sidekiq 6.2.0 → 6.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 990d3e553aed906265ffa0cafb74fa4c79e0ccde957f21ccc3d09531d01e75bf
-  data.tar.gz: 92a68ab1ea824dc78b91610e98c3d10ce4a5794e7aebd66803dc6f29db419420
+  metadata.gz: 298711914bcb8534a9599c47b00b7410467ce324619ee70e7050d15c42f4c329
+  data.tar.gz: '007900de7a1558633520c61870a58eff341e9c11009441dbabe0fbc177e4ed99'
 SHA512:
-  metadata.gz: 37664695dd79557af0395fe20855db1d250753dd8c874023a866c27d69e78bfa36b3f70501dad18a6ac64673e62fa8fdf413c77d0052a9ca0d59f25a17df41f9
-  data.tar.gz: 4d6ef75d6eb4be49e8b8d21d56bd0e300a284a4a6db9a0f0357724206b5e1b81b8bf75b53d8442319fd5fe5a9f08a467d75c59289d82d6aa70a00aa0d5102445
+  metadata.gz: 592ecc114de13f0e43bba9193e1ffd3a973c89a43fac3ed1b750b6a70e29b5bf128a05657baf3fc2ccb77134f092efac055651907f01c0ed6d3c00d45a5ebdc9
+  data.tar.gz: a7baed1f1df451e8bd5183fec4631e49c0761e700c4c95fc070389894894a5fb90103d0adce29da797bc1cae72f8a1f21e71da0279e8c18cb62e3b3b5ae05f0a

data/Changes.md

@@ -2,6 +2,13 @@
 
 [Sidekiq Changes](https://github.com/mperham/sidekiq/blob/master/Changes.md) | [Sidekiq Pro Changes](https://github.com/mperham/sidekiq/blob/master/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/mperham/sidekiq/blob/master/Ent-Changes.md)
 
+6.2.1
+---------
+
+- Update RTT warning logic to handle transient RTT spikes [#4851]
+- Fix very low priority CVE on unescaped queue name [#4852]
+- Add note about sessions and Rails apps in API mode
+
 6.2.0
 ---------
 
@@ -31,6 +38,10 @@ If this is a bare Rack app, use a session middleware before Sidekiq::Web:
   # now, update your Rack app to include the secret with a session cookie middleware
   use Rack::Session::Cookie, secret: File.read(".session.key"), same_site: true, max_age: 86400
   run Sidekiq::Web
+
+If this is a Rails app in API mode, you need to enable sessions.
+
+  https://guides.rubyonrails.org/api_app.html#using-session-middlewares
 ```
 
 6.1.3

data/lib/sidekiq/client.rb

@@ -228,10 +228,6 @@ module Sidekiq
     end
 
     def normalize_item(item)
-      # 6.0.0 push_bulk bug, #4321
-      # TODO Remove after a while...
-      item.delete("at") if item.key?("at") && item["at"].nil?
-
       validate(item)
       # raise(ArgumentError, "Arguments must be native JSON types, see https://github.com/mperham/sidekiq/wiki/Best-Practices") unless JSON.load(JSON.dump(item['args'])) == item['args']
 

data/lib/sidekiq/launcher.rb

@@ -188,6 +188,10 @@ module Sidekiq
       end
     end
 
+    # We run the heartbeat every five seconds.
+    # Capture five samples of RTT, log a warning if each sample
+    # is above our warning threshold.
+    RTT_READINGS = RingBuffer.new(5)
     RTT_WARNING_LEVEL = 50_000
 
     def check_rtt
@@ -198,15 +202,17 @@ module Sidekiq
         b = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC, :microsecond)
       end
       rtt = b - a
+      RTT_READINGS << rtt
       # Ideal RTT for Redis is < 1000µs
       # Workable is < 10,000µs
       # Log a warning if it's a disaster.
-      if rtt > RTT_WARNING_LEVEL
-        Sidekiq.logger.warn <<-EOM
+      if RTT_READINGS.all? { |x| x > RTT_WARNING_LEVEL }
+        Sidekiq.logger.warn <<~EOM
           Your Redis network connection is performing extremely poorly.
-          Current RTT is #{rtt} µs, ideally this should be < 1000.
+          Last RTT readings were #{RTT_READINGS.buffer.inspect}, ideally these should be < 1000.
           Ensure Redis is running in the same AZ or datacenter as Sidekiq.
         EOM
+        RTT_READINGS.reset
       end
       rtt
     end

data/lib/sidekiq/util.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "forwardable"
 require "socket"
 require "securerandom"
 require "sidekiq/exception_handler"
@@ -8,6 +9,33 @@ module Sidekiq
   ##
   # This module is part of Sidekiq core and not intended for extensions.
   #
+
+  class RingBuffer
+    include Enumerable
+    extend Forwardable
+    def_delegators :@buf, :[], :each, :size
+
+    def initialize(size, default = 0)
+      @size = size
+      @buf = Array.new(size, default)
+      @index = 0
+    end
+
+    def <<(element)
+      @buf[@index % @size] = element
+      @index += 1
+      element
+    end
+
+    def buffer
+      @buf
+    end
+
+    def reset(default = 0)
+      @buf.fill(default)
+    end
+  end
+
   module Util
     include ExceptionHandler
 

data/lib/sidekiq/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "6.2.0"
+  VERSION = "6.2.1"
 end

data/lib/sidekiq/web.rb

@@ -144,11 +144,11 @@ module Sidekiq
       m = middlewares
 
       ::Rack::Builder.new do
-        use Rack::Static, :urls => ["/stylesheets", "/images", "/javascripts"],
-                          :root => ASSETS,
-                          :cascade => true,
-                          :header_rules => [
-                            [:all, {'Cache-Control' => 'public, max-age=86400'}],
+        use Rack::Static, urls: ["/stylesheets", "/images", "/javascripts"],
+                          root: ASSETS,
+                          cascade: true,
+                          header_rules: [
+                            [:all, {"Cache-Control" => "public, max-age=86400"}]
                           ]
         m.each { |middleware, block| use(*middleware, &block) }
         use Sidekiq::Web::CsrfProtection unless $TESTING

data/lib/sidekiq/web/action.rb

@@ -15,7 +15,7 @@ module Sidekiq
     end
 
     def halt(res)
-      throw :halt, res
+      throw :halt, [res, {"Content-Type" => "text/plain"}, [res.to_s]]
     end
 
     def redirect(location)

data/lib/sidekiq/web/application.rb

@@ -82,10 +82,12 @@ module Sidekiq
       erb(:queues)
     end
 
+    QUEUE_NAME = /\A[a-z_:.\-0-9]+\z/i
+
     get "/queues/:name" do
       @name = route_params[:name]
 
-      halt(404) unless @name
+      halt(404) if !@name || @name !~ QUEUE_NAME
 
       @count = (params["count"] || 25).to_i
       @queue = Sidekiq::Queue.new(@name)

data/lib/sidekiq/web/csrf_protection.rb

@@ -77,16 +77,19 @@ module Sidekiq
           end
 
 
-          If this is a bare Rack app, use a session middleware before Sidekiq::Web:
+          If this is a Rails app in API mode, you need to enable sessions.
+
+            https://guides.rubyonrails.org/api_app.html#using-session-middlewares
 
+          If this is a bare Rack app, use a session middleware before Sidekiq::Web:
 
-          # first, use IRB to create a shared secret key for sessions and commit it
-          require 'securerandom'; File.open(".session.key", "w") {|f| f.write(SecureRandom.hex(32)) }
+            # first, use IRB to create a shared secret key for sessions and commit it
+            require 'securerandom'; File.open(".session.key", "w") {|f| f.write(SecureRandom.hex(32)) }
 
+            # now use the secret with a session cookie middleware
+            use Rack::Session::Cookie, secret: File.read(".session.key"), same_site: true, max_age: 86400
+            run Sidekiq::Web
 
-          # now use the secret with a session cookie middleware
-          use Rack::Session::Cookie, secret: File.read(".session.key"), same_site: true, max_age: 86400
-          run Sidekiq::Web
         EOM
       end
 

data/web/views/busy.erb

@@ -78,9 +78,10 @@
         <td><%= process['busy'] %></td>
         <td>
           <form method="POST">
+            <%= csrf_tag %>
+            <input type="hidden" name="identity" value="<%= process['identity'] %>"/>
+
             <div class="btn-group pull-right flip">
-              <%= csrf_tag %>
-              <input type="hidden" name="identity" value="<%= process['identity'] %>"/>
               <% unless process.stopping? %><button class="btn btn-warn" type="submit" name="quiet" value="1"><%= t('Quiet') %></button><% end %>
               <button class="btn btn-danger" type="submit" name="stop" value="1"><%= t('Stop') %></button>
             </div>

data/web/views/queue.erb

@@ -52,4 +52,4 @@
     <% end %>
   </table>
 </div>
-<%= erb :_paging, locals: { url: "#{root_path}queues/#{@name}" } %>
+<%= erb :_paging, locals: { url: "#{root_path}queues/#{CGI.escape(@name)}" } %>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq
 version: !ruby/object:Gem::Version
-  version: 6.2.0
+  version: 6.2.1
 platform: ruby
 authors:
 - Mike Perham
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-15 00:00:00.000000000 Z
+date: 2021-04-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis