sprokovuln 0.2.0

data/vendor/ruby/gems/rack-2.0.5/lib/rack/multipart.rb

@@ -0,0 +1,63 @@
+require 'rack/multipart/parser'
+
+module Rack
+  # A multipart form data parser, adapted from IOWA.
+  #
+  # Usually, Rack::Request#POST takes care of calling this.
+  module Multipart
+    autoload :UploadedFile, 'rack/multipart/uploaded_file'
+    autoload :Generator, 'rack/multipart/generator'
+
+    EOL = "\r\n"
+    MULTIPART_BOUNDARY = "AaB03x"
+    MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|ni
+    TOKEN = /[^\s()<>,;:\\"\/\[\]?=]+/
+    CONDISP = /Content-Disposition:\s*#{TOKEN}\s*/i
+    VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
+    BROKEN_QUOTED = /^#{CONDISP}.*;\sfilename="(.*?)"(?:\s*$|\s*;\s*#{TOKEN}=)/i
+    BROKEN_UNQUOTED = /^#{CONDISP}.*;\sfilename=(#{TOKEN})/i
+    MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
+    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*\s+name=(#{VALUE})/ni
+    MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
+    # Updated definitions from RFC 2231
+    ATTRIBUTE_CHAR = %r{[^ \t\v\n\r)(><@,;:\\"/\[\]?='*%]}
+    ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
+    SECTION = /\*[0-9]+/
+    REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/
+    REGULAR_PARAMETER = /(#{REGULAR_PARAMETER_NAME})=(#{VALUE})/
+    EXTENDED_OTHER_NAME = /#{ATTRIBUTE}\*[1-9][0-9]*\*/
+    EXTENDED_OTHER_VALUE = /%[0-9a-fA-F]{2}|#{ATTRIBUTE_CHAR}/
+    EXTENDED_OTHER_PARAMETER = /(#{EXTENDED_OTHER_NAME})=(#{EXTENDED_OTHER_VALUE}*)/
+    EXTENDED_INITIAL_NAME = /#{ATTRIBUTE}(?:\*0)?\*/
+    EXTENDED_INITIAL_VALUE = /[a-zA-Z0-9\-]*'[a-zA-Z0-9\-]*'#{EXTENDED_OTHER_VALUE}*/
+    EXTENDED_INITIAL_PARAMETER = /(#{EXTENDED_INITIAL_NAME})=(#{EXTENDED_INITIAL_VALUE})/
+    EXTENDED_PARAMETER = /#{EXTENDED_INITIAL_PARAMETER}|#{EXTENDED_OTHER_PARAMETER}/
+    DISPPARM = /;\s*(?:#{REGULAR_PARAMETER}|#{EXTENDED_PARAMETER})\s*/
+    RFC2183 = /^#{CONDISP}(#{DISPPARM})+$/i
+
+    class << self
+      def parse_multipart(env, params = Rack::Utils.default_query_parser)
+        extract_multipart Rack::Request.new(env), params
+      end
+
+      def extract_multipart(req, params = Rack::Utils.default_query_parser)
+        io = req.get_header(RACK_INPUT)
+        io.rewind
+        content_length = req.content_length
+        content_length = content_length.to_i if content_length
+
+        tempfile = req.get_header(RACK_MULTIPART_TEMPFILE_FACTORY) || Parser::TEMPFILE_FACTORY
+        bufsize = req.get_header(RACK_MULTIPART_BUFFER_SIZE) || Parser::BUFSIZE
+
+        info = Parser.parse io, content_length, req.get_header('CONTENT_TYPE'), tempfile, bufsize, params
+        req.set_header(RACK_TEMPFILES, info.tmp_files)
+        info.params
+      end
+
+      def build_multipart(params, first = true)
+        Generator.new(params, first).dump
+      end
+    end
+
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/null_logger.rb

@@ -0,0 +1,37 @@
+module Rack
+  class NullLogger
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      env[RACK_LOGGER] = self
+      @app.call(env)
+    end
+
+    def info(progname = nil, &block); end
+    def debug(progname = nil, &block); end
+    def warn(progname = nil, &block); end
+    def error(progname = nil, &block); end
+    def fatal(progname = nil, &block); end
+    def unknown(progname = nil, &block); end
+    def info? ;  end
+    def debug? ; end
+    def warn? ;  end
+    def error? ; end
+    def fatal? ; end
+    def level ; end
+    def progname ; end
+    def datetime_format ; end
+    def formatter ; end
+    def sev_threshold ; end
+    def level=(level); end
+    def progname=(progname); end
+    def datetime_format=(datetime_format); end
+    def formatter=(formatter); end
+    def sev_threshold=(sev_threshold); end
+    def close ; end
+    def add(severity, message = nil, progname = nil, &block); end
+    def <<(msg); end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/query_parser.rb

@@ -0,0 +1,192 @@
+module Rack
+  class QueryParser
+    DEFAULT_SEP = /[&;] */n
+    COMMON_SEP = { ";" => /[;] */n, ";," => /[;,] */n, "&" => /[&] */n }
+
+    # ParameterTypeError is the error that is raised when incoming structural
+    # parameters (parsed by parse_nested_query) contain conflicting types.
