sprokovuln 0.2.0

data/vendor/ruby/gems/rack-2.0.5/test/spec_conditional_get.rb

@@ -0,0 +1,103 @@
+require 'minitest/autorun'
+require 'time'
+require 'rack/conditional_get'
+require 'rack/mock'
+
+describe Rack::ConditionalGet do
+  def conditional_get(app)
+    Rack::Lint.new Rack::ConditionalGet.new(app)
+  end
+
+  it "set a 304 status and truncate body when If-Modified-Since hits" do
+    timestamp = Time.now.httpdate
+    app = conditional_get(lambda { |env|
+      [200, {'Last-Modified'=>timestamp}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => timestamp)
+
+    response.status.must_equal 304
+    response.body.must_be :empty?
+  end
+
+  it "set a 304 status and truncate body when If-Modified-Since hits and is higher than current time" do
+    app = conditional_get(lambda { |env|
+      [200, {'Last-Modified'=>(Time.now - 3600).httpdate}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => Time.now.httpdate)
+
+    response.status.must_equal 304
+    response.body.must_be :empty?
+  end
+
+  it "set a 304 status and truncate body when If-None-Match hits" do
+    app = conditional_get(lambda { |env|
+      [200, {'ETag'=>'1234'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_NONE_MATCH' => '1234')
+
+    response.status.must_equal 304
+    response.body.must_be :empty?
+  end
+
+  it "not set a 304 status if If-Modified-Since hits but Etag does not" do
+    timestamp = Time.now.httpdate
+    app = conditional_get(lambda { |env|
+      [200, {'Last-Modified'=>timestamp, 'Etag'=>'1234', 'Content-Type' => 'text/plain'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => timestamp, 'HTTP_IF_NONE_MATCH' => '4321')
+
+    response.status.must_equal 200
+    response.body.must_equal 'TEST'
+  end
+
+  it "set a 304 status and truncate body when both If-None-Match and If-Modified-Since hits" do
+    timestamp = Time.now.httpdate
+    app = conditional_get(lambda { |env|
+      [200, {'Last-Modified'=>timestamp, 'ETag'=>'1234'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => timestamp, 'HTTP_IF_NONE_MATCH' => '1234')
+
+    response.status.must_equal 304
+    response.body.must_be :empty?
+  end
+
+  it "not affect non-GET/HEAD requests" do
+    app = conditional_get(lambda { |env|
+      [200, {'Etag'=>'1234', 'Content-Type' => 'text/plain'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      post("/", 'HTTP_IF_NONE_MATCH' => '1234')
+
+    response.status.must_equal 200
+    response.body.must_equal 'TEST'
+  end
+
+  it "not affect non-200 requests" do
+    app = conditional_get(lambda { |env|
+      [302, {'Etag'=>'1234', 'Content-Type' => 'text/plain'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_NONE_MATCH' => '1234')
+
+    response.status.must_equal 302
+    response.body.must_equal 'TEST'
+  end
+
+  it "not affect requests with malformed HTTP_IF_NONE_MATCH" do
+    bad_timestamp = Time.now.strftime('%Y-%m-%d %H:%M:%S %z')
+    app = conditional_get(lambda { |env|
+      [200,{'Last-Modified'=>(Time.now - 3600).httpdate, 'Content-Type' => 'text/plain'}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => bad_timestamp)
+
+    response.status.must_equal 200
+    response.body.must_equal 'TEST'
+  end
+
+end

data/vendor/ruby/gems/rack-2.0.5/test/spec_config.rb

@@ -0,0 +1,23 @@
+require 'minitest/autorun'
+require 'rack/builder'
+require 'rack/config'
+require 'rack/content_length'
+require 'rack/lint'
+require 'rack/mock'
+
+describe Rack::Config do
+  it "accept a block that modifies the environment" do
+    app = Rack::Builder.new do
+      use Rack::Lint
+      use Rack::Config do |env|
+        env['greeting'] = 'hello'
+      end
+      run lambda { |env|
+        [200, {'Content-Type' => 'text/plain'}, [env['greeting'] || '']]
+      }
+    end
+
+    response = Rack::MockRequest.new(app).get('/')
+    response.body.must_equal 'hello'
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/test/spec_content_length.rb

@@ -0,0 +1,86 @@
+require 'minitest/autorun'
+require 'rack/content_length'
+require 'rack/lint'
+require 'rack/mock'
+
+describe Rack::ContentLength do
+  def content_length(app)
+    Rack::Lint.new Rack::ContentLength.new(app)
+  end
+
+  def request
+    Rack::MockRequest.env_for
+  end
+
+  it "set Content-Length on Array bodies if none is set" do
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain'}, ["Hello, World!"]] }
+    response = content_length(app).call(request)
+    response[1]['Content-Length'].must_equal '13'
+  end
+
+  it "not set Content-Length on variable length bodies" do
+    body = lambda { "Hello World!" }
+    def body.each ; yield call ; end
+
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain'}, body] }
+    response = content_length(app).call(request)
+    response[1]['Content-Length'].must_be_nil
+  end
+
+  it "not change Content-Length if it is already set" do
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain', 'Content-Length' => '1'}, "Hello, World!"] }
+    response = content_length(app).call(request)
+    response[1]['Content-Length'].must_equal '1'
+  end
+
+  it "not set Content-Length on 304 responses" do
+    app = lambda { |env| [304, {}, []] }
+    response = content_length(app).call(request)
+    response[1]['Content-Length'].must_be_nil
+  end
+
+  it "not set Content-Length when Transfer-Encoding is chunked" do
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain', 'Transfer-Encoding' => 'chunked'}, []] }
+    response = content_length(app).call(request)
+    response[1]['Content-Length'].must_be_nil
+  end
+
+  # Using "Connection: close" for this is fairly contended. It might be useful
+  # to have some other way to signal this.
+  #
+  # should "not force a Content-Length when Connection:close" do
+  #   app = lambda { |env| [200, {'Connection' => 'close'}, []] }
+  #   response = content_length(app).call({})
+  #   response[1]['Content-Length'].must_be_nil
+  # end
+
+  it "close bodies that need to be closed" do
+    body = Struct.new(:body) do
+      attr_reader :closed
+      def each; body.join; end
+      def close; @closed = true; end
+      def to_ary; end
+    end.new(%w[one two three])
+
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain'}, body] }
+    response = content_length(app).call(request)
+    body.closed.must_be_nil
+    response[2].close
+    body.closed.must_equal true
+  end
+
+  it "support single-execute bodies" do
+    body = Struct.new(:body) do
+      def each
+        yield body.shift until body.empty?
+      end
+      def to_ary; end
+    end.new(%w[one two three])
+
+    app = lambda { |env| [200, {'Content-Type' => 'text/plain'}, body] }
+    response = content_length(app).call(request)
+    expected = %w[one two three]
+    response[1]['Content-Length'].must_equal expected.join.size.to_s
+    response[2].to_enum.to_a.must_equal expected
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/test/spec_content_type.rb

@@ -0,0 +1,46 @@
+require 'minitest/autorun'
+require 'rack/content_type'
+require 'rack/lint'
+require 'rack/mock'
+
+describe Rack::ContentType do
+  def content_type(app, *args)
+    Rack::Lint.new Rack::ContentType.new(app, *args)
+  end
+
+  def request
+    Rack::MockRequest.env_for
+  end
+
+  it "set Content-Type to default text/html if none is set" do
+    app = lambda { |env| [200, {}, "Hello, World!"] }
+    headers = content_type(app).call(request)[1]
+    headers['Content-Type'].must_equal 'text/html'
+  end
+
+  it "set Content-Type to chosen default if none is set" do
+    app = lambda { |env| [200, {}, "Hello, World!"] }
+    headers =
+      content_type(app, 'application/octet-stream').call(request)[1]
+    headers['Content-Type'].must_equal 'application/octet-stream'
+  end
+
+  it "not change Content-Type if it is already set" do
+    app = lambda { |env| [200, {'Content-Type' => 'foo/bar'}, "Hello, World!"] }
+    headers = content_type(app).call(request)[1]
+    headers['Content-Type'].must_equal 'foo/bar'
+  end
+
+  it "detect Content-Type case insensitive" do
+    app = lambda { |env| [200, {'CONTENT-Type' => 'foo/bar'}, "Hello, World!"] }
+    headers = content_type(app).call(request)[1]
+    headers.to_a.select { |k,v| k.downcase == "content-type" }.
