roda 3.106.0 → 3.108.0

data/lib/roda/plugins/json_parser.rb

@@ -17,7 +17,19 @@ class Roda
     module JsonParser
       DEFAULT_ERROR_HANDLER = proc{|r| r.halt [400, {}, []]}
 
+      # simplecov:disable
+      MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
+      # simplecov:enable
+      private_constant :MATCH_METHOD
+
       # Handle options for the json_parser plugin:
+      # :content_type_regexp :: A regexp used to determine if the request's
+      #                         content type is JSON. For backwards compatibility,
+      #                         uses the insecure /json/ if not provided. Warns
+      #                         if this option is not provided. The recommended
+      #                         value to use is /\Aapplication\/json\b/i or
+      #                         /\Aapplication\/(?:vnd\.api\+)?json\b/i. Roda 4
+      #                         will default to the latter.
       # :error_handler :: A proc to call if an exception is raised when
       #                   parsing a JSON request body.  The proc is called
       #                   with the request object, and should probably call
@@ -37,6 +49,13 @@ class Roda
         app.opts[:json_parser_error_handler] = opts[:error_handler] || app.opts[:json_parser_error_handler] || DEFAULT_ERROR_HANDLER
         app.opts[:json_parser_parser] = opts[:parser] || app.opts[:json_parser_parser] || app.opts[:json_parser] || JSON.method(:parse)
         app.opts[:json_parser_include_request] = opts[:include_request] if opts.has_key?(:include_request)
+        app.opts[:json_parser_content_type_regexp] = opts[:content_type_regexp] || app.opts[:json_parser_content_type_regexp]
+
+        unless app.opts[:json_parser_content_type_regexp]
+          # RODA4: Switch to /\Aapplication\/(?:vnd\.api\+)?json\b/i by default
+          RodaPlugins.warn(':content_type_regexp option not provided to json_parser plugin, using /json/ for backwards compatibility, which may be insecure, using /\Aapplication\/json\b/i or /\Aapplication\/(?:vnd\.api\+)?json\b/i is recommended')
+          app.opts[:json_parser_content_type_regexp] = /json/
+        end
 
         case opts[:wrap]
         when :unless_hash, :always
@@ -57,7 +76,7 @@ class Roda
             return post_params
           end
 
-          unless (input = env["rack.input"]) && (content_type = self.content_type) && content_type.include?('json')
+          unless (input = env["rack.input"]) && (content_type = self.content_type) && roda_class.opts[:json_parser_content_type_regexp].send(MATCH_METHOD, content_type)
             return super
           end
 
@@ -84,7 +103,6 @@ class Roda
           args << self if roda_class.opts[:json_parser_include_request]
           roda_class.opts[:json_parser_parser].call(*args)
         end
-
         
         # Rack 3 dropped requirement that input be rewindable
         if Rack.release >= '3'

data/lib/roda/plugins/mail_processor.rb

@@ -510,11 +510,11 @@ class Roda
             a1.casecmp?(a2)
           end
         else
-          # :nocov:
+          # simplecov:disable
           def address_match?(a1, a2)
             a1.downcase == a2.downcase
           end
-          # :nocov:
+          # simplecov:enable
         end
 
         # Match if any of the given addresses match the given val, which

data/lib/roda/plugins/mailer.rb

@@ -153,9 +153,9 @@ class Roda
             mail
           end
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:mail) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         # Calls +mail+ with given arguments and immediately sends the resulting mail.
         def sendmail(*args)
@@ -163,9 +163,9 @@ class Roda
             m.deliver
           end
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:sendmail) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
       end
 
       module RequestMethods

data/lib/roda/plugins/middleware.rb

@@ -125,6 +125,7 @@ class Roda
         app.opts[:middleware_configure] = block if block
         app.opts[:middleware_handle_result] = opts[:handle_result]
         app.opts[:middleware_forward_response_headers] = opts[:forward_response_headers]
+        # RODA4: Make next_if_not_found default to true
         app.opts[:middleware_next_if_not_found] = opts[:next_if_not_found]
       end
 

