sprokovuln 0.2.0

data/vendor/ruby/gems/rack-2.0.5/lib/rack/auth/digest/nonce.rb

@@ -0,0 +1,51 @@
+require 'digest/md5'
+
+module Rack
+  module Auth
+    module Digest
+      # Rack::Auth::Digest::Nonce is the default nonce generator for the
+      # Rack::Auth::Digest::MD5 authentication handler.
+      #
+      # +private_key+ needs to set to a constant string.
+      #
+      # +time_limit+ can be optionally set to an integer (number of seconds),
+      # to limit the validity of the generated nonces.
+
+      class Nonce
+
+        class << self
+          attr_accessor :private_key, :time_limit
+        end
+
+        def self.parse(string)
+          new(*string.unpack("m*").first.split(' ', 2))
+        end
+
+        def initialize(timestamp = Time.now, given_digest = nil)
+          @timestamp, @given_digest = timestamp.to_i, given_digest
+        end
+
+        def to_s
+          [([ @timestamp, digest ] * ' ')].pack("m*").strip
+        end
+
+        def digest
+          ::Digest::MD5.hexdigest([ @timestamp, self.class.private_key ] * ':')
+        end
+
+        def valid?
+          digest == @given_digest
+        end
+
+        def stale?
+          !self.class.time_limit.nil? && (Time.now.to_i - @timestamp) > self.class.time_limit
+        end
+
+        def fresh?
+          !stale?
+        end
+
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/auth/digest/params.rb

@@ -0,0 +1,52 @@
+module Rack
+  module Auth
+    module Digest
+      class Params < Hash
+
+        def self.parse(str)
+          Params[*split_header_value(str).map do |param|
+            k, v = param.split('=', 2)
+            [k, dequote(v)]
+          end.flatten]
+        end
+
+        def self.dequote(str) # From WEBrick::HTTPUtils
+          ret = (/\A"(.*)"\Z/ =~ str) ? $1 : str.dup
+          ret.gsub!(/\\(.)/, "\\1")
+          ret
+        end
+
+        def self.split_header_value(str)
+          str.scan(/\w+\=(?:"[^\"]+"|[^,]+)/n)
+        end
+
+        def initialize
+          super()
+
+          yield self if block_given?
+        end
+
+        def [](k)
+          super k.to_s
+        end
+
+        def []=(k, v)
+          super k.to_s, v.to_s
+        end
+
+        UNQUOTED = ['nc', 'stale']
+
+        def to_s
+          map do |k, v|
+            "#{k}=" << (UNQUOTED.include?(k) ? v.to_s : quote(v))
+          end.join(', ')
+        end
+
+        def quote(str) # From WEBrick::HTTPUtils
+          '"' << str.gsub(/[\\\"]/o, "\\\1") << '"'
+        end
+
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/auth/digest/request.rb

@@ -0,0 +1,41 @@
+require 'rack/auth/abstract/request'
+require 'rack/auth/digest/params'
+require 'rack/auth/digest/nonce'
+
+module Rack
+  module Auth
+    module Digest
+      class Request < Auth::AbstractRequest
+        def method
+          @env[RACK_METHODOVERRIDE_ORIGINAL_METHOD] || @env[REQUEST_METHOD]
+        end
+
+        def digest?
+          "digest" == scheme
+        end
+
+        def correct_uri?
+          request.fullpath == uri
+        end
+
+        def nonce
+          @nonce ||= Nonce.parse(params['nonce'])
+        end
+
+        def params
+          @params ||= Params.parse(parts.last)
+        end
+
+        def respond_to?(sym, *)
+          super or params.has_key? sym.to_s
+        end
+
+        def method_missing(sym, *args)
+          return super unless params.has_key?(key = sym.to_s)
+          return params[key] if args.size == 0
+          raise ArgumentError, "wrong number of arguments (#{args.size} for 0)"
+        end
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/body_proxy.rb

@@ -0,0 +1,44 @@
+module Rack
+  class BodyProxy
+    def initialize(body, &block)
+      @body = body
+      @block = block
+      @closed = false
+    end
+
+    def respond_to?(method_name, include_all=false)
+      case method_name
+      when :to_ary, 'to_ary'
+        return false
+      end
+      super or @body.respond_to?(method_name, include_all)
+    end
+
+    def close
+      return if @closed
+      @closed = true
+      begin
+        @body.close if @body.respond_to? :close
+      ensure
+        @block.call
+      end
+    end
+
+    def closed?
+      @closed
+    end
+
+    # N.B. This method is a special case to address the bug described by #434.
+    # We are applying this special case for #each only. Future bugs of this
+    # class will be handled by requesting users to patch their ruby
+    # implementation, to save adding too many methods in this class.
+    def each
+      @body.each { |body| yield body }
+    end
+
+    def method_missing(method_name, *args, &block)
+      super if :to_ary == method_name
+      @body.__send__(method_name, *args, &block)
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/builder.rb

@@ -0,0 +1,164 @@
+module Rack
+  # Rack::Builder implements a small DSL to iteratively construct Rack
+  # applications.
+  #
+  # Example:
+  #
+  #  require 'rack/lobster'
+  #  app = Rack::Builder.new do
+  #    use Rack::CommonLogger
+  #    use Rack::ShowExceptions
+  #    map "/lobster" do
+  #      use Rack::Lint
+  #      run Rack::Lobster.new
+  #    end
+  #  end
+  #
+  #  run app
+  #
+  # Or
+  #
+  #  app = Rack::Builder.app do
+  #    use Rack::CommonLogger
+  #    run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['OK']] }
+  #  end
+  #
+  #  run app
+  #
+  # +use+ adds middleware to the stack, +run+ dispatches to an application.
+  # You can use +map+ to construct a Rack::URLMap in a convenient way.
+
+  class Builder
+    def self.parse_file(config, opts = Server::Options.new)
+      options = {}
+      if config =~ /\.ru$/
+        cfgfile = ::File.read(config)
+        if cfgfile[/^#\\(.*)/] && opts
+          options = opts.parse! $1.split(/\s+/)
+        end
+        cfgfile.sub!(/^__END__\n.*\Z/m, '')
+        app = new_from_string cfgfile, config
+      else
+        require config
+        app = Object.const_get(::File.basename(config, '.rb').split('_').map(&:capitalize).join(''))
+      end
+      return app, options
+    end
+
+    def self.new_from_string(builder_script, file="(rackup)")
+      eval "Rack::Builder.new {\n" + builder_script + "\n}.to_app",
+        TOPLEVEL_BINDING, file, 0
+    end
+
+    def initialize(default_app = nil, &block)
+      @use, @map, @run, @warmup = [], nil, default_app, nil
+      instance_eval(&block) if block_given?
+    end
+
+    def self.app(default_app = nil, &block)
+      self.new(default_app, &block).to_app
+    end
+
+    # Specifies middleware to use in a stack.
+    #
+    #   class Middleware
+    #     def initialize(app)
+    #       @app = app
+    #     end
+    #
+    #     def call(env)
+    #       env["rack.some_header"] = "setting an example"
+    #       @app.call(env)
+    #     end
+    #   end
+    #
+    #   use Middleware
+    #   run lambda { |env| [200, { "Content-Type" => "text/plain" }, ["OK"]] }
+    #
+    # All requests through to this application will first be processed by the middleware class.
+    # The +call+ method in this example sets an additional environment key which then can be
+    # referenced in the application if required.
+    def use(middleware, *args, &block)
+      if @map
+        mapping, @map = @map, nil
+        @use << proc { |app| generate_map app, mapping }
+      end
+      @use << proc { |app| middleware.new(app, *args, &block) }
+    end
+
+    # Takes an argument that is an object that responds to #call and returns a Rack response.
+    # The simplest form of this is a lambda object:
+    #
+    #   run lambda { |env| [200, { "Content-Type" => "text/plain" }, ["OK"]] }
+    #
+    # However this could also be a class:
+    #
+    #   class Heartbeat
+    #     def self.call(env)
+    #      [200, { "Content-Type" => "text/plain" }, ["OK"]]
+    #     end
+    #   end
+    #
+    #   run Heartbeat
+    def run(app)
+      @run = app
+    end
+
+    # Takes a lambda or block that is used to warm-up the application.
+    #
+    #   warmup do |app|
+    #     client = Rack::MockRequest.new(app)
+    #     client.get('/')
+    #   end
+    #
+    #   use SomeMiddleware
+    #   run MyApp
+    def warmup(prc=nil, &block)
+      @warmup = prc || block
+    end
+
+    # Creates a route within the application.
+    #
+    #   Rack::Builder.app do
+    #     map '/' do
+    #       run Heartbeat
+    #     end
+    #   end
+    #
+    # The +use+ method can also be used here to specify middleware to run under a specific path:
+    #
+    #   Rack::Builder.app do
+    #     map '/' do
+    #       use Middleware
+    #       run Heartbeat
+    #     end
+    #   end
+    #
+    # This example includes a piece of middleware which will run before requests hit +Heartbeat+.
+    #
+    def map(path, &block)
+      @map ||= {}
+      @map[path] = block
+    end
+
+    def to_app
+      app = @map ? generate_map(@run, @map) : @run
+      fail "missing run or map statement" unless app
+      app = @use.reverse.inject(app) { |a,e| e[a] }
+      @warmup.call(app) if @warmup
+      app
+    end
+
+    def call(env)
+      to_app.call(env)
+    end
+
+    private
+
+    def generate_map(default_app, mapping)
+      mapped = default_app ? {'/' => default_app} : {}
+      mapping.each { |r,b| mapped[r] = self.class.new(default_app, &b).to_app }
+      URLMap.new(mapped)
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/cascade.rb

@@ -0,0 +1,52 @@
+module Rack
+  # Rack::Cascade tries a request on several apps, and returns the
+  # first response that is not 404 or 405 (or in a list of configurable
+  # status codes).
+
+  class Cascade
+    NotFound = [404, {CONTENT_TYPE => "text/plain"}, []]
+
+    attr_reader :apps
+
+    def initialize(apps, catch=[404, 405])
+      @apps = []; @has_app = {}
+      apps.each { |app| add app }
+
+      @catch = {}
+      [*catch].each { |status| @catch[status] = true }
+    end
+
+    def call(env)
+      result = NotFound
+
+      last_body = nil
+
+      @apps.each do |app|
+        # The SPEC says that the body must be closed after it has been iterated
+        # by the server, or if it is replaced by a middleware action. Cascade
+        # replaces the body each time a cascade happens. It is assumed that nil
+        # does not respond to close, otherwise the previous application body
+        # will be closed. The final application body will not be closed, as it
+        # will be passed to the server as a result.
+        last_body.close if last_body.respond_to? :close
+
+        result = app.call(env)
+        last_body = result[2]
+        break unless @catch.include?(result[0].to_i)
+      end
+
+      result
+    end
+
+    def add(app)
+      @has_app[app] = true
+      @apps << app
+    end
+
+    def include?(app)
+      @has_app.include? app
+    end
+
+    alias_method :<<, :add
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/chunked.rb

