ultra-max-sys 0.0.1

data/roda-3.106.0/lib/roda/plugins/run_require_slash.rb

@@ -0,0 +1,46 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The run_require_slash plugin makes +r.run+ a no-op if the remaining
+    # path is not empty and does not start with +/+. The Rack SPEC requires that
+    # +PATH_INFO+ start with a slash if not empty, so this plugin prevents
+    # dispatching to the application with an environment that would violate the
+    # Rack SPEC.
+    #
+    # You are unlikely to want to use this plugin unless you are consuming partial
+    # segments of the request path, or using the match_affix plugin to change
+    # how routing is done:
+    #
+    #   plugin :match_affix, "", /(\/|\z)/
+    #   route do |r|
+    #     r.on "/a" do
+    #       r.on "b" do
+    #         r.run App
+    #       end
+    #     end
+    #   end
+    #
+    #   # with run_require_slash: 
+    #   # GET /a/b/e => Not dispatched to application
+    #   # GET /a/b => App gets "" as PATH_INFO
+    #
+    #   # without run_require_slash: 
+    #   # GET /a/b/e => App gets "e" as PATH_INFO, violating rack SPEC
+    #   # GET /a/b => App gets "" as PATH_INFO
+    module RunRequireSlash
+      module RequestMethods
+        # Calls the given rack app only if the remaining patch is empty or
+        # starts with a slash.
+        def run(*)
+          if @remaining_path.empty? || @remaining_path.start_with?('/')
+            super
+          end
+        end
+      end
+    end
+
+    register_plugin(:run_require_slash, RunRequireSlash)
+  end
+end

data/roda-3.106.0/lib/roda/plugins/sec_fetch_site_csrf.rb

@@ -0,0 +1,131 @@
+# frozen-string-literal: true
+
+class Roda
+  module RodaPlugins
+    # The sec_fetch_site_csrf plugin allows for CSRF protection using the
+    # Sec-Fetch-Site header added in modern browsers. It allows for CSRF
+    # protection without the use of CSRF tokens, which can simplify
+    # form creation.
+    #
+    # The protection offered by the sec_fetch_site_csrf plugin is weaker than
+    # the protection offered by the route_csrf plugin with default settings,
+    # since it doesn't support per-request tokens. Be aware you are trading
+    # security for simplicity when using the sec_fetch_site_csrf plugin instead
+    # of the route_csrf plugin.  Other caveats in using the sec_fetch_site_csrf
+    # plugin:
+    #
+    # * Not all browsers set the Sec-Fetch-Site header. Some browsers
+    #   didn't start setting the header until 2023. In these cases, you
+    #   need to decide how to handle the request. The default is to deny
+    #   the request, though you can use the :allow_missing option to allow
+    #   it.
+    #
+    # * Sec-Fetch-Site headers are not set for http requests, only https
+    #   requests, so this doesn't offer protection for http requests.
+    #
+    # * It isn't possible to share a CSRF secret between applications in
+    #   different origins to allow cross-site requests between the
+    #   applications.
+    #
+    # This plugin adds the +check_sec_fetch_site!+ method to the routing
+    # block scope. You should call this method at the appropriate place
+    # in the routing tree to enforce the CSRF protection. The method can
+    # accept a block to override the :csrf_failure plugin option behavior
+    # on a per-call basis.
+    #
+    # When loading the plugin with no options:
+    #
+    #   plugin :sec_fetch_site_csrf
+    #
+    # Only same-origin requests are allowed by default.
+    #
+    # This plugin supports the following options:
+    #
+    # :allow_missing :: Whether to allow requests lacking the Sec-Fetch-Site
+    #                   header (false by default).
+    # :allow_none :: Whether to allow requests where Sec-Fetch-Value is none
+    #                (false by default).
+    # :allow_same_site :: Whether to allow requests where Sec-Fetch-Value is
+    #                     same-site (false by default)
+    # :check_request_methods :: Which request methods require CSRF protection
+    #                           (default: <tt>['POST', 'DELETE', 'PATCH', 'PUT']</tt>)
+    # :csrf_failure :: The action to taken if a request does not have a valid header
+    #                  (default: :raise).  Options:
+    #                  :raise :: raise a Roda::RodaPlugins::SecFetchSiteCsrf::CsrfFailure
+    #                            exception
+    #                  :empty_403 :: return a blank 403 page
+    #                  :clear_session :: clear the current session
+    #
+    # The plugin also supports a block, in which case failures will call the block
+    # as a routing block (the block should accept the request object).
+    module SecFetchSiteCsrf
+      DEFAULTS = {
+        :csrf_failure => :raise,
+        :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze)
+      }.freeze
+
+      # Exception class raised when :csrf_failure option is :raise and
+      # the Sec-Fetch-Site header is not considered valid.
+      class CsrfFailure < RodaError; end
+
+      def self.configure(app, opts=OPTS, &block)
+        options = app.opts[:sec_fetch_site_csrf] = (app.opts[:sec_fetch_site_csrf] || DEFAULTS).merge(opts)
+
+        allowed_values = options[:allowed_values] = ["same-origin"]
+        allowed_values << "same-site" if opts[:allow_same_site]
+        allowed_values << "none" if opts[:allow_none]
+        allowed_values << nil if opts[:allow_missing]
+        allowed_values.freeze
+
+        if block
+          options[:csrf_failure] = :method
+          app.define_roda_method(:_roda_sec_fetch_site_csrf_failure, 1, &app.send(:convert_route_block, block))
+        end
+
+        case options[:csrf_failure]
+        when :raise, :empty_403, :clear_session, :method
+          # nothing
+        else
+          raise RodaError, "Unsupported :csrf_failure plugin option: #{options[:csrf_failure].inspect}"
+        end
+
+        options.freeze
+      end
+
+      module InstanceMethods
+        # Check that the Sec-Fetch-Site header is valid, if the request requires it.
+        # If the header is valid or the request does not require the header, return nil.
+        # Otherwise, if a block is given, treat it as a routing block and yield to it, and
+        # if a block is not given, use the plugin :csrf_failure option to determine how to
+        # handle it.
+        def check_sec_fetch_site!(&block)
+          plugin_opts = self.class.opts[:sec_fetch_site_csrf]
+          return unless plugin_opts[:check_request_methods].include?(request.request_method)
+
+          sec_fetch_site = env["HTTP_SEC_FETCH_SITE"]
+          return if plugin_opts[:allowed_values].include?(sec_fetch_site)
+
+          @_request.on(&block) if block
+          
+          case failure_action = plugin_opts[:csrf_failure]
+          when :raise
+            raise CsrfFailure, "potential cross-site request, Sec-Fetch-Site value: #{sec_fetch_site.inspect}"
+          when :empty_403
+            @_response.status = 403
+            headers = @_response.headers
+            headers.clear
+            headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html'
+            headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
+            throw :halt, @_response.finish_with_body([])
+          when :clear_session
+            session.clear
+          else # when :method
+            @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)}
+          end
+        end
+      end
+    end
+
+    register_plugin(:sec_fetch_site_csrf, SecFetchSiteCsrf)
+  end
+end

