sidekiq 8.0.9 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef51643693879cd574d6edd54ef41443defc4825c855d5eed0e07d42e35aa1cd
-  data.tar.gz: 2d9acb8d89326185356ee9818ca543e8a6992bac0a00262e06aa9394052978c1
+  metadata.gz: 63658318932ac6b7045211590b07f84ed9e1e6398f908ace790a0df20d5ac1f0
+  data.tar.gz: 0c3f5e69ada7529bdac7392acb1c56ef2a19b8ed13210be8c36aac19858c6df4
 SHA512:
-  metadata.gz: 761f705abeb6b5deb31591d07d9d9ea0d79d5d6f74367f622842994aa0a57866bd3af9add1089ce2b29d8dd4a9cd110d839036504a1ae0830ac59dbca186ff26
-  data.tar.gz: 5df2e3b47cb7ed56a51ff90b1a8d23ea96f74e9fd64a9116d249a266c7a074ef2a4bac09d66202c66a4f631c6f15bcae167df8ae733f43020f0b53886ae3e564
+  metadata.gz: 9a5e95a2faccbbf42f8e651c4882c9495ad72b0500bb8fe77fa2a93fb4aa6f8cb96fc820621cd1910fb4b00accf35d75a99d548b3cc8ccdd41a18b5620a9ad73
+  data.tar.gz: 1bc66490ee07c548c71f680fb280e876efa7eeb8c6f234277df73211ce05c5ae29f5c9bc13064972da945568d1df6634252a6c22a7c5298bdd436b7266246c53

data/Changes.md

@@ -2,6 +2,35 @@
 
 [Sidekiq Changes](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/sidekiq/sidekiq/blob/main/Ent-Changes.md)
 
+8.1.0
+----------
+
+- `retry_for` and `retry` are now mutually exclusive [#6878, Saidbek]
+- `perform_inline` now enforces `strict_args!` [#6718, Saidbek]
+- Integrate Herb linting for ERB templates [#6760, Saidbek]
+- Remove CSRF code, use `Sec-Fetch-Site` header [#6874, deve1212]
+- Allow custom Web UI `assets_path` for CDN purposes [#6865, stanhu]
+- Upgrade to connection_pool 3.0
+- Allow idle connection reaping after N seconds.
+You can activate this **beta** feature like below.
+Feedback requested: is this feature stable and useful for you in production?
+This feature may or may not be enabled by default in Sidekiq 9.0.
+```ruby
+Sidekiq.configure_server do |cfg|
+  cfg.reap_idle_redis_connections(60)
+end
+```
+
+8.0.10
+----------
+
+- Add confirm dialog for Delete All buttons in Web UI [#6853]
+- Adjust scheduler to run closer to poll average [#6866]
+- Forward compatibility changes for connection_pool 3.0.0
+- Backwards compatibility fix for <8.0.9 process data in Redis [#6870]
+- Backtrace dump can now be triggered with the INFO signal, since Puma uses the
+  same signal [#6857]
+
 8.0.9
 ----------
 

data/README.md

@@ -97,6 +97,21 @@ Contributing
 
 See [the contributing guidelines](https://github.com/sidekiq/sidekiq/blob/main/.github/contributing.md).
 
+### ERB Linting with HERB
+
+This project uses [HERB](https://herb-tools.dev/) for ERB file linting and formatting. All ERB files have been renamed to use the `.html.erb` extension for better tooling support.
+
+**Local Development:**
+```bash
+# Run HERB linting
+bundle exec rake lint:herb
+# or
+bin/lint-herb
+```
+
+**CI Integration:**
+HERB linting is automatically run in CI to ensure all ERB files are properly formatted and free of parse errors.
+
 License
 -----------------
 

data/bin/lint-herb

@@ -0,0 +1,13 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# HERB Linting Script
+# Run this script to lint all ERB files in the project
+# Usage: bin/lint-herb
+
+require "bundler/setup"
+
+puts "🔍 Running HERB linting on ERB files..."
+puts
+
+exec("bundle exec herb analyze web/views -n --no-log-file")

data/lib/sidekiq/api.rb

@@ -1091,19 +1091,29 @@ module Sidekiq
 
     # deprecated, use capsules below
     def queues
-      capsules.values.flat_map { |x| x["weights"].keys }.uniq
+      # Backwards compatibility with <8.0.8
+      if !self["capsules"]
+        self["queues"]
+      else
+        capsules.values.flat_map { |x| x["weights"].keys }.uniq
+      end
     end
 
     # deprecated, use capsules below
     def weights
-      hash = {}
-      capsules.values.each do |cap|
-        # Note: will lose data if two capsules are processing the same named queue
-        cap["weights"].each_pair do |queue, weight|
-          hash[queue] = weight
+      # Backwards compatibility with <8.0.8
+      if !self["capsules"]
+        self["weights"]
+      else
+        hash = {}
+        capsules.values.each do |cap|
+          # Note: will lose data if two capsules are processing the same named queue
+          cap["weights"].each_pair do |queue, weight|
+            hash[queue] = weight
+          end
         end
+        hash
       end
-      hash
     end
 
     def capsules

data/lib/sidekiq/cli.rb

@@ -49,7 +49,7 @@ module Sidekiq # :nodoc:
       logger.info "Booted Rails #{::Rails.version} application in #{environment} environment" if rails_app?
 
       self_read, self_write = IO.pipe
-      sigs = %w[INT TERM TTIN TSTP]
+      sigs = %w[INT TERM INFO TTIN TSTP]
       # USR1 and USR2 don't work on the JVM
       sigs << "USR2" if Sidekiq.pro? && !jruby?
       sigs.each do |sig|
@@ -201,7 +201,19 @@ module Sidekiq # :nodoc:
         cli.logger.info "Received TSTP, no longer accepting new work"
         cli.launcher.quiet
       },
+      # deprecated, use INFO
       "TTIN" => ->(cli) {
+        cli.logger.error { "DEPRECATED: Please use the INFO signal for backtraces, support for TTIN will be removed in Sidekiq 9.0." }
+        Thread.list.each do |thread|
+          cli.logger.warn "Thread TID-#{(thread.object_id ^ ::Process.pid).to_s(36)} #{thread.name}"
+          if thread.backtrace
+            cli.logger.warn thread.backtrace.join("\n")
+          else
+            cli.logger.warn "<no backtrace available>"
+          end
+        end
+      },
+      "INFO" => ->(cli) {
         Thread.list.each do |thread|
           cli.logger.warn "Thread TID-#{(thread.object_id ^ ::Process.pid).to_s(36)} #{thread.name}"
           if thread.backtrace
@@ -212,12 +224,12 @@ module Sidekiq # :nodoc:
         end
       }
     }
-    UNHANDLED_SIGNAL_HANDLER = ->(cli) { cli.logger.info "No signal handler registered, ignoring" }
-    SIGNAL_HANDLERS.default = UNHANDLED_SIGNAL_HANDLER
 
     def handle_signal(sig)
       logger.debug "Got #{sig} signal"
-      SIGNAL_HANDLERS[sig].call(self)
+      hndlr = SIGNAL_HANDLERS[sig]
+      hndlr ? hndlr.call(self) :
+        logger.warn("No #{sig} signal handler registered, ignoring")
     end
 
     private

data/lib/sidekiq/config.rb

@@ -36,7 +36,8 @@ module Sidekiq
       dead_timeout_in_seconds: 180 * 24 * 60 * 60, # 6 months
       reloader: proc { |&block| block.call },
       backtrace_cleaner: ->(backtrace) { backtrace },
-      logged_job_attributes: ["bid", "tags"]
+      logged_job_attributes: ["bid", "tags"],
+      redis_idle_timeout: nil
     }
 
     ERROR_HANDLER = ->(ex, ctx, cfg = Sidekiq.default_configuration) {
@@ -145,10 +146,9 @@ module Sidekiq
       @redis_config = @redis_config.merge(hash)
     end
 
-    def reap_idle_redis_connections(timeout = nil)
-      self[:reap_connections] = timeout
+    def reap_idle_redis_connections(timeout = 60)
+      self[:redis_idle_timeout] = timeout
     end
-    alias_method :reap, :reap_idle_redis_connections
 
     def redis_pool
       Thread.current[:sidekiq_redis_pool] || Thread.current[:sidekiq_capsule]&.redis_pool || local_redis_pool

data/lib/sidekiq/job.rb

@@ -226,6 +226,8 @@ module Sidekiq
         end
         return nil unless result
 