data/lib/roda/plugins/optimized_segment_matchers.rb

@@ -27,11 +27,16 @@ class Roda
           rp = @remaining_path
           if rp.getbyte(0) == 47
             if last = rp.index('/', 1)
-              @remaining_path = rp[last, rp.length]
-              always{yield rp[1, last-1]}
+              return false if last == 1
+              always do
+                @remaining_path = rp[last, rp.length]
+                yield rp[1, last-1]
+              end
             elsif (len = rp.length) > 1
-              @remaining_path = ""
-              always{yield rp[1, len]}
+              always do
+                @remaining_path = ""
+                yield rp[1, len]
+              end
             end
           end
         end
@@ -41,8 +46,10 @@ class Roda
         def is_segment
           rp = @remaining_path
           if rp.getbyte(0) == 47 && !rp.index('/', 1) && (len = rp.length) > 1
-            @remaining_path = ""
-            always{yield rp[1, len]}
+            always do
+              @remaining_path = ""
+              yield rp[1, len]
+            end
           end
         end
       end

data/lib/roda/plugins/optimized_string_matchers.rb

@@ -28,7 +28,11 @@ class Roda
       module RequestMethods
         # Optimized version of +on+ that only supports a single string.
         def on_branch(s)
-          always{yield} if _match_string(s)
+          rp = @remaining_path
+          if _match_string(s)
+            always{yield}
+            @remaining_path = rp
+          end
         end
 
         # Optimized version of +is+ that only supports a single string.
@@ -37,9 +41,8 @@ class Roda
           if _match_string(s)
             if @remaining_path.empty?
               always{yield}
-            else
-              @remaining_path = rp
             end
+            @remaining_path = rp
           end
         end
       end

data/lib/roda/plugins/params_capturing.rb

@@ -54,14 +54,20 @@ class Roda
     # Also note that this plugin will not work correctly if you are using
     # the symbol_matchers plugin with custom symbol matching and are using
     # symbols that capture multiple values or no values.
+    #
+    # If you are using the pass or break plugin along with this plugin,
+    # it is recommended you load the params_capturing_restore plugin, as that
+    # allows +r.pass+ or +break+ inside param capturing blocking to work
+    # correctly.
     module ParamsCapturing
       REQUEST_INSTANCE_VARIABLES = [:@_params_captures].freeze
 
       module RequestMethods
         # Lazily initialize captures entry when params is called.
         def params
+          return @params if @params
           ret = super
-          ret['captures'] ||= []
+          ret['captures'] = []
           ret
         end
 
@@ -100,16 +106,19 @@ class Roda
           end
 
           super do |*a|
-            if pc
-              @_params_captures = nil
-              pc.zip(a).each do |k,v|
-                params[k] = v
-              end
-            end
+            _set_params_captures(a) if pc
             params['captures'].concat(a) 
             yield(*a)
           end
         end
+
+        # Set the captures into the parameters.
+        def _set_params_captures(a)
+          @_params_captures.zip(a).each do |k,v|
+            params[k] = v
+          end
+          @_params_captures = nil
+        end
       end
     end
 

data/lib/roda/plugins/params_capturing_restore.rb

@@ -0,0 +1,72 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The params_capturing_restore plugin allows the params_capturing plugin
+    # to work with the use of +r.pass+ (pass plugin) or +break+ (break plugin)
+    # inside a block that uses param capturing, restoring the previous state of
+    # the params.
+    #
+    # This is not done by the params_capturing plugin as it requires significant
+    # extra work for every param capturing block, and most users of the
+    # params_capturing plugin are not using the pass or break plugins.
+    module ParamsCapturingRestore
+      REQUEST_INSTANCE_VARIABLES = [:@_params_captures_restore].freeze
+
+      ABSENT = Object.new.freeze
+      private_constant :ABSENT
+
+      def self.load_dependencies(app)
+        app.plugin :params_capturing
+      end
+
+      module RequestMethods
+        private
+
+        # Restore previous state of the params before capturing when
+        # the block exits.
+        def if_match(args)
+          params = self.params
+          num_captures = params['captures'].length
+          old_params = nil
+
+          super do |*a|
+            old_params = @_params_captures_restore
+            @_params_captures_restore = nil
+            yield(*a)
+          end
+        ensure
+          if old_params
+            old_params.each_slice(2) do |k, v|
+              if v == ABSENT
+                params.delete(k)
+              else
+                params[k] = v
+              end
+            end
+          end
+
+          captures = params['captures']
+          if num_captures != captures.length
+            captures.slice!(num_captures, 1000000)
+          end
+        end
+
+        # Record the original value of the params before calling super
+        # to update the params.
+        def _set_params_captures(a)
+          restore = @_params_captures_restore = []
+          @_params_captures.zip(a).each do |k,v|
+            restore << k << params.fetch(k, ABSENT)
+          end
+
+          super
+        end
+      end
+    end
+
+    register_plugin(:params_capturing_restore, ParamsCapturingRestore)
+  end
+end
+

data/lib/roda/plugins/part.rb

@@ -44,19 +44,19 @@ class Roda
               render(template, :locals=>locals, &block)
             end
           RUBY
-        # :nocov:
+        # simplecov:disable
         else
           def part(template, locals=OPTS, &block)
             render(template, :locals=>locals, &block)
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def part(template, ...)
               if optimized_method = _optimized_render_method_for_locals(template, OPTS)

data/lib/roda/plugins/pass.rb

@@ -29,7 +29,10 @@ class Roda
 
         # Handle passing inside the match block.
         def always
-          catch(:pass){super}
+          rp = @remaining_path
+          ret = catch(:pass){super}
+          @remaining_path = rp
+          ret
         end
 
         # Handle passing inside the match block.

data/lib/roda/plugins/path.rb

@@ -169,17 +169,17 @@ class Roda
                 # Allow calling private _method to get path
                 relative_path(request.script_name.to_s + send(_meth, *a, &blk))
               end
-              # :nocov:
+              # simplecov:disable
               ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true)
-              # :nocov:
+              # simplecov:enable
             elsif add_script_name
               define_method(meth) do |*a, &blk|
                 # Allow calling private _method to get path
                 request.script_name.to_s + send(_meth, *a, &blk)
               end
-              # :nocov:
+              # simplecov:disable
               ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true)
-              # :nocov:
+              # simplecov:enable
             else
               define_method(meth, &block)
             end
@@ -198,9 +198,9 @@ class Roda
             end
 
             define_method(url_meth, &url_block)
-            # :nocov:
+            # simplecov:disable
             ruby2_keywords(url_meth) if respond_to?(:ruby2_keywords, true)
-            # :nocov:
+            # simplecov:enable
           end
 
           nil

data/lib/roda/plugins/path_matchers.rb

@@ -29,12 +29,16 @@ class Roda
     #     # Matches '/foo.bar', yielding 'foo'
     #     # Does not match bar.foo
     #   end
+    #
+    # Note that all of these matchers treat a given string as regexp source,
+    # so if you are including regexp metacharacters but want a literal string
+    # match, use +Regexp.escape+.
     module PathMatchers
       module RequestMethods
         # Match when the current segment ends with the given extension.
         # request path end with the extension.
         def match_extension(ext)
-          match_suffix(".#{ext}")
+          match_suffix("\\.#{ext}")
         end
 
         # Match when the current path segment starts with the given prefix.

data/lib/roda/plugins/public.rb

@@ -46,10 +46,10 @@ class Roda
       ENCODING_MAP = {:zstd=>'zstd', :brotli=>'br', :gzip=>'gzip'}.freeze
       ENCODING_EXTENSIONS = {'br'=>'.br', 'gzip'=>'.gz', 'zstd'=>'.zst'}.freeze
 
-      # :nocov:
+      # simplecov:disable
       PARSER = defined?(::URI::RFC2396_PARSER) ? ::URI::RFC2396_PARSER : ::URI::DEFAULT_PARSER
       MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
-      # :nocov:
+      # simplecov:enable
 
       # Use options given to setup a Rack::File instance for serving files. Options:
       # :brotli :: Whether to serve already brotli-compressed files with a .br extension
@@ -114,9 +114,9 @@ class Roda
         def public_file_readable?(path)
           ::File.file?(path) && ::File.readable?(path)
         rescue SystemCallError
-          # :nocov:
+          # simplecov:disable
           false
-          # :nocov:
+          # simplecov:enable
         end
 
         def public_serve_with(server)

data/lib/roda/plugins/render.rb

@@ -46,8 +46,11 @@ class Roda
     #
     # The following plugin options are supported:
     #
-    # :allowed_paths :: Set the template paths to allow.  Attempts to render paths outside
-    #                   of these paths will raise an error.  Defaults to the +:views+ directory.
+    # :allowed_paths :: Set the template directories to allow.  Attempts to render paths outside
+    #                   of these directories will raise an error.  Defaults to the +:views+ option,
+    #                   if it is a directory.  For backwards compatibility, if a non-directory is
+    #                   given, it will be used as a prefix match. Roda 4 will raise if a non-directory
+    #                   is given as an allowed path and +:check_paths+ is true.
     # :assume_fixed_locals :: Set if you are sure all templates in your application use fixed locals
     #                         to allow for additional optimization. This is ignored unless both
     #                         compiled methods and fixed locals are not supported.
@@ -298,24 +301,24 @@ class Roda
         def self.tilt_template_fixed_locals?(template)
           template.fixed_locals?
         end
-      # :nocov:
+      # simplecov:disable
       else
         def self.tilt_template_fixed_locals?(template)
           false
         end
       end
-      # :nocov:
+      # simplecov:enable
 
       if compiled_method_arity == -2
         def self.tilt_template_compiled_method(template, locals_keys, scope_class)
           template.send(:compiled_method, locals_keys, scope_class)
         end
-      # :nocov:
+      # simplecov:disable
       else
         def self.tilt_template_compiled_method(template, locals_keys, scope_class)
           template.send(:compiled_method, locals_keys)
         end
-      # :nocov:
+      # simplecov:enable
       end
 
       # Setup default rendering options.  See Render for details.
@@ -331,9 +334,18 @@ class Roda
         opts = app.opts[:render]
         opts[:engine] = (opts[:engine] || "erb").dup.freeze
         opts[:views] = app.expand_path(opts[:views]||"views").freeze
-        opts[:allowed_paths] ||= [opts[:views]].freeze
-        opts[:allowed_paths] = opts[:allowed_paths].map{|f| app.expand_path(f, nil)}.uniq.freeze
         opts[:check_paths] = true unless opts.has_key?(:check_paths)
+        opts[:allowed_paths] ||= [opts[:views]]
+        opts[:allowed_paths] = opts[:allowed_paths].map do |f|
+          path = app.expand_path(f, nil)
+          if File.directory?(path) || f == opts[:views]
+            path << "/"
+          elsif opts[:check_paths]
+            # RODA4: raise
+            RodaPlugins.warn("allowed path #{f.inspect} is not a directory in the file system. For backwards compatibility, will allow prefix matches, but this could result in security issues. Roda 4 will raise if an allowed path is not a directory.")
+          end
+          path.freeze
+        end.uniq.freeze
         opts[:assume_fixed_locals] &&= FIXED_LOCALS_COMPILED_METHOD_SUPPORT
 
         unless opts.has_key?(:check_template_mtime)
@@ -763,7 +775,7 @@ class Roda
                 end
               end
             RUBY
-          # :nocov:
+          # simplecov:disable
           elsif RUBY_VERSION >= '2'
             class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
               def _call_optimized_template_method((meth, fixed_locals), locals, &block)
@@ -787,7 +799,7 @@ class Roda
               send(meth, locals, &block)
             end
           end
-          # :nocov:
+          # simplecov:enable
         else
           def _cached_template_method(_)
             nil
@@ -981,9 +993,9 @@ class Roda
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def _call_optimized_template_method((meth,_), locals, &block)
               send(meth, **locals, &block)

data/lib/roda/plugins/render_coverage.rb

@@ -1,9 +1,9 @@
 # frozen-string-literal: true
 
 require 'tilt'
-# :nocov:
+# simplecov:disable
 raise 'Tilt version does not support coverable templates' unless Tilt::Template.method_defined?(:compiled_path=)
-# :nocov:
+# simplecov:enable
 
 #
 class Roda
@@ -55,8 +55,9 @@ class Roda
           path = File.expand_path(opts[:path])
           compiled_path = nil
           (self.opts[:render_coverage_strip_paths] || render_opts[:allowed_paths]).each do |dir|
-            if path.start_with?(dir + '/')
-              compiled_path = File.join(self.opts[:render_coverage_dir], path[dir.length+1, 10000000].tr('/', '-'))
+            dir += "/" unless dir.end_with?("/")
+            if path.start_with?(dir)
+              compiled_path = File.join(self.opts[:render_coverage_dir], path[dir.length, 10000000].tr('/', '-'))
               break
             end
           end
@@ -76,9 +77,9 @@ class Roda
           template = super
 
           # Set compiled path for template when using older tilt versions.
-          # :nocov:
+          # simplecov:disable
           template.compiled_path = compiled_path if compiled_path
-          # :nocov:
+          # simplecov:enable
 
           template
         end

data/lib/roda/plugins/render_each.rb

@@ -171,12 +171,12 @@ class Roda
 
             File.basename(template).sub(/\..+\z/, '').to_sym
           end
-        # :nocov:
+        # simplecov:disable
         else
           def render_each_default_local(template)
             File.basename(template.to_s).sub(/\..+\z/, '').to_sym
           end
-        # :nocov:
+        # simplecov:enable
         end
 
         if Render::COMPILED_METHOD_SUPPORT

data/lib/roda/plugins/route_block_args.rb

@@ -1,5 +1,7 @@
 # frozen-string-literal: true
 
+# RODA4: Remove plugin
+
 #
 class Roda
   module RodaPlugins
@@ -22,6 +24,10 @@ class Roda
     #       end
     #     end
     #   end
+    #
+    # This plugin will be no longer ship with Roda starting in Roda 4. Users
+    # are encouraged to switch to defining local variables at the top of the
+    # route block instead of using this plugin.
     module RouteBlockArgs
       def self.configure(app, &block)
         app.instance_exec do 

data/lib/roda/plugins/route_csrf.rb

@@ -57,13 +57,18 @@ class Roda
     # :csrf_failure :: The action to taken if a request fails the CSRF check (default: :raise).  Options:
     #                  :raise :: raise a Roda::RodaPlugins::RouteCsrf::InvalidToken exception
     #                  :empty_403 :: return a blank 403 page (rack_csrf's default behavior)
-    #                  :clear_session :: Clear the current session
+    #                  :clear_session :: Clear the current session  (deprecated)
     #                  Proc :: Treated as a routing block, called with request object
     # :check_header :: Whether the HTTP header should be checked for the token value (default: false).
     #                  If true, checks the HTTP header after checking for the form input parameter.
     #                  If :only, only checks the HTTP header and doesn't check the form input parameter.
     # :check_request_methods :: Which request methods require CSRF protection
     #                           (default: <tt>['POST', 'DELETE', 'PATCH', 'PUT']</tt>)
+    # :exempt_request_methods :: If given, specifies which request methods do not require CSRF protection.
+    #                            It is recommended to set this so an allow list approach is used, as
+    #                            :check_request_methods is the equivalent of a deny list
+    #                            (recommended: <tt>['GET', 'HEAD', 'OPTIONS', 'QUERY']</tt>, which
+    #                            will be the default in Roda 4)
     # :upgrade_from_rack_csrf_key :: If provided, the session key that should be checked for the
     #                                rack_csrf raw token.  If the session key is present, the value
     #                                will be checked against the submitted token, and if it matches,
@@ -155,6 +160,19 @@ class Roda
     #
     # By including random data in the HMAC for all tokens, different tokens are generated
     # each time, mitigating compression ratio attacks such as BREACH.
+    #
+    # == REQUEST_METHOD modifications
+    #
+    # It's possible to use Rack middleware that modify REQUEST_METHOD in the env hash,
+    # such that it does not reflect that actual request method. One example of this is
+    # Rack::MethodOverride. Using such middleware is generally bad from a security perspective,
+    # but if you want to do so anyway, you need to override the request method that the
+    # route_csrf plugin will use so it reflects the actual request method. If you are using
+    # Rack::MethodOverride, you can use:
+    #
+    #   def csrf_request_method
+    #     env['rack.methodoverride.original_method'] || super
+    #   end
     module RouteCsrf
       # Default CSRF option values
       DEFAULTS = {
@@ -165,6 +183,7 @@ class Roda
         :require_request_specific_tokens => true,
         :csrf_failure => :raise,
         :check_header => false,
+        # RODA4: Remove and set :exempt_request_methods by default
         :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze)
       }.freeze
 
@@ -186,6 +205,9 @@ class Roda
           options[:csrf_failure] = :csrf_failure_method
           app.define_roda_method(:_roda_route_csrf_failure, 1, &app.send(:convert_route_block, block))
         end
+        if opts[:csrf_failure] == :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the route_csrf plugin is deprecated"
+        end
         options[:env_header] = "HTTP_#{options[:header].to_s.tr('-', '_').upcase}".freeze
         options.freeze
       end
@@ -212,6 +234,7 @@ class Roda
               headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
               throw :halt, @_response.finish_with_body([])
             when :clear_session
+              RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to check_csrf! is deprecated"
               session.clear
             when :csrf_failure_method
               @_request.on{_roda_route_csrf_failure(@_request)}
@@ -297,13 +320,22 @@ class Roda
 
         private
 
+        # The request method to use to determine whether to perform a CSRF check.
+        # defaults to REQUEST_METHOD in the environment, can be overridden if
+        # that isn't the actual request method.
+        def csrf_request_method
+          @_request.env['REQUEST_METHOD']
+        end
+
         # Returns error message string if the CSRF token is not valid.
         # Returns nil if the CSRF token is valid.
         def csrf_invalid_message(opts)
           opts = opts.empty? ? csrf_options : csrf_options.merge(opts)
-          method = request.request_method
+          method = csrf_request_method
 
-          unless opts[:check_request_methods].include?(method)
+          if exempt = opts[:exempt_request_methods]
+            return if exempt.include?(method)
+          elsif !opts[:check_request_methods].include?(method)
             return
           end