roda 3.106.0 → 3.108.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90404574f8af3e952feb444cabe5bb01430e2d7c3658daee9f22f0c22e25d5f6
-  data.tar.gz: 347ba47cf4c3b9e280848ba717a1a4a9f57f8ac0712d2aaa8e5942020c22cb29
+  metadata.gz: 88f17808e272159aaa6d5f1239eeb3453935aa188c0933b753e5a66046212e03
+  data.tar.gz: 952920ff3e1dafeefea80acefcbd3fb5e03f0033c2ca909757c697e2acd7c955
 SHA512:
-  metadata.gz: 00e03ccebd8d48c4c1576ae0da2929d85a30430114b9a292bd8b9029fba31b4a7fa10767d7fb59a643c4280fb659e9afa90dacde27c7a5bdbc98fc5ee1df40a6
-  data.tar.gz: 7867f8da5bad9db4102f09fc692158feee7605c8021b5d01bb07ebfe57d3a82ca0b18d7fc1341d6e5cdf9ff534736a6c9c3ce2420b2078abe96209ad423bce92
+  metadata.gz: fdd21d3152a257f21d1cfb33562334b71de82e1f017899dae0d5e9974f9b1028824c017f82d54405d5f88bed4d53607f6c238bb21c1907492da38b3b755e1a73
+  data.tar.gz: 61ed1ac97df5919e486a82abb62ad47b45603ec3c46d230ce6aa6f7ac697cd52b45af167a597ad691ec6de5267886e6b420efc0d3117a3604ba45f613703e80d

data/lib/roda/plugins/_base64.rb

@@ -9,12 +9,12 @@ class Roda
           def decode64(str)
             str.unpack1("m0")
           end
-        # :nocov:
+        # simplecov:disable
         else
           def decode64(str)
             str.unpack("m0")[0]
           end
-        # :nocov:
+        # simplecov:enable
         end
 
         def urlsafe_encode64(bin)

data/lib/roda/plugins/_optimized_matching.rb

@@ -44,6 +44,7 @@ class Roda
                 rp = @remaining_path
                 if rp.getbyte(0) == 47
                   if last = rp.index('/', 1)
+                    return false if last == 1
                     @remaining_path = rp[last, rp.length]
                     always{yield rp[1, last-1]}
                   elsif (len = rp.length) > 1

data/lib/roda/plugins/all_verbs.rb

@@ -6,7 +6,7 @@ class Roda
     # The all_verbs plugin adds methods for http verbs other than
     # get and post.  The following verbs are added, assuming
     # rack handles them: delete, head, options, link, patch, put,
-    # trace, unlink.
+    # query, trace, unlink.
     #
     # These methods operate just like Roda's default get and post
     # methods, so using them without any arguments just checks for
@@ -33,7 +33,7 @@ class Roda
     # isn't documentation for the individual methods created.
     module AllVerbs
       module RequestMethods
-        %w'delete head options link patch put trace unlink'.each do |verb|
+        %w'delete head options link patch put query trace unlink'.each do |verb|
           if ::Rack::Request.method_defined?("#{verb}?")
             class_eval(<<-END, __FILE__, __LINE__+1)
               def #{verb}(*args, &block)

