ultra-lite-hub 0.0.1

data/roda-3.105.0/lib/roda/plugins/content_security_policy.rb

@@ -0,0 +1,329 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The content_security_policy plugin allows you to easily set a Content-Security-Policy
+    # header for the application, which modern browsers will use to control access to specific
+    # types of page content.
+    #
+    # You would generally call the plugin with a block to set the default policy:
+    #
+    #   plugin :content_security_policy do |csp|
+    #     csp.default_src :none
+    #     csp.img_src :self
+    #     csp.style_src :self
+    #     csp.script_src :self
+    #     csp.font_src :self
+    #     csp.form_action :self
+    #     csp.base_uri :none
+    #     csp.frame_ancestors :none
+    #     csp.block_all_mixed_content
+    #   end
+    #
+    # Then, anywhere in the routing tree, you can customize the policy for just that
+    # branch or action using the same block syntax:
+    #
+    #   r.get 'foo' do
+    #     content_security_policy do |csp|
+    #       csp.object_src :self
+    #       csp.add_style_src 'bar.com'
+    #     end
+    #     # ...
+    #   end
+    #
+    # In addition to using a block, you can also call methods on the object returned
+    # by the method:
+    #
+    #   r.get 'foo' do
+    #     content_security_policy.script_src :self, 'example.com', [:nonce, 'foobarbaz']
+    #     # ...
+    #   end
+    #
+    # The following methods are available for configuring the content security policy,
+    # which specify the setting (substituting _ with -): 
+    #
+    # * base_uri
+    # * child_src
+    # * connect_src
+    # * default_src
+    # * font_src
+    # * form_action
+    # * frame_ancestors
+    # * frame_src
+    # * img_src
+    # * manifest_src
+    # * media_src
+    # * object_src
+    # * plugin_types
+    # * report_to
+    # * report_uri
+    # * require_sri_for
+    # * sandbox
+    # * script_src
+    # * style_src
+    # * worker_src
+    #
+    # All of these methods support any number of arguments, and each argument should
+    # be one of the following types:
+    #
+    # String :: used verbatim
+    # Symbol :: Substitutes +_+ with +-+ and surrounds with <tt>'</tt>
+    # Array :: only accepts 2 element arrays, joins elements with +-+ and
+    #          surrounds the result with <tt>'</tt>
+    #
+    # Example:
+    #
+    #   content_security_policy.script_src :self, :unsafe_eval, 'example.com', [:nonce, 'foobarbaz']
+    #   # script-src 'self' 'unsafe-eval' example.com 'nonce-foobarbaz'; 
+    #  
+    # When calling a method with no arguments, the setting is removed from the policy instead
+    # of being left empty, since all of these setting require at least one value.  Likewise,
+    # if the policy does not have any settings, the header will not be added.
+    #
+    # Calling the method overrides any previous setting.  Each of the methods has +add_*+ and
+    # +get_*+ methods defined. The +add_*+ method appends to any existing setting, and the +get_*+ method
+    # returns the current value for the setting.
+    #
+    #   content_security_policy.script_src :self, :unsafe_eval
+    #   content_security_policy.add_script_src 'example.com', [:nonce, 'foobarbaz']
+    #   # script-src 'self' 'unsafe-eval' example.com 'nonce-foobarbaz'; 
+    #
+    #   content_security_policy.get_script_src
+    #   # => [:self, :unsafe_eval, 'example.com', [:nonce, 'foobarbaz']]
+    #
+    # The clear method can be used to remove all settings from the policy. Empty policies
+    # do not set any headers. You can use +response.skip_content_security_policy!+ to skip
+    # setting a policy.  This is faster than calling +content_security_policy.clear+, since
+    # it does not duplicate the default policy.
+    #
+    # The following methods to set boolean settings are also defined:
+    #
+    # * block_all_mixed_content
+    # * upgrade_insecure_requests
+    #
+    # Calling these methods will turn on the related setting.  To turn the setting
+    # off again, you can call them with a +false+ argument. There is also a <tt>*?</tt> method
+    # for each setting for returning whether the setting is currently enabled.
+    #
+    # Likewise there is also a +report_only+ method for turning on report only mode (the
+    # default is enforcement mode), or turning off report only mode if a false argument
+    # is given.  Also, there is a +report_only?+ method for returning whether report only
+    # mode is enabled.
+    module ContentSecurityPolicy
+      # Represents a content security policy.
+      class Policy
+        '
+        base-uri
+        child-src
+        connect-src
+        default-src
+        font-src
+        form-action
+        frame-ancestors
+        frame-src
+        img-src
+        manifest-src
+        media-src
+        object-src
+        plugin-types
+        report-to
+        report-uri
+        require-sri-for
+        sandbox
+        script-src
+        style-src
+        worker-src
+        '.split.each(&:freeze).each do |setting|
+          meth = setting.tr('-', '_').freeze
+
+          # Setting method name sets the setting value, or removes it if no args are given.
+          define_method(meth) do |*args|
+            if args.empty?
+              @opts.delete(setting)
+            else
+              @opts[setting] = args.freeze
+            end
+            nil
+          end
+
+          # add_* method name adds to the setting value, or clears setting if no values
+          # are given.
+          define_method("add_#{meth}") do |*args|
+            unless args.empty?
+              @opts[setting] ||= EMPTY_ARRAY
+              @opts[setting] += args
+              @opts[setting].freeze
+            end
+            nil
+          end
+
+          # get_* method always returns current setting value.
+          define_method("get_#{meth}") do
+            @opts[setting]
+          end
+        end
+
+        %w'block-all-mixed-content upgrade-insecure-requests'.each(&:freeze).each do |setting|
+          meth = setting.tr('-', '_').freeze
+
+          # Setting method name turns on setting if true or no argument given,
+          # or removes setting if false is given.
+          define_method(meth) do |arg=true|
+            if arg
+              @opts[setting] = true
+            else
+              @opts.delete(setting)
+            end
+
+            nil
+          end
+
+          # *? method returns true or false depending on whether setting is enabled.
+          define_method("#{meth}?") do
+            !!@opts[setting]
+          end
+        end
+
+        def initialize
+          clear
+        end
+
+        # Clear all settings, useful to remove any inherited settings.
+        def clear
+          @opts = {}
+        end
+
+        # Do not allow future modifications to any settings.
+        def freeze
+          @opts.freeze
+          header_value.freeze
+          super
+        end
+
+        # The header name to use, depends on whether report only mode has been enabled.
+        def header_key
+          @report_only ? RodaResponseHeaders::CONTENT_SECURITY_POLICY_REPORT_ONLY : RodaResponseHeaders::CONTENT_SECURITY_POLICY
+        end
+
+        # The header value to use.
+        def header_value
+          return @header_value if @header_value
+
+          s = String.new
+          @opts.each do |k, vs|
+            s << k
+            unless vs == true
+              vs.each{|v| append_formatted_value(s, v)}
+            end
+            s << '; '
+          end
+          @header_value = s
+        end
+
+        # Set whether the Content-Security-Policy-Report-Only header instead of the
+        # default Content-Security-Policy header.
+        def report_only(report=true)
+          @report_only = report
+        end
+
+        # Whether this policy uses report only mode.
+        def report_only?
+          !!@report_only
+        end
+
+        # Set the current policy in the headers hash.  If no settings have been made
+        # in the policy, does not set a header.
+        def set_header(headers)
+          return if @opts.empty?
+          headers[header_key] ||= header_value
+        end
+
+        private
+
+        # Handle three types of values when formatting the header:
+        # String :: used verbatim
+        # Symbol :: Substitutes _ with - and surrounds with '
+        # Array :: only accepts 2 element arrays, joins them with - and
+        #          surrounds them with '
+        def append_formatted_value(s, v)
+          case v
+          when String
+            s << ' ' << v
+          when Array
+            case v.length
+            when 2
+              s << " '" << v.join('-') << "'"
+            else
+              raise RodaError, "unsupported CSP value used: #{v.inspect}"
+            end
+          when Symbol
+            s << " '" << v.to_s.tr('_', '-') << "'"
+          else
+            raise RodaError, "unsupported CSP value used: #{v.inspect}"
+          end
+        end
+
+        # Make object copy use copy of settings, and remove cached header value.
+        def initialize_copy(_)
+          super
+          @opts = @opts.dup
+          @header_value = nil
+        end
+      end
+
+
+      # Yield the current Content Security Policy to the block.
+      def self.configure(app)
+        policy = app.opts[:content_security_policy] = if policy = app.opts[:content_security_policy]
+          policy.dup
+        else
+          Policy.new
+        end
+
+        yield policy if defined?(yield)
+        policy.freeze
+      end
+
+      module InstanceMethods
+        # If a block is given, yield the current content security policy.  Returns the
+        # current content security policy.
+        def content_security_policy
+          policy = @_response.content_security_policy
+          yield policy if defined?(yield)
+          policy
+        end
+      end
+
+      module ResponseMethods
+        # Unset any content security policy when reinitializing
+        def initialize
+          super
+          @content_security_policy &&= nil
+        end
+
+        # The current content security policy to be used for this response.
+        def content_security_policy
+          @content_security_policy ||= roda_class.opts[:content_security_policy].dup
+        end
+
+        # Do not set a content security policy header for this response.
+        def skip_content_security_policy!
+          @skip_content_security_policy = true
+        end
+
+        private
+
+        # Set the appropriate content security policy header.
+        def set_default_headers
+          super
+          unless @skip_content_security_policy
+            (@content_security_policy || roda_class.opts[:content_security_policy]).set_header(headers)
+          end
+        end
+      end
+    end
+
+    register_plugin(:content_security_policy, ContentSecurityPolicy)
+  end
+end