+      must_equal [["CONTENT-Type","foo/bar"]]
+  end
+
+  it "not set Content-Type on 304 responses" do
+    app = lambda { |env| [304, {}, []] }
+    response = content_type(app, "text/html").call(request)
+    response[1]['Content-Type'].must_be_nil
+  end
+end

data/vendor/ruby/gems/rack-2.0.5/test/spec_deflater.rb

@@ -0,0 +1,375 @@
+require 'minitest/autorun'
+require 'stringio'
+require 'time'  # for Time#httpdate
+require 'rack/deflater'
+require 'rack/lint'
+require 'rack/mock'
+require 'zlib'
+
+describe Rack::Deflater do
+
+  def build_response(status, body, accept_encoding, options = {})
+    body = [body] if body.respond_to? :to_str
+    app = lambda do |env|
+      res = [status, options['response_headers'] || {}, body]
+      res[1]['Content-Type'] = 'text/plain' unless res[0] == 304
+      res
+    end
+
+    request = Rack::MockRequest.env_for('', (options['request_headers'] || {}).merge('HTTP_ACCEPT_ENCODING' => accept_encoding))
+    deflater = Rack::Lint.new Rack::Deflater.new(app, options['deflater_options'] || {})
+
+    deflater.call(request)
+  end
+
+  ##
+  # Constructs response object and verifies if it yields right results
+  #
+  # [expected_status] expected response status, e.g. 200, 304
+  # [expected_body] expected response body
+  # [accept_encoing] what Accept-Encoding header to send and expect, e.g.
+  #                  'deflate' - accepts and expects deflate encoding in response
+  #                  { 'gzip' => nil } - accepts gzip but expects no encoding in response
+  # [options] hash of request options, i.e.
+  #           'app_status' - what status dummy app should return (may be changed by deflater at some point)
+  #           'app_body' - what body dummy app should return (may be changed by deflater at some point)
+  #           'request_headers' - extra request headers to be sent
+  #           'response_headers' - extra response headers to be returned
+  #           'deflater_options' - options passed to deflater middleware
+  # [block] useful for doing some extra verification
+  def verify(expected_status, expected_body, accept_encoding, options = {}, &block)
+    accept_encoding, expected_encoding = if accept_encoding.kind_of?(Hash)
+      [accept_encoding.keys.first, accept_encoding.values.first]
+    else
+      [accept_encoding, accept_encoding.dup]
+    end
+
+    # build response
+    status, headers, body = build_response(
+      options['app_status'] || expected_status,
+      options['app_body'] || expected_body,
+      accept_encoding,
+      options
+    )
+
+    # verify status
+    status.must_equal expected_status
+
+    # verify body
+    unless options['skip_body_verify']
+      body_text = ''
+      body.each { |part| body_text << part }
+
+      deflated_body = case expected_encoding
+      when 'deflate'
+        inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+        inflater.inflate(body_text) << inflater.finish
+      when 'gzip'
+        io = StringIO.new(body_text)
+        gz = Zlib::GzipReader.new(io)
+        tmp = gz.read
+        gz.close
+        tmp
+      else
+        body_text
+      end
+
+      deflated_body.must_equal expected_body
+    end
+
+    # yield full response verification
+    yield(status, headers, body) if block_given?
