roda 3.107.0 → 3.108.0

data/lib/roda/plugins/params_capturing.rb

@@ -54,14 +54,20 @@ class Roda
     # Also note that this plugin will not work correctly if you are using
     # the symbol_matchers plugin with custom symbol matching and are using
     # symbols that capture multiple values or no values.
+    #
+    # If you are using the pass or break plugin along with this plugin,
+    # it is recommended you load the params_capturing_restore plugin, as that
+    # allows +r.pass+ or +break+ inside param capturing blocking to work
+    # correctly.
     module ParamsCapturing
       REQUEST_INSTANCE_VARIABLES = [:@_params_captures].freeze
 
       module RequestMethods
         # Lazily initialize captures entry when params is called.
         def params
+          return @params if @params
           ret = super
-          ret['captures'] ||= []
+          ret['captures'] = []
           ret
         end
 
@@ -100,16 +106,19 @@ class Roda
           end
 
           super do |*a|
-            if pc
-              @_params_captures = nil
-              pc.zip(a).each do |k,v|
-                params[k] = v
-              end
-            end
+            _set_params_captures(a) if pc
             params['captures'].concat(a) 
             yield(*a)
           end
         end
+
+        # Set the captures into the parameters.
+        def _set_params_captures(a)
+          @_params_captures.zip(a).each do |k,v|
+            params[k] = v
+          end
+          @_params_captures = nil
+        end
       end
     end
 

data/lib/roda/plugins/params_capturing_restore.rb

@@ -0,0 +1,72 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The params_capturing_restore plugin allows the params_capturing plugin
+    # to work with the use of +r.pass+ (pass plugin) or +break+ (break plugin)
+    # inside a block that uses param capturing, restoring the previous state of
+    # the params.
+    #
+    # This is not done by the params_capturing plugin as it requires significant
+    # extra work for every param capturing block, and most users of the
+    # params_capturing plugin are not using the pass or break plugins.
+    module ParamsCapturingRestore
+      REQUEST_INSTANCE_VARIABLES = [:@_params_captures_restore].freeze
+
+      ABSENT = Object.new.freeze
+      private_constant :ABSENT
+
+      def self.load_dependencies(app)
+        app.plugin :params_capturing
+      end
+
+      module RequestMethods
+        private
+
+        # Restore previous state of the params before capturing when
+        # the block exits.
+        def if_match(args)
+          params = self.params
+          num_captures = params['captures'].length
+          old_params = nil
+
+          super do |*a|
+            old_params = @_params_captures_restore
+            @_params_captures_restore = nil
+            yield(*a)
+          end
+        ensure
+          if old_params
+            old_params.each_slice(2) do |k, v|
+              if v == ABSENT
+                params.delete(k)
+              else
+                params[k] = v
+              end
+            end
+          end
+
+          captures = params['captures']
+          if num_captures != captures.length
+            captures.slice!(num_captures, 1000000)
+          end
+        end
+
+        # Record the original value of the params before calling super
+        # to update the params.
+        def _set_params_captures(a)
+          restore = @_params_captures_restore = []
+          @_params_captures.zip(a).each do |k,v|
+            restore << k << params.fetch(k, ABSENT)
+          end
+
+          super
+        end
+      end
+    end
+
+    register_plugin(:params_capturing_restore, ParamsCapturingRestore)
+  end
+end
+

data/lib/roda/plugins/part.rb

@@ -44,19 +44,19 @@ class Roda
               render(template, :locals=>locals, &block)
             end
           RUBY
-        # :nocov:
+        # simplecov:disable
         else
           def part(template, locals=OPTS, &block)
             render(template, :locals=>locals, &block)
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def part(template, ...)
               if optimized_method = _optimized_render_method_for_locals(template, OPTS)

data/lib/roda/plugins/pass.rb

@@ -29,7 +29,10 @@ class Roda
 
         # Handle passing inside the match block.
         def always
-          catch(:pass){super}
+          rp = @remaining_path
+          ret = catch(:pass){super}
+          @remaining_path = rp
+          ret
         end
 
         # Handle passing inside the match block.

data/lib/roda/plugins/path.rb

@@ -169,17 +169,17 @@ class Roda
                 # Allow calling private _method to get path
                 relative_path(request.script_name.to_s + send(_meth, *a, &blk))
               end
-              # :nocov:
+              # simplecov:disable
               ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true)
-              # :nocov:
+              # simplecov:enable
             elsif add_script_name
               define_method(meth) do |*a, &blk|
                 # Allow calling private _method to get path
                 request.script_name.to_s + send(_meth, *a, &blk)
               end
-              # :nocov:
+              # simplecov:disable
               ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true)
-              # :nocov:
+              # simplecov:enable
             else
               define_method(meth, &block)
             end
@@ -198,9 +198,9 @@ class Roda
             end
 
             define_method(url_meth, &url_block)
-            # :nocov:
+            # simplecov:disable
             ruby2_keywords(url_meth) if respond_to?(:ruby2_keywords, true)
-            # :nocov:
+            # simplecov:enable
           end
 
           nil

data/lib/roda/plugins/path_matchers.rb

@@ -29,12 +29,16 @@ class Roda
     #     # Matches '/foo.bar', yielding 'foo'
     #     # Does not match bar.foo
     #   end
+    #
+    # Note that all of these matchers treat a given string as regexp source,
+    # so if you are including regexp metacharacters but want a literal string
+    # match, use +Regexp.escape+.
     module PathMatchers
       module RequestMethods
         # Match when the current segment ends with the given extension.
         # request path end with the extension.
         def match_extension(ext)
-          match_suffix(".#{ext}")
+          match_suffix("\\.#{ext}")
         end
 
         # Match when the current path segment starts with the given prefix.

data/lib/roda/plugins/public.rb

@@ -46,10 +46,10 @@ class Roda
       ENCODING_MAP = {:zstd=>'zstd', :brotli=>'br', :gzip=>'gzip'}.freeze
       ENCODING_EXTENSIONS = {'br'=>'.br', 'gzip'=>'.gz', 'zstd'=>'.zst'}.freeze
 
-      # :nocov:
+      # simplecov:disable
       PARSER = defined?(::URI::RFC2396_PARSER) ? ::URI::RFC2396_PARSER : ::URI::DEFAULT_PARSER
       MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
-      # :nocov:
+      # simplecov:enable
 
       # Use options given to setup a Rack::File instance for serving files. Options:
       # :brotli :: Whether to serve already brotli-compressed files with a .br extension
@@ -114,9 +114,9 @@ class Roda
         def public_file_readable?(path)
           ::File.file?(path) && ::File.readable?(path)
         rescue SystemCallError
-          # :nocov:
+          # simplecov:disable
           false
-          # :nocov:
+          # simplecov:enable
         end
 
         def public_serve_with(server)

data/lib/roda/plugins/render.rb

@@ -46,8 +46,11 @@ class Roda
     #
     # The following plugin options are supported:
     #
-    # :allowed_paths :: Set the template paths to allow.  Attempts to render paths outside
-    #                   of these paths will raise an error.  Defaults to the +:views+ directory.
+    # :allowed_paths :: Set the template directories to allow.  Attempts to render paths outside
+    #                   of these directories will raise an error.  Defaults to the +:views+ option,
+    #                   if it is a directory.  For backwards compatibility, if a non-directory is
+    #                   given, it will be used as a prefix match. Roda 4 will raise if a non-directory
+    #                   is given as an allowed path and +:check_paths+ is true.
     # :assume_fixed_locals :: Set if you are sure all templates in your application use fixed locals
     #                         to allow for additional optimization. This is ignored unless both
     #                         compiled methods and fixed locals are not supported.
@@ -298,24 +301,24 @@ class Roda
         def self.tilt_template_fixed_locals?(template)
           template.fixed_locals?
         end
-      # :nocov:
+      # simplecov:disable
       else
         def self.tilt_template_fixed_locals?(template)
           false
         end
       end
-      # :nocov:
+      # simplecov:enable
 
       if compiled_method_arity == -2
         def self.tilt_template_compiled_method(template, locals_keys, scope_class)
           template.send(:compiled_method, locals_keys, scope_class)
         end
-      # :nocov:
+      # simplecov:disable
       else
         def self.tilt_template_compiled_method(template, locals_keys, scope_class)
           template.send(:compiled_method, locals_keys)
         end
-      # :nocov:
+      # simplecov:enable
       end
 