+    class ParameterTypeError < TypeError; end
+
+    # InvalidParameterError is the error that is raised when incoming structural
+    # parameters (parsed by parse_nested_query) contain invalid format or byte
+    # sequence.
+    class InvalidParameterError < ArgumentError; end
+
+    def self.make_default(key_space_limit, param_depth_limit)
+      new Params, key_space_limit, param_depth_limit
+    end
+
+    attr_reader :key_space_limit, :param_depth_limit
+
+    def initialize(params_class, key_space_limit, param_depth_limit)
+      @params_class = params_class
+      @key_space_limit = key_space_limit
+      @param_depth_limit = param_depth_limit
+    end
+
+    # Stolen from Mongrel, with some small modifications:
+    # Parses a query string by breaking it up at the '&'
+    # and ';' characters.  You can also use this to parse
+    # cookies by changing the characters used in the second
+    # parameter (which defaults to '&;').
+    def parse_query(qs, d = nil, &unescaper)
+      unescaper ||= method(:unescape)
+
+      params = make_params
+
+      (qs || '').split(d ? (COMMON_SEP[d] || /[#{d}] */n) : DEFAULT_SEP).each do |p|
+        next if p.empty?
+        k, v = p.split('='.freeze, 2).map!(&unescaper)
+
+        if cur = params[k]
+          if cur.class == Array
+            params[k] << v
+          else
+            params[k] = [cur, v]
+          end
+        else
+          params[k] = v
+        end
+      end
+
+      return params.to_params_hash
+    end
+
+    # parse_nested_query expands a query string into structural types. Supported
+    # types are Arrays, Hashes and basic value types. It is possible to supply
+    # query strings with parameters of conflicting types, in this case a
+    # ParameterTypeError is raised. Users are encouraged to return a 400 in this
+    # case.
+    def parse_nested_query(qs, d = nil)
+      return {} if qs.nil? || qs.empty?
+      params = make_params
+
+      (qs || '').split(d ? (COMMON_SEP[d] || /[#{d}] */n) : DEFAULT_SEP).each do |p|
+        k, v = p.split('='.freeze, 2).map! { |s| unescape(s) }
+
+        normalize_params(params, k, v, param_depth_limit)
+      end
+
+      return params.to_params_hash
+    rescue ArgumentError => e
+      raise InvalidParameterError, e.message
+    end
+
+    # normalize_params recursively expands parameters into structural types. If
+    # the structural types represented by two different parameter names are in
+    # conflict, a ParameterTypeError is raised.
+    def normalize_params(params, name, v, depth)
+      raise RangeError if depth <= 0
+
+      name =~ %r(\A[\[\]]*([^\[\]]+)\]*)
+      k = $1 || ''.freeze
+      after = $' || ''.freeze
+
+      if k.empty?
+        if !v.nil? && name == "[]".freeze
+          return Array(v)
+        else
+          return
+        end
+      end
+
+      if after == ''.freeze
+        params[k] = v
+      elsif after == "[".freeze
+        params[name] = v
+      elsif after == "[]".freeze
+        params[k] ||= []
+        raise ParameterTypeError, "expected Array (got #{params[k].class.name}) for param `#{k}'" unless params[k].is_a?(Array)
+        params[k] << v
+      elsif after =~ %r(^\[\]\[([^\[\]]+)\]$) || after =~ %r(^\[\](.+)$)
+        child_key = $1
+        params[k] ||= []
+        raise ParameterTypeError, "expected Array (got #{params[k].class.name}) for param `#{k}'" unless params[k].is_a?(Array)
+        if params_hash_type?(params[k].last) && !params_hash_has_key?(params[k].last, child_key)
+          normalize_params(params[k].last, child_key, v, depth - 1)
+        else
+          params[k] << normalize_params(make_params, child_key, v, depth - 1)
+        end
+      else
+        params[k] ||= make_params
+        raise ParameterTypeError, "expected Hash (got #{params[k].class.name}) for param `#{k}'" unless params_hash_type?(params[k])
+        params[k] = normalize_params(params[k], after, v, depth - 1)
+      end
+
+      params
+    end
+
+    def make_params
+      @params_class.new @key_space_limit
+    end
+
+    def new_space_limit(key_space_limit)
+      self.class.new @params_class, key_space_limit, param_depth_limit
+    end
+
+    def new_depth_limit(param_depth_limit)
+      self.class.new @params_class, key_space_limit, param_depth_limit
+    end
+
+    private
+
+    def params_hash_type?(obj)
+      obj.kind_of?(@params_class)
+    end
+
+    def params_hash_has_key?(hash, key)
+      return false if key =~ /\[\]/
+
+      key.split(/[\[\]]+/).inject(hash) do |h, part|
+        next h if part == ''
+        return false unless params_hash_type?(h) && h.key?(part)
+        h[part]
+      end
+
+      true
+    end
+
+    def unescape(s)
+      Utils.unescape(s)
+    end
+
+    class Params
+      def initialize(limit)
+        @limit  = limit
+        @size   = 0
+        @params = {}
+      end
+
+      def [](key)
+        @params[key]
+      end
+
+      def []=(key, value)
+        @size += key.size if key && !@params.key?(key)
+        raise RangeError, 'exceeded available parameter key space' if @size > @limit
+        @params[key] = value
+      end
+
+      def key?(key)
+        @params.key?(key)
+      end
+
+      def to_params_hash
+        hash = @params
+        hash.keys.each do |key|
+          value = hash[key]
+          if value.kind_of?(self.class)
+            if value.object_id == self.object_id
+              hash[key] = hash
+            else
+              hash[key] = value.to_params_hash
+            end
+          elsif value.kind_of?(Array)
+            value.map! {|x| x.kind_of?(self.class) ? x.to_params_hash : x}
+          end
+        end
+        hash
+      end
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/recursive.rb

@@ -0,0 +1,62 @@
+require 'uri'
+
+module Rack
+  # Rack::ForwardRequest gets caught by Rack::Recursive and redirects
+  # the current request to the app at +url+.
+  #
+  #   raise ForwardRequest.new("/not-found")
+  #
+
+  class ForwardRequest < Exception
+    attr_reader :url, :env
+
+    def initialize(url, env={})
+      @url = URI(url)
+      @env = env
+
+      @env[PATH_INFO] =       @url.path
+      @env[QUERY_STRING] =    @url.query  if @url.query
+      @env[HTTP_HOST] =       @url.host   if @url.host
+      @env["HTTP_PORT"] =     @url.port   if @url.port
+      @env[RACK_URL_SCHEME] = @url.scheme if @url.scheme
+
+      super "forwarding to #{url}"
+    end
+  end
+
+  # Rack::Recursive allows applications called down the chain to
+  # include data from other applications (by using
+  # <tt>rack['rack.recursive.include'][...]</tt> or raise a
+  # ForwardRequest to redirect internally.