data/lib/roda/plugins/assets.rb

@@ -159,6 +159,35 @@ class Roda
     #   plugin :assets,
     #     css_opts: {style: :compressed}
     #
+    # In Roda 4, automatic compression of assets will not be attempted. You will
+    # need to specify the compressor to use using a Proc or Method. Here are values
+    # that you can use.
+    # 
+    # ==== yui
+    #
+    #  require 'yuicompressor'
+    #   plugin :assets,
+    #     css_compressor: lambda{|v| ::YUICompressor.compress_css(v, munge: true) },
+    #     js_compressor: lambda{|v| ::YUICompressor.compress_js(v, munge: true) }
+    #
+    # ==== closure-compiler
+    #
+    #   require 'closure-compiler'
+    #   plugin :assets, js_compressor: ::Closure::Compiler.new.method(:compile)
+    #
+    # ==== uglifier
+    #
+    #   require 'uglifier'
+    #   plugin :assets, js_compressor: Uglifier.method(:compile)
+    #
+    # ==== minjs
+    #
+    #   require 'minjs'
+    #   plugin :assets,
+    #     js_compressor: proc { |content|
+    #       Minjs::Compressor::Compressor.new(debug: false).compress(content).to_js
+    #     }
+    #
     # === Source Maps (CSS)
     #
     # The assets plugin does not have direct support for source maps, so it is
@@ -274,7 +303,7 @@ class Roda
     # :compiled_path:: Path inside public folder in which compiled files are stored (default: :prefix)
     # :concat_only :: Whether to just concatenate instead of concatenating
     #                 and compressing files (default: false)
-    # :css_compressor :: Compressor to use for compressing CSS, either :yui, :none, or nil (the default, which will try
+    # :css_compressor :: Compressor to use for compressing CSS, either a Proc, Method, :yui, :none, or nil (the default, which will try
     #                    :yui if available, but not fail if it is not available)
     # :css_dir :: Directory name containing your css source, inside :path (default: 'css')
     # :css_headers :: A hash of additional headers for your rendered css files
@@ -288,7 +317,7 @@ class Roda
     #                   related group are contained in a subdirectory with the same name (default: true)
     # :gzip :: Store gzipped compiled assets files, and serve those to clients who accept gzip encoding.
     # :headers :: A hash of additional headers for both js and css rendered files
-    # :js_compressor :: Compressor to use for compressing javascript, either :yui, :closure, :uglifier, :minjs,
+    # :js_compressor :: Compressor to use for compressing javascript, either a Proc, Method, :yui, :closure, :uglifier, :minjs,
     #                   :none, or nil (the default, which will try :yui, :closure, :uglifier, then :minjs, but
     #                   not fail if any of them is not available)
     # :js_dir :: Directory name containing your javascript source, inside :path (default: 'js')
@@ -454,6 +483,17 @@ class Roda
         opts[:js_suffix]           = (opts[:add_suffix] ? '.js' : '').freeze
         opts[:css_suffix]          = (opts[:add_suffix] ? '.css' : '').freeze
 
+        unless opts[:concat_only]
+          [:css_compressor, :js_compressor].each do |s|
+            case v = opts[s]
+            when nil, :none, Proc, Method
+              nil
+            else
+              RodaPlugins.warn "Support for the assets plugin #{s}: #{v.inspect} option will be removed in Roda 4. See the assets plugin documentation for how to use an appropriate proc or method."
+            end
+          end
+        end
+
         opts.freeze
       end
 
@@ -535,6 +575,7 @@ class Roda
             app.read_asset_file(file, type)
           end.join("\n")
 
+          # RODA4: Remove :concat_only option
           unless o[:concat_only]
             content = compress_asset(content, type)
           end
@@ -564,6 +605,8 @@ class Roda
             return content
           when nil
             # default, try different compressors
+          when Proc, Method
+            return compressor.call(content)
           else
             # Allow calling private compress methods
             return send("compress_#{type}_#{compressor}", content)
@@ -579,6 +622,7 @@ class Roda
             begin
             # Allow calling private compress methods
               if c = send("compress_#{type}_#{comp}", content)
+                RodaPlugins.warn "Support for automatic compression of assets by trying common asset compressor libraries will be removed in Roda 4. The #{comp} #{type.to_s.upcase} compressor is currently used. See the assets plugin documentation for how to use an appropriate value for the assets plugin :#{type}_compressor option."
                 return c
               end
             rescue LoadError, CompressorNotFound
@@ -615,9 +659,9 @@ class Roda
           begin
             require 'uglifier'
           rescue => e
-            # :nocov:
+            # simplecov:disable
             raise CompressorNotFound, "#{e.class}: #{e.message}", e.backtrace
-            # :nocov:
+            # simplecov:enable
           end
 
           Uglifier.compile(content)
@@ -645,11 +689,11 @@ class Roda
           digest = begin
             require 'openssl'
             ::OpenSSL::Digest
-          # :nocov:
+          # simplecov:disable
           rescue LoadError
             require 'digest/sha2'
             ::Digest
-          # :nocov:
+          # simplecov:enable
           end
           digest.const_get(algo.to_s.upcase).hexdigest(content)
         end

data/lib/roda/plugins/bearer_token.rb

@@ -8,9 +8,9 @@ class Roda
     # in the authorization header will be recognized as long as they start
     # with the case insensitive string "bearer ".
     module BearerToken
-      # :nocov:
+      # simplecov:disable
       METHOD = RUBY_VERSION >= "2.4" ? :match? : :match
-      # :nocov:
+      # simplecov:enable
 
       module RequestMethods
         # Return the bearer token for the request if there is one in the

data/lib/roda/plugins/break.rb

@@ -22,12 +22,20 @@ class Roda
     #   end
     #
     # This provides the same basic feature as the pass plugin, but
-    # uses Ruby's standard control flow primative instead of a
+    # uses Ruby's standard control flow primitive instead of a
     # separate method.
     module Break
       module RequestMethods
         private
 
+        # Handle passing inside the match block.
+        def always
+          rp = @remaining_path
+          super
+        ensure
+          @remaining_path = rp
+        end
+
         # Handle break inside match blocks, restoring remaining path.
         def if_match(_)
           rp = @remaining_path

data/lib/roda/plugins/caching.rb

@@ -75,28 +75,27 @@ class Roda
         # Set the last modified time of the resource using the Last-Modified header.
         # The +time+ argument should be a Time instance.
         #
-        # If the current request includes an If-Modified-Since header that is
-        # equal or later than the time specified, immediately returns a response
-        # with a 304 status.
-        #
         # If the current request includes an If-Unmodified-Since header that is
         # before than the time specified, immediately returns a response
         # with a 412 status.
+        #
+        # If the current request does not include an If-None-Match header and
+        # includes an If-Modified-Since header that is equal or later than the
+        # time specified, immediately returns a response with a 304 status.
         def last_modified(time)
           return unless time
           res = response
           e = env
           res[RodaResponseHeaders::LAST_MODIFIED] = time.httpdate
-          return if e['HTTP_IF_NONE_MATCH']
           status = res.status
 
-          if (!status || status == 200) && (ims = time_from_header(e['HTTP_IF_MODIFIED_SINCE'])) && ims >= time.to_i
-            res.status = 304
+          if (!status || (status >= 200 && status < 300) || status == 412) && (ius = time_from_header(e['HTTP_IF_UNMODIFIED_SINCE'])) && ius < time.to_i
+            res.status = 412
             halt
           end
 
-          if (!status || (status >= 200 && status < 300) || status == 412) && (ius = time_from_header(e['HTTP_IF_UNMODIFIED_SINCE'])) && ius < time.to_i
-            res.status = 412
+          if !e['HTTP_IF_NONE_MATCH'] && (!status || status == 200) && (ims = time_from_header(e['HTTP_IF_MODIFIED_SINCE'])) && ims >= time.to_i
+            res.status = 304
             halt
           end
         end
@@ -113,8 +112,9 @@ class Roda
         # matching etag, immediately returns a response with a 304 or 412 status,
         # depending on the request method.
         #
-        # When the current request includes an If-Match header with a
-        # etag that doesn't match, immediately returns a response with a 412 status.
+        # When the current request includes an If-Match header with an etag that
+        # doesn't match, or where the :weak option was used, immediately returns a
+        # response with a 412 status.
         def etag(value, opts=OPTS)
           # Before touching this code, please double check RFC 2616 14.24 and 14.26.
           weak = opts[:weak]
@@ -132,7 +132,7 @@ class Roda
             end
 
