sinatra 3.0.2 → 3.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51d1e07bf88ff5cf3837bb62442c1e72ac0fcf0a76c1704d4807490dc03d9154
-  data.tar.gz: 7b3aa08a0f94b508478e33c3840b3100ffc74a77d9bf6a1422010c3cbfc1193d
+  metadata.gz: 253794a685657aa33414a6384abfa99f0c4b0a8aa97a9f15aa6d5ae88bcd747e
+  data.tar.gz: 455faa2397e06210cdeeb6e90eb5b8ec56908695585c869bb9241afc1e480cca
 SHA512:
-  metadata.gz: 10ffb0b48fbbd7677e4b4be938db356e005096d36b993695c1a60c27600b504a4ab38e7e920465b03f72eb60ff1b860b885c621d394d3f9b0160f848fc1a68ee
-  data.tar.gz: e1f70f1588cf5e35d806c5f6b245920e310362fefc9e5f54e99e632bb6b532c54955d8eda8675a80294a9526a648121e70f512df88c88886ecbb7ceb75eeb951
+  metadata.gz: b8ca8d0630ca6a5b420a6066ac6bb0375092e92a549bf623974a8780b576b859a227eccf32402ffb4628a04523c107420cda5982bcc69a14dbb3779ff299b255
+  data.tar.gz: 85352987ea63bcbdfa6a80af67a59e5e3e4e812f1aaf4f28016ebd085805934ffa2787278b3034cef623ee5ed278bb5b66eeb02f390b6b8fea5326f7f039c4d7

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 * _Your new feature here._
 
+## 3.0.5 / 2022-12-16
+
+* Fix: Add Zeitwerk compatibility. [#1831](https://github.com/sinatra/sinatra/pull/1831) by Dawid Janczak
+
+* Fix: Allow CALLERS_TO_IGNORE to be overridden
+
+## 3.0.4 / 2022-11-25
+
+* Fix: Escape filename in the Content-Disposition header. [#1841](https://github.com/sinatra/sinatra/pull/1841) by Kunpei Sakai
+
+## 3.0.3 / 2022-11-11
+
+* Fix: fixed ReDoS for Rack::Protection::IPSpoofing. [#1823](https://github.com/sinatra/sinatra/pull/1823) by @ooooooo-q
+
 ## 3.0.2 / 2022-10-01
 
 * New: Add Haml 6 support. [#1820](https://github.com/sinatra/sinatra/pull/1820) by Jordan Owens
@@ -58,6 +72,12 @@
 
 * Docs: Japanese documentation: Make Session section reflect changes done to README.md. [#1731](https://github.com/sinatra/sinatra/pull/1731) by @shu-i-chi
 
+## 2.2.3 / 2022-11-25
+
+* Fix: Escape filename in the Content-Disposition header. [#1841](https://github.com/sinatra/sinatra/pull/1841) by Kunpei Sakai
+
+* Fix: fixed ReDoS for Rack::Protection::IPSpoofing. [#1823](https://github.com/sinatra/sinatra/pull/1823) by @ooooooo-q
+
 ## 2.2.2 / 2022-07-23
 
 * Update mustermann dependency to version 2.
@@ -70,6 +90,8 @@
 
 ## 2.2.0 / 2022-02-15
 
+* Breaking change: Add `#select`, `#reject` and `#compact` methods to `Sinatra::IndifferentHash`. If hash keys need to be converted to symbols, call `#to_h` to get a `Hash` instance first. [#1711](https://github.com/sinatra/sinatra/pull/1711) by Olivier Bellone
+
 * Handle EOFError raised by Rack and return Bad Request 400 status. [#1743](https://github.com/sinatra/sinatra/pull/1743) by tamazon
 
 * Minor refactors in `base.rb`. [#1640](https://github.com/sinatra/sinatra/pull/1640) by ceclinux
@@ -100,8 +122,6 @@
 
 * Remove unnecessary `test_files` from the gemspec. [#1712](https://github.com/sinatra/sinatra/pull/1712) by Masataka Pocke Kuwabara
 
-* Add `#select`, `#reject` and `#compact` methods to `Sinatra::IndifferentHash`. [#1711](https://github.com/sinatra/sinatra/pull/1711) by Olivier Bellone
-
 * Docs: Spanish documentation: Update README.es.md with removal of Thin. [#1630](https://github.com/sinatra/sinatra/pull/1630) by Espartaco Palma
 
 * Docs: German documentation: Fixed typos in German README.md. [#1648](https://github.com/sinatra/sinatra/pull/1648) by Juri

data/Gemfile

@@ -15,9 +15,14 @@ gem 'rake'
 
 rack_version = ENV['rack'].to_s
 rack_version = nil if rack_version.empty? || (rack_version == 'stable')
-rack_version = { github: 'rack/rack' } if rack_version == 'main'
+rack_version = { github: 'rack/rack' } if rack_version == 'latest'
 gem 'rack', rack_version
 
+puma_version = ENV['puma'].to_s
+puma_version = nil if puma_version.empty? || (puma_version == 'stable')
+puma_version = { github: 'puma/puma' } if puma_version == 'latest'
+gem 'puma', puma_version
+
 gem 'minitest', '~> 5.0'
 gem 'rack-test', github: 'rack/rack-test'
 gem 'rubocop', '~> 1.32.0', require: false
@@ -40,7 +45,6 @@ gem 'liquid'
 gem 'markaby'
 gem 'nokogiri', '> 1.5.0'
 gem 'pandoc-ruby', '~> 2.0.2'
-gem 'puma'
 gem 'rabl'
 gem 'rainbows', platforms: [:mri] # uses #fork
 gem 'rdiscount', platforms: [:ruby]

data/README.md

@@ -938,7 +938,7 @@ __END__
 
 @@ layout
 %html
-  = yield
+  != yield
 
 @@ index
 %div.title Hello world.
@@ -984,7 +984,7 @@ To associate a file extension with a template engine, use
 `tt` for Haml templates, you can do the following:
 
 ```ruby
-Tilt.register :tt, Tilt[:haml]
+Tilt.register Tilt[:haml], :tt
 ```
 
 ### Adding Your Own Template Engine
@@ -992,7 +992,7 @@ Tilt.register :tt, Tilt[:haml]
 First, register your engine with Tilt, then create a rendering method:
 
 ```ruby
-Tilt.register :myat, MyAwesomeTemplateEngine
+Tilt.register MyAwesomeTemplateEngine, :myat
 
 helpers do
   def myat(*args) render(:myat, *args) end
@@ -2903,4 +2903,4 @@ SemVerTag.
 * API documentation for the [latest release](http://www.rubydoc.info/gems/sinatra)
   or the [current HEAD](http://www.rubydoc.info/github/sinatra/sinatra) on
   [RubyDoc](http://www.rubydoc.info/)
-* [CI server](https://travis-ci.org/sinatra/sinatra)
+* [CI Actions](https://github.com/sinatra/sinatra/actions)

data/VERSION

@@ -1 +1 @@
-3.0.2
+3.0.5

data/lib/sinatra/base.rb

@@ -396,13 +396,20 @@ module Sinatra
       response['Content-Type'] = mime_type
     end
 
+    # https://html.spec.whatwg.org/#multipart-form-data
+    MULTIPART_FORM_DATA_REPLACEMENT_TABLE = {
+      '"'  => '%22',
+      "\r" => '%0D',
+      "\n" => '%0A'
+    }.freeze
+
     # Set the Content-Disposition to "attachment" with the specified filename,
     # instructing the user agents to prompt to save.
     def attachment(filename = nil, disposition = :attachment)
       response['Content-Disposition'] = disposition.to_s.dup
       return unless filename
 
-      params = format('; filename="%s"', File.basename(filename))
+      params = format('; filename="%s"', File.basename(filename).gsub(/["\r\n]/, MULTIPART_FORM_DATA_REPLACEMENT_TABLE))
       response['Content-Disposition'] << params
       ext = File.extname(filename)
       content_type(ext) unless response['Content-Type'] || ext.empty?
@@ -1209,11 +1216,16 @@ module Sinatra
         %r{rubygems/(custom|core_ext/kernel)_require\.rb$}, # rubygems require hacks
         /active_support/,                                   # active_support require hacks
         %r{bundler(/(?:runtime|inline))?\.rb},              # bundler require hacks
-        /<internal:/                                        # internal in ruby >= 1.9.2
+        /<internal:/,                                       # internal in ruby >= 1.9.2
+        %r{zeitwerk/kernel\.rb}                             # Zeitwerk kernel#require decorator
       ].freeze
 
       attr_reader :routes, :filters, :templates, :errors
 
+      def callers_to_ignore
+        CALLERS_TO_IGNORE
+      end
+
       # Removes all routes, filters, middleware and extension hooks from the
       # current class (not routes/filters/... defined by its superclass).
       def reset!
@@ -1780,7 +1792,7 @@ module Sinatra
       def cleaned_caller(keep = 3)
         caller(1)
           .map! { |line| line.split(/:(?=\d|in )/, 3)[0, keep] }
-          .reject { |file, *_| CALLERS_TO_IGNORE.any? { |pattern| file =~ pattern } }
+          .reject { |file, *_| callers_to_ignore.any? { |pattern| file =~ pattern } }
       end
     end
 

data/lib/sinatra/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sinatra
-  VERSION = '3.0.1'
+  VERSION = '3.0.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sinatra
 version: !ruby/object:Gem::Version
-  version: 3.0.2
+  version: 3.0.5
 platform: ruby
 authors:
 - Blake Mizerany
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-10-01 00:00:00.000000000 Z
+date: 2022-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mustermann
@@ -53,14 +53,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.2
+        version: 3.0.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.2
+        version: 3.0.5
 - !ruby/object:Gem::Dependency
   name: tilt
   requirement: !ruby/object:Gem::Requirement