data/roda-3.106.0/lib/roda/plugins/send_file.rb

@@ -0,0 +1,127 @@
+# frozen-string-literal: true
+
+begin
+  require 'rack/files'
+rescue LoadError
+  require 'rack/file'
+end
+
+#
+class Roda
+  module RodaPlugins
+    # The send_file plugin adds a send_file method, used for
+    # returning the contents of a file as the body of a request.
+    # It also loads the response_attachment plugin to set the
+    # Content-Disposition and Content-Type based on the file's
+    # extension.
+    #
+    # senf_file will serve the file with the given path from the file system:
+    #
+    #   send_file 'path/to/file.txt'
+    #
+    # Options:
+    #
+    # :disposition :: Set the Content-Disposition to the given disposition.
+    # :filename :: Set the Content-Disposition to attachment (unless :disposition is set),
+    #              and set the filename parameter to the value.
+    # :last_modified :: Explicitly set the Last-Modified header to the given value, and
+    #                   return a not modified response if there has not been modified since
+    #                   the previous request.  This option requires the caching plugin.
+    # :status :: Override the status for the response.
+    # :type :: Set the Content-Type to use for this response.
+    #
+    # == License
+    #
+    # The implementation was originally taken from Sinatra,
+    # which is also released under the MIT License:
+    #
+    # Copyright (c) 2007, 2008, 2009 Blake Mizerany
+    # Copyright (c) 2010, 2011, 2012, 2013, 2014 Konstantin Haase
+    # 
+    # Permission is hereby granted, free of charge, to any person
+    # obtaining a copy of this software and associated documentation
+    # files (the "Software"), to deal in the Software without
+    # restriction, including without limitation the rights to use,
+    # copy, modify, merge, publish, distribute, sublicense, and/or sell
+    # copies of the Software, and to permit persons to whom the
+    # Software is furnished to do so, subject to the following
+    # conditions:
+    # 
+    # The above copyright notice and this permission notice shall be
+    # included in all copies or substantial portions of the Software.
+    # 
+    # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+    # OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+    # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+    # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+    # OTHER DEALINGS IN THE SOFTWARE.
+    module SendFile
+      RACK_FILES = defined?(Rack::Files) ? Rack::Files : Rack::File
+
+      # Depend on the status_303 plugin.
+      def self.load_dependencies(app)
+        app.plugin :response_attachment
+      end
+
+      module InstanceMethods
+        # Use the contents of the file at +path+ as the response body.  See plugin documentation for options.
+        def send_file(path, opts = OPTS)
+          r = @_request
+          res = @_response
+          headers = res.headers
+          if (type = opts[:type]) || !headers[RodaResponseHeaders::CONTENT_TYPE]
+            type_str = type.to_s
+
+            if type_str.include?('/')
+              type = type_str
+            else
+              if type
+                type = ".#{type}" unless type_str.start_with?(".")
+              else
+                type = ::File.extname(path)
+              end
+
+              type &&= Rack::Mime.mime_type(type, nil)
+              type ||= 'application/octet-stream'
+            end
+            
+            headers[RodaResponseHeaders::CONTENT_TYPE] = type
+          end
+
+          disposition = opts[:disposition]
+          filename    = opts[:filename]
+          if disposition || filename
+            disposition ||= 'attachment'
+            filename = path if filename.nil?
+            res.attachment(filename, disposition)
+          end
+
+          if lm = opts[:last_modified]
+            r.last_modified(lm)
+          end
+
+          file = RACK_FILES.new nil
+          s, h, b = if Rack.release > '2'
+            file.serving(r, path)
+          else
+            file.path = path
+            file.serving(env)
+          end
+
+          res.status = opts[:status] || s
+          headers.delete(RodaResponseHeaders::CONTENT_LENGTH)
+          headers.replace(h.merge!(headers))
+          r.halt res.finish_with_body(b)
+        rescue Errno::ENOENT
+          response.status = 404
+          r.halt
+        end
+      end
+    end
+
+    register_plugin(:send_file, SendFile)
+  end
+end