             if ifm = e['HTTP_IF_MATCH']
-              unless etag_matches?(ifm, etag, new_resource)
+              if weak || !etag_matches?(ifm, etag, new_resource)
                 res.status = 412
                 halt
               end

data/lib/roda/plugins/common_logger.rb

@@ -36,11 +36,11 @@ class Roda
           Process.clock_gettime(Process::CLOCK_MONOTONIC)
         end
       else
-        # :nocov:
+        # simplecov:disable
         def self.start_timer # :nodoc:
           Time.now
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module InstanceMethods
@@ -61,10 +61,10 @@ class Roda
           line = "#{env['HTTP_X_FORWARDED_FOR'] || env["REMOTE_ADDR"] || "-"} - #{env["REMOTE_USER"] || "-"} [#{Time.now.strftime("%d/%b/%Y:%H:%M:%S %z")}] \"#{env["REQUEST_METHOD"]} #{env["SCRIPT_NAME"]}#{env["PATH_INFO"]}#{"?#{env["QUERY_STRING"]}" if ((qs = env["QUERY_STRING"]) && !qs.empty?)} #{@_request.http_version}\" #{status} #{((length = headers[RodaResponseHeaders::CONTENT_LENGTH]) && (length unless length == '0')) || '-'} #{elapsed_time} "
           if MUTATE_LINE
             line.gsub!(/[^[:print:]]/){|c| sprintf("\\x%x", c.ord)}
-          # :nocov:
+          # simplecov:disable
           else
             line = line.gsub(/[^[:print:]]/){|c| sprintf("\\x%x", c.ord)}
-          # :nocov:
+          # simplecov:enable
           end
           line[-1] = "\n"
           opts[:common_logger_meth].call(line)

data/lib/roda/plugins/cookie_flags.rb

@@ -48,9 +48,9 @@ class Roda
     # Note that this plugin only affects cookies set by the application, and does not
     # affect cookies set by middleware the application is using.
     module CookieFlags
-      # :nocov:
+      # simplecov:disable
       MATCH_METH = RUBY_VERSION >= '2.4' ? :match? : :match
-      # :nocov:
+      # simplecov:enable
       private_constant :MATCH_METH
 
       DEFAULTS = {:secure=>true, :httponly=>true, :same_site=>'strict', :action=>:modify}.freeze

data/lib/roda/plugins/csrf.rb

@@ -1,5 +1,7 @@
 # frozen-string-literal: true
 
+# RODA4: Remove plugin
+
 require 'rack/csrf'
 
 class Roda
@@ -7,6 +9,7 @@ class Roda
     # This plugin is no longer recommended for use, it exists only for
     # backwards compatibility.  Consider using the route_csrf plugin
     # instead, as that provides stronger CSRF protection.
+    # This plugin will no longer ship with Roda starting in Roda 4.
     #
     # The csrf plugin adds CSRF protection using rack_csrf, along with
     # some csrf helper methods to use in your views.  To use it, load

data/lib/roda/plugins/delay_build.rb

@@ -3,6 +3,8 @@
 #
 class Roda
   module RodaPlugins
+    warn("The delay_build plugin no longer has an effect. It will be removed in Roda 4.")
+
     module DelayBuild
       module ClassMethods
         # No-op for backwards compatibility

data/lib/roda/plugins/each_part.rb

@@ -43,19 +43,19 @@ class Roda
               render_each(enum, template, :locals=>locals, &block)
             end
           RUBY
-        # :nocov:
+        # simplecov:disable
         else
           def each_part(enum, template, locals=OPTS, &block)
             render_each(enum, template, :locals=>locals, &block)
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def each_part(enum, template, **locals, &block)
               if optimized_method = _cached_render_each_template_method(template)

