sprokovuln 0.2.0

data/vendor/ruby/gems/rack-2.0.5/lib/rack/content_type.rb

@@ -0,0 +1,29 @@
+require 'rack/utils'
+
+module Rack
+
+  # Sets the Content-Type header on responses which don't have one.
+  #
+  # Builder Usage:
+  #   use Rack::ContentType, "text/plain"
+  #
+  # When no content type argument is provided, "text/html" is assumed.
+  class ContentType
+    include Rack::Utils
+
+    def initialize(app, content_type = "text/html")
+      @app, @content_type = app, content_type
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      headers = Utils::HeaderHash.new(headers)
+
+      unless STATUS_WITH_NO_ENTITY_BODY.include?(status)
+        headers[CONTENT_TYPE] ||= @content_type
+      end
+
+      [status, headers, body]
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/deflater.rb

@@ -0,0 +1,119 @@
+require "zlib"
+require "time"  # for Time.httpdate
+require 'rack/utils'
+
+module Rack
+  # This middleware enables compression of http responses.
+  #
+  # Currently supported compression algorithms:
+  #
+  #   * gzip
+  #   * identity (no transformation)
+  #
+  # The middleware automatically detects when compression is supported
+  # and allowed. For example no transformation is made when a cache
+  # directive of 'no-transform' is present, or when the response status
+  # code is one that doesn't allow an entity body.
+  class Deflater
+    ##
+    # Creates Rack::Deflater middleware.
+    #
+    # [app] rack app instance
+    # [options] hash of deflater options, i.e.
+    #           'if' - a lambda enabling / disabling deflation based on returned boolean value
+    #                  e.g use Rack::Deflater, :if => lambda { |env, status, headers, body| body.map(&:bytesize).reduce(0, :+) > 512 }
+    #           'include' - a list of content types that should be compressed
+    def initialize(app, options = {})
+      @app = app
+
+      @condition = options[:if]
+      @compressible_types = options[:include]
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      headers = Utils::HeaderHash.new(headers)
+
+      unless should_deflate?(env, status, headers, body)
+        return [status, headers, body]
+      end
+
+      request = Request.new(env)
+
+      encoding = Utils.select_best_encoding(%w(gzip identity),
+                                            request.accept_encoding)
+
+      # Set the Vary HTTP header.
+      vary = headers["Vary"].to_s.split(",").map(&:strip)
+      unless vary.include?("*") || vary.include?("Accept-Encoding")
+        headers["Vary"] = vary.push("Accept-Encoding").join(",")
+      end
+
+      case encoding
+      when "gzip"
+        headers['Content-Encoding'] = "gzip"
+        headers.delete(CONTENT_LENGTH)
+        mtime = headers.key?("Last-Modified") ?
+          Time.httpdate(headers["Last-Modified"]) : Time.now
+        [status, headers, GzipStream.new(body, mtime)]
+      when "identity"
+        [status, headers, body]
+      when nil
+        message = "An acceptable encoding for the requested resource #{request.fullpath} could not be found."
+        bp = Rack::BodyProxy.new([message]) { body.close if body.respond_to?(:close) }
+        [406, {CONTENT_TYPE => "text/plain", CONTENT_LENGTH => message.length.to_s}, bp]
+      end
+    end
+
+    class GzipStream
+      def initialize(body, mtime)
+        @body = body
+        @mtime = mtime
+        @closed = false
+      end
+
+      def each(&block)
+        @writer = block
+        gzip  =::Zlib::GzipWriter.new(self)
+        gzip.mtime = @mtime
+        @body.each { |part|
+          gzip.write(part)
+          gzip.flush
+        }
+      ensure
+        gzip.close
+        @writer = nil
+      end
+
+      def write(data)
+        @writer.call(data)
+      end
+
+      def close
+        return if @closed
+        @closed = true
+        @body.close if @body.respond_to?(:close)
+      end
+    end
+
+    private
+
+    def should_deflate?(env, status, headers, body)
+      # Skip compressing empty entity body responses and responses with
+      # no-transform set.
+      if Utils::STATUS_WITH_NO_ENTITY_BODY.include?(status) ||
+          headers[CACHE_CONTROL].to_s =~ /\bno-transform\b/ ||
+         (headers['Content-Encoding'] && headers['Content-Encoding'] !~ /\bidentity\b/)
+        return false
+      end
+
+      # Skip if @compressible_types are given and does not include request's content type
+      return false if @compressible_types && !(headers.has_key?(CONTENT_TYPE) && @compressible_types.include?(headers[CONTENT_TYPE][/[^;]*/]))
+
+      # Skip if @condition lambda is given and evaluates to false
+      return false if @condition && !@condition.call(env, status, headers, body)
+
+      true
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/directory.rb

@@ -0,0 +1,179 @@
+require 'time'
+require 'rack/utils'
+require 'rack/mime'
+
+module Rack
+  # Rack::Directory serves entries below the +root+ given, according to the
+  # path info of the Rack request. If a directory is found, the file's contents
+  # will be presented in an html based index. If a file is found, the env will
+  # be passed to the specified +app+.
+  #
+  # If +app+ is not specified, a Rack::File of the same +root+ will be used.
+
+  class Directory
+    DIR_FILE = "<tr><td class='name'><a href='%s'>%s</a></td><td class='size'>%s</td><td class='type'>%s</td><td class='mtime'>%s</td></tr>"
+    DIR_PAGE = <<-PAGE
+<html><head>
+  <title>%s</title>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+  <style type='text/css'>
+table { width:100%%; }
+.name { text-align:left; }
+.size, .mtime { text-align:right; }
+.type { width:11em; }
+.mtime { width:15em; }
+  </style>
+</head><body>
+<h1>%s</h1>
+<hr />
+<table>
+  <tr>
+    <th class='name'>Name</th>
+    <th class='size'>Size</th>
+    <th class='type'>Type</th>
+    <th class='mtime'>Last Modified</th>
+  </tr>
+%s
+</table>
+<hr />
+</body></html>
+    PAGE
+
+    class DirectoryBody < Struct.new(:root, :path, :files)
+      def each
+        show_path = Rack::Utils.escape_html(path.sub(/^#{root}/,''))
+        listings = files.map{|f| DIR_FILE % DIR_FILE_escape(*f) }*"\n"
+        page  = DIR_PAGE % [ show_path, show_path , listings ]
+        page.each_line{|l| yield l }
+      end
+
+      private
+      # Assumes url is already escaped.
+      def DIR_FILE_escape url, *html
+        [url, *html.map { |e| Utils.escape_html(e) }]
+      end
+    end
+
+    attr_reader :root, :path
+
+    def initialize(root, app=nil)
+      @root = ::File.expand_path(root)
+      @app = app || Rack::File.new(@root)
+      @head = Rack::Head.new(lambda { |env| get env })
+    end
+
+    def call(env)
+      # strip body if this is a HEAD call
+      @head.call env
+    end
+
+    def get(env)
+      script_name = env[SCRIPT_NAME]
+      path_info = Utils.unescape_path(env[PATH_INFO])
+
+      if bad_request = check_bad_request(path_info)
+        bad_request
+      elsif forbidden = check_forbidden(path_info)
+        forbidden
+      else
+        path = ::File.join(@root, path_info)
+        list_path(env, path, path_info, script_name)
+      end
+    end
+
+    def check_bad_request(path_info)
+      return if Utils.valid_path?(path_info)
+
+      body = "Bad Request\n"
+      size = body.bytesize
+      return [400, {CONTENT_TYPE => "text/plain",
+        CONTENT_LENGTH => size.to_s,
+        "X-Cascade" => "pass"}, [body]]
+    end
+
+    def check_forbidden(path_info)
+      return unless path_info.include? ".."
+
+      body = "Forbidden\n"
+      size = body.bytesize
+      return [403, {CONTENT_TYPE => "text/plain",
+        CONTENT_LENGTH => size.to_s,
+        "X-Cascade" => "pass"}, [body]]
+    end
+
+    def list_directory(path_info, path, script_name)
+      files = [['../','Parent Directory','','','']]
+      glob = ::File.join(path, '*')
+
+      url_head = (script_name.split('/') + path_info.split('/')).map do |part|
+        Rack::Utils.escape_path part
+      end
+
+      Dir[glob].sort.each do |node|
+        stat = stat(node)
+        next unless stat
+        basename = ::File.basename(node)
+        ext = ::File.extname(node)
+
+        url = ::File.join(*url_head + [Rack::Utils.escape_path(basename)])
+        size = stat.size
+        type = stat.directory? ? 'directory' : Mime.mime_type(ext)
+        size = stat.directory? ? '-' : filesize_format(size)
+        mtime = stat.mtime.httpdate
+        url << '/'  if stat.directory?