+        verify_json(item)
+
         # round-trip the payload via JSON
         msg = Sidekiq.load_json(Sidekiq.dump_json(item))
 

data/lib/sidekiq/job_retry.rb

@@ -178,10 +178,14 @@ module Sidekiq
         msg["error_backtrace"] = compress_backtrace(lines)
       end
 
-      return retries_exhausted(jobinst, msg, exception) if count >= max_retry_attempts
-
+      # retry_for and retry are mutually exclusive - if retry_for is set,
+      # we exclusively use duration-based retry logic and ignore count-based logic
       rf = msg["retry_for"]
-      return retries_exhausted(jobinst, msg, exception) if rf && (time_for(msg["failed_at"]) + rf) < Time.now
+      if rf
+        return retries_exhausted(jobinst, msg, exception) if (time_for(msg["failed_at"]) + rf) < Time.now
+      elsif count >= max_retry_attempts
+        return retries_exhausted(jobinst, msg, exception)
+      end
 
       strategy, delay = delay_for(jobinst, count, exception, msg)
       case strategy

data/lib/sidekiq/launcher.rb

@@ -142,10 +142,10 @@ module Sidekiq
       key = identity
       fails = procd = 0
 
-      idle = config[:reap_connections]
-      if idle
-        config.capsules.each_value { |cap| cap.local_redis_pool.reap(idle, &:close) }
-        config.local_redis_pool.reap(idle, &:close)
+      idle_timeout = config[:redis_idle_timeout]
+      if idle_timeout
+        config.capsules.each_value { |cap| cap.local_redis_pool.reap(idle_seconds: idle_timeout, &:close) }
+        config.local_redis_pool.reap(idle_seconds: idle_timeout, &:close)
       end
 
       begin
@@ -220,11 +220,11 @@ module Sidekiq
       # Log a warning if it's a disaster.
       if RTT_READINGS.all? { |x| x > RTT_WARNING_LEVEL }
         logger.warn <<~EOM
-          Your Redis network connection is performing extremely poorly.
+          Your Redis network connection appears to be performing poorly.
           Last RTT readings were #{RTT_READINGS.buffer.inspect}, ideally these should be < 1000.
-          Ensure Redis is running in the same AZ or datacenter as Sidekiq.
-          If these values are close to 100,000, that means your Sidekiq process may be
-          CPU-saturated; reduce your concurrency and/or see https://github.com/sidekiq/sidekiq/discussions/5039
+          Ensure Redis is running in the same AZ or datacenter as Sidekiq and that
+          your Sidekiq process is not CPU-saturated; reduce your concurrency and/or
+          see https://github.com/sidekiq/sidekiq/discussions/5039
         EOM
         RTT_READINGS.reset
       end

data/lib/sidekiq/redis_connection.rb

@@ -23,7 +23,7 @@ module Sidekiq
 
         size = symbolized_options.delete(:size) || 5
         pool_timeout = symbolized_options.delete(:pool_timeout) || 1
-        pool_name = symbolized_options.delete(:pool_name)
+        symbolized_options.delete(:pool_name)
 
         # Default timeout in redis-client is 1 second, which can be too aggressive
         # if the Sidekiq process is CPU-bound. With 10-15 threads and a thread quantum of 100ms,
@@ -33,7 +33,7 @@ module Sidekiq
         symbolized_options[:timeout] ||= 3
 
         redis_config = Sidekiq::RedisClientAdapter.new(symbolized_options)
-        ConnectionPool.new(timeout: pool_timeout, size: size, name: pool_name) do
+        ConnectionPool.new(timeout: pool_timeout, size: size) do
           redis_config.new_client
         end
       end

data/lib/sidekiq/scheduled.rb

@@ -72,6 +72,7 @@ module Sidekiq
       include Sidekiq::Component
 
       INITIAL_WAIT = 10
+      attr_accessor :rnd
 
       def initialize(config)
         @config = config
@@ -80,6 +81,7 @@ module Sidekiq
         @done = false
         @thread = nil
         @count_calls = 0
+        @rnd = Random.new
       end
 
       # Shut down this instance, will pause until the thread is dead.
@@ -115,9 +117,9 @@ module Sidekiq
       private
 
       def wait
-        @sleeper.pop(random_poll_interval)
+        @sleeper.pop(timeout: random_poll_interval)
       rescue Timeout::Error
-        # expected
+        # TODO move to exception: false
       rescue => ex
         # if poll_interval_average hasn't been calculated yet, we can
         # raise an error trying to reach Redis.
@@ -151,11 +153,11 @@ module Sidekiq
 
         if count < 10
           # For small clusters, calculate a random interval that is ±50% the desired average.
-          interval * rand + interval.to_f / 2
+          interval * @rnd.rand + interval.to_f / 2
         else
           # With 10+ processes, we should have enough randomness to get decent polling
           # across the entire timespan
-          interval * rand
+          interval * @rnd.rand * 2
         end
       end
 
@@ -223,7 +225,7 @@ module Sidekiq
         total += INITIAL_WAIT unless @config[:poll_interval_average]
         total += (5 * rand)
 
-        @sleeper.pop(total)
+        @sleeper.pop(timeout: total)
       rescue Timeout::Error
       ensure
         # periodically clean out the `processes` set in Redis which can collect

data/lib/sidekiq/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "8.0.9"
+  VERSION = "8.1.0"
   MAJOR = 8
 
   def self.gem_version

data/lib/sidekiq/web/action.rb

@@ -117,7 +117,7 @@ module Sidekiq
         if content.is_a? Symbol
           unless respond_to?(:"_erb_#{content}")
             views = options[:views] || Web.views
-            filename = "#{views}/#{content}.erb"
+            filename = "#{views}/#{content}.html.erb"
             src = ERB.new(File.read(filename)).src
 
             # Need to use lineno less by 1 because erb generates a

data/lib/sidekiq/web/config.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "sidekiq/web/csrf_protection"
-
 module Sidekiq
   class Web
     ##
@@ -24,10 +22,7 @@ module Sidekiq
         # and very difficult for us to vendor or provide ourselves. If you are worried
         # about data security and wish to self-host, you can change these URLs.
         profile_view_url: "https://profiler.firefox.com/public/%s",
-        profile_store_url: "https://api.profiler.firefox.com/compressed-store",
-        # Will be false in Sidekiq 9.0.
-        # CSRF is unnecessary if you are using SameSite=(Strict|Lax) cookies.
-        csrf: true
+        profile_store_url: "https://api.profiler.firefox.com/compressed-store"
       }
 
       ##
@@ -54,11 +49,13 @@ module Sidekiq
 
       # Adds the "Back to App" link in the header
       attr_accessor :app_url
+      attr_accessor :assets_path
 
       def initialize
         @options = OPTIONS.dup
         @locales = LOCALES
         @views = VIEWS
+        @assets_path = ASSETS
         @tabs = DEFAULT_TABS.dup
         @middlewares = []
         @custom_job_info_rows = []

data/lib/sidekiq/web/helpers.rb

@@ -122,8 +122,8 @@ module Sidekiq
       resultset
     end
 
-    def filtering(which)
-      erb(:filtering, locals: {which: which})
+    def filtering(which, placeholder_key: "AnyJobContent", label_key: "Filter")
+      erb(:filtering, locals: {which:, placeholder_key:, label_key:})
     end
 
     def filter_link(jid, within = "retries")
@@ -329,7 +329,7 @@ module Sidekiq
     end
 
     def csrf_tag
-      "<input type='hidden' name='authenticity_token' value='#{env[:csrf_token]}'/>"
+      ""
     end
 
     def csp_nonce

data/lib/sidekiq/web.rb

@@ -13,7 +13,7 @@ module Sidekiq
     ROOT = File.expand_path("#{File.dirname(__FILE__)}/../../web")
     VIEWS = "#{ROOT}/views"
     LOCALES = ["#{ROOT}/locales"]
-    LAYOUT = "#{VIEWS}/layout.erb"
+    LAYOUT = "#{VIEWS}/layout.html.erb"
     ASSETS = "#{ROOT}/assets"
 