+
+  class Recursive
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      dup._call(env)
+    end
+
+    def _call(env)
+      @script_name = env[SCRIPT_NAME]
+      @app.call(env.merge(RACK_RECURSIVE_INCLUDE => method(:include)))
+    rescue ForwardRequest => req
+      call(env.merge(req.env))
+    end
+
+    def include(env, path)
+      unless path.index(@script_name) == 0 && (path[@script_name.size] == ?/ ||
+                                               path[@script_name.size].nil?)
+        raise ArgumentError, "can only include below #{@script_name}, not #{path}"
+      end
+
+      env = env.merge(PATH_INFO => path,
+                      SCRIPT_NAME => @script_name,
+                      REQUEST_METHOD => GET,
+                      "CONTENT_LENGTH" => "0", "CONTENT_TYPE" => "",
+                      RACK_INPUT => StringIO.new(""))
+      @app.call(env)
+    end
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/lib/rack/reloader.rb

@@ -0,0 +1,110 @@
+#          Copyright (c) 2009 Michael Fellinger m.fellinger@gmail.com
+#       Rack::Reloader is subject to the terms of an MIT-style license.
+#      See COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+require 'pathname'
+
+module Rack
+
+  # High performant source reloader
+  #
+  # This class acts as Rack middleware.
+  #
+  # What makes it especially suited for use in a production environment is that
+  # any file will only be checked once and there will only be made one system
+  # call stat(2).
+  #
+  # Please note that this will not reload files in the background, it does so
+  # only when actively called.
+  #
+  # It is performing a check/reload cycle at the start of every request, but
+  # also respects a cool down time, during which nothing will be done.
+  class Reloader
+    def initialize(app, cooldown = 10, backend = Stat)
+      @app = app
+      @cooldown = cooldown
+      @last = (Time.now - cooldown)
+      @cache = {}
+      @mtimes = {}
+      @reload_mutex = Mutex.new
+
+      extend backend
+    end
+
+    def call(env)
+      if @cooldown and Time.now > @last + @cooldown
+        if Thread.list.size > 1
+          @reload_mutex.synchronize{ reload! }
+        else
+          reload!
+        end
+
+        @last = Time.now
+      end
+
+      @app.call(env)
+    end
+
+    def reload!(stderr = $stderr)
+      rotation do |file, mtime|
+        previous_mtime = @mtimes[file] ||= mtime
+        safe_load(file, mtime, stderr) if mtime > previous_mtime
+      end
+    end
+
+    # A safe Kernel::load, issuing the hooks depending on the results
+    def safe_load(file, mtime, stderr = $stderr)
+      load(file)
+      stderr.puts "#{self.class}: reloaded `#{file}'"
+      file
+    rescue LoadError, SyntaxError => ex
+      stderr.puts ex
+    ensure
+      @mtimes[file] = mtime
+    end
+
+    module Stat
+      def rotation
+        files = [$0, *$LOADED_FEATURES].uniq
+        paths = ['./', *$LOAD_PATH].uniq
+
+        files.map{|file|
+          next if file =~ /\.(so|bundle)$/ # cannot reload compiled files
+
+          found, stat = figure_path(file, paths)
+          next unless found && stat && mtime = stat.mtime
+
+          @cache[file] = found
+
+          yield(found, mtime)
+        }.compact
+      end
+
+      # Takes a relative or absolute +file+ name, a couple possible +paths+ that
+      # the +file+ might reside in. Returns the full path and File::Stat for the
+      # path.
+      def figure_path(file, paths)
+        found = @cache[file]
+        found = file if !found and Pathname.new(file).absolute?
+        found, stat = safe_stat(found)
+        return found, stat if found
+
+        paths.find do |possible_path|
+          path = ::File.join(possible_path, file)
+          found, stat = safe_stat(path)
+          return ::File.expand_path(found), stat if found
+        end
+
+        return false, false
+      end
+
+      def safe_stat(file)
+        return unless file
+        stat = ::File.stat(file)
+        return file, stat if stat.file?
+      rescue Errno::ENOENT, Errno::ENOTDIR, Errno::ESRCH
+        @cache.delete(file) and false
+      end
+    end
+  end
+end