roda 3.106.0 → 3.108.0

data/lib/roda/plugins/run_append_slash.rb

@@ -22,8 +22,11 @@ class Roda
     #   # GET /a/ => App gets "/" as PATH_INFO
     module RunAppendSlash
       # Set plugin specific options.  Options:
-      # :use_redirects :: Whether to issue 302 redirects when appending the
-      #                   trailing slash.
+      # :use_redirects :: Whether to issue a redirect to the path with the slash
+      #                   appended, instead of calling the app directly with the
+      #                   trailing slash. Note that if the current path starts
+      #                   with +//+, it will call the app directly instead of
+      #                   redirecting.
       def self.configure(app, opts=OPTS)
         app.opts[:run_append_slash_redirect] = !!opts[:use_redirects]
       end
@@ -32,10 +35,11 @@ class Roda
         # Calls the given rack app. If the path matches the root of the app but
         # does not contain a trailing slash, a trailing slash is appended to the
         # path internally, or a redirect is issued when configured with
-        # <tt>use_redirects: true</tt>.
+        # <tt>use_redirects: true</tt>. If the path starts with +//+,
+        # the redirect approach will not be used.
         def run(*)
           if @remaining_path.empty?
-            if scope.opts[:run_append_slash_redirect]
+            if scope.opts[:run_append_slash_redirect] && !(path = self.path).start_with?('//')
               redirect("#{path}/")
             else
               @remaining_path += '/'

data/lib/roda/plugins/sec_fetch_site_csrf.rb

@@ -54,7 +54,7 @@ class Roda
     #                  :raise :: raise a Roda::RodaPlugins::SecFetchSiteCsrf::CsrfFailure
     #                            exception
     #                  :empty_403 :: return a blank 403 page
-    #                  :clear_session :: clear the current session
+    #                  :clear_session :: clear the current session (deprecated)
     #
     # The plugin also supports a block, in which case failures will call the block
     # as a routing block (the block should accept the request object).
@@ -83,8 +83,10 @@ class Roda
         end
 
         case options[:csrf_failure]
-        when :raise, :empty_403, :clear_session, :method
+        when :raise, :empty_403, :method
           # nothing
+        when :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the sec_fetch_site_csrf plugin is deprecated"
         else
           raise RodaError, "Unsupported :csrf_failure plugin option: #{options[:csrf_failure].inspect}"
         end
@@ -118,6 +120,7 @@ class Roda
             headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
             throw :halt, @_response.finish_with_body([])
           when :clear_session
+            # RODA4: Remove
             session.clear
           else # when :method
             @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)}

data/lib/roda/plugins/sessions.rb

@@ -5,9 +5,9 @@ require 'openssl'
 begin
   OpenSSL::Cipher.new("aes-256-ctr")
 rescue OpenSSL::Cipher::CipherError
-  # :nocov:
+  # simplecov:disable
   raise LoadError, "Roda sessions plugin requires the aes-256-ctr cipher"
-  # :nocov:
+  # simplecov:enable
 end
 
 require 'json'
@@ -67,7 +67,7 @@ class Roda
     #                    given, it will be merged into the default cookie options.
     # :env_key :: The key in `env` where the session should be located. Defaults to <tt>"rack.session"</tt>, the
     #             default key for sessions in Rack.
-    # :gzip_over :: For session data over this many bytes, compress it with the deflate algorithm (default: nil,
+    # :gzip_over (deprecated) :: For session data over this many bytes, compress it with the deflate algorithm (default: nil,
     #               so never compress).  Note that compression should not be enabled if you are storing data in
     #               the session derived from user input and also storing sensitive data in the session.
     # :key :: The cookie name to use (default: <tt>'roda.session'</tt>)
@@ -94,7 +94,7 @@ class Roda
     #                 (default: 3600).
     # :upgrade_from_rack_session_cookie_key :: The cookie name to use for transparently upgrading from
     #                                          Rack::Session:Cookie (defaults to <tt>'rack.session'</tt>).
-    # :upgrade_from_rack_session_cookie_secret :: The secret for the HMAC-SHA1 signature when allowing
+    # :upgrade_from_rack_session_cookie_secret (deprecated) :: The secret for the HMAC-SHA1 signature when allowing
     #                                             transparent upgrades from Rack::Session::Cookie. Using this
     #                                             option is only recommended during a short transition period,
     #                                             and is not enabled by default as it lowers security.
@@ -189,12 +189,17 @@ class Roda
         opts[:session_version_num] = opts[:per_cookie_cipher_secret] ? 1 : 0
 
         if opts[:upgrade_from_rack_session_cookie_secret]
+          RodaPlugins.warn("Support for upgrading rack session cookie sessions will be removed in Roda 4.")
           opts[:upgrade_from_rack_session_cookie_key] ||= 'rack.session'
           rsco = opts[:upgrade_from_rack_session_cookie_options] = Hash[opts[:upgrade_from_rack_session_cookie_options] || OPTS]
           rsco[:path] ||= co[:path]
           rsco[:domain] ||= co[:domain]
         end
 