data/roda-3.105.0/lib/roda/plugins/cookie_flags.rb

@@ -0,0 +1,157 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The cookie_flags plugin allows users to force specific cookie flags for
+    # all cookies set by the application.  It can also be used to warn or
+    # raise for unexpected cookie flags.
+    #
+    # The cookie_flags plugin deals with the following cookie flags:
+    #
+    # httponly :: Disallows access to the cookie from client-side scripts.
+    # samesite :: Restricts to which domains the cookie is sent.
+    # secure :: Instructs the browser to only transmit the cookie over HTTPS.
+    #
+    # This plugin ships in secure-by-default mode, where it enforces
+    # secure, httponly, samesite=strict cookies. You can disable enforcing
+    # specific flags using the following options:
+    #
+    # :httponly :: Set to false to not enforce httponly flag.
+    # :same_site :: Set to symbol or string to enforce a different samesite
+    #               setting, or false to not enforce a specific samesite setting.
+    # :secure :: Set to false to not enforce secure flag.
+    #
+    # For example, to enforce secure cookies and enforce samesite=lax, but not enforce
+    # an httponly flag:
+    #
+    #   plugin :cookie_flags, httponly: false, same_site: 'lax'
+    #
+    # In general, overriding cookie flags using this plugin should be considered a
+    # stop-gap solution.  Instead of overriding cookie flags, it's better to fix
+    # whatever is setting the cookie flags incorrectly.  You can use the :action
+    # option to modify the behavior:
+    #
+    #   # Issue warnings when modifying cookie flags
+    #   plugin :cookie_flags, action: :warn_and_modify
+    #
+    #   # Issue warnings for incorrect cookie flags without modifying cookie flags
+    #   plugin :cookie_flags, action: :warn
+    #
+    #   # Raise errors for incorrect cookie flags
+    #   plugin :cookie_flags, action: :raise
+    #
+    # The recommended way to use the plugin is to use it only during testing with
+    # <tt>action: :raise</tt>.  Then as long as you have fully covering tests, you
+    # can be sure the cookies set by your application use the correct flags.
+    #
+    # Note that this plugin only affects cookies set by the application, and does not
+    # affect cookies set by middleware the application is using.
+    module CookieFlags
+      # :nocov:
+      MATCH_METH = RUBY_VERSION >= '2.4' ? :match? : :match
+      # :nocov:
+      private_constant :MATCH_METH
+
+      DEFAULTS = {:secure=>true, :httponly=>true, :same_site=>'strict', :action=>:modify}.freeze
+      private_constant :DEFAULTS
+
+      # Error class raised for action: :raise when incorrect cookie flags are used.
+      class Error < RodaError
+      end
+
+      def self.configure(app, opts=OPTS)
+        previous = app.opts[:cookie_flags] || DEFAULTS
+        opts = app.opts[:cookie_flags] = previous.merge(opts)
+
+        case opts[:same_site]
+        when String, Symbol
+          opts[:same_site] = opts[:same_site].to_s.downcase.freeze
+          opts[:same_site_string] = "; samesite=#{opts[:same_site]}".freeze
+          opts[:secure] = true if opts[:same_site] == 'none'
+        end
+
+        opts.freeze
+      end
+
+      module InstanceMethods
+        private
+
+        def _handle_cookie_flags_array(cookies)
+          opts = self.class.opts[:cookie_flags]
+          needs_secure = opts[:secure]
+          needs_httponly = opts[:httponly]
+          if needs_same_site = opts[:same_site]
+            same_site_string = opts[:same_site_string]
+            same_site_regexp = /;\s*samesite\s*=\s*(\S+)\s*(?:\z|;)/i
+          end
+          action = opts[:action]
+
+          cookies.map do |cookie|
+            if needs_secure
+              add_secure = !/;\s*secure\s*(?:\z|;)/i.send(MATCH_METH, cookie)
+            end
+
+            if needs_httponly
+              add_httponly = !/;\s*httponly\s*(?:\z|;)/i.send(MATCH_METH, cookie)
+            end
+
+            if needs_same_site
+              has_same_site = same_site_regexp.match(cookie)
+              unless add_same_site = !has_same_site
+                update_same_site = needs_same_site != has_same_site[1].downcase
+              end
+            end
+
+            next cookie unless add_secure || add_httponly || add_same_site || update_same_site
+
+            case action
+            when :raise, :warn, :warn_and_modify
+              message = "Response contains cookie with unexpected flags: #{cookie.inspect}." \
+                   "Expecting the following cookie flags: "\
+                   "#{'secure ' if add_secure}#{'httponly ' if add_httponly}#{same_site_string[2..-1] if add_same_site || update_same_site}"
+
+              if action == :raise
+                raise Error, message
+              else
+                warn(message)
+                next cookie if action == :warn
+              end
+            end
+
+            if update_same_site
+              cookie = cookie.gsub(same_site_regexp, same_site_string)
+            else
+              cookie = cookie.dup
+              cookie << same_site_string if add_same_site
+            end
+
+            cookie << '; secure' if add_secure
+            cookie << '; httponly' if add_httponly
+
+            cookie
+          end
+        end
+
+        if Rack.release >= '3'
+          def _handle_cookie_flags(cookies)
+            cookies = [cookies] if cookies.is_a?(String)
+            _handle_cookie_flags_array(cookies)
+          end
+        else
+          def _handle_cookie_flags(cookie_string)
+            _handle_cookie_flags_array(cookie_string.split("\n")).join("\n")
+          end
+        end
+
+        # Handle cookie flags in response
+        def _roda_after_85__cookie_flags(res)
+          return unless res && (headers = res[1]) && (value = headers[RodaResponseHeaders::SET_COOKIE])
+          headers[RodaResponseHeaders::SET_COOKIE] = _handle_cookie_flags(value)
+        end
+      end
+    end
+
+    register_plugin(:cookie_flags, CookieFlags)
+  end
+end