     DEFAULT_TABS = {
@@ -42,6 +42,12 @@ module Sidekiq
         @@config.app_url = url
       end
 
+      def assets_path=(path)
+        @@config.assets_path = path
+      end
+
+      def assets_path = @@config.assets_path
+
       def tabs = @@config.tabs
 
       def locales = @@config.locales
@@ -87,13 +93,27 @@ module Sidekiq
       env[:web_config] = Sidekiq::Web.configure
       env[:csp_nonce] = SecureRandom.hex(8)
       env[:redis_pool] = self.class.redis_pool
-      app.call(env)
+      safe_request?(env) ? app.call(env) : deny(env)
     end
 
     def app
       @app ||= build(@@config)
     end
 
+    def safe_methods?(env)
+      %w[GET HEAD OPTIONS TRACE].include? env["REQUEST_METHOD"]
+    end
+
+    def safe_request?(env)
+      return true if safe_methods?(env)
+      env["HTTP_SEC_FETCH_SITE"] == "same-origin"
+    end
+
+    def deny(env)
+      Sidekiq.logger.warn "attack prevented by #{self.class}"
+      [403, {Rack::CONTENT_TYPE => "text/plain"}, ["Forbidden"]]
+    end
+
     private
 
     def build(cfg)
@@ -105,11 +125,10 @@ module Sidekiq
 
       ::Rack::Builder.new do
         use Rack::Static, urls: ["/stylesheets", "/images", "/javascripts"],
-          root: ASSETS,
+          root: cfg.assets_path,
           cascade: true,
           header_rules: rules
         m.each { |middleware, block| use(*middleware, &block) }
-        use CsrfProtection if cfg[:csrf]
         run Sidekiq::Web::Application.new(self.class)
       end
     end

data/sidekiq.gemspec

@@ -23,9 +23,9 @@ Gem::Specification.new do |gem|
     "rubygems_mfa_required" => "true"
   }
 
-  gem.add_dependency "redis-client", ">= 0.23.2"
-  gem.add_dependency "connection_pool", ">= 2.5.0"
-  gem.add_dependency "rack", ">= 3.1.0"
-  gem.add_dependency "json", ">= 2.9.0"
-  gem.add_dependency "logger", ">= 1.6.2"
+  gem.add_dependency "redis-client", ">= 0.26.0"
+  gem.add_dependency "connection_pool", ">= 3.0.0"
+  gem.add_dependency "rack", ">= 3.2.0"
+  gem.add_dependency "json", ">= 2.16.0"
+  gem.add_dependency "logger", ">= 1.7.0"
 end

data/web/assets/javascripts/application.js

@@ -190,7 +190,7 @@ function updateProgressBars() {
 function handleConfirmDialog (event) {
   const target = event.target
 
-  if (target.localName !== "input") { return }
+  if (target.localName !== "input" && target.localName !== "button" ) { return }
   const confirmMessage = target.dataset.confirm
 
   if (confirmMessage === undefined) { return }

data/web/assets/stylesheets/style.css

@@ -448,9 +448,7 @@ canvas + .table_container {
 }
 
 .buttons-row {
-  margin-top: var(--space-3x);
   display: flex;
-  flex-wrap: wrap;
   gap: 8px;
 }
 

data/web/locales/fr.yml

@@ -8,7 +8,7 @@ fr:
   AreYouSureDeleteJob: Êtes-vous certain de vouloir supprimer cette tâche ?
   AreYouSureDeleteQueue: Êtes-vous certain de vouloir supprimer la queue %{queue} ?
   Arguments: Arguments
-  Back to App: Retour à l'application
+  BackToApp: Retour à l'application
   Busy: En cours
   Class: Classe
   Connections: Connexions

data/web/views/{filtering.erb → filtering.html.erb}

@@ -1,6 +1,6 @@
 <div class="filter">
   <form role="search" method="get" class="form-inline" action="<%= root_path %><%= which %>">
-    <label for="substr"><%= t('Filter') %></label>
-    <input class="form-control" type="search" name="substr" value="<%= h url_params("substr") %>" placeholder="<%= t('AnyJobContent') %>" autocomplete="off">
+    <label for="substr"><%= t(label_key) %></label>
+    <input class="form-control" type="search" name="substr" value="<%= h url_params("substr") %>" placeholder="<%= t(placeholder_key) %>" autocomplete="off">
   </form>
 </div>