data/lib/roda/plugins/error_email.rb

@@ -44,9 +44,9 @@ class Roda
         :filter=>lambda{|k,v| false},
         :headers=>OPTS,
         :host=>'localhost',
-        # :nocov:
+        # simplecov:disable
         :emailer=>lambda{|h| Net::SMTP.start(h[:host]){|s| s.send_message(h[:message], h[:from], h[:to])}},
-        # :nocov:
+        # simplecov:enable
         :default_headers=>lambda do |h, e|
           subject = if e.respond_to?(:message)
             "#{e.class}: #{e.message}"

data/lib/roda/plugins/exception_page.rb

@@ -415,14 +415,14 @@ END
           def exception_page_exception_message(exception)
             exception.detailed_message(highlight: false).to_s
           end
-        # :nocov:
+        # simplecov:disable
         else
           # Return message to use for exception.
           def exception_page_exception_message(exception)
             exception.message.to_s
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module RequestMethods

data/lib/roda/plugins/h.rb

@@ -17,10 +17,10 @@ class Roda
       begin
         require 'cgi/escape'
         unless CGI.respond_to?(:escapeHTML) # work around for JRuby 9.1
-          # :nocov:
+          # simplecov:disable
           CGI = Object.new
           CGI.extend(defined?(::CGI::Escape) ? ::CGI::Escape : ::CGI::Util)
-          # :nocov:
+          # simplecov:enable
         end
 
         module InstanceMethods
@@ -30,7 +30,7 @@ class Roda
           end
         end
       rescue LoadError
-        # :nocov:
+        # simplecov:disable
 
         # A Hash of entities and their escaped equivalents,
         # to be escaped by h().
@@ -50,7 +50,7 @@ class Roda
             string.to_s.gsub(ESCAPE_HTML_PATTERN){|c| ESCAPE_HTML[c] }
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
     end
 

data/lib/roda/plugins/hash_branches.rb

@@ -128,12 +128,16 @@ class Roda
           if routes = roda_class.opts[:hash_branches][namespace]
             if segment_end = rp.index('/', 1)
               if meth = routes[rp[0, segment_end]]
-                @remaining_path = rp[segment_end, 100000000]
-                always{scope.send(meth, self)}
+                always do
+                  @remaining_path = rp[segment_end, 100000000]
+                  scope.send(meth, self)
+                end
               end
             elsif meth = routes[rp]
-              @remaining_path = ''
-              always{scope.send(meth, self)}
+              always do
+                @remaining_path = ''
+                scope.send(meth, self)
+              end
             end
           end
         end

data/lib/roda/plugins/hash_paths.rb

@@ -116,8 +116,10 @@ class Roda
         # remaining path, and dispatch to that block if there is one.
         def hash_paths(namespace=matched_path)
           if (routes = roda_class.opts[:hash_paths][namespace]) && (meth = routes[@remaining_path])
-            @remaining_path = ''
-            always{scope.send(meth, self)}
+            always do
+              @remaining_path = ''
+              scope.send(meth, self)
+            end
           end
         end
       end

data/lib/roda/plugins/hash_public.rb

@@ -51,11 +51,11 @@ class Roda
       Digest = begin
         require 'openssl'
         ::OpenSSL::Digest
-      # :nocov:
+      # simplecov:disable
       rescue LoadError
         require 'digest/sha2'
         ::Digest
-      # :nocov:
+      # simplecov:enable
       end
 
       def self.load_dependencies(app, opts = OPTS)

data/lib/roda/plugins/hmac_paths.rb

@@ -346,43 +346,41 @@ class Roda
 
             if submitted_hmac.bytesize == 64
               on String do |flags|
-                if flags.bytesize >= 1
-                  if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
-                    # Namespace required and not provided, or provided and not required.
-                    # Bail early to avoid unnecessary HMAC calculation.
-                    @remaining_path = orig_path
-                    return
-                  end
+                if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
+                  # Namespace required and not provided, or provided and not required.
+                  # Bail early to avoid unnecessary HMAC calculation.
+                  @remaining_path = orig_path
+                  return
+                end
 