data/roda-3.105.0/lib/roda/plugins/cookies.rb

@@ -0,0 +1,51 @@
+# frozen-string-literal: true
+
+require 'rack/utils'
+
+#
+class Roda
+  module RodaPlugins
+    # The cookies plugin adds response methods for handling cookies.
+    # Currently, you can set cookies with +set_cookie+ and delete cookies
+    # with +delete_cookie+:
+    #
+    #   response.set_cookie('foo', 'bar')
+    #   response.delete_cookie('foo')
+    #
+    # Pass a hash of cookie options when loading the plugin to set some
+    # defaults for all cookies upon setting and deleting. This is particularly
+    # useful for configuring the +domain+ and +path+ of all cookies.
+    #
+    #   plugin :cookies, domain: 'example.com', path: '/api'
+    module Cookies
+      # Allow setting default cookie options when loading the cookies plugin.
+      def self.configure(app, opts={})
+        app.opts[:cookies_opts] = (app.opts[:cookies_opts]||{}).merge(opts).freeze
+      end
+
+      module ResponseMethods
+        # Modify the headers to include a Set-Cookie value that
+        # deletes the cookie.  A value hash can be provided to
+        # override the default one used to delete the cookie.
+        # Example:
+        #
+        #   response.delete_cookie('foo')
+        #   response.delete_cookie('foo', domain: 'example.org')
+        def delete_cookie(key, value = {})
+          ::Rack::Utils.delete_cookie_header!(@headers, key, roda_class.opts[:cookies_opts].merge(value))
+        end
+
+        # Set the cookie with the given key in the headers.
+        #
+        #   response.set_cookie('foo', 'bar')
+        #   response.set_cookie('foo', value: 'bar', domain: 'example.org')
+        def set_cookie(key, value)
+          value = { :value=>value } unless value.respond_to?(:keys)
+          ::Rack::Utils.set_cookie_header!(@headers, key, roda_class.opts[:cookies_opts].merge(value))
+        end
+      end
+    end
+
+    register_plugin(:cookies, Cookies)
+  end
+end

data/roda-3.105.0/lib/roda/plugins/csrf.rb

@@ -0,0 +1,81 @@
+# frozen-string-literal: true
+
+require 'rack/csrf'
+
+class Roda
+  module RodaPlugins
+    # This plugin is no longer recommended for use, it exists only for
+    # backwards compatibility.  Consider using the route_csrf plugin
+    # instead, as that provides stronger CSRF protection.
+    #
+    # The csrf plugin adds CSRF protection using rack_csrf, along with
+    # some csrf helper methods to use in your views.  To use it, load
+    # the plugin, with the options hash passed to Rack::Csrf:
+    #
+    #   plugin :csrf, raise: true
+    #
+    # Optionally you can choose not to setup rack_csrf middleware on the
+    # roda app if you already have one configured:
+    #
+    #   plugin :csrf, skip_middleware: true
+    #
+    # This adds the following instance methods:
+    #
+    # csrf_field :: The field name to use for the hidden/meta csrf tag.
+    # csrf_header :: The http header name to use for submitting csrf token via
+    #                headers (useful for javascript).
+    # csrf_metatag :: An html meta tag string containing the token, suitable
+    #                 for placing in the page header
+    # csrf_tag :: An html hidden input tag string containing the token, suitable
+    #             for placing in an html form.
+    # csrf_token :: The value of the csrf token, in case it needs to be accessed
+    #               directly.
+    module Csrf
+      CSRF = ::Rack::Csrf
+
+      # Load the Rack::Csrf middleware into the app with the given options.
+      def self.configure(app, opts={})
+        return if opts[:skip_middleware]
+        app.instance_exec do
+          @middleware.each do |(mid, *rest), _|
+            if mid.equal?(CSRF)
+              rest[0].merge!(opts)
+              build_rack_app
+              return
+            end
+          end
+          use CSRF, opts
+        end
+      end
+
+      module InstanceMethods
+        # The name of the hidden/meta csrf tag.
+        def csrf_field
+          CSRF.field
+        end
+
+        # The http header name to use for submitting csrf token via headers.
+        def csrf_header
+          CSRF.header
+        end
+
+        # An html meta tag string containing the token.
+        def csrf_metatag(opts={})
+          CSRF.metatag(env, opts)
+        end
+
+        # An html hidden input tag string containing the token.
+        def csrf_tag
+          CSRF.tag(env)
+        end
+
+        # The value of the csrf token.
+        def csrf_token
+          CSRF.token(env)
+        end
+      end
+    end
+
+    register_plugin(:csrf, Csrf)
+  end
+end

data/roda-3.105.0/lib/roda/plugins/custom_block_results.rb

@@ -0,0 +1,85 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The custom_block_results plugin allows you to specify handling
+    # for different block results.  By default, Roda only supports
+    # nil, false, and string block results, but using this plugin,
+    # you can support other block results.
+    #
+    # For example, if you wanted to support returning Integer
+    # block results, and have them set the response status code,
+    # you could do:
+    #
+    #   plugin :custom_block_results
+    #
+    #   handle_block_result Integer do |result|
+    #     response.status_code = result
+    #   end
+    #
+    #   route do |r|
+    #     200
+    #   end
+    #
+    # The expected use case for this is to customize behavior by
+    # class, but matching uses ===, so it is possible to use non-class
+    # objects that respond to === appropriately.
+    #
+    # Note that custom block result handling only occurs if the types
+    # are not handled by Roda itself.  You cannot use this to modify
+    # the handling of nil, false, or string results.  Additionally,
+    # if the response body has already been written to before the the
+    # route block exits, then the result of the block is ignored,
+    # and the related +handle_block_result+ block will not be called
+    # (this is standard Roda behavior).
+    # 
+    # The return value of the +handle_block_result+ block is written
+    # to the body if the block return value is a String, similar to
+    # standard Roda handling of block results.  Non-String return
+    # values are ignored.
+    module CustomBlockResults
+      def self.configure(app)
+        app.opts[:custom_block_results] ||= {}
+      end
+
+      module ClassMethods
+        # Freeze the configured custom block results when freezing the app.
+        def freeze
+          opts[:custom_block_results].freeze
+          super
+        end
+
+        # Specify a block that will be called when an instance of klass
+        # is returned as a block result.  The block defines a method.
+        def handle_block_result(klass, &block)
+          opts[:custom_block_results][klass] = define_roda_method(opts[:custom_block_results][klass] || "custom_block_result_#{klass}", 1, &block)
+        end
+      end
+
+      module RequestMethods
+        private
+
+        # Try each configured custom block result, and call the related method
+        # to get the block result.
+        def unsupported_block_result(result)
+          roda_class.opts[:custom_block_results].each do |klass, meth|
+            if klass === result
+              result = scope.send(meth, result)
+
+              if String === result
+                return result
+              else
+                return
+              end
+            end
+          end
+
+          super
+        end
+      end
+    end
+
+    register_plugin(:custom_block_results, CustomBlockResults)
+  end
+end