       # Setup default rendering options.  See Render for details.
@@ -331,9 +334,18 @@ class Roda
         opts = app.opts[:render]
         opts[:engine] = (opts[:engine] || "erb").dup.freeze
         opts[:views] = app.expand_path(opts[:views]||"views").freeze
-        opts[:allowed_paths] ||= [opts[:views]].freeze
-        opts[:allowed_paths] = opts[:allowed_paths].map{|f| app.expand_path(f, nil)}.uniq.freeze
         opts[:check_paths] = true unless opts.has_key?(:check_paths)
+        opts[:allowed_paths] ||= [opts[:views]]
+        opts[:allowed_paths] = opts[:allowed_paths].map do |f|
+          path = app.expand_path(f, nil)
+          if File.directory?(path) || f == opts[:views]
+            path << "/"
+          elsif opts[:check_paths]
+            # RODA4: raise
+            RodaPlugins.warn("allowed path #{f.inspect} is not a directory in the file system. For backwards compatibility, will allow prefix matches, but this could result in security issues. Roda 4 will raise if an allowed path is not a directory.")
+          end
+          path.freeze
+        end.uniq.freeze
         opts[:assume_fixed_locals] &&= FIXED_LOCALS_COMPILED_METHOD_SUPPORT
 
         unless opts.has_key?(:check_template_mtime)
@@ -763,7 +775,7 @@ class Roda
                 end
               end
             RUBY
-          # :nocov:
+          # simplecov:disable
           elsif RUBY_VERSION >= '2'
             class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
               def _call_optimized_template_method((meth, fixed_locals), locals, &block)
@@ -787,7 +799,7 @@ class Roda
               send(meth, locals, &block)
             end
           end
-          # :nocov:
+          # simplecov:enable
         else
           def _cached_template_method(_)
             nil
@@ -981,9 +993,9 @@ class Roda
       end
 
       module AssumeFixedLocalsInstanceMethods
-        # :nocov:
+        # simplecov:disable
         if RUBY_VERSION >= '3.0'
-        # :nocov:
+        # simplecov:enable
           class_eval(<<-RUBY, __FILE__, __LINE__ + 1)
             def _call_optimized_template_method((meth,_), locals, &block)
               send(meth, **locals, &block)

data/lib/roda/plugins/render_coverage.rb

@@ -1,9 +1,9 @@
 # frozen-string-literal: true
 
 require 'tilt'
-# :nocov:
+# simplecov:disable
 raise 'Tilt version does not support coverable templates' unless Tilt::Template.method_defined?(:compiled_path=)
-# :nocov:
+# simplecov:enable
 
 #
 class Roda
@@ -55,8 +55,9 @@ class Roda
           path = File.expand_path(opts[:path])
           compiled_path = nil
           (self.opts[:render_coverage_strip_paths] || render_opts[:allowed_paths]).each do |dir|
-            if path.start_with?(dir + '/')
-              compiled_path = File.join(self.opts[:render_coverage_dir], path[dir.length+1, 10000000].tr('/', '-'))
+            dir += "/" unless dir.end_with?("/")
+            if path.start_with?(dir)
+              compiled_path = File.join(self.opts[:render_coverage_dir], path[dir.length, 10000000].tr('/', '-'))
               break
             end
           end
@@ -76,9 +77,9 @@ class Roda
           template = super
 
           # Set compiled path for template when using older tilt versions.
-          # :nocov:
+          # simplecov:disable
           template.compiled_path = compiled_path if compiled_path
-          # :nocov:
+          # simplecov:enable
 
           template
         end

data/lib/roda/plugins/render_each.rb

@@ -171,12 +171,12 @@ class Roda
 
             File.basename(template).sub(/\..+\z/, '').to_sym
           end
-        # :nocov:
+        # simplecov:disable
         else
           def render_each_default_local(template)
             File.basename(template.to_s).sub(/\..+\z/, '').to_sym
           end
-        # :nocov:
+        # simplecov:enable
         end
 
         if Render::COMPILED_METHOD_SUPPORT

data/lib/roda/plugins/route_csrf.rb

@@ -57,13 +57,18 @@ class Roda
     # :csrf_failure :: The action to taken if a request fails the CSRF check (default: :raise).  Options:
     #                  :raise :: raise a Roda::RodaPlugins::RouteCsrf::InvalidToken exception
     #                  :empty_403 :: return a blank 403 page (rack_csrf's default behavior)
-    #                  :clear_session :: Clear the current session
+    #                  :clear_session :: Clear the current session  (deprecated)
     #                  Proc :: Treated as a routing block, called with request object
     # :check_header :: Whether the HTTP header should be checked for the token value (default: false).
     #                  If true, checks the HTTP header after checking for the form input parameter.
     #                  If :only, only checks the HTTP header and doesn't check the form input parameter.
     # :check_request_methods :: Which request methods require CSRF protection
     #                           (default: <tt>['POST', 'DELETE', 'PATCH', 'PUT']</tt>)
+    # :exempt_request_methods :: If given, specifies which request methods do not require CSRF protection.
+    #                            It is recommended to set this so an allow list approach is used, as
+    #                            :check_request_methods is the equivalent of a deny list
+    #                            (recommended: <tt>['GET', 'HEAD', 'OPTIONS', 'QUERY']</tt>, which
+    #                            will be the default in Roda 4)
     # :upgrade_from_rack_csrf_key :: If provided, the session key that should be checked for the
     #                                rack_csrf raw token.  If the session key is present, the value
     #                                will be checked against the submitted token, and if it matches,
@@ -155,6 +160,19 @@ class Roda
     #
     # By including random data in the HMAC for all tokens, different tokens are generated
     # each time, mitigating compression ratio attacks such as BREACH.
+    #
+    # == REQUEST_METHOD modifications
+    #
+    # It's possible to use Rack middleware that modify REQUEST_METHOD in the env hash,
+    # such that it does not reflect that actual request method. One example of this is
+    # Rack::MethodOverride. Using such middleware is generally bad from a security perspective,
+    # but if you want to do so anyway, you need to override the request method that the
+    # route_csrf plugin will use so it reflects the actual request method. If you are using
+    # Rack::MethodOverride, you can use:
+    #
+    #   def csrf_request_method
+    #     env['rack.methodoverride.original_method'] || super
+    #   end
     module RouteCsrf
       # Default CSRF option values
       DEFAULTS = {
@@ -165,6 +183,7 @@ class Roda
         :require_request_specific_tokens => true,
         :csrf_failure => :raise,
         :check_header => false,
+        # RODA4: Remove and set :exempt_request_methods by default
         :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze)
       }.freeze
 
@@ -186,6 +205,9 @@ class Roda
           options[:csrf_failure] = :csrf_failure_method
           app.define_roda_method(:_roda_route_csrf_failure, 1, &app.send(:convert_route_block, block))
         end
+        if opts[:csrf_failure] == :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the route_csrf plugin is deprecated"
+        end
         options[:env_header] = "HTTP_#{options[:header].to_s.tr('-', '_').upcase}".freeze
         options.freeze
       end
@@ -212,6 +234,7 @@ class Roda
               headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
               throw :halt, @_response.finish_with_body([])
             when :clear_session
+              RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to check_csrf! is deprecated"
               session.clear
             when :csrf_failure_method
               @_request.on{_roda_route_csrf_failure(@_request)}
@@ -297,13 +320,22 @@ class Roda
 
         private
 
+        # The request method to use to determine whether to perform a CSRF check.
+        # defaults to REQUEST_METHOD in the environment, can be overridden if
+        # that isn't the actual request method.
+        def csrf_request_method
+          @_request.env['REQUEST_METHOD']
+        end
+
         # Returns error message string if the CSRF token is not valid.
         # Returns nil if the CSRF token is valid.
         def csrf_invalid_message(opts)
           opts = opts.empty? ? csrf_options : csrf_options.merge(opts)
-          method = request.request_method
+          method = csrf_request_method
 
-          unless opts[:check_request_methods].include?(method)
+          if exempt = opts[:exempt_request_methods]
+            return if exempt.include?(method)
+          elsif !opts[:check_request_methods].include?(method)
             return
           end
 

data/lib/roda/plugins/run_append_slash.rb

@@ -22,8 +22,11 @@ class Roda
     #   # GET /a/ => App gets "/" as PATH_INFO
     module RunAppendSlash
       # Set plugin specific options.  Options:
-      # :use_redirects :: Whether to issue 302 redirects when appending the
-      #                   trailing slash.
+      # :use_redirects :: Whether to issue a redirect to the path with the slash
+      #                   appended, instead of calling the app directly with the
+      #                   trailing slash. Note that if the current path starts
+      #                   with +//+, it will call the app directly instead of
+      #                   redirecting.
       def self.configure(app, opts=OPTS)
         app.opts[:run_append_slash_redirect] = !!opts[:use_redirects]
       end
@@ -32,10 +35,11 @@ class Roda
         # Calls the given rack app. If the path matches the root of the app but
         # does not contain a trailing slash, a trailing slash is appended to the
         # path internally, or a redirect is issued when configured with
-        # <tt>use_redirects: true</tt>.
+        # <tt>use_redirects: true</tt>. If the path starts with +//+,
+        # the redirect approach will not be used.
         def run(*)
           if @remaining_path.empty?
-            if scope.opts[:run_append_slash_redirect]
+            if scope.opts[:run_append_slash_redirect] && !(path = self.path).start_with?('//')
               redirect("#{path}/")
             else
               @remaining_path += '/'

data/lib/roda/plugins/sec_fetch_site_csrf.rb

@@ -54,7 +54,7 @@ class Roda
     #                  :raise :: raise a Roda::RodaPlugins::SecFetchSiteCsrf::CsrfFailure
     #                            exception
     #                  :empty_403 :: return a blank 403 page
-    #                  :clear_session :: clear the current session
+    #                  :clear_session :: clear the current session (deprecated)
     #
     # The plugin also supports a block, in which case failures will call the block
     # as a routing block (the block should accept the request object).
@@ -83,8 +83,10 @@ class Roda
         end
 
         case options[:csrf_failure]
-        when :raise, :empty_403, :clear_session, :method
+        when :raise, :empty_403, :method
           # nothing
+        when :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the sec_fetch_site_csrf plugin is deprecated"
         else
           raise RodaError, "Unsupported :csrf_failure plugin option: #{options[:csrf_failure].inspect}"
         end
@@ -118,6 +120,7 @@ class Roda
             headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
             throw :halt, @_response.finish_with_body([])
           when :clear_session
+            # RODA4: Remove
             session.clear
           else # when :method
             @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)}

data/lib/roda/plugins/sessions.rb

@@ -5,9 +5,9 @@ require 'openssl'
 begin
   OpenSSL::Cipher.new("aes-256-ctr")
 rescue OpenSSL::Cipher::CipherError
-  # :nocov:
+  # simplecov:disable
   raise LoadError, "Roda sessions plugin requires the aes-256-ctr cipher"
-  # :nocov:
+  # simplecov:enable
 end
 
 require 'json'

data/lib/roda/plugins/shape_friendly.rb

@@ -90,9 +90,9 @@ class Roda
           end
           nil
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:plugin) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         private
 
@@ -132,9 +132,9 @@ class Roda
         end
       end
 
-      # :nocov:
+      # simplecov:disable
       if RUBY_VERSION >= '4.0'
-      # :nocov:
+      # simplecov:enable
         module InstanceMethods
           private
 

data/lib/roda/plugins/static.rb

@@ -21,6 +21,9 @@ class Roda
     # uses a separate option for it.
     #
     # Users of this plugin may want to consider using the public plugin instead.
+    # As this only loads a middleware, it does not integrate with other Roda
+    # security features, such as the content_security_policy and host_authorization
+    # plugins.
     # 
     # Examples:
     #

data/lib/roda/plugins/type_routing.rb

@@ -198,11 +198,11 @@ class Roda
         # The response type indicated by the Accept request header.
         def accept_response_type
           mimes = @scope.opts[:type_routing][:mimes]
+          response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
 
           @env['HTTP_ACCEPT'].to_s.split(/\s*,\s*/).map do |part|
             mime, _= part.split(/\s*;\s*/, 2)
             if sym = mimes[mime]
-              response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
               return sym
             end
           end

data/lib/roda/plugins/url_escape.rb

@@ -19,7 +19,7 @@ class Roda
         if RUBY_VERSION >= '2'
           define_method(:url_escape, Rack::Utils.instance_method(:escape))
           define_method(:url_unescape, Rack::Utils.instance_method(:unescape))
-        # :nocov:
+        # simplecov:disable
         else
           def url_escape(v)
             Rack::Utils.escape(v)
@@ -29,7 +29,7 @@ class Roda
             Rack::Utils.unescape(v)
           end
         end
-        # :nocov:
+        # simplecov:enable
       end
     end
 

data/lib/roda/plugins/view_options.rb

@@ -158,13 +158,11 @@ class Roda
         # template isn't a layout template, merge the options
         # and locals into the returned hash.
         def parse_template_opts(template, opts)
-          t_opts = super
-
-          if !t_opts[:_is_layout] && (v_opts = @_view_options)
-            t_opts.merge!(v_opts)
+          if (v_opts = @_view_options) && (!template.is_a?(Hash) || !template[:_is_layout])
+            opts = v_opts.merge(opts)
           end
 
-          t_opts
+          super
         end
 
         # If layout options or locals have been set,

data/lib/roda/plugins.rb

@@ -43,11 +43,11 @@ class Roda
     # Deprecate the constant with the given name in the given module,
     # if the ruby version supports it.
     def self.deprecate_constant(mod, name)
-      # :nocov:
+      # simplecov:disable
       if RUBY_VERSION >= '2.3'
         mod.deprecate_constant(name)
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     if RUBY_VERSION >= '3.3'
@@ -57,12 +57,12 @@ class Roda
         mod.set_temporary_name(yield)
         mod
       end
-    # :nocov:
+    # simplecov:disable
     else
       def self.set_temp_name(mod)
         mod
       end
     end
-    # :nocov:
+    # simplecov:enable
   end
 end