roda 3.44.0 → 3.45.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b60182ef0483279ac1d1983495ba020c1803d6c1fe0fa84af882142f816f72bc
-  data.tar.gz: 20f6053b7c73fed454dc3f39e55a516d7a5461a4005356b5788480b8aab36f14
+  metadata.gz: 5dbdf55425a681a0cb32fa0b4a44cd50bf5be6f85c78c1ea1adbdd19e28c2d61
+  data.tar.gz: e91ee695e5f8648f4269a2c229b794ef2ee921f4291102519d4ca2cadd9bf13a
 SHA512:
-  metadata.gz: 89359f0c972c236bee671606fc7254f4999c6fc03f1b0ef8ff7c9691b581b6e796197b9fbee6fd109ae4d1026624f041d2e64c6182dbf8c80818756543923c9d
-  data.tar.gz: 2d786d8641f5195a65874f3326abe07057748e4de2df7d0a8e8cd9439b6afceb08e65b6a3733e15b0289e273cc070033c1dc466e1909880410b4d05541fa04ae
+  metadata.gz: aa46429e09091c3cf0112c251a9863845c69d4245674dcaddaec030244213d8b9ac1aae96cfa6093680c33f87c732ee4464e4cbe2572d192eb0a9f7e09acd43b
+  data.tar.gz: 57cf84f7db6e6334918f0c01f7308c4c48db7e0ba9f2a14fe87420c3b2bd17471a229ec02a2ad9242ec6fd4aa67848f6dff04b319fea361a985dd264b52252ab

data/CHANGELOG

@@ -1,3 +1,7 @@
+= 3.45.0 (2021-06-14)
+
+* Make typecast_params plugin check for null bytes in strings by default, with :allow_null_bytes option for previous behavior (jeremyevans)
+
 = 3.44.0 (2021-05-12)
 
 * Add optimized_segment_matchers plugin for optimized matchers for a single String class argument (jeremyevans)

data/README.rdoc

@@ -965,19 +965,17 @@ option. If you really want to turn path checking off, you can do so via the
 Roda does not ship with integrated support for code reloading, but there are rack-based
 reloaders that will work with Roda apps.
 
-For most applications, {rack-unreloader}[https://github.com/jeremyevans/rack-unreloader]
-is probably the fastest approach to reloading while still being fairly safe, as it
-reloads just files that have been modified, and unloads constants defined in the files
-before reloading them.  However, it requires modifying your application code to use
-rack-unreloader specific APIs.
-
-A similar solution that reloads files and unloads constants is ActiveSupport::Dependencies.
-ActiveSupport::Dependencies doesn't require modifying your application code, but it modifies
-some core methods, including +require+ and +const_missing+. It requires less configuration,
-but depends that you follow Rails' file and class naming conventions. It also provides
-autoloading (on the fly) of files when a missing constant is accessed. If your application
-does not rely on autoloading then +require_dependency+ must be used to require the dependencies
-or they won't be reloaded.
+{Zeitwerk}[https://github.com/fxn/zeitwerk] (which Rails now uses for reloading) can be used
+with Roda.  It requires minimal setup and handles most cases. It overrides +require+ when
+activated. If it can meet the needs of your application, it's probably the best approach.
+
+{rack-unreloader}[https://github.com/jeremyevans/rack-unreloader] uses a fast
+approach to reloading while still being fairly safe, as it only reloads files that have
+been modified, and unloads constants defined in the files before reloading them. It can handle
+advanced cases that Zeitwerk does not support, such as classes defined in multiple files
+(common when using separate route files for different routing branches in the same application).
+However, rack-unreloader does not modify core classes and using it requires modifying your
+application code to use rack-unreloader specific APIs, which may not be simple.
 
 {AutoReloader}[https://github.com/rosenfeld/auto_reloader] provides transparent reloading for
 all files reached from one of the +reloadable_paths+ option entries, by detecting new top-level

data/doc/release_notes/3.45.0.txt

@@ -0,0 +1,22 @@
+= Improvements
+
+* The typecast_params plugin checks now checks for null bytes by
+  default before typecasting.  If null bytes are present, it raises
+  an error.  Most applications do not require null bytes in
+  parameters, and in some cases allowing them can lead to security
+  issues, especially when parameters are passed to C extensions.
+  In general, the benefit of forbidding null bytes in parameters is
+  greater than the cost.
+  
+  If you would like to continue allowing null bytes, use the
+  :allow_null_bytes option when loading the plugin.
+
+  Note that this change does not affect uploaded files, since those
+  are expected to contain null bytes.
+
+= Backwards Compatibility
+
+* The change to the typecast_params plugin to raise an error for
+  null bytes can break applications that are expecting null bytes
+  to be passed in parameters.  Such applications should use the
+  :allow_null_bytes option when loading the plugin.

data/lib/roda/plugins/assets.rb

@@ -152,6 +152,22 @@ class Roda
     # together and not compressed during compilation.  You can use the
     # :css_compressor and :js_compressor options to specify the compressor to use.
     #
+    # It is also possible to use the built-in compression options in the CSS or JS
+    # compiler, assuming the compiler supports such options.  For example, with
+    # sass/sassc, you can use:
+    #
+    #   plugin :assets,
+    #     css_opts: {style: :compressed}
+    #
+    # === Source Maps (CSS)
+    #
+    # The assets plugin does not have direct support for source maps, so it is
+    # recommended you use embedded source maps if supported by the CSS compiler.
+    # For sass/sassc, you can use:
+    #
+    #   plugin :assets,
+    #     css_opts: {:source_map_embed=>true, source_map_contents: true, source_map_file: "."}
+    #
     # === With Asset Groups
     #
     # When using asset groups, a separate compiled file will be produced per

data/lib/roda/plugins/typecast_params.rb

@@ -260,6 +260,11 @@ class Roda
     # strip leading and trailing whitespace from parameter string values before processing, which
     # you can do by passing the <tt>strip: :all</tt> option when loading the plugin.
     #
+    # By default, the typecast_params conversion procs check that null bytes are not allowed
+    # in param string values. This check for null bytes occurs prior to any type conversion.
+    # If you would like to skip this check and allow null bytes in param string values,
+    # you can do by passing the <tt>:allow_null_bytes</tt> option when loading the plugin.
+    #
     # By design, typecast_params only deals with string keys, it is not possible to use
     # symbol keys as arguments to the conversion methods and have them converted.
     module TypecastParams
@@ -356,6 +361,14 @@ class Roda
         end
       end
 
+      module AllowNullByte
+        private
+
+        # Allow ASCII NUL bytes ("\0") in parameter string values.
+        def check_null_byte(v)
+        end
+      end
+
       module StringStripper
         private
 
@@ -391,7 +404,10 @@ class Roda
           convert_array_meth = :"_convert_array_#{type}"
           define_method(convert_array_meth) do |v|
             raise Error, "expected array but received #{v.inspect}" unless v.is_a?(Array)
-            v.map!{|val| send(convert_meth, val)}
+            v.map! do |val|
+              check_null_byte(val)
+              send(convert_meth, val)
+            end
           end
 
           private convert_meth, convert_array_meth
@@ -927,12 +943,20 @@ class Roda
           end
         end
 
+        # Raise an Error if the value is a string containing a null byte.
+        def check_null_byte(v)
+          if v.is_a?(String) && v.index("\0")
+            handle_error(nil, :null_byte, "string parameter contains null byte", true)
+          end
+        end
+
         # Get the value of +key+ for the object, and convert it to the expected type using +meth+.
         # If the value either before or after conversion is nil, return the +default+ value.
         def process(meth, key, default)
           v = param_value(key)
 
           unless v.nil?
+            check_null_byte(v)
             v = send(meth, v)
           end
 
@@ -992,6 +1016,9 @@ class Roda
         if opts[:strip] == :all
           app::TypecastParams.send(:include, StringStripper)
         end
+        if opts[:allow_null_bytes]
+          app::TypecastParams.send(:include, AllowNullByte)
+        end
       end
 
       module ClassMethods

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 44
+  RodaMinorVersion = 45
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.44.0
+  version: 3.45.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-12 00:00:00.000000000 Z
+date: 2021-06-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -215,6 +215,7 @@ extra_rdoc_files:
 - doc/release_notes/3.42.0.txt
 - doc/release_notes/3.43.0.txt
 - doc/release_notes/3.44.0.txt
+- doc/release_notes/3.45.0.txt
 - doc/release_notes/3.5.0.txt
 - doc/release_notes/3.6.0.txt
 - doc/release_notes/3.7.0.txt
@@ -266,6 +267,7 @@ files:
 - doc/release_notes/3.42.0.txt
 - doc/release_notes/3.43.0.txt
 - doc/release_notes/3.44.0.txt
+- doc/release_notes/3.45.0.txt
 - doc/release_notes/3.5.0.txt
 - doc/release_notes/3.6.0.txt
 - doc/release_notes/3.7.0.txt