@@ -0,0 +1,69 @@
+require 'rack/utils'
+
+module Rack
+
+  # Middleware that applies chunked transfer encoding to response bodies
+  # when the response does not include a Content-Length header.
+  class Chunked
+    include Rack::Utils
+
+    # A body wrapper that emits chunked responses
+    class Body
+      TERM = "\r\n"
+      TAIL = "0#{TERM}#{TERM}"
+
+      include Rack::Utils
+
+      def initialize(body)
+        @body = body
+      end
+
+      def each
+        term = TERM
+        @body.each do |chunk|
+          size = chunk.bytesize
+          next if size == 0
+
+          chunk = chunk.b
+          yield [size.to_s(16), term, chunk, term].join
+        end
+        yield TAIL
+      end
+
+      def close
+        @body.close if @body.respond_to?(:close)
+      end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    # pre-HTTP/1.0 (informally "HTTP/0.9") HTTP requests did not have
+    # a version (nor response headers)
+    def chunkable_version?(ver)
+      case ver
+      when "HTTP/1.0", nil, "HTTP/0.9"
+        false
+      else
+        true
+      end
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      headers = HeaderHash.new(headers)
+
+      if ! chunkable_version?(env[HTTP_VERSION]) ||
+         STATUS_WITH_NO_ENTITY_BODY.include?(status) ||
+         headers[CONTENT_LENGTH] ||
+         headers[TRANSFER_ENCODING]
+        [status, headers, body]
+      else
+        headers.delete(CONTENT_LENGTH)
+        headers[TRANSFER_ENCODING] = 'chunked'
+        [status, headers, Body.new(body)]
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/common_logger.rb

@@ -0,0 +1,72 @@
+require 'rack/body_proxy'
+
+module Rack
+  # Rack::CommonLogger forwards every request to the given +app+, and
+  # logs a line in the
+  # {Apache common log format}[http://httpd.apache.org/docs/1.3/logs.html#common]
+  # to the +logger+.
+  #
+  # If +logger+ is nil, CommonLogger will fall back +rack.errors+, which is
+  # an instance of Rack::NullLogger.
+  #
+  # +logger+ can be any class, including the standard library Logger, and is
+  # expected to have either +write+ or +<<+ method, which accepts the CommonLogger::FORMAT.
+  # According to the SPEC, the error stream must also respond to +puts+
+  # (which takes a single argument that responds to +to_s+), and +flush+
+  # (which is called without arguments in order to make the error appear for
+  # sure)
+  class CommonLogger
+    # Common Log Format: http://httpd.apache.org/docs/1.3/logs.html#common
+    #
+    #   lilith.local - - [07/Aug/2006 23:58:02 -0400] "GET / HTTP/1.1" 500 -
+    #
+    #   %{%s - %s [%s] "%s %s%s %s" %d %s\n} %
+    FORMAT = %{%s - %s [%s] "%s %s%s %s" %d %s %0.4f\n}
+
+    def initialize(app, logger=nil)
+      @app = app
+      @logger = logger
+    end
+
+    def call(env)
+      began_at = Time.now
+      status, header, body = @app.call(env)
+      header = Utils::HeaderHash.new(header)
+      body = BodyProxy.new(body) { log(env, status, header, began_at) }
+      [status, header, body]
+    end
+
+    private
+
+    def log(env, status, header, began_at)
+      now = Time.now
+      length = extract_content_length(header)
+
+      msg = FORMAT % [
+        env['HTTP_X_FORWARDED_FOR'] || env["REMOTE_ADDR"] || "-",
+        env["REMOTE_USER"] || "-",
+        now.strftime("%d/%b/%Y:%H:%M:%S %z"),
+        env[REQUEST_METHOD],
+        env[PATH_INFO],
+        env[QUERY_STRING].empty? ? "" : "?#{env[QUERY_STRING]}",
+        env[HTTP_VERSION],
+        status.to_s[0..3],
+        length,
+        now - began_at ]
+
+      logger = @logger || env[RACK_ERRORS]
+      # Standard library logger doesn't support write but it supports << which actually
+      # calls to write on the log device without formatting
+      if logger.respond_to?(:write)
+        logger.write(msg)
+      else
+        logger << msg
+      end
+    end
+
+    def extract_content_length(headers)
+      value = headers[CONTENT_LENGTH] or return '-'
+      value.to_s == '0' ? '-' : value
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/conditional_get.rb

@@ -0,0 +1,79 @@
+require 'rack/utils'
+
+module Rack
+
+  # Middleware that enables conditional GET using If-None-Match and
+  # If-Modified-Since. The application should set either or both of the
+  # Last-Modified or Etag response headers according to RFC 2616. When
+  # either of the conditions is met, the response body is set to be zero
+  # length and the response status is set to 304 Not Modified.
+  #
+  # Applications that defer response body generation until the body's each
+  # message is received will avoid response body generation completely when
+  # a conditional GET matches.
+  #
+  # Adapted from Michael Klishin's Merb implementation:
+  # https://github.com/wycats/merb/blob/master/merb-core/lib/merb-core/rack/middleware/conditional_get.rb
+  class ConditionalGet
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      case env[REQUEST_METHOD]
+      when "GET", "HEAD"
+        status, headers, body = @app.call(env)
+        headers = Utils::HeaderHash.new(headers)
+        if status == 200 && fresh?(env, headers)
+          status = 304
+          headers.delete(CONTENT_TYPE)
+          headers.delete(CONTENT_LENGTH)
+          original_body = body
+          body = Rack::BodyProxy.new([]) do
+            original_body.close if original_body.respond_to?(:close)
+          end
+        end
+        [status, headers, body]
+      else
+        @app.call(env)
+      end
+    end
+
+  private
+
+    def fresh?(env, headers)
+      modified_since = env['HTTP_IF_MODIFIED_SINCE']
+      none_match     = env['HTTP_IF_NONE_MATCH']
+
+      return false unless modified_since || none_match
+
+      success = true
+      success &&= modified_since?(to_rfc2822(modified_since), headers) if modified_since
+      success &&= etag_matches?(none_match, headers) if none_match
+      success
+    end
+
+    def etag_matches?(none_match, headers)
+      etag = headers['ETag'] and etag == none_match
+    end
+
+    def modified_since?(modified_since, headers)
+      last_modified = to_rfc2822(headers['Last-Modified']) and
+        modified_since and
+        modified_since >= last_modified
+    end
+
+    def to_rfc2822(since)
+      # shortest possible valid date is the obsolete: 1 Nov 97 09:55 A
+      # anything shorter is invalid, this avoids exceptions for common cases
+      # most common being the empty string
+      if since && since.length >= 16
+        # NOTE: there is no trivial way to write this in a non execption way
+        #   _rfc2822 returns a hash but is not that usable
+        Time.rfc2822(since) rescue nil
+      else
+        nil
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/config.rb

@@ -0,0 +1,20 @@
+module Rack
+  # Rack::Config modifies the environment using the block given during
+  # initialization.
+  #
+  # Example:
+  #     use Rack::Config do |env|
+  #       env['my-key'] = 'some-value'
+  #     end
+  class Config
+    def initialize(app, &block)
+      @app = app
+      @block = block
+    end
+
+    def call(env)
+      @block.call(env)
+      @app.call(env)
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/content_length.rb

@@ -0,0 +1,37 @@
+require 'rack/utils'
+require 'rack/body_proxy'
+
+module Rack
+
+  # Sets the Content-Length header on responses with fixed-length bodies.
+  class ContentLength
+    include Rack::Utils
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      headers = HeaderHash.new(headers)
+
+      if !STATUS_WITH_NO_ENTITY_BODY.include?(status.to_i) &&
+         !headers[CONTENT_LENGTH] &&
+         !headers[TRANSFER_ENCODING] &&
+         body.respond_to?(:to_ary)
+
+        obody = body
+        body, length = [], 0
+        obody.each { |part| body << part; length += part.bytesize }
+
+        body = BodyProxy.new(body) do
+          obody.close if obody.respond_to?(:close)
+        end
+
+        headers[CONTENT_LENGTH] = length.to_s
+      end
+
+      [status, headers, body]
+    end
+  end
+end