-                  if flags.include?('m')
-                    rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
-                  end
+                if flags.include?('m')
+                  rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
+                end
 
-                  if flags.include?('p')
-                    rpath = "#{rpath}?#{env["QUERY_STRING"]}"
-                  end
+                if flags.include?('p')
+                  rpath = "#{rpath}?#{env["QUERY_STRING"]}"
+                end
 
-                  if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
-                    if flags.include?('t')
-                      on Integer do |int|
-                        if int >= Time.now.to_i
-                          always(&block)
-                        else
-                          # Return from method without matching
-                          @remaining_path = orig_path
-                          return
-                        end
+                if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
+                  if flags.include?('t')
+                    on Integer do |int|
+                      if int >= Time.now.to_i
+                        always(&block)
+                      else
+                        # Return from method without matching
+                        @remaining_path = orig_path
+                        return
                       end
-                    else
-                      always(&block)
                     end
+                  else
+                    always(&block)
                   end
                 end
-
-                # Return from method without matching
-                @remaining_path = orig_path
-                return
               end
+
+              # Return from method without matching
+              @remaining_path = orig_path
+              return
             end
 
             # Return from method without matching

data/lib/roda/plugins/host_routing.rb

@@ -68,8 +68,29 @@ class Roda
     #     end
     #   end
     #
-    # This plugin uses the host method on the request to get the hostname (this method
-    # is defined by Rack).
+    # This plugin uses the +host+ method on the request to get the hostname (this method
+    # is defined by Rack). Note that as of Rack 3.2, Rack's default approach to determine
+    # the hostname is insecure in many cases, since:
+    #
+    # * It will use a forwarded header instead of the +host+ header by default if the
+    #   request was from a trusted proxy.
+    # * Rack trust proxies from any private IP address range by default
+    #   (this can be disabled using <tt>Rack::Request.ip_filter=</tt>).
+    # * Rack supports both +forwarded+ and <tt>x-forwarded-host</tt> headers, will check
+    #   both by default, and the order of checking depends on Rack's configuration
+    #   (this can be configured using <tt>Rack::Request.forwarded_priority</tt>).
+    # * If the application can be reached via an arbitrary +host+ header, the attacker
+    #   has full control over the <tt>Rack::Request#host</tt> value even when forwarded
+    #   host usage is disabled.
+    #
+    # You should configure Rack appropriately for your deployment, not allowing the use
+    # of forwarded information unless your deployment is using a reverse proxy, and only
+    # allowing the specific forwarded header set by the expected reverse proxy if a
+    # reverse proxy is used. Rack 3.3 should include more control in this area,
+    # and Rack 4 should ship with more secure defaults in regard to forwarding headers.
+    #
+    # It is recommended to use the host_authorization plugin to check that the requested
+    # host is allowed when using this plugin.
     module HostRouting
       REQUEST_INSTANCE_VARIABLES = [:@_host_routing_host].freeze
 
@@ -140,7 +161,7 @@ class Roda
         # Treat all given hostnames as routing to the give host.
         def to(host, *hostnames)
           hostnames.each do |hostname|
-            @host_hash[hostname] = host
+            @host_hash[hostname.downcase.freeze] = host
           end
         end
 
@@ -180,7 +201,11 @@ class Roda
         # * The return value of the +hosts.default+ block, if given
         # * The default value provided in the +hosts.default+ call
         def _get_host_routing_host
-          host = self.host || ""
+          if host = self.host
+            host = host.downcase
+          else
+            host = ""
+          end
 
           roda_class.opts[:host_routing_hash][host] ||
             scope._host_routing_default(host) ||

data/lib/roda/plugins/invalid_request_body.rb

@@ -72,6 +72,8 @@ class Roda
         # raises an exception.
         def POST
           super
+        rescue RodaError
+          raise
         rescue => e 
           handle_invalid_request_body(e)
         end