rack 3.0.6.1 → 3.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b43a4c41d97b3e6b9790b04c0713ac20814fa986310ccd17918baaaf3f94b260
-  data.tar.gz: a461e437f8cf4591d39d4a84fdceec6ffddb3d11c67fc5a4bdf74926e18d80bc
+  metadata.gz: 6d78a46e82a591436bcb6103319864e8f4148e56de71e1fc18d3e7c8b2e97751
+  data.tar.gz: bbc8b98ab7d2a4c80876e840fe04d20e99b973d274ae5366544154a5cacba4df
 SHA512:
-  metadata.gz: cb7fcf3c2fa1cd168ff0373246160eec7fa6d94a6b4e5d88438f2239cf79e8b9df708626b32603f63368c1133ca7b3fb00d16a292ca5214a7740c558201c1a0f
-  data.tar.gz: 64d3a5fb0603f6f12760bd2ff95a118985eb843b1875d36c9f9f2af37ca413f311e3c566f5861efb159349d9958ef2c78f8d537ba618009d0ca3ac91047d6d53
+  metadata.gz: 699070faa7af77eb112f78684073725f304d17604afbd6fec37316ad020903f148ade1c070458999d526d4d49077f47abafca5c1ce1e4d7c12ef7a9bdb4fce5d
+  data.tar.gz: 8e0573a8dc26d426a3fd7b2f770b343cb1ea1c1e57f51261a7c8af745bf5d37c5bb637d4a6170a9e904a1dcb8a69b909a6f8c4bb8dae8791800b88cf7d06fd64

data/CHANGELOG.md

@@ -2,10 +2,22 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.0.7] - 2023-03-16
+
+- Make query parameters without `=` have `nil` values. ([#2059](https://github.com/rack/rack/pull/2059), [@jeremyevans])
+
 ## [3.0.6.1] - 2023-03-13
 
 - [CVE-2023-27539] Avoid ReDoS in header parsing
 
+## [3.0.6] - 2023-03-13
+
+- Add `QueryParser#missing_value` for handling missing values + tests. ([#2052](https://github.com/rack/rack/pull/2052), [@ioquatix])
+
+## [3.0.5] - 2023-03-13
+
+- Split form/query parsing into two steps. ([#2038](https://github.com/rack/rack/pull/2038), [@matthewd](https://github.com/matthewd))
+
 ## [3.0.4.1] - 2023-03-02
 
 - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts

data/lib/rack/constants.rb

@@ -54,13 +54,11 @@ module Rack
   RACK_RESPONSE_FINISHED              = 'rack.response_finished'
   RACK_REQUEST_FORM_INPUT             = 'rack.request.form_input'
   RACK_REQUEST_FORM_HASH              = 'rack.request.form_hash'
-  RACK_REQUEST_FORM_PAIRS             = 'rack.request.form_pairs'
   RACK_REQUEST_FORM_VARS              = 'rack.request.form_vars'
   RACK_REQUEST_FORM_ERROR             = 'rack.request.form_error'
   RACK_REQUEST_COOKIE_HASH            = 'rack.request.cookie_hash'
   RACK_REQUEST_COOKIE_STRING          = 'rack.request.cookie_string'
   RACK_REQUEST_QUERY_HASH             = 'rack.request.query_hash'
-  RACK_REQUEST_QUERY_PAIRS            = 'rack.request.query_pairs'
   RACK_REQUEST_QUERY_STRING           = 'rack.request.query_string'
   RACK_METHODOVERRIDE_ORIGINAL_METHOD = 'rack.methodoverride.original_method'
 end

data/lib/rack/multipart.rb

@@ -13,31 +13,6 @@ module Rack
   module Multipart
     MULTIPART_BOUNDARY = "AaB03x"
 
-    # Accumulator for multipart form data, conforming to the QueryParser API.
-    # In future, the Parser could return the pair list directly, but that would
-    # change its API.
-    class ParamList # :nodoc:
-      def self.make_params
-        new
-      end
-
-      def self.normalize_params(params, key, value)
-        params << [key, value]
-      end
-
-      def initialize
-        @pairs = []
-      end
-
-      def <<(pair)
-        @pairs << pair
-      end
-
-      def to_params_hash
-        @pairs
-      end
-    end
-
     class << self
       def parse_multipart(env, params = Rack::Utils.default_query_parser)
         io = env[RACK_INPUT]

data/lib/rack/query_parser.rb

@@ -39,42 +39,19 @@ module Rack
       @param_depth_limit = param_depth_limit
     end
 
-    # Originally stolen from Mongrel, now with some modifications:
+    # Stolen from Mongrel, with some small modifications:
     # Parses a query string by breaking it up at the '&'.  You can also use this
     # to parse cookies by changing the characters used in the second parameter
     # (which defaults to '&').
-    #
-    # Returns an array of 2-element arrays, where the first element is the
-    # key and the second element is the value.
-    def split_query(qs, separator = nil, &unescaper)
-      pairs = []
-
-      if qs && !qs.empty?
-        unescaper ||= method(:unescape)
-
-        qs.split(separator ? (COMMON_SEP[separator] || /[#{separator}] */n) : DEFAULT_SEP).each do |p|
-          next if p.empty?
-          pair = p.split('=', 2).map!(&unescaper)
-          pair << nil if pair.length == 1
-          pairs << pair
-        end
-      end
-
-      pairs
-    rescue ArgumentError => e
-      raise InvalidParameterError, e.message, e.backtrace
-    end
-
-    # Parses a query string by breaking it up at the '&'.  You can also use this
-    # to parse cookies by changing the characters used in the second parameter
-    # (which defaults to '&').
-    #
-    # Returns a hash where each value is a string (when a key only appears once)
-    # or an array of strings (when a key appears more than once).
     def parse_query(qs, separator = nil, &unescaper)
+      unescaper ||= method(:unescape)
+
       params = make_params
 
-      split_query(qs, separator, &unescaper).each do |k, v|
+      (qs || '').split(separator ? (COMMON_SEP[separator] || /[#{separator}] */n) : DEFAULT_SEP).each do |p|
+        next if p.empty?
+        k, v = p.split('=', 2).map!(&unescaper)
+
         if cur = params[k]
           if cur.class == Array
             params[k] << v
@@ -86,7 +63,7 @@ module Rack
         end
       end
 
-      params.to_h
+      return params.to_h
     end
 
     # parse_nested_query expands a query string into structural types. Supported
@@ -97,11 +74,17 @@ module Rack
     def parse_nested_query(qs, separator = nil)
       params = make_params
 
-      split_query(qs, separator).each do |k, v|
-        _normalize_params(params, k, v, 0)
+      unless qs.nil? || qs.empty?
+        (qs || '').split(separator ? (COMMON_SEP[separator] || /[#{separator}] */n) : DEFAULT_SEP).each do |p|
+          k, v = p.split('=', 2).map! { |s| unescape(s) }
+
+          _normalize_params(params, k, v, 0)
+        end
       end
 
-      params.to_h
+      return params.to_h
+    rescue ArgumentError => e
+      raise InvalidParameterError, e.message, e.backtrace
     end
 
     # normalize_params recursively expands parameters into structural types. If
@@ -113,14 +96,6 @@ module Rack
       _normalize_params(params, name, v, 0)
     end
 
-    # This value is used by default when a parameter is missing (nil). This
-    # usually happens when a parameter is specified without an `=value` part.
-    # The default value is an empty string, but this can be overridden by
-    # subclasses.
-    def missing_value
-      String.new
-    end
-
     private def _normalize_params(params, name, v, depth)
       raise ParamsTooDeepError if depth >= param_depth_limit
 
@@ -155,8 +130,6 @@ module Rack
 
       return if k.empty?
 
-      v ||= missing_value
-
       if after == ''
         if k == '[]' && depth != 0
           return [v]

data/lib/rack/request.rb

@@ -483,22 +483,11 @@ module Rack
       # Returns the data received in the query string.
       def GET
         if get_header(RACK_REQUEST_QUERY_STRING) == query_string
-          if query_hash = get_header(RACK_REQUEST_QUERY_HASH)
-            return query_hash
-          end
-        end
-
-        set_header(RACK_REQUEST_QUERY_HASH, expand_params(query_param_list))
-      end
-
-      def query_param_list
-        if get_header(RACK_REQUEST_QUERY_STRING) == query_string
-          get_header(RACK_REQUEST_QUERY_PAIRS)
+          get_header(RACK_REQUEST_QUERY_HASH)
         else
-          query_pairs = split_query(query_string, '&')
-          set_header RACK_REQUEST_QUERY_STRING, query_string
-          set_header RACK_REQUEST_QUERY_HASH, nil
-          set_header(RACK_REQUEST_QUERY_PAIRS, query_pairs)
+          query_hash = parse_query(query_string, '&')
+          set_header(RACK_REQUEST_QUERY_STRING, query_string)
+          set_header(RACK_REQUEST_QUERY_HASH, query_hash)
         end
       end
 
