roda 3.107.0 → 3.108.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84bb84bd98ebe0d00d48315d9036ae1c22d93c92715922a6dba297f225c9fec7
-  data.tar.gz: 7cf2abbe3656ec22aef206a4e895c2520a8f80dc0ed11ec058a8a5f4cf3194b5
+  metadata.gz: 88f17808e272159aaa6d5f1239eeb3453935aa188c0933b753e5a66046212e03
+  data.tar.gz: 952920ff3e1dafeefea80acefcbd3fb5e03f0033c2ca909757c697e2acd7c955
 SHA512:
-  metadata.gz: 874ed7d5065e77c593bccd1939d3742acf3e65a0b6ea6eb95e02cd6ce9ca55c9819cfafe6ecfc61ce548075832b91c68800e7f5ae35774efb60949f0a86cb1ae
-  data.tar.gz: 40a37368dfc79527849fec46d615c26680cad15dd590b8b6a3dba0fa2809c2b90bacefa70f65b78566f88c62485f97afd715494a214fcc87050125ac7743d519
+  metadata.gz: fdd21d3152a257f21d1cfb33562334b71de82e1f017899dae0d5e9974f9b1028824c017f82d54405d5f88bed4d53607f6c238bb21c1907492da38b3b755e1a73
+  data.tar.gz: 61ed1ac97df5919e486a82abb62ad47b45603ec3c46d230ce6aa6f7ac697cd52b45af167a597ad691ec6de5267886e6b420efc0d3117a3604ba45f613703e80d

data/lib/roda/plugins/_base64.rb

@@ -9,12 +9,12 @@ class Roda
           def decode64(str)
             str.unpack1("m0")
           end
-        # :nocov:
+        # simplecov:disable
         else
           def decode64(str)
             str.unpack("m0")[0]
           end
-        # :nocov:
+        # simplecov:enable
         end
 
         def urlsafe_encode64(bin)

data/lib/roda/plugins/_optimized_matching.rb

@@ -44,6 +44,7 @@ class Roda
                 rp = @remaining_path
                 if rp.getbyte(0) == 47
                   if last = rp.index('/', 1)
+                    return false if last == 1
                     @remaining_path = rp[last, rp.length]
                     always{yield rp[1, last-1]}
                   elsif (len = rp.length) > 1

data/lib/roda/plugins/all_verbs.rb

@@ -6,7 +6,7 @@ class Roda
     # The all_verbs plugin adds methods for http verbs other than
     # get and post.  The following verbs are added, assuming
     # rack handles them: delete, head, options, link, patch, put,
-    # trace, unlink.
+    # query, trace, unlink.
     #
     # These methods operate just like Roda's default get and post
     # methods, so using them without any arguments just checks for
@@ -33,7 +33,7 @@ class Roda
     # isn't documentation for the individual methods created.
     module AllVerbs
       module RequestMethods
-        %w'delete head options link patch put trace unlink'.each do |verb|
+        %w'delete head options link patch put query trace unlink'.each do |verb|
           if ::Rack::Request.method_defined?("#{verb}?")
             class_eval(<<-END, __FILE__, __LINE__+1)
               def #{verb}(*args, &block)

data/lib/roda/plugins/assets.rb

@@ -659,9 +659,9 @@ class Roda
           begin
             require 'uglifier'
           rescue => e
-            # :nocov:
+            # simplecov:disable
             raise CompressorNotFound, "#{e.class}: #{e.message}", e.backtrace
-            # :nocov:
+            # simplecov:enable
           end
 
           Uglifier.compile(content)
@@ -689,11 +689,11 @@ class Roda
           digest = begin
             require 'openssl'
             ::OpenSSL::Digest
-          # :nocov:
+          # simplecov:disable
           rescue LoadError
             require 'digest/sha2'
             ::Digest
-          # :nocov:
+          # simplecov:enable
           end
           digest.const_get(algo.to_s.upcase).hexdigest(content)
         end

data/lib/roda/plugins/bearer_token.rb

@@ -8,9 +8,9 @@ class Roda
     # in the authorization header will be recognized as long as they start
     # with the case insensitive string "bearer ".
     module BearerToken
-      # :nocov:
+      # simplecov:disable
       METHOD = RUBY_VERSION >= "2.4" ? :match? : :match
-      # :nocov:
+      # simplecov:enable
 
       module RequestMethods
         # Return the bearer token for the request if there is one in the

data/lib/roda/plugins/break.rb

@@ -22,12 +22,20 @@ class Roda
     #   end
     #
     # This provides the same basic feature as the pass plugin, but
-    # uses Ruby's standard control flow primative instead of a
+    # uses Ruby's standard control flow primitive instead of a
     # separate method.
     module Break
       module RequestMethods
         private
 
+        # Handle passing inside the match block.
+        def always
+          rp = @remaining_path
+          super
+        ensure
+          @remaining_path = rp
+        end
+
         # Handle break inside match blocks, restoring remaining path.
         def if_match(_)
           rp = @remaining_path

data/lib/roda/plugins/caching.rb

@@ -75,28 +75,27 @@ class Roda
         # Set the last modified time of the resource using the Last-Modified header.
         # The +time+ argument should be a Time instance.
         #
-        # If the current request includes an If-Modified-Since header that is
-        # equal or later than the time specified, immediately returns a response
-        # with a 304 status.
-        #
         # If the current request includes an If-Unmodified-Since header that is
         # before than the time specified, immediately returns a response
         # with a 412 status.
+        #
+        # If the current request does not include an If-None-Match header and
+        # includes an If-Modified-Since header that is equal or later than the
+        # time specified, immediately returns a response with a 304 status.
         def last_modified(time)
           return unless time
           res = response
           e = env
           res[RodaResponseHeaders::LAST_MODIFIED] = time.httpdate
-          return if e['HTTP_IF_NONE_MATCH']
           status = res.status
 
-          if (!status || status == 200) && (ims = time_from_header(e['HTTP_IF_MODIFIED_SINCE'])) && ims >= time.to_i
-            res.status = 304
+          if (!status || (status >= 200 && status < 300) || status == 412) && (ius = time_from_header(e['HTTP_IF_UNMODIFIED_SINCE'])) && ius < time.to_i
+            res.status = 412
             halt
           end
 
-          if (!status || (status >= 200 && status < 300) || status == 412) && (ius = time_from_header(e['HTTP_IF_UNMODIFIED_SINCE'])) && ius < time.to_i
-            res.status = 412
+          if !e['HTTP_IF_NONE_MATCH'] && (!status || status == 200) && (ims = time_from_header(e['HTTP_IF_MODIFIED_SINCE'])) && ims >= time.to_i
+            res.status = 304
             halt
           end
         end
@@ -113,8 +112,9 @@ class Roda
         # matching etag, immediately returns a response with a 304 or 412 status,
         # depending on the request method.
         #
-        # When the current request includes an If-Match header with a
-        # etag that doesn't match, immediately returns a response with a 412 status.
+        # When the current request includes an If-Match header with an etag that
+        # doesn't match, or where the :weak option was used, immediately returns a
+        # response with a 412 status.
         def etag(value, opts=OPTS)
           # Before touching this code, please double check RFC 2616 14.24 and 14.26.
           weak = opts[:weak]
@@ -132,7 +132,7 @@ class Roda
             end
 
             if ifm = e['HTTP_IF_MATCH']
-              unless etag_matches?(ifm, etag, new_resource)
+              if weak || !etag_matches?(ifm, etag, new_resource)
                 res.status = 412
                 halt
               end

data/lib/roda/plugins/common_logger.rb

@@ -36,11 +36,11 @@ class Roda
           Process.clock_gettime(Process::CLOCK_MONOTONIC)
         end
       else
-        # :nocov:
+        # simplecov:disable
         def self.start_timer # :nodoc:
           Time.now
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module InstanceMethods
@@ -61,10 +61,10 @@ class Roda
           line = "#{env['HTTP_X_FORWARDED_FOR'] || env["REMOTE_ADDR"] || "-"} - #{env["REMOTE_USER"] || "-"} [#{Time.now.strftime("%d/%b/%Y:%H:%M:%S %z")}] \"#{env["REQUEST_METHOD"]} #{env["SCRIPT_NAME"]}#{env["PATH_INFO"]}#{"?#{env["QUERY_STRING"]}" if ((qs = env["QUERY_STRING"]) && !qs.empty?)} #{@_request.http_version}\" #{status} #{((length = headers[RodaResponseHeaders::CONTENT_LENGTH]) && (length unless length == '0')) || '-'} #{elapsed_time} "
           if MUTATE_LINE
             line.gsub!(/[^[:print:]]/){|c| sprintf("\\x%x", c.ord)}
-          # :nocov:
+          # simplecov:disable
           else
             line = line.gsub(/[^[:print:]]/){|c| sprintf("\\x%x", c.ord)}
-          # :nocov:
+          # simplecov:enable
           end
           line[-1] = "\n"
           opts[:common_logger_meth].call(line)

data/lib/roda/plugins/cookie_flags.rb

@@ -48,9 +48,9 @@ class Roda
     # Note that this plugin only affects cookies set by the application, and does not
     # affect cookies set by middleware the application is using.
     module CookieFlags
-      # :nocov:
+      # simplecov:disable
       MATCH_METH = RUBY_VERSION >= '2.4' ? :match? : :match
-      # :nocov:
+      # simplecov:enable
       private_constant :MATCH_METH
 
       DEFAULTS = {:secure=>true, :httponly=>true, :same_site=>'strict', :action=>:modify}.freeze

data/lib/roda/plugins/each_part.rb

@@ -43,19 +43,19 @@ class Roda
               render_each(enum, template, :locals=>locals, &block)
             end
           RUBY
-        # :nocov:
+        # simplecov:disable
         else
           def each_part(enum, template, locals=OPTS, &block)
             render_each(enum, template, :locals=>locals, &block)
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def each_part(enum, template, **locals, &block)
               if optimized_method = _cached_render_each_template_method(template)

data/lib/roda/plugins/error_email.rb

@@ -44,9 +44,9 @@ class Roda
         :filter=>lambda{|k,v| false},
         :headers=>OPTS,
         :host=>'localhost',
-        # :nocov:
+        # simplecov:disable
         :emailer=>lambda{|h| Net::SMTP.start(h[:host]){|s| s.send_message(h[:message], h[:from], h[:to])}},
-        # :nocov:
+        # simplecov:enable
         :default_headers=>lambda do |h, e|
           subject = if e.respond_to?(:message)
             "#{e.class}: #{e.message}"

data/lib/roda/plugins/exception_page.rb

@@ -415,14 +415,14 @@ END
           def exception_page_exception_message(exception)
             exception.detailed_message(highlight: false).to_s
           end
-        # :nocov:
+        # simplecov:disable
         else
           # Return message to use for exception.
           def exception_page_exception_message(exception)
             exception.message.to_s
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module RequestMethods

data/lib/roda/plugins/h.rb

@@ -17,10 +17,10 @@ class Roda
       begin
         require 'cgi/escape'
         unless CGI.respond_to?(:escapeHTML) # work around for JRuby 9.1
-          # :nocov:
+          # simplecov:disable
           CGI = Object.new
           CGI.extend(defined?(::CGI::Escape) ? ::CGI::Escape : ::CGI::Util)
-          # :nocov:
+          # simplecov:enable
         end
 
         module InstanceMethods
@@ -30,7 +30,7 @@ class Roda
           end
         end
       rescue LoadError
-        # :nocov:
+        # simplecov:disable
 
         # A Hash of entities and their escaped equivalents,
         # to be escaped by h().
@@ -50,7 +50,7 @@ class Roda
             string.to_s.gsub(ESCAPE_HTML_PATTERN){|c| ESCAPE_HTML[c] }
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
     end
 

data/lib/roda/plugins/hash_branches.rb

@@ -128,12 +128,16 @@ class Roda
           if routes = roda_class.opts[:hash_branches][namespace]
             if segment_end = rp.index('/', 1)
               if meth = routes[rp[0, segment_end]]
-                @remaining_path = rp[segment_end, 100000000]
-                always{scope.send(meth, self)}
+                always do
+                  @remaining_path = rp[segment_end, 100000000]
+                  scope.send(meth, self)
+                end
               end
             elsif meth = routes[rp]
-              @remaining_path = ''
-              always{scope.send(meth, self)}
+              always do
+                @remaining_path = ''
+                scope.send(meth, self)
+              end
             end
           end
         end

data/lib/roda/plugins/hash_paths.rb

@@ -116,8 +116,10 @@ class Roda
         # remaining path, and dispatch to that block if there is one.
         def hash_paths(namespace=matched_path)
           if (routes = roda_class.opts[:hash_paths][namespace]) && (meth = routes[@remaining_path])
-            @remaining_path = ''
-            always{scope.send(meth, self)}
+            always do
+              @remaining_path = ''
+              scope.send(meth, self)
+            end
           end
         end
       end

data/lib/roda/plugins/hash_public.rb

@@ -51,11 +51,11 @@ class Roda
       Digest = begin
         require 'openssl'
         ::OpenSSL::Digest
-      # :nocov:
+      # simplecov:disable
       rescue LoadError
         require 'digest/sha2'
         ::Digest
-      # :nocov:
+      # simplecov:enable
       end
 
       def self.load_dependencies(app, opts = OPTS)

data/lib/roda/plugins/hmac_paths.rb

@@ -346,43 +346,41 @@ class Roda
 
             if submitted_hmac.bytesize == 64
               on String do |flags|
-                if flags.bytesize >= 1
-                  if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
-                    # Namespace required and not provided, or provided and not required.
-                    # Bail early to avoid unnecessary HMAC calculation.
-                    @remaining_path = orig_path
-                    return
-                  end
+                if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
+                  # Namespace required and not provided, or provided and not required.
+                  # Bail early to avoid unnecessary HMAC calculation.
+                  @remaining_path = orig_path
+                  return
+                end
 
-                  if flags.include?('m')
-                    rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
-                  end
+                if flags.include?('m')
+                  rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
+                end
 
-                  if flags.include?('p')
-                    rpath = "#{rpath}?#{env["QUERY_STRING"]}"
-                  end
+                if flags.include?('p')
+                  rpath = "#{rpath}?#{env["QUERY_STRING"]}"
+                end
 
-                  if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
-                    if flags.include?('t')
-                      on Integer do |int|
-                        if int >= Time.now.to_i
-                          always(&block)
-                        else
-                          # Return from method without matching
-                          @remaining_path = orig_path
-                          return
-                        end
+                if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
+                  if flags.include?('t')
+                    on Integer do |int|
+                      if int >= Time.now.to_i
+                        always(&block)
+                      else
+                        # Return from method without matching
+                        @remaining_path = orig_path
+                        return
                       end
-                    else
-                      always(&block)
                     end
+                  else
+                    always(&block)
                   end
                 end
-
-                # Return from method without matching
-                @remaining_path = orig_path
-                return
               end
+
+              # Return from method without matching
+              @remaining_path = orig_path
+              return
             end
 
             # Return from method without matching

data/lib/roda/plugins/host_routing.rb

@@ -68,8 +68,29 @@ class Roda
     #     end
     #   end
     #
-    # This plugin uses the host method on the request to get the hostname (this method
-    # is defined by Rack).
+    # This plugin uses the +host+ method on the request to get the hostname (this method
+    # is defined by Rack). Note that as of Rack 3.2, Rack's default approach to determine
+    # the hostname is insecure in many cases, since:
+    #
+    # * It will use a forwarded header instead of the +host+ header by default if the
+    #   request was from a trusted proxy.
+    # * Rack trust proxies from any private IP address range by default
+    #   (this can be disabled using <tt>Rack::Request.ip_filter=</tt>).
+    # * Rack supports both +forwarded+ and <tt>x-forwarded-host</tt> headers, will check
+    #   both by default, and the order of checking depends on Rack's configuration
+    #   (this can be configured using <tt>Rack::Request.forwarded_priority</tt>).
+    # * If the application can be reached via an arbitrary +host+ header, the attacker
+    #   has full control over the <tt>Rack::Request#host</tt> value even when forwarded
+    #   host usage is disabled.
+    #
+    # You should configure Rack appropriately for your deployment, not allowing the use
+    # of forwarded information unless your deployment is using a reverse proxy, and only
+    # allowing the specific forwarded header set by the expected reverse proxy if a
+    # reverse proxy is used. Rack 3.3 should include more control in this area,
+    # and Rack 4 should ship with more secure defaults in regard to forwarding headers.
+    #
+    # It is recommended to use the host_authorization plugin to check that the requested
+    # host is allowed when using this plugin.
     module HostRouting
       REQUEST_INSTANCE_VARIABLES = [:@_host_routing_host].freeze
 
@@ -140,7 +161,7 @@ class Roda
         # Treat all given hostnames as routing to the give host.
         def to(host, *hostnames)
           hostnames.each do |hostname|
-            @host_hash[hostname] = host
+            @host_hash[hostname.downcase.freeze] = host
           end
         end
 
@@ -180,7 +201,11 @@ class Roda
         # * The return value of the +hosts.default+ block, if given
         # * The default value provided in the +hosts.default+ call
         def _get_host_routing_host
-          host = self.host || ""
+          if host = self.host
+            host = host.downcase
+          else
+            host = ""
+          end
 
           roda_class.opts[:host_routing_hash][host] ||
             scope._host_routing_default(host) ||

data/lib/roda/plugins/invalid_request_body.rb

@@ -72,6 +72,8 @@ class Roda
         # raises an exception.
         def POST
           super
+        rescue RodaError
+          raise
         rescue => e 
           handle_invalid_request_body(e)
         end

data/lib/roda/plugins/json_parser.rb

@@ -17,7 +17,19 @@ class Roda
     module JsonParser
       DEFAULT_ERROR_HANDLER = proc{|r| r.halt [400, {}, []]}
 
+      # simplecov:disable
+      MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
+      # simplecov:enable
+      private_constant :MATCH_METHOD
+
       # Handle options for the json_parser plugin:
+      # :content_type_regexp :: A regexp used to determine if the request's
+      #                         content type is JSON. For backwards compatibility,
+      #                         uses the insecure /json/ if not provided. Warns
+      #                         if this option is not provided. The recommended
+      #                         value to use is /\Aapplication\/json\b/i or
+      #                         /\Aapplication\/(?:vnd\.api\+)?json\b/i. Roda 4
+      #                         will default to the latter.
       # :error_handler :: A proc to call if an exception is raised when
       #                   parsing a JSON request body.  The proc is called
       #                   with the request object, and should probably call
@@ -37,6 +49,13 @@ class Roda
         app.opts[:json_parser_error_handler] = opts[:error_handler] || app.opts[:json_parser_error_handler] || DEFAULT_ERROR_HANDLER
         app.opts[:json_parser_parser] = opts[:parser] || app.opts[:json_parser_parser] || app.opts[:json_parser] || JSON.method(:parse)
         app.opts[:json_parser_include_request] = opts[:include_request] if opts.has_key?(:include_request)
+        app.opts[:json_parser_content_type_regexp] = opts[:content_type_regexp] || app.opts[:json_parser_content_type_regexp]
+
+        unless app.opts[:json_parser_content_type_regexp]
+          # RODA4: Switch to /\Aapplication\/(?:vnd\.api\+)?json\b/i by default
+          RodaPlugins.warn(':content_type_regexp option not provided to json_parser plugin, using /json/ for backwards compatibility, which may be insecure, using /\Aapplication\/json\b/i or /\Aapplication\/(?:vnd\.api\+)?json\b/i is recommended')
+          app.opts[:json_parser_content_type_regexp] = /json/
+        end
 
         case opts[:wrap]
         when :unless_hash, :always
@@ -57,7 +76,7 @@ class Roda
             return post_params
           end
 
-          unless (input = env["rack.input"]) && (content_type = self.content_type) && content_type.include?('json')
+          unless (input = env["rack.input"]) && (content_type = self.content_type) && roda_class.opts[:json_parser_content_type_regexp].send(MATCH_METHOD, content_type)
             return super
           end
 
@@ -84,7 +103,6 @@ class Roda
           args << self if roda_class.opts[:json_parser_include_request]
           roda_class.opts[:json_parser_parser].call(*args)
         end
-
         
         # Rack 3 dropped requirement that input be rewindable
         if Rack.release >= '3'

data/lib/roda/plugins/mail_processor.rb

@@ -510,11 +510,11 @@ class Roda
             a1.casecmp?(a2)
           end
         else
-          # :nocov:
+          # simplecov:disable
           def address_match?(a1, a2)
             a1.downcase == a2.downcase
           end
-          # :nocov:
+          # simplecov:enable
         end
 
         # Match if any of the given addresses match the given val, which

data/lib/roda/plugins/mailer.rb

@@ -153,9 +153,9 @@ class Roda
             mail
           end
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:mail) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         # Calls +mail+ with given arguments and immediately sends the resulting mail.
         def sendmail(*args)
@@ -163,9 +163,9 @@ class Roda
             m.deliver
           end
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:sendmail) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
       end
 
       module RequestMethods

data/lib/roda/plugins/optimized_segment_matchers.rb

@@ -27,11 +27,16 @@ class Roda
           rp = @remaining_path
           if rp.getbyte(0) == 47
             if last = rp.index('/', 1)
-              @remaining_path = rp[last, rp.length]
-              always{yield rp[1, last-1]}
+              return false if last == 1
+              always do
+                @remaining_path = rp[last, rp.length]
+                yield rp[1, last-1]
+              end
             elsif (len = rp.length) > 1
-              @remaining_path = ""
-              always{yield rp[1, len]}
+              always do
+                @remaining_path = ""
+                yield rp[1, len]
+              end
             end
           end
         end
@@ -41,8 +46,10 @@ class Roda
         def is_segment
           rp = @remaining_path
           if rp.getbyte(0) == 47 && !rp.index('/', 1) && (len = rp.length) > 1
-            @remaining_path = ""
-            always{yield rp[1, len]}
+            always do
+              @remaining_path = ""
+              yield rp[1, len]
+            end
           end
         end
       end

data/lib/roda/plugins/optimized_string_matchers.rb

@@ -28,7 +28,11 @@ class Roda
       module RequestMethods
         # Optimized version of +on+ that only supports a single string.
         def on_branch(s)
-          always{yield} if _match_string(s)
+          rp = @remaining_path
+          if _match_string(s)
+            always{yield}
+            @remaining_path = rp
+          end
         end
 
         # Optimized version of +is+ that only supports a single string.
@@ -37,9 +41,8 @@ class Roda
           if _match_string(s)
             if @remaining_path.empty?
               always{yield}
-            else
-              @remaining_path = rp
             end
+            @remaining_path = rp
           end
         end
       end