+      key = escape(key)
+      domain = value[:domain]
+      path = value[:path]
+      regexp = if domain
+                 if path
+                   /\A#{key}=.*(?:domain=#{domain}(?:;|$).*path=#{path}(?:;|$)|path=#{path}(?:;|$).*domain=#{domain}(?:;|$))/
+                 else
+                   /\A#{key}=.*domain=#{domain}(?:;|$)/
+                 end
+               elsif path
+                 /\A#{key}=.*path=#{path}(?:;|$)/
                else
-                 /\A#{escape(key)}=/
+                 /\A#{key}=/
                end
 
       cookies.reject! { |cookie| regexp.match? cookie }
 
       cookies.join("\n")
     end
-    module_function :make_delete_cookie_header
 
     def delete_cookie_header!(header, key, value = {})
       header[SET_COOKIE] = add_remove_cookie_to_header(header[SET_COOKIE], key, value)
       nil
     end
-    module_function :delete_cookie_header!
 
     # Adds a cookie that will *remove* a cookie from the client.  Hence the
     # strange method name.
@@ -309,12 +308,10 @@ module Rack
                    expires: Time.at(0) }.merge(value))
 
     end
-    module_function :add_remove_cookie_to_header
 
     def rfc2822(time)
       time.rfc2822
     end
-    module_function :rfc2822
 
     # Modified version of stdlib time.rb Time#rfc2822 to use '%d-%b-%Y' instead
     # of '% %b %Y'.
@@ -330,7 +327,6 @@ module Rack
       mon = Time::RFC2822_MONTH_NAME[time.mon - 1]
       time.strftime("#{wday}, %d-#{mon}-%Y %H:%M:%S GMT")
     end
-    module_function :rfc2109
 
     # Parses the "Range:" header, if present, into an array of Range objects.
     # Returns nil if the header is missing or syntactically invalid.
@@ -339,7 +335,6 @@ module Rack
       warn "`byte_ranges` is deprecated, please use `get_byte_ranges`" if $VERBOSE
       get_byte_ranges env['HTTP_RANGE'], size
     end
-    module_function :byte_ranges
 
     def get_byte_ranges(http_range, size)
       # See <http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.35>
@@ -368,7 +363,6 @@ module Rack
       end
       ranges
     end
-    module_function :get_byte_ranges
 
     # Constant time string comparison.
     #
@@ -385,7 +379,6 @@ module Rack
       b.each_byte { |v| r |= v ^ l[i += 1] }
       r == 0
     end
-    module_function :secure_compare
 
     # Context allows the use of a compatible middleware at different points
     # in a request handling stack. A compatible middleware must define
@@ -418,6 +411,14 @@ module Rack
     #
     # @api private
     class HeaderHash < Hash # :nodoc:
+      def self.[](headers)
+        if headers.is_a?(HeaderHash) && !headers.frozen?
+          return headers
+        else
+          return self.new(headers)
+        end
+      end
+
       def initialize(hash = {})
         super()
         @names = {}
@@ -430,6 +431,12 @@ module Rack
         @names = other.names.dup
       end
 
+      # on clear, we need to clear @names hash
+      def clear
+        super
+        @names.clear
+      end
+
       def each
         super do |k, v|
           yield(k, v.respond_to?(:to_ary) ? v.to_ary.join("\n") : v)
@@ -574,7 +581,6 @@ module Rack
         status.to_i
       end
     end
-    module_function :status_code
 
     PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
 
@@ -588,18 +594,16 @@ module Rack
         part == '..' ? clean.pop : clean << part
       end
 
-      clean.unshift '/' if parts.empty? || parts.first.empty?
-
-      ::File.join clean
+      clean_path = clean.join(::File::SEPARATOR)
+      clean_path.prepend("/") if parts.empty? || parts.first.empty?
+      clean_path
     end
-    module_function :clean_path_info
 
     NULL_BYTE = "\0"
 
     def valid_path?(path)
       path.valid_encoding? && !path.include?(NULL_BYTE)
     end
-    module_function :valid_path?
 
   end
 end