data/web/views/{metrics.erb → metrics.html.erb}

@@ -58,8 +58,9 @@
                     id="<%= id %>"
                     class="metrics-swatch"
                     value="<%= kls %>"
-                    <%= visible_kls.include?(kls) ? 'checked' : '' %>
-                  >
+                    <% if visible_kls.include?(kls) %>
+                    checked
+                    <% end %>>
                   <code><a href="<%= root_path %>metrics/<%= kls %>?period=<%= @period %>"><%= kls %></a></code>
                 </div>
               </td>

data/web/views/{morgue.erb → morgue.html.erb}

@@ -59,7 +59,7 @@
         <input class="btn btn-primary pull-left flip" type="submit" name="retry" value="<%= t('RetryNow') %>">
         <input class="btn btn-danger pull-left flip" type="submit" name="delete" value="<%= t('Delete') %>">
         <button class="btn btn-primary bulk-action-buttons bulk-lead-button" type="submit" name="action" value="retry_all" formaction="<%= "#{root_path}morgue/all/retry" %>"><%= t('RetryAll') %></button>
-        <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}morgue/all/delete" %>"><%= t('DeleteAll') %></button>
+        <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}morgue/all/delete" %>" data-confirm="<%= t('AreYouSure') %>"><%= t('DeleteAll') %></button>
       </div>
     </form>
 

data/web/views/{retries.erb → retries.html.erb}

@@ -63,7 +63,7 @@
         <input class="btn btn-danger" type="submit" name="kill" value="<%= t('Kill') %>">
         <!-- Retry all -->
         <button class="btn btn-primary bulk-action-buttons bulk-lead-button" type="submit" name="action" value="retry_all" formaction="<%= "#{root_path}retries/all/retry" %>"><%= t('RetryAll') %></button>
-        <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}retries/all/delete" %>"><%= t('DeleteAll') %></button>
+        <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}retries/all/delete" %>" data-confirm="<%= t('AreYouSure') %>"><%= t('DeleteAll') %></button>
         <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="kill_all" formaction="<%= "#{root_path}retries/all/kill" %>"><%= t('KillAll') %></button>
       </div>
     </form>

data/web/views/{scheduled.erb → scheduled.html.erb}

@@ -54,7 +54,7 @@
       <div class="buttons-row">
         <input class="btn btn-danger" type="submit" name="delete" value="<%= t('Delete') %>">
         <input class="btn btn-danger" type="submit" name="add_to_queue" value="<%= t('AddToQueue') %>">
-        <button class="btn btn-danger bulk-action-buttons bulk-lead-button" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}scheduled/all/delete" %>"><%= t('DeleteAll') %></button>
+        <button class="btn btn-danger bulk-action-buttons bulk-lead-button" type="submit" name="action" value="delete_all" formaction="<%= "#{root_path}scheduled/all/delete" %>" data-confirm="<%= t('AreYouSure') %>"><%= t('DeleteAll') %></button>
         <button class="btn btn-danger bulk-action-buttons" type="submit" name="action" value="add_all_to_queue" formaction="<%= "#{root_path}scheduled/all/add_to_queue" %>"><%= t('AddAllToQueue') %></button>
       </div>
     </form>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq
 version: !ruby/object:Gem::Version
-  version: 8.0.9
+  version: 8.1.0
 platform: ruby
 authors:
 - Mike Perham
@@ -15,70 +15,70 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.23.2
+        version: 0.26.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.23.2
+        version: 0.26.0
 - !ruby/object:Gem::Dependency
   name: connection_pool
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: 3.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: 3.0.0
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.0
+        version: 3.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.0
+        version: 3.2.0
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.9.0
+        version: 2.16.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.9.0
+        version: 2.16.0
 - !ruby/object:Gem::Dependency
   name: logger
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.6.2
+        version: 1.7.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.6.2
+        version: 1.7.0
 description: Simple, efficient background processing for Ruby.
 email:
 - info@contribsys.com
@@ -91,6 +91,7 @@ files:
 - Changes.md
 - LICENSE.txt
 - README.md
+- bin/lint-herb
 - bin/multi_queue_bench
 - bin/sidekiq
 - bin/sidekiqload
@@ -151,7 +152,6 @@ files:
 - lib/sidekiq/web/action.rb
 - lib/sidekiq/web/application.rb
 - lib/sidekiq/web/config.rb
-- lib/sidekiq/web/csrf_protection.rb
 - lib/sidekiq/web/helpers.rb
 - lib/sidekiq/web/router.rb
 - lib/sidekiq/worker_compatibility_alias.rb
@@ -199,28 +199,28 @@ files:
 - web/locales/vi.yml
 - web/locales/zh-CN.yml
 - web/locales/zh-TW.yml
-- web/views/_footer.erb
-- web/views/_job_info.erb
-- web/views/_metrics_period_select.erb
-- web/views/_nav.erb
-- web/views/_paging.erb
-- web/views/_poll_link.erb
-- web/views/_summary.erb
-- web/views/busy.erb
-- web/views/dashboard.erb
-- web/views/dead.erb
-- web/views/filtering.erb
-- web/views/layout.erb
-- web/views/metrics.erb
-- web/views/metrics_for_job.erb
-- web/views/morgue.erb
-- web/views/profiles.erb
-- web/views/queue.erb
-- web/views/queues.erb
-- web/views/retries.erb
-- web/views/retry.erb
-- web/views/scheduled.erb
-- web/views/scheduled_job_info.erb
+- web/views/_footer.html.erb
+- web/views/_job_info.html.erb
+- web/views/_metrics_period_select.html.erb
+- web/views/_nav.html.erb
+- web/views/_paging.html.erb
+- web/views/_poll_link.html.erb
+- web/views/_summary.html.erb
+- web/views/busy.html.erb
+- web/views/dashboard.html.erb
+- web/views/dead.html.erb
+- web/views/filtering.html.erb
+- web/views/layout.html.erb
+- web/views/metrics.html.erb
+- web/views/metrics_for_job.html.erb
+- web/views/morgue.html.erb
+- web/views/profiles.html.erb
+- web/views/queue.html.erb
+- web/views/queues.html.erb
+- web/views/retries.html.erb
+- web/views/retry.html.erb
+- web/views/scheduled.html.erb
+- web/views/scheduled_job_info.html.erb
 homepage: https://sidekiq.org
 licenses:
 - LGPL-3.0

data/lib/sidekiq/web/csrf_protection.rb

@@ -1,183 +0,0 @@
-# frozen_string_literal: true
-
-# this file originally based on authenticity_token.rb from the sinatra/rack-protection project
-#
-# The MIT License (MIT)
-#
-# Copyright (c) 2011-2017 Konstantin Haase
-# Copyright (c) 2015-2017 Zachary Scott
-#
-# Permission is hereby granted, free of charge, to any person obtaining
-# a copy of this software and associated documentation files (the
-# 'Software'), to deal in the Software without restriction, including
-# without limitation the rights to use, copy, modify, merge, publish,
-# distribute, sublicense, and/or sell copies of the Software, and to
-# permit persons to whom the Software is furnished to do so, subject to
-# the following conditions:
-#
-# The above copyright notice and this permission notice shall be
-# included in all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-require "securerandom"
-require "rack/request"
-
-module Sidekiq
-  class Web
-    class CsrfProtection
-      def initialize(app, options = nil)
-        @app = app
-      end
-
-      def call(env)
-        accept?(env) ? admit(env) : deny(env)
-      end
-
-      private
-
-      def admit(env)
-        # On each successful request, we create a fresh masked token
-        # which will be used in any forms rendered for this request.
-        s = session(env)
-        s[:csrf] ||= SecureRandom.base64(TOKEN_LENGTH)
-        env[:csrf_token] = mask_token(s[:csrf])
-        @app.call(env)
-      end
-
-      def safe?(env)
-        %w[GET HEAD OPTIONS TRACE].include? env["REQUEST_METHOD"]
-      end
-
-      def logger(env)
-        @logger ||= env["rack.logger"] || ::Logger.new(env["rack.errors"])
-      end
-
-      def deny(env)
-        logger(env).warn "attack prevented by #{self.class}"
-        [403, {Rack::CONTENT_TYPE => "text/plain"}, ["Forbidden"]]
-      end
-
-      def session(env)
-        env["rack.session"] || fail(<<~EOM)
-          Sidekiq::Web needs a valid Rack session for CSRF protection. If this is a Rails app,
-          make sure you mount Sidekiq::Web *inside* your application routes:
-
-
-          Rails.application.routes.draw do
-            mount Sidekiq::Web => "/sidekiq"
-            ....
-          end
-
-
-          If this is a Rails app in API mode, you need to enable sessions.
-
-            https://guides.rubyonrails.org/api_app.html#using-session-middlewares
-
-          If this is a bare Rack app, use a session middleware before Sidekiq::Web:
-
-            # first, use IRB to create a shared secret key for sessions and commit it
-            require 'securerandom'; File.open(".session.key", "w") {|f| f.write(SecureRandom.hex(32)) }
-
-            # now use the secret with a session cookie middleware
-            use Rack::Session::Cookie, secret: File.read(".session.key"), same_site: true, max_age: 86400
-            run Sidekiq::Web
-
-        EOM
-      end
-
-      def accept?(env)
-        return true if safe?(env)
-
-        giventoken = ::Rack::Request.new(env).params["authenticity_token"]
-        valid_token?(env, giventoken)
-      end
-
-      TOKEN_LENGTH = 32
-
-      # Checks that the token given to us as a parameter matches
-      # the token stored in the session.
-      def valid_token?(env, giventoken)
-        return false if giventoken.nil? || giventoken.empty?
-
-        begin
-          token = decode_token(giventoken)
-        rescue ArgumentError # client input is invalid
-          return false
-        end
-
-        sess = session(env)
-        localtoken = sess[:csrf]
-
-        # Checks that Rack::Session::Cookie actually contains the csrf token
-        return false if localtoken.nil?
-
-        # Rotate the session token after every use
-        sess[:csrf] = SecureRandom.base64(TOKEN_LENGTH)
-
-        # See if it's actually a masked token or not. We should be able
-        # to handle any unmasked tokens that we've issued without error.
-
-        if unmasked_token?(token)
-          compare_with_real_token token, localtoken
-        elsif masked_token?(token)
-          unmasked = unmask_token(token)
-          compare_with_real_token unmasked, localtoken
-        else
-          false # Token is malformed
-        end
-      end
-
-      # Creates a masked version of the authenticity token that varies
-      # on each request. The masking is used to mitigate SSL attacks
-      # like BREACH.
-      def mask_token(token)
-        token = decode_token(token)
-        one_time_pad = SecureRandom.random_bytes(token.length)
-        encrypted_token = xor_byte_strings(one_time_pad, token)
-        masked_token = one_time_pad + encrypted_token
-        encode_token(masked_token)
-      end
-
-      # Essentially the inverse of +mask_token+.
-      def unmask_token(masked_token)
-        # Split the token into the one-time pad and the encrypted
-        # value and decrypt it
-        token_length = masked_token.length / 2
-        one_time_pad = masked_token[0...token_length]
-        encrypted_token = masked_token[token_length..]
-        xor_byte_strings(one_time_pad, encrypted_token)
-      end
-
-      def unmasked_token?(token)
-        token.length == TOKEN_LENGTH
-      end
-
-      def masked_token?(token)
-        token.length == TOKEN_LENGTH * 2
-      end
-
-      def compare_with_real_token(token, local)
-        ::Rack::Utils.secure_compare(token.to_s, decode_token(local).to_s)
-      end
-
-      def encode_token(token)
-        [token].pack("m0").tr("+/", "-_")
-      end
-
-      def decode_token(token)
-        token.tr("-_", "+/").unpack1("m0")
-      end
-
-      def xor_byte_strings(s1, s2)
-        s1.bytes.zip(s2.bytes).map { |(c1, c2)| c1 ^ c2 }.pack("c*")
-      end
-    end
-  end
-end