+        if opts[:gzip_over]
+          RodaPlugins.warn("Support for compressing session data will be removed in Roda 4.")
+        end
+
         opts[:cipher_secret], opts[:hmac_secret] = split_secret(:secret, opts[:secret])
         opts[:old_cipher_secret], opts[:old_hmac_secret] = (split_secret(:old_secret, opts[:old_secret]) if opts[:old_secret])
 

data/lib/roda/plugins/shape_friendly.rb

@@ -90,9 +90,9 @@ class Roda
           end
           nil
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:plugin) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         private
 
@@ -132,9 +132,9 @@ class Roda
         end
       end
 
-      # :nocov:
+      # simplecov:disable
       if RUBY_VERSION >= '4.0'
-      # :nocov:
+      # simplecov:enable
         module InstanceMethods
           private
 

data/lib/roda/plugins/static.rb

@@ -1,5 +1,7 @@
 # frozen-string-literal: true
 
+# RODA4: Remove plugin
+
 require 'rack/static'
 
 #
@@ -19,6 +21,9 @@ class Roda
     # uses a separate option for it.
     #
     # Users of this plugin may want to consider using the public plugin instead.
+    # As this only loads a middleware, it does not integrate with other Roda
+    # security features, such as the content_security_policy and host_authorization
+    # plugins.
     # 
     # Examples:
     #
@@ -26,6 +31,15 @@ class Roda
     #   plugin :static, ['/js', '/css'] # path: /path/to/app/public
     #   plugin :static, ['/images'], root: 'pub'  # path: /path/to/app/pub
     #   plugin :static, ['/media'], root: '/path/to/public' # path: /path/to/public
+    #
+    # This plugin will no longer ship with Roda starting in Roda 4. As the plugin only
+    # configures a middleware, you should switch to doing so directly. Translating
+    # the above example to direct middleware usage:
+    #
+    #   require 'rack/static'
+    #   use Rack::Static, urls: ['/js', '/css'], root: '/path/to/app/public'
+    #   use Rack::Static, urls: ['/images'], root: '/path/to/app/pub'
+    #   use Rack::Static, urls: ['/media'], root: '/path/to/public'
     module Static
       # Load the Rack::Static middleware.  Use the paths given as the :urls option,
       # and set the :root option to be relative to the application's :root option.

data/lib/roda/plugins/type_routing.rb

@@ -198,11 +198,11 @@ class Roda
         # The response type indicated by the Accept request header.
         def accept_response_type
           mimes = @scope.opts[:type_routing][:mimes]
+          response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
 
           @env['HTTP_ACCEPT'].to_s.split(/\s*,\s*/).map do |part|
             mime, _= part.split(/\s*;\s*/, 2)
             if sym = mimes[mime]
-              response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
               return sym
             end
           end

data/lib/roda/plugins/url_escape.rb

@@ -0,0 +1,39 @@
+# frozen-string-literal: true
+
+require 'rack/utils'
+
+#
+class Roda
+  module RodaPlugins
+    # The url_escape plugin add url_escape and url_unescape methods
+    # to the route block scope.
+    #
+    #   plugin :url_escape
+    #
+    #   route do |r|
+    #     link = "/path/q=#{url_escape(r.params["some_param"])}"
+    #     response_body(link)
+    #   end
+    module UrlEscape
+      module InstanceMethods
+        if RUBY_VERSION >= '2'
+          define_method(:url_escape, Rack::Utils.instance_method(:escape))
+          define_method(:url_unescape, Rack::Utils.instance_method(:unescape))
+        # simplecov:disable
+        else
+          def url_escape(v)
+            Rack::Utils.escape(v)
+          end
+
+          def url_unescape(v)
+            Rack::Utils.unescape(v)
+          end
+        end
+        # simplecov:enable
+      end
+    end
+
+    register_plugin(:url_escape, UrlEscape)
+  end
+end
+

data/lib/roda/plugins/view_options.rb

@@ -158,13 +158,11 @@ class Roda
         # template isn't a layout template, merge the options
         # and locals into the returned hash.
         def parse_template_opts(template, opts)
-          t_opts = super
-
-          if !t_opts[:_is_layout] && (v_opts = @_view_options)
-            t_opts.merge!(v_opts)
+          if (v_opts = @_view_options) && (!template.is_a?(Hash) || !template[:_is_layout])
+            opts = v_opts.merge(opts)
           end
 
-          t_opts
+          super
         end
 
         # If layout options or locals have been set,

data/lib/roda/plugins.rb

@@ -43,11 +43,11 @@ class Roda
     # Deprecate the constant with the given name in the given module,
     # if the ruby version supports it.
     def self.deprecate_constant(mod, name)
-      # :nocov:
+      # simplecov:disable
       if RUBY_VERSION >= '2.3'
         mod.deprecate_constant(name)
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     if RUBY_VERSION >= '3.3'
@@ -57,12 +57,12 @@ class Roda
         mod.set_temporary_name(yield)
         mod
       end
-    # :nocov:
+    # simplecov:disable
     else
       def self.set_temp_name(mod)
         mod
       end
     end
-    # :nocov:
+    # simplecov:enable
   end
 end

data/lib/roda/request.rb

@@ -437,8 +437,15 @@ class Roda
 
         # Match the given hash if all hash matchers match.
         def _match_hash(hash)
+          rp = @remaining_path
+          captures_len = @captures.length
+
           # Allow calling private methods, as match methods are generally private
-          hash.all?{|k,v| send("match_#{k}", v)}
+          return true if hash.all?{|k,v| send("match_#{k}", v)}
+
+          @remaining_path = rp
+          @captures.slice!(captures_len, 10000000)
+          false
         end
 
         # Match integer segment of up to 100 decimal characters, and yield resulting value as an
@@ -510,6 +517,7 @@ class Roda
           rp = @remaining_path
           if rp.getbyte(0) == 47
             if last = rp.index('/', 1)
+              return false if last == 1
               @captures << rp[1, last-1]
               @remaining_path = rp[last, rp.length]
             elsif (len = rp.length) > 1
@@ -568,11 +576,12 @@ class Roda
 
             if meth
               return unless captures = scope.send(meth, *captures)
-            # :nocov:
+            # simplecov:disable
+            # RODA4: Remove elsif block
             elsif defined?(yield)
-              # RODA4: Remove
+              RodaPlugins.warn("Passing a block to RodaRequest#consume will be ignored in Roda 4. Update the code to pass a scope method symbol as the second argument.")
               return unless captures = yield(*captures)
-            # :nocov:
+            # simplecov:enable
             end
 
             @remaining_path = matchdata.post_match
@@ -593,13 +602,13 @@ class Roda
             if regexp.match?(rp)
               if last = rp.index('/', 1)
                 val = rp[1, last-1]
-                @remaining_path = rp[last, rp.length]
+                new_rp = rp[last, rp.length]
               else
                 val = rp[1, rp.length]
-                @remaining_path = ""
+                new_rp = ""
               end
 
-              if meth
+              ret = if meth
                 if captures = scope.send(meth, val)
                   if captures.is_a?(Array)
                     @captures.concat(captures)
@@ -610,12 +619,16 @@ class Roda
               else
                 @captures << val
               end
+
+              @remaining_path = new_rp if ret
+
+              ret
             end
           end
-        # :nocov:
+        # simplecov:disable
         else
           alias _consume_single_segment consume
-        # :nocov:
+        # simplecov:enable
         end
 
         # The default path to use for redirects when a path is not given.
@@ -626,9 +639,13 @@ class Roda
         #
         # If the current request is a GET request, raise an error, as otherwise
         # it is easy to create an infinite redirect.
+        #
+        # If the path starts +//+, then this redirects to the root path
+        # (+/+) instead of using a protocol-relative redirect.
         def default_redirect_path
           raise RodaError, "must provide path argument to redirect for get requests" if is_get?
-          path
+          path = self.path
+          path.start_with?('//') ? '/' : path
         end
 
         # The default status to use for redirects if a status is not provided,

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 106
+  RodaMinorVersion = 108
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

data/lib/roda.rb

@@ -71,29 +71,34 @@ class Roda
         #
         # If the :check_arity app option is not set to false, Roda will check that
         # the arity of the block matches the expected arity, and compensate for
-        # cases where it does not.  If it is set to :warn, Roda will warn in the
-        # cases where the arity does not match what is expected.
+        # cases where it does not.  The :check_arity default app option setting is
+        # :warn, in which case Roda will warn in the cases where the arity does not
+        # match what is expected.
         #
         # If the expected arity is :any, Roda must perform a dynamic arity check
         # when the method is called, which can hurt performance even in the case
         # where the arity matches.  The :check_dynamic_arity app option can be
         # set to false to turn off the dynamic arity checks.  The
         # :check_dynamic_arity app option can be to :warn to warn if Roda needs
-        # to adjust arity dynamically.
+        # to adjust arity dynamically. The default value of the :check_dynamic_arity
+        # app option is to use the same value as the :check_arity app option.
         #
         # Roda only checks arity for regular blocks, not lambda blocks, as the
         # fixes Roda uses for regular blocks would not work for lambda blocks.
         #
         # Roda does not support blocks with required keyword arguments if the
         # expected arity is 0 or 1.
+        #
+        # Support for the :check_arity and :check_dynamic_arity options will be
+        # removed in Roda 4.
         def define_roda_method(meth, expected_arity, &block)
           if meth.is_a?(String)
             meth = roda_method_name(meth)
           end
           call_meth = meth
 
-          # RODA4: Switch to false # :warn in last Roda 3 version
-          if (check_arity = opts.fetch(:check_arity, true)) && !block.lambda?
+          # RODA4: Remove support for :check_arity, default to false behavior
+          if (check_arity = opts.fetch(:check_arity, :warn)) && !block.lambda?
             required_args, optional_args, rest, keyword = _define_roda_method_arg_numbers(block)
 
             if keyword == :required && (expected_arity == 0 || expected_arity == 1)
@@ -137,9 +142,9 @@ class Roda
                   block = if RUBY_VERSION >= '2.7'
                     eval('lambda{|*a, **kw| instance_exec(*a, **kw, &b)}', nil, __FILE__, __LINE__) # Keyword arguments fallback
                   else
-                    # :nocov:
+                    # simplecov:disable
                     lambda{|*a| instance_exec(*a, &b)} # Keyword arguments fallback
-                    # :nocov:
+                    # simplecov:enable
                   end
                 else
                   arity_meth = meth
@@ -221,7 +226,7 @@ class Roda
               plugin :direct_call
             end
 
-            if RUBY_VERSION > "2.4" && ([:on, :is, :_verb, :_match_class_String, :_match_class_Integer, :_match_string, :_match_regexp, :empty_path?, :if_match, :match, :_match_class]).all?{|m| self::RodaRequest.instance_method(m).owner == RequestMethods}
+            if RUBY_VERSION > "2.4" && ([:on, :is, :_verb, :_match_class_String, :_match_class_Integer, :_match_string, :_match_regexp, :empty_path?, :if_match, :match, :_match_class, :always]).all?{|m| self::RodaRequest.instance_method(m).owner == RequestMethods}
               plugin :_optimized_matching
             end
           end
@@ -307,9 +312,9 @@ class Roda
           plugin.configure(self, *args, &block) if plugin.respond_to?(:configure)
           @app = nil
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:plugin) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         # Setup routing tree for the current Roda application, and build the
         # underlying rack application using the stored middleware. Requires
@@ -345,9 +350,9 @@ class Roda
           @middleware << [args, block].freeze
           @app = nil
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:use) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         private
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.106.0
+  version: 3.108.0
 platform: ruby
 authors:
 - Jeremy Evans
@@ -259,6 +259,7 @@ files:
 - lib/roda/plugins/padrino_render.rb
 - lib/roda/plugins/param_matchers.rb
 - lib/roda/plugins/params_capturing.rb
+- lib/roda/plugins/params_capturing_restore.rb
 - lib/roda/plugins/part.rb
 - lib/roda/plugins/partials.rb
 - lib/roda/plugins/pass.rb
@@ -310,6 +311,7 @@ files:
 - lib/roda/plugins/typecast_params.rb
 - lib/roda/plugins/typecast_params_sized_integers.rb
 - lib/roda/plugins/unescape_path.rb
+- lib/roda/plugins/url_escape.rb
 - lib/roda/plugins/view_options.rb
 - lib/roda/plugins/view_subdir_leading_slash.rb
 - lib/roda/request.rb
@@ -339,7 +341,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Routing tree web toolkit
 test_files: []