+        basename << '/'  if stat.directory?
+
+        files << [ url, basename, size, type, mtime ]
+      end
+
+      return [ 200, { CONTENT_TYPE =>'text/html; charset=utf-8'}, DirectoryBody.new(@root, path, files) ]
+    end
+
+    def stat(node)
+      ::File.stat(node)
+    rescue Errno::ENOENT, Errno::ELOOP
+      return nil
+    end
+
+    # TODO: add correct response if not readable, not sure if 404 is the best
+    #       option
+    def list_path(env, path, path_info, script_name)
+      stat = ::File.stat(path)
+
+      if stat.readable?
+        return @app.call(env) if stat.file?
+        return list_directory(path_info, path, script_name) if stat.directory?
+      else
+        raise Errno::ENOENT, 'No such file or directory'
+      end
+
+    rescue Errno::ENOENT, Errno::ELOOP
+      return entity_not_found(path_info)
+    end
+
+    def entity_not_found(path_info)
+      body = "Entity not found: #{path_info}\n"
+      size = body.bytesize
+      return [404, {CONTENT_TYPE => "text/plain",
+        CONTENT_LENGTH => size.to_s,
+        "X-Cascade" => "pass"}, [body]]
+    end
+
+    # Stolen from Ramaze
+
+    FILESIZE_FORMAT = [
+      ['%.1fT', 1 << 40],
+      ['%.1fG', 1 << 30],
+      ['%.1fM', 1 << 20],
+      ['%.1fK', 1 << 10],
+    ]
+
+    def filesize_format(int)
+      FILESIZE_FORMAT.each do |format, size|
+        return format % (int.to_f / size) if int >= size
+      end
+
+      "#{int}B"
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/etag.rb

@@ -0,0 +1,74 @@
+require 'rack'
+require 'digest/sha2'
+
+module Rack
+  # Automatically sets the ETag header on all String bodies.
+  #
+  # The ETag header is skipped if ETag or Last-Modified headers are sent or if
+  # a sendfile body (body.responds_to :to_path) is given (since such cases
+  # should be handled by apache/nginx).
+  #
+  # On initialization, you can pass two parameters: a Cache-Control directive
+  # used when Etag is absent and a directive when it is present. The first
+  # defaults to nil, while the second defaults to "max-age=0, private, must-revalidate"
+  class ETag
+    ETAG_STRING = Rack::ETAG
+    DEFAULT_CACHE_CONTROL = "max-age=0, private, must-revalidate".freeze
+
+    def initialize(app, no_cache_control = nil, cache_control = DEFAULT_CACHE_CONTROL)
+      @app = app
+      @cache_control = cache_control
+      @no_cache_control = no_cache_control
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+
+      if etag_status?(status) && etag_body?(body) && !skip_caching?(headers)
+        original_body = body
+        digest, new_body = digest_body(body)
+        body = Rack::BodyProxy.new(new_body) do
+          original_body.close if original_body.respond_to?(:close)
+        end
+        headers[ETAG_STRING] = %(W/"#{digest}") if digest
+      end
+
+      unless headers[CACHE_CONTROL]
+        if digest
+          headers[CACHE_CONTROL] = @cache_control if @cache_control
+        else
+          headers[CACHE_CONTROL] = @no_cache_control if @no_cache_control
+        end
+      end
+
+      [status, headers, body]
+    end
+
+    private
+
+      def etag_status?(status)
+        status == 200 || status == 201
+      end
+
+      def etag_body?(body)
+        !body.respond_to?(:to_path)
+      end
+
+      def skip_caching?(headers)
+        (headers[CACHE_CONTROL] && headers[CACHE_CONTROL].include?('no-cache')) ||
+          headers.key?(ETAG_STRING) || headers.key?('Last-Modified')
+      end
+
+      def digest_body(body)
+        parts = []
+        digest = nil
+
+        body.each do |part|
+          parts << part
+          (digest ||= Digest::SHA256.new) << part unless part.empty?
+        end
+
+        [digest && digest.hexdigest.byteslice(0, 32), parts]
+      end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/events.rb

@@ -0,0 +1,154 @@
+require 'rack/response'
+require 'rack/body_proxy'
+
+module Rack
+  ### This middleware provides hooks to certain places in the request /
+  #response lifecycle.  This is so that middleware that don't need to filter
+  #the response data can safely leave it alone and not have to send messages
+  #down the traditional "rack stack".
+  #
+  # The events are:
+  #
+  # * on_start(request, response)
+  #
+  #   This event is sent at the start of the request, before the next
+  #   middleware in the chain is called.  This method is called with a request
+  #   object, and a response object.  Right now, the response object is always
+  #   nil, but in the future it may actually be a real response object.
+  #
+  # * on_commit(request, response)
+  #
+  #   The response has been committed.  The application has returned, but the
+  #   response has not been sent to the webserver yet.  This method is always
+  #   called with a request object and the response object.  The response
+  #   object is constructed from the rack triple that the application returned.
+  #   Changes may still be made to the response object at this point.
+  #
+  # * on_send(request, response)
+  #
+  #   The webserver has started iterating over the response body and presumably
+  #   has started sending data over the wire. This method is always called with
+  #   a request object and the response object.  The response object is
+  #   constructed from the rack triple that the application returned.  Changes
+  #   SHOULD NOT be made to the response object as the webserver has already
+  #   started sending data.  Any mutations will likely result in an exception.
+  #
+  # * on_finish(request, response)
+  #
+  #   The webserver has closed the response, and all data has been written to
+  #   the response socket.  The request and response object should both be
+  #   read-only at this point.  The body MAY NOT be available on the response
+  #   object as it may have been flushed to the socket.
+  #
+  # * on_error(request, response, error)
+  #
+  #   An exception has occurred in the application or an `on_commit` event.
+  #   This method will get the request, the response (if available) and the
+  #   exception that was raised.
+  #
+  # ## Order
+  #
+  # `on_start` is called on the handlers in the order that they were passed to
+  # the constructor.  `on_commit`, on_send`, `on_finish`, and `on_error` are
+  # called in the reverse order.  `on_finish` handlers are called inside an
+  # `ensure` block, so they are guaranteed to be called even if something
+  # raises an exception.  If something raises an exception in a `on_finish`
+  # method, then nothing is guaranteed.
+
+  class Events
+    module Abstract
+      def on_start req, res
+      end
+
+      def on_commit req, res
+      end
+
+      def on_send req, res
+      end
+
+      def on_finish req, res
+      end
+
+      def on_error req, res, e
+      end
+    end
+
+    class EventedBodyProxy < Rack::BodyProxy # :nodoc:
+      attr_reader :request, :response
+
+      def initialize body, request, response, handlers, &block
+        super(body, &block)
+        @request  = request
+        @response = response
+        @handlers = handlers
+      end
+
+      def each
+        @handlers.reverse_each { |handler| handler.on_send request, response }
+        super
+      end
+    end
+
+    class BufferedResponse < Rack::Response::Raw # :nodoc:
+      attr_reader :body
+
+      def initialize status, headers, body
+        super(status, headers)
+        @body = body
+      end
+
+      def to_a; [status, headers, body]; end
+    end
+
+    def initialize app, handlers
+      @app      = app
+      @handlers = handlers
+    end
+
+    def call env
+      request = make_request env
+      on_start request, nil
+
+      begin
+        status, headers, body = @app.call request.env
+        response = make_response status, headers, body
+        on_commit request, response
+      rescue StandardError => e
+        on_error request, response, e
+        on_finish request, response
+        raise
+      end
+
+      body = EventedBodyProxy.new(body, request, response, @handlers) do
+        on_finish request, response
+      end
+      [response.status, response.headers, body]
+    end
+
+    private
+
+    def on_error request, response, e
+      @handlers.reverse_each { |handler| handler.on_error request, response, e }
+    end
+
+    def on_commit request, response
+      @handlers.reverse_each { |handler| handler.on_commit request, response }
+    end
+
+    def on_start request, response
+      @handlers.each { |handler| handler.on_start request, nil }
+    end
+
+    def on_finish request, response
+      @handlers.reverse_each { |handler| handler.on_finish request, response }
+    end
+
+    def make_request env
+      Rack::Request.new env
+    end
+
+    def make_response status, headers, body
+      BufferedResponse.new status, headers, body
+    end
+  end
+end