+  end
+
+  # automatic gzip detection (streamable)
+  def auto_inflater
+    Zlib::Inflate.new(32 + Zlib::MAX_WBITS)
+  end
+
+  def deflate_or_gzip
+    {'deflate, gzip' => 'gzip'}
+  end
+
+  it 'be able to deflate bodies that respond to each' do
+    app_body = Object.new
+    class << app_body; def each; yield('foo'); yield('bar'); end; end
+
+    verify(200, 'foobar', deflate_or_gzip, { 'app_body' => app_body }) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+    end
+  end
+
+  it 'flush deflated chunks to the client as they become ready' do
+    app_body = Object.new
+    class << app_body; def each; yield('foo'); yield('bar'); end; end
+
+    verify(200, app_body, deflate_or_gzip, { 'skip_body_verify' => true }) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+
+      buf = []
+      inflater = auto_inflater
+      body.each { |part| buf << inflater.inflate(part) }
+      buf << inflater.finish
+
+      buf.delete_if { |part| part.empty? }.join.must_equal 'foobar'
+    end
+  end
+
+  it 'does not raise when a client aborts reading' do
+    app_body = Object.new
+    class << app_body; def each; yield('foo'); yield('bar'); end; end
+    opts = { 'skip_body_verify' => true }
+    verify(200, app_body, 'gzip', opts) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+
+      buf = []
+      inflater = auto_inflater
+      FakeDisconnect = Class.new(RuntimeError)
+      assert_raises(FakeDisconnect, "not Zlib::DataError not raised") do
+        body.each do |part|
+          tmp = inflater.inflate(part)
+          buf << tmp if tmp.bytesize > 0
+          raise FakeDisconnect
+        end
+      end
+      inflater.finish
+      buf.must_equal(%w(foo))
+    end
+  end
+
+  # TODO: This is really just a special case of the above...
+  it 'be able to deflate String bodies' do
+    verify(200, 'Hello world!', deflate_or_gzip) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+    end
+  end
+
+  it 'be able to gzip bodies that respond to each' do
+    app_body = Object.new
+    class << app_body; def each; yield('foo'); yield('bar'); end; end
+
+    verify(200, 'foobar', 'gzip', { 'app_body' => app_body }) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+    end
+  end
+
+  it 'flush gzipped chunks to the client as they become ready' do
+    app_body = Object.new
+    class << app_body; def each; yield('foo'); yield('bar'); end; end
+
+    verify(200, app_body, 'gzip', { 'skip_body_verify' => true }) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+
+      buf = []
+      inflater = Zlib::Inflate.new(Zlib::MAX_WBITS + 32)
+      body.each { |part| buf << inflater.inflate(part) }
+      buf << inflater.finish
+
+      buf.delete_if { |part| part.empty? }.join.must_equal 'foobar'
+    end
+  end
+
+  it 'be able to fallback to no deflation' do
+    verify(200, 'Hello world!', 'superzip') do |status, headers, body|
+      headers.must_equal({
+        'Vary' => 'Accept-Encoding',
+        'Content-Type' => 'text/plain'
+      })
+    end
+  end
+
+  it 'be able to skip when there is no response entity body' do
+    verify(304, '', { 'gzip' => nil }, { 'app_body' => [] }) do |status, headers, body|
+      headers.must_equal({})
+    end
+  end
+
+  it 'handle the lack of an acceptable encoding' do
+    app_body = 'Hello world!'
+    not_found_body1 = 'An acceptable encoding for the requested resource / could not be found.'
+    not_found_body2 = 'An acceptable encoding for the requested resource /foo/bar could not be found.'
+    options1 = {
+      'app_status' => 200,
+      'app_body' => app_body,
+      'request_headers' => {
+        'PATH_INFO' => '/'
+      }
+    }
+    options2 = {
+      'app_status' => 200,
+      'app_body' => app_body,
+      'request_headers' => {
+        'PATH_INFO' => '/foo/bar'
+      }
+    }
+
+    verify(406, not_found_body1, 'identity;q=0', options1) do |status, headers, body|
+      headers.must_equal({
+        'Content-Type' => 'text/plain',
+        'Content-Length' => not_found_body1.length.to_s
+      })
+    end
+
+    verify(406, not_found_body2, 'identity;q=0', options2) do |status, headers, body|
+      headers.must_equal({
+        'Content-Type' => 'text/plain',
+        'Content-Length' => not_found_body2.length.to_s
+      })
+    end
+  end
+
+  it 'handle gzip response with Last-Modified header' do
+    last_modified = Time.now.httpdate
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain',
+        'Last-Modified' => last_modified
+      }
+    }
+
+    verify(200, 'Hello World!', 'gzip', options) do |status, headers, body|
+      headers.must_equal({
+        'Content-Encoding' => 'gzip',
+        'Vary' => 'Accept-Encoding',
+        'Last-Modified' => last_modified,
+        'Content-Type' => 'text/plain'
+      })
+    end
+  end
+
+  it 'do nothing when no-transform Cache-Control directive present' do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain',
+        'Cache-Control' => 'no-transform'
+      }
+    }
+    verify(200, 'Hello World!', { 'gzip' => nil }, options) do |status, headers, body|
+      headers.wont_include 'Content-Encoding'
+    end
+  end
+
+  it 'do nothing when Content-Encoding already present' do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain',
+        'Content-Encoding' => 'gzip'
+      }
+    }
+    verify(200, 'Hello World!', { 'gzip' => nil }, options)
+  end
+
+  it 'deflate when Content-Encoding is identity' do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain',
+        'Content-Encoding' => 'identity'
+      }
+    }
+    verify(200, 'Hello World!', deflate_or_gzip, options)
+  end
+
+  it "deflate if content-type matches :include" do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain'
+      },
+      'deflater_options' => {
+        :include => %w(text/plain)
+      }
+    }
+    verify(200, 'Hello World!', 'gzip', options)
+  end
+
+  it "deflate if content-type is included it :include" do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain; charset=us-ascii'
+      },
+      'deflater_options' => {
+        :include => %w(text/plain)
+      }
+    }
+    verify(200, 'Hello World!', 'gzip', options)
+  end
+
+  it "not deflate if content-type is not set but given in :include" do
+    options = {
+      'deflater_options' => {
+        :include => %w(text/plain)
+      }
+    }
+    verify(304, 'Hello World!', { 'gzip' => nil }, options)
+  end
+
+  it "not deflate if content-type do not match :include" do
+    options = {
+      'response_headers' => {
+        'Content-Type' => 'text/plain'
+      },
+      'deflater_options' => {
+        :include => %w(text/json)
+      }
+    }
+    verify(200, 'Hello World!', { 'gzip' => nil }, options)
+  end
+
+  it "deflate response if :if lambda evaluates to true" do
+    options = {
+      'deflater_options' => {
+        :if => lambda { |env, status, headers, body| true }
+      }
+    }
+    verify(200, 'Hello World!', deflate_or_gzip, options)
+  end
+
+  it "not deflate if :if lambda evaluates to false" do
+    options = {
+      'deflater_options' => {
+        :if => lambda { |env, status, headers, body| false }
+      }
+    }
+    verify(200, 'Hello World!', { 'gzip' => nil }, options)
+  end
+
+  it "check for Content-Length via :if" do
+    response = 'Hello World!'
+    response_len = response.length
+    options = {
+      'response_headers' => {
+        'Content-Length' => response_len.to_s
+      },
+      'deflater_options' => {
+        :if => lambda { |env, status, headers, body|
+          headers['Content-Length'].to_i >= response_len
+        }
+      }
+    }
+
+    verify(200, response, 'gzip', options)
+  end
+end