@@ -507,16 +496,6 @@ module Rack
       # This method support both application/x-www-form-urlencoded and
       # multipart/form-data.
       def POST
-        if get_header(RACK_REQUEST_FORM_INPUT).equal?(get_header(RACK_INPUT))
-          if form_hash = get_header(RACK_REQUEST_FORM_HASH)
-            return form_hash
-          end
-        end
-
-        set_header(RACK_REQUEST_FORM_HASH, expand_params(body_param_list))
-      end
-
-      def body_param_list
         if error = get_header(RACK_REQUEST_FORM_ERROR)
           raise error.class, error.message, cause: error.cause
         end
@@ -524,36 +503,36 @@ module Rack
         begin
           rack_input = get_header(RACK_INPUT)
 
-          form_pairs = nil
-
-          # If the form data has already been memoized from the same
-          # input:
-          if get_header(RACK_REQUEST_FORM_INPUT).equal?(rack_input)
-            if form_pairs = get_header(RACK_REQUEST_FORM_PAIRS)
-              return form_pairs
+          # If the form hash was already memoized:
+          if form_hash = get_header(RACK_REQUEST_FORM_HASH)
+            # And it was memoized from the same input:
+            if get_header(RACK_REQUEST_FORM_INPUT).equal?(rack_input)
+              return form_hash
             end
           end
 
+          # Otherwise, figure out how to parse the input:
           if rack_input.nil?
-            form_pairs = []
+            set_header RACK_REQUEST_FORM_INPUT, nil
+            set_header(RACK_REQUEST_FORM_HASH, {})
           elsif form_data? || parseable_data?
-            unless form_pairs = Rack::Multipart.extract_multipart(self, Rack::Multipart::ParamList)
-              form_vars = rack_input.read
+            unless set_header(RACK_REQUEST_FORM_HASH, parse_multipart)
+              form_vars = get_header(RACK_INPUT).read
 
               # Fix for Safari Ajax postings that always append \0
               # form_vars.sub!(/\0\z/, '') # performance replacement:
               form_vars.slice!(-1) if form_vars.end_with?("\0")
 
               set_header RACK_REQUEST_FORM_VARS, form_vars
-              form_pairs = split_query(form_vars, '&')
+              set_header RACK_REQUEST_FORM_HASH, parse_query(form_vars, '&')
             end
+
+            set_header RACK_REQUEST_FORM_INPUT, get_header(RACK_INPUT)
+            get_header RACK_REQUEST_FORM_HASH
           else
-            form_pairs = []
+            set_header RACK_REQUEST_FORM_INPUT, get_header(RACK_INPUT)
+            set_header(RACK_REQUEST_FORM_HASH, {})
           end
-
-          set_header RACK_REQUEST_FORM_INPUT, rack_input
-          set_header RACK_REQUEST_FORM_HASH, nil
-          set_header(RACK_REQUEST_FORM_PAIRS, form_pairs)
         rescue => error
           set_header(RACK_REQUEST_FORM_ERROR, error)
           raise
@@ -693,28 +672,6 @@ module Rack
         Rack::Multipart.extract_multipart(self, query_parser)
       end
 
-      def split_query(query, d = '&')
-        query_parser = query_parser()
-        unless query_parser.respond_to?(:split_query)
-          query_parser = Utils.default_query_parser
-          unless query_parser.respond_to?(:split_query)
-            query_parser = QueryParser.make_default(0)
-          end
-        end
-
-        query_parser.split_query(query, d)
-      end
-
-      def expand_params(pairs, query_parser = query_parser())
-        params = query_parser.make_params
-
-        pairs.each do |key, value|
-          query_parser.normalize_params(params, key, value)
-        end
-
-        params.to_params_hash
-      end
-
       def split_header(value)
         value ? value.strip.split(/[,\s]+/) : []
       end

data/lib/rack/version.rb

@@ -25,7 +25,7 @@ module Rack
     VERSION
   end
 
-  RELEASE = "3.0.6.1"
+  RELEASE = "3.0.7"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 3.0.6.1
+  version: 3.0.7
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-13 00:00:00.000000000 Z
+date: 2023-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -149,7 +149,7 @@ metadata:
   changelog_uri: https://github.com/rack/rack/blob/main/CHANGELOG.md
   documentation_uri: https://rubydoc.info/github/rack/rack
   source_code_uri: https://github.com/rack/rack
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -164,8 +164,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.4.6
+signing_key:
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []