roda 3.43.0 → 3.43.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6bca86a88a2d0e6fc0952ec2b2a91aa2e4d6dc0374546d5ac9d74d5b39a30abc
-  data.tar.gz: 20044ea95c1b1efabc06d8cda365384193c33ddd8140c7c91f9977483975e004
+  metadata.gz: 95c0306a50aefb2cfa3bd700403ff2d8441acb78438dcca36bdb0341708208fe
+  data.tar.gz: df524e11cab19b33d6f4e2a139f2813b89dc0832863aa2e0ac70c69cc4f98e68
 SHA512:
-  metadata.gz: 2281aac1898e6a81c114023fefb15f77c14ad1ebcd37daad10a1f5c51815c0d175c68a052627bb5025e02c92821d6c64cf6eb3757d801b277b771e73daddc20f
-  data.tar.gz: a55217f87afb2989312e62804715b65c8213997699b187f52a78f8a96dfb592a62ee7adeb029a52663631887ef5cdd15c746930cf9dfba437b744df159b7090c
+  metadata.gz: dc0c531cdc7d9ae5d122cae6394b49ebd9014811c6dfba64ef70bc2b4ffe03d66efe2a10dd11f180a1c68db15a7bf3e048f8fdd8550fa72584d2190d8b3d59ea
+  data.tar.gz: 3f42b2dd764cae91a0b81f43933c230b5795f29f33aebf18a7cbfd800071dfdb9ce29f80b471747105e6caa524571877f207cffde621fdaf3d04b89d5c295f8e

data/CHANGELOG

@@ -1,3 +1,7 @@
+= 3.43.1 (2021-04-13)
+
+* [SECURITY] Fix issue where loading content_security_policy plugin after default_headers plugin had no effect (jeremyevans)
+
 = 3.43.0 (2021-04-12)
 
 * Add host_authorization plugin, for checking that requests are submitted using an approved host (jeremyevans)

data/lib/roda/plugins/default_headers.rb

@@ -23,30 +23,31 @@ class Roda
     module DefaultHeaders
       # Merge the given headers into the existing default headers, if any.
       def self.configure(app, headers={})
-        headers = app.opts[:default_headers] = (app.default_headers || app::RodaResponse::DEFAULT_HEADERS).merge(headers).freeze
+        app.opts[:default_headers] = (app.default_headers || app::RodaResponse::DEFAULT_HEADERS).merge(headers).freeze
+      end 
+
+      module ClassMethods
+        # The default response headers to use for the current class.
+        def default_headers
+          opts[:default_headers]
+        end
 
-        if headers.all?{|k, v| k.is_a?(String) && v.is_a?(String)}
-          response_class = app::RodaResponse
-          owner = response_class.instance_method(:set_default_headers).owner
-          if owner == Base::ResponseMethods || (owner == response_class && app.opts[:set_default_headers_overridder] == response_class)
-            app.opts[:set_default_headers_overridder] = response_class
-            response_class.class_eval(<<-END, __FILE__, __LINE__+1)
+        # Optimize the response class set_default_headers method if it hasn't been
+        # overridden and all default headers are strings.
+        def freeze
+          if (headers = opts[:default_headers]).all?{|k, v| k.is_a?(String) && v.is_a?(String)} &&
+             (self::RodaResponse.instance_method(:set_default_headers).owner == Base::ResponseMethods)
+            self::RodaResponse.class_eval(<<-END, __FILE__, __LINE__+1)
               private
 
-              alias set_default_headers set_default_headers
               def set_default_headers
                 h = @headers
                 #{headers.map{|k,v| "h[#{k.inspect}] ||= #{v.inspect}"}.join('; ')}
               end
             END
           end
-        end
-      end 
 
-      module ClassMethods
-        # The default response headers to use for the current class.
-        def default_headers
-          opts[:default_headers]
+          super
         end
       end
 

data/lib/roda/version.rb

@@ -8,7 +8,7 @@ class Roda
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.
-  RodaPatchVersion = 0
+  RodaPatchVersion = 1
 
   # The full version of Roda as a string.
   RodaVersion = "#{RodaMajorVersion}.#{RodaMinorVersion}.#{RodaPatchVersion}".freeze

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.43.0
+  version: 3.43.1
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-12 00:00:00.000000000 Z
+date: 2021-04-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack