sidekiq 2.16.0 → 2.16.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 08f16a145d63e3e2a04ec513885c855f1a0b12d7
-  data.tar.gz: 5596a8f758154a052f1b0e2eedfbe837bc801f2e
+  metadata.gz: 34e9d5b007bd144d33930ee67fa26a492e6664eb
+  data.tar.gz: 28e8782a74a452e75040674eaf22ac33cf2bb660
 SHA512:
-  metadata.gz: 5867e076904084e5b63c9f7a3dbe9358173405b48c3903954d7cf75129d2afe7d92aac884da37fa492d4542e82233d867d9927c3467e4cd11496abc123a965cc
-  data.tar.gz: fe962090ddb489623737ccc89279f6cd2bf9e36d53dadcc9a7fdd9f41bca067e1743d04a98ce5afe49c83f3e467819695221ac8bd5338bbb5b2f89c9294d6afe
+  metadata.gz: a0c318ac705b8ca596327765b1ea1ed914534b70736dc3af10c8adac268d53f576e30df7b4a56568fd8b5f97e1f4e739609af50fc03ccf83d730f1a8c9bfcfd7
+  data.tar.gz: bc670c8eb9e5d31fe24d4d7a7ef7301e8390d606c178c6b68b9638b8588f298c63c97d500280ddf802f69b602a589ca2d913f7336338ac00a2582fecec4ae58b

data/Changes.md

@@ -1,3 +1,10 @@
+2.16.1
+-----------
+
+- Revert usage of `resolv-replace`.  MRI's native DNS lookup releases the GIL.
+- Fix several Capistrano 3 issues
+- Escaping dynamic data like job args and error messages in Sidekiq Web UI. [#1299, lian]
+
 2.16.0
 -----------
 

data/lib/sidekiq/capistrano.rb

@@ -1,4 +1,4 @@
-if Gem::Version.new(Capistrano::VERSION).release >= Gem::Version.new('3.0.0')
+if defined?(Capistrano::VERSION) && Gem::Version.new(Capistrano::VERSION).release >= Gem::Version.new('3.0.0')
   load File.expand_path("../tasks/sidekiq.rake", __FILE__)
 else
   require_relative 'capistrano2'

data/lib/sidekiq/cli.rb

@@ -1,6 +1,5 @@
 $stdout.sync = true
 
-require 'resolv-replace'
 require 'yaml'
 require 'singleton'
 require 'optparse'

data/lib/sidekiq/tasks/sidekiq.rake

@@ -1,8 +1,10 @@
 namespace :load do
   task :defaults do
 
+    set :sidekiq_default_hooks, ->{ true }
+
     # If you need a special boot commands
-    # 
+    #
     # set :sidekiq_cmd,           ->{ "bundle exec sidekiq"  }
     # set :sidekiqctl_cmd,        ->{ "bundle exec sidekiqctl" }
     set :sidekiq_cmd,           ->{  }
@@ -31,9 +33,9 @@ namespace :sidekiq do
   desc "Quiet sidekiq (stop accepting new work)"
   task :quiet do
     on roles fetch(:sidekiq_role) do
-      within current_path do
-        for_each_process do |pid_file, idx|
-          if test "[ -f #{current_path}/#{pid_file} ]"
+      for_each_process do |pid_file, idx|
+        if test "[ -f #{current_path}/#{pid_file} ]"
+          within current_path do
             if fetch(:sidekiqctl_cmd)
               execute fetch(:sidekiqctl_cmd), 'quiet', "#{current_path}/#{pid_file}"
             else
@@ -48,9 +50,9 @@ namespace :sidekiq do
   desc "Stop sidekiq"
   task :stop do
     on roles fetch(:sidekiq_role) do
-      within current_path do
-        for_each_process do |pid_file, idx|
-          if test "[ -f #{current_path}/#{pid_file} ]"
+      for_each_process do |pid_file, idx|
+        if test "[ -f #{current_path}/#{pid_file} ]"
+          within current_path do
             if fetch(:sidekiqctl_cmd)
               execute fetch(:sidekiqctl_cmd), 'stop', "#{current_path}/#{pid_file}", fetch(:sidekiq_timeout)
             else
@@ -69,9 +71,9 @@ namespace :sidekiq do
       within current_path do
         for_each_process do |pid_file, idx|
           if fetch(:sidekiq_cmd)
-            execute fetch(:sidekiq_cmd), "-d -i #{idx} -P #{pid_file} #{fetch(:sidekiq_options)}" 
+            execute fetch(:sidekiq_cmd), "-d -i #{idx} -P #{pid_file} #{fetch(:sidekiq_options)}"
           else
-            execute :bundle, :exec, :sidekiq, "-d -i #{idx} -P #{pid_file} #{fetch(:sidekiq_options)}" 
+            execute :bundle, :exec, :sidekiq, "-d -i #{idx} -P #{pid_file} #{fetch(:sidekiq_options)}"
           end
         end
       end
@@ -84,9 +86,11 @@ namespace :sidekiq do
     invoke 'sidekiq:start'
   end
 
-  after 'deploy:starting',  'sidekiq:quiet'
-  after 'deploy:updated',   'sidekiq:stop'
-  after 'deploy:reverted',  'sidekiq:stop'
-  after 'deploy:published', 'sidekiq:start'
-  
+  if fetch(:sidekiq_default_hooks)
+    after 'deploy:starting',  'sidekiq:quiet'
+    after 'deploy:updated',   'sidekiq:stop'
+    after 'deploy:reverted',  'sidekiq:stop'
+    after 'deploy:published', 'sidekiq:start'
+  end
+
 end

data/lib/sidekiq/version.rb

@@ -1,3 +1,3 @@
 module Sidekiq
-  VERSION = "2.16.0"
+  VERSION = "2.16.1"
 end

data/lib/sidekiq/web_helpers.rb

@@ -127,7 +127,7 @@ module Sidekiq
     def display_args(args, truncate_after_chars = 2000)
       args.map do |arg|
         a = arg.inspect
-        truncate(a)
+        h(truncate(a))
       end.join(", ")
     end
 
@@ -159,7 +159,7 @@ module Sidekiq
     end
 
     def h(text)
-      ERB::Util.h(text)
+      Rack::Utils.escape_html(text)
     end
 
     # Any paginated list that performs an action needs to redirect

data/test/test_web.rb

@@ -265,6 +265,47 @@ class TestWeb < Sidekiq::Test
       assert_match /#{msg['args'][2]}/, last_response.body
     end
 
+    it 'escape job args and error messages' do
+      # on /retries page
+      params = add_xss_retry
+      get '/retries'
+      assert_equal 200, last_response.status
+      assert_match /FailWorker/, last_response.body
+
+      assert last_response.body.include?( "fail message: &lt;a&gt;hello&lt;&#x2F;a&gt;" )
+      assert !last_response.body.include?( "fail message: <a>hello</a>" )
+
+      assert last_response.body.include?( "args\">&quot;&lt;a&gt;hello&lt;&#x2F;a&gt;&quot;<" )
+      assert !last_response.body.include?( "args\"><a>hello</a><" )
+
+
+      # on /workers page
+      Sidekiq.redis do |conn|
+        identity = 'foo:1234-123abc:default'
+        conn.sadd('workers', identity)
+        conn.setex("worker:#{identity}:started", 10, Time.now.to_s)
+        hash = {:queue => 'critical', :payload => { 'class' => "FailWorker", 'args' => ["<a>hello</a>"] }, :run_at => Time.now.to_i }
+        conn.setex("worker:#{identity}", 10, Sidekiq.dump_json(hash))
+      end
+
+      get '/workers'
+      assert_equal 200, last_response.status
+      assert_match /FailWorker/, last_response.body
+      assert last_response.body.include?( "&lt;a&gt;hello&lt;&#x2F;a&gt;" )
+      assert !last_response.body.include?( "<a>hello</a>" )
+
+
+      # on /queues page
+      params = add_xss_retry # sorry, don't know how to easily make this show up on queues page otherwise.
+      post "/retries/#{job_params(*params)}", 'retry' => 'Retry'
+      assert_equal 302, last_response.status
+
+      get '/queues/foo'
+      assert_equal 200, last_response.status
+      assert last_response.body.include?( "&lt;a&gt;hello&lt;&#x2F;a&gt;" )
+      assert !last_response.body.include?( "<a>hello</a>" )
+    end
+
     it 'can show user defined tab' do
       begin
         Sidekiq::Web.tabs['Custom Tab'] = '/custom'
@@ -380,6 +421,22 @@ class TestWeb < Sidekiq::Test
       [msg, score]
     end
 
+    def add_xss_retry
+      msg = { 'class' => 'FailWorker',
+              'args' => ['<a>hello</a>'],
+              'queue' => 'foo',
+              'error_message' => 'fail message: <a>hello</a>',
+              'error_class' => 'RuntimeError',
+              'retry_count' => 0,
+              'failed_at' => Time.now.utc,
+              'jid' => 'f39af2a05e8f4b24dbc0f1e4'}
+      score = Time.now.to_f
+      Sidekiq.redis do |conn|
+        conn.zadd('retry', score, Sidekiq.dump_json(msg))
+      end
+      [msg, score]
+    end
+
     def add_worker
       process_id = rand(1000)
       msg = "{\"queue\":\"default\",\"payload\":{\"retry\":true,\"queue\":\"default\",\"timeout\":20,\"backtrace\":5,\"class\":\"HardWorker\",\"args\":[\"bob\",10,5],\"jid\":\"2b5ad2b016f5e063a1c62872\"},\"run_at\":1361208995}"

data/web/views/_workers.erb

@@ -16,11 +16,11 @@
       <td><%= msg['payload']['class'] %></td>
       <td>
         <% if msg['payload']['args'].to_s.size > 100 %>
-          <%= msg['payload']['args'].inspect[0..100] + "... " %>
+          <%= h(msg['payload']['args'].inspect[0..100]) + "... " %>
           <button data-toggle="collapse" data-target="#worker_<%= index %>" class="btn btn-default btn-xs"><%= t('ShowAll') %></button>
-          <div class="toggle" id="worker_<%= index %>" style="display: none;max-width: 750px;"><%= msg['payload']['args'] %></div>
+          <div class="toggle" id="worker_<%= index %>" style="display: none;max-width: 750px;"><%= h(msg['payload']['args']) %></div>
         <% else %>
-          <%= msg['payload']['args'] %>
+          <%= h(msg['payload']['args']) %>
         <% end %>
       </td>
       <td><%= relative_time(msg['run_at'].is_a?(Numeric) ? Time.at(msg['run_at']) : Time.parse(msg['run_at'])) %></td>

data/web/views/queue.erb

@@ -19,11 +19,11 @@
       <td><%= msg['class'] %></td>
       <td>
         <% if msg['args'] and msg['args'].to_s.size > 100 %>
-          <%= msg['args'].inspect[0..100] + "... " %>
+          <%= h(msg['args'].inspect[0..100]) + "... " %>
           <button data-toggle="collapse" data-target="#worker_<%= index %>" class="btn btn-default btn-xs"><%= t('ShowAll') %></button>
-          <div class="toggle" id="worker_<%= index %>" style="display: none;"><%= msg['args'] %></div>
+          <div class="toggle" id="worker_<%= index %>" style="display: none;"><%= h(msg['args']) %></div>
         <% else %>
-          <%= msg['args'] %>
+          <%= h(msg['args']) %>
         <% end %>
       </td>
       <td>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq
 version: !ruby/object:Gem::Version
-  version: 2.16.0
+  version: 2.16.1
 platform: ruby
 authors:
 - Mike Perham
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-27 00:00:00.000000000 Z
+date: 2013-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis