ultra-safe-rb 0.0.1

data/better_errors-2.10.1/lib/better_errors/editor.rb

@@ -0,0 +1,103 @@
+require "uri"
+
+module BetterErrors
+  class Editor
+    KNOWN_EDITORS = [
+      { symbols: [:atom], sniff: /atom/i, url: "atom://core/open/file?filename=%{file}&line=%{line}" },
+      { symbols: [:emacs, :emacsclient], sniff: /emacs/i, url: "emacs://open?url=file://%{file}&line=%{line}" },
+      { symbols: [:idea], sniff: /idea/i, url: "idea://open?file=%{file}&line=%{line}" },
+      { symbols: [:macvim, :mvim], sniff: /vim/i, url: "mvim://open?url=file://%{file_unencoded}&line=%{line}" },
+      { symbols: [:rubymine], sniff: /mine/i, url: "x-mine://open?file=%{file}&line=%{line}" },
+      { symbols: [:sublime, :subl, :st], sniff: /subl/i, url: "subl://open?url=file://%{file}&line=%{line}" },
+      { symbols: [:textmate, :txmt, :tm], sniff: /mate/i, url: "txmt://open?url=file://%{file}&line=%{line}" },
+      { symbols: [:vscode, :code], sniff: /code/i, url: "vscode://file/%{file}:%{line}" },
+      { symbols: [:vscodium, :codium], sniff: /codium/i, url: "vscodium://file/%{file}:%{line}" },
+    ]
+
+    def self.for_formatting_string(formatting_string)
+      new proc { |file, line|
+        formatting_string % { file: URI.encode_www_form_component(file), file_unencoded: file, line: line }
+      }
+    end
+
+    def self.for_proc(url_proc)
+      new url_proc
+    end
+
+    # Automatically sniffs a default editor preset based on
+    # environment variables.
+    #
+    # @return [Symbol]
+    def self.default_editor
+      editor_from_environment_formatting_string ||
+        editor_from_environment_editor ||
+        editor_from_symbol(:textmate)
+    end
+
+    def self.editor_from_environment_editor
+      if ENV["BETTER_ERRORS_EDITOR"]
+        editor = editor_from_command(ENV["BETTER_ERRORS_EDITOR"])
+        return editor if editor
+        puts "BETTER_ERRORS_EDITOR environment variable is not recognized as a supported Better Errors editor."
+      end
+      if ENV["EDITOR"]
+        editor = editor_from_command(ENV["EDITOR"])
+        return editor if editor
+        puts "EDITOR environment variable is not recognized as a supported Better Errors editor. Using TextMate by default."
+      else
+        puts "Since there is no EDITOR or BETTER_ERRORS_EDITOR environment variable, using Textmate by default."
+      end
+    end
+
+    def self.editor_from_command(editor_command)
+      env_preset = KNOWN_EDITORS.find { |preset| editor_command =~ preset[:sniff] }
+      for_formatting_string(env_preset[:url]) if env_preset
+    end
+
+    def self.editor_from_environment_formatting_string
+      return unless ENV['BETTER_ERRORS_EDITOR_URL']
+
+      for_formatting_string(ENV['BETTER_ERRORS_EDITOR_URL'])
+    end
+
+    def self.editor_from_symbol(symbol)
+      KNOWN_EDITORS.each do |preset|
+        return for_formatting_string(preset[:url]) if preset[:symbols].include?(symbol)
+      end
+    end
+
+    def initialize(url_proc)
+      @url_proc = url_proc
+    end
+
+    def url(raw_path, line)
+      if virtual_path && raw_path.start_with?(virtual_path)
+        if host_path
+          file = raw_path.sub(%r{\A#{virtual_path}}, host_path)
+        else
+          file = raw_path.sub(%r{\A#{virtual_path}/}, '')
+        end
+      else
+        file = raw_path
+      end
+        
+      url_proc.call(file, line)
+    end
+
+    def scheme
+      url('/fake', 42).sub(/:.*/, ':')
+    end
+
+    private
+
+    attr_reader :url_proc
+
+    def virtual_path
+      @virtual_path ||= ENV['BETTER_ERRORS_VIRTUAL_PATH']
+    end
+
+    def host_path
+      @host_path ||= ENV['BETTER_ERRORS_HOST_PATH']
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/error_page.rb

@@ -0,0 +1,169 @@
+require "cgi"
+require "json"
+require "securerandom"
+require "rouge"
+require "better_errors/error_page_style"
+
+module BetterErrors
+  # @private
+  class ErrorPage
+    VariableInfo = Struct.new(:frame, :editor_url, :rails_params, :rack_session, :start_time)
+
+    def self.template_path(template_name)
+      File.expand_path("../templates/#{template_name}.erb", __FILE__)
+    end
+
+    def self.template(template_name)
+      Erubi::Engine.new(File.read(template_path(template_name)), escape: true)
+    end
+
+    def self.render_template(template_name, locals)
+      locals.send(:eval, self.template(template_name).src)
+    rescue => e
+      # Fix the backtrace, which doesn't identify the template that failed (within Better Errors).
+      # We don't know the line number, so just injecting the template path has to be enough.
+      e.backtrace.unshift "#{self.template_path(template_name)}:0"
+      raise
+    end
+
+    attr_reader :exception, :env, :repls
+
+    def initialize(exception, env)
+      @exception = RaisedException.new(exception)
+      @env = env
+      @start_time = Time.now.to_f
+      @repls = []
+    end
+
+    def id
+      @id ||= SecureRandom.hex(8)
+    end
+
+    def render_main(csrf_token, csp_nonce)
+      frame = backtrace_frames[0]
+      first_frame_variable_info = VariableInfo.new(frame, editor_url(frame), rails_params, rack_session, Time.now.to_f)
+      self.class.render_template('main', binding)
+    end
+
+    def render_text
+      self.class.render_template('text', binding)
+    end
+
+    def do_variables(opts)
+      index = opts["index"].to_i
+      frame = backtrace_frames[index]
+      variable_info = VariableInfo.new(frame, editor_url(frame), rails_params, rack_session, Time.now.to_f)
+      { html: self.class.render_template("variable_info", variable_info) }
+    end
+
+    def do_eval(opts)
+      index = opts["index"].to_i
+      code = opts["source"]
+
+      unless (binding = backtrace_frames[index].frame_binding)
+        return { error: "REPL unavailable in this stack frame" }
+      end
+
+      @repls[index] ||= REPL.provider.new(binding, exception)
+
+      eval_and_respond(index, code)
+    end
+
+    def backtrace_frames
+      exception.backtrace
+    end
+
+    def exception_type
+      exception.type
+    end
+
+    def exception_message
+      exception.message.strip.gsub(/(\r?\n\s*\r?\n)+/, "\n")
+    end
+
+    def exception_hint
+      exception.hint
+    end
+
+    def active_support_actions
+      return [] unless defined?(ActiveSupport::ActionableError)
+
+      ActiveSupport::ActionableError.actions(exception.type)
+    end
+
+    def action_dispatch_action_endpoint
+      return unless defined?(ActionDispatch::ActionableExceptions)
+
+      ActionDispatch::ActionableExceptions.endpoint
+    end
+
+    def application_frames
+      backtrace_frames.select(&:application?)
+    end
+
+    def first_frame
+      application_frames.first || backtrace_frames.first
+    end
+
+    private
+
+    def editor_url(frame)
+      BetterErrors.editor.url(frame.filename, frame.line)
+    end
+
+    def rack_session
+      env['rack.session']
+    end
+
+    def rails_params
+      env['action_dispatch.request.parameters']
+    end
+
+    def uri_prefix
+      env["SCRIPT_NAME"] || ""
+    end
+
+    def request_path
+      env["PATH_INFO"]
+    end
+
+    def self.html_formatted_code_block(frame)
+      CodeFormatter::HTML.new(frame.filename, frame.line).output
+    end
+
+    def self.text_formatted_code_block(frame)
+      CodeFormatter::Text.new(frame.filename, frame.line).output
+    end
+
+    def text_heading(char, str)
+      str + "\n" + char*str.size
+    end
+
+    def self.inspect_value(obj)
+      if BetterErrors.ignored_classes.include? obj.class.name
+        "<span class='unsupported'>(Instance of ignored class. "\
+        "#{obj.class.name ? "Remove #{CGI.escapeHTML(obj.class.name)} from" : "Modify"}"\
+        " BetterErrors.ignored_classes if you need to see it.)</span>"
+      else
+        InspectableValue.new(obj).to_html
+      end
+    rescue BetterErrors::ValueLargerThanConfiguredMaximum
+      "<span class='unsupported'>(Object too large. "\
+        "#{obj.class.name ? "Modify #{CGI.escapeHTML(obj.class.name)}#inspect or a" : "A"}"\
+        "djust BetterErrors.maximum_variable_inspect_size if you need to see it.)</span>"
+    rescue Exception => e
+      "<span class='unsupported'>(exception #{CGI.escapeHTML(e.class.to_s)} was raised in inspect)</span>"
+    end
+
+    def eval_and_respond(index, code)
+      result, prompt, prefilled_input = @repls[index].send_input(code)
+
+      {
+        highlighted_input: Rouge::Formatters::HTML.new.format(Rouge::Lexers::Ruby.lex(code)),
+        prefilled_input:   prefilled_input,
+        prompt:            prompt,
+        result:            result
+      }
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/error_page_style.rb

@@ -0,0 +1,43 @@
+module BetterErrors
+  # @private
+  module ErrorPageStyle
+    def self.compiled_css(for_deployment = false)
+      begin
+        require "sassc"
+      rescue LoadError
+        raise LoadError, "The `sassc` gem is required when developing the `better_errors` gem. "\
+          "If you're using a release of `better_errors`, the compiled CSS is missing from the released gem"
+        # If you arrived here because sassc is not in your project's Gemfile,
+        # the issue here is that the release of the better_errors gem
+        # is supposed to contain the compiled CSS, but that file is missing from the release.
+        # So better_errors is trying to build the CSS on the fly, which requires the sassc gem.
+        #
+        # If you're developing the better_errors gem locally, and you're running a project
+        # that does not have sassc in its bundle, run `rake style:build` in the better_errors
+        # project to compile the CSS file.
+      end
+
+      style_dir = File.expand_path("style", File.dirname(__FILE__))
+      style_file = "#{style_dir}/main.scss"
+
+      engine = SassC::Engine.new(
+        File.read(style_file),
+        filename: style_file,
+        style: for_deployment ? :compressed : :expanded,
+        line_comments: !for_deployment,
+        load_paths: [style_dir],
+      )
+      engine.render
+    end
+
+    def self.style_tag(csp_nonce)
+      style_file = File.expand_path("templates/main.css", File.dirname(__FILE__))
+      css = if File.exist?(style_file)
+        File.open(style_file).read
+      else
+        compiled_css(false)
+      end
+      "<style type='text/css' nonce='#{csp_nonce}'>\n#{css}\n</style>"
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/exception_extension.rb

@@ -0,0 +1,17 @@
+module BetterErrors
+  module ExceptionExtension
+    prepend_features Exception
+
+    def set_backtrace(*)
+      if caller_locations.none? { |loc| loc.path == __FILE__ }
+        @__better_errors_bindings_stack = ::Kernel.binding.callers.drop(1)
+      end
+
+      super
+    end
+
+    def __better_errors_bindings_stack
+      @__better_errors_bindings_stack || []
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/exception_hint.rb

@@ -0,0 +1,29 @@
+module BetterErrors
+  class ExceptionHint
+    def initialize(exception)
+      @exception = exception
+    end
+
+    def hint
+      case exception
+      when NoMethodError
+        /\Aundefined method `(?<method>[^']+)' for (?<val>[^:]+):(?<klass>\w+)/.match(exception.message) do |match|
+          if match[:val] == "nil"
+            return "Something is `nil` when it probably shouldn't be."
+          elsif !match[:klass].start_with? '0x'
+            return "`#{match[:method]}` is being called on a `#{match[:klass]}` object, "\
+              "which might not be the type of object you were expecting."
+          end
+        end
+      when NameError
+        /\Aundefined local variable or method `(?<method>[^']+)' for/.match(exception.message) do |match|
+          return "`#{match[:method]}` is probably misspelled."
+        end
+      end
+    end
+
+    private
+
+    attr_reader :exception
+  end
+end

data/better_errors-2.10.1/lib/better_errors/inspectable_value.rb

@@ -0,0 +1,45 @@
+require "cgi"
+require "objspace" rescue nil
+
+module BetterErrors
+  class ValueLargerThanConfiguredMaximum < StandardError; end
+
+  class InspectableValue
+    def initialize(value)
+      @original_value = value
+    end
+
+    def to_html
+      raise ValueLargerThanConfiguredMaximum unless value_small_enough_to_inspect?
+      value_as_html
+    end
+
+    private
+
+    attr_reader :original_value
+
+    def value_as_html
+      @value_as_html ||= CGI.escapeHTML(value)
+    end
+
+    def value
+      @value ||= begin
+        if original_value.respond_to? :inspect
+          original_value.inspect
+        else
+          original_value
+        end
+      end
+    end
+
+    def value_small_enough_to_inspect?
+      return true if BetterErrors.maximum_variable_inspect_size.nil?
+
+      if defined?(ObjectSpace) && defined?(ObjectSpace.memsize_of) && ObjectSpace.memsize_of(value)
+        ObjectSpace.memsize_of(value) <= BetterErrors.maximum_variable_inspect_size
+      else
+        value_as_html.length <= BetterErrors.maximum_variable_inspect_size
+      end
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/middleware.rb

@@ -0,0 +1,237 @@
+require "json"
+require "ipaddr"
+require "securerandom"
+require "set"
+require "rack"
+
+module BetterErrors
+  # Better Errors' error handling middleware. Including this in your middleware
+  # stack will show a Better Errors error page for exceptions raised below this
+  # middleware.
+  #
+  # If you are using Ruby on Rails, you do not need to manually insert this
+  # middleware into your middleware stack.
+  #
+  # @example Sinatra
+  #   require "better_errors"
+  #
+  #   if development?
+  #     use BetterErrors::Middleware
+  #   end
+  #
+  # @example Rack
+  #   require "better_errors"
+  #   if ENV["RACK_ENV"] == "development"
+  #     use BetterErrors::Middleware
+  #   end
+  #
+  class Middleware
+    # The set of IP addresses that are allowed to access Better Errors.
+    #
+    # Set to `{ "127.0.0.1/8", "::1/128" }` by default.
+    ALLOWED_IPS = Set.new
+
+    # Adds an address to the set of IP addresses allowed to access Better
+    # Errors.
+    def self.allow_ip!(addr)
+      ALLOWED_IPS << (addr.is_a?(IPAddr) ? addr : IPAddr.new(addr))
+    end
+
+    allow_ip! "127.0.0.0/8"
+    allow_ip! "::1/128" rescue nil # windows ruby doesn't have ipv6 support
+
+    CSRF_TOKEN_COOKIE_NAME = "BetterErrors-#{BetterErrors::VERSION}-CSRF-Token"
+
+    # A new instance of BetterErrors::Middleware
+    #
+    # @param app      The Rack app/middleware to wrap with Better Errors
+    # @param handler  The error handler to use.
+    def initialize(app, handler = ErrorPage)
+      @app      = app
+      @handler  = handler
+    end
+
+    # Calls the Better Errors middleware
+    #
+    # @param [Hash] env
+    # @return [Array]
+    def call(env)
+      if allow_ip? env
+        better_errors_call env
+      else
+        @app.call env
+      end
+    end
+
+  private
+
+    def allow_ip?(env)
+      request = Rack::Request.new(env)
+      return true unless request.ip and !request.ip.strip.empty?
+      ip = IPAddr.new request.ip.split("%").first
+      ALLOWED_IPS.any? { |subnet| subnet.include? ip }
+    end
+
+    def better_errors_call(env)
+      case env["PATH_INFO"]
+      when %r{/__better_errors/(?<id>.+?)/(?<method>\w+)\z}
+        internal_call(env, $~[:id], $~[:method])
+      when %r{/__better_errors/?\z}
+        show_error_page env
+      else
+        protected_app_call env
+      end
+    end
+
+    def protected_app_call(env)
+      @app.call env
+    rescue Exception => ex
+      @error_page = @handler.new ex, env
+      log_exception
+      show_error_page(env, ex)
+    end
+
+    def show_error_page(env, exception=nil)
+      request = Rack::Request.new(env)
+      csrf_token = request.cookies[CSRF_TOKEN_COOKIE_NAME] || SecureRandom.uuid
+      csp_nonce = SecureRandom.base64(12)
+
+      type, content = if @error_page
+        if text?(env)
+          [ 'plain', @error_page.render_text ]
+        else
+          [ 'html', @error_page.render_main(csrf_token, csp_nonce) ]
+        end
+      else
+        [ 'html', no_errors_page ]
+      end
+
+      status_code = 500
+      if defined?(ActionDispatch::ExceptionWrapper) && exception
+        status_code = ActionDispatch::ExceptionWrapper.new(env, exception).status_code
+      end
+
+      headers = {
+        "Content-Type" => "text/#{type}; charset=utf-8",
+        "Content-Security-Policy" => [
+          "default-src 'none'",
+          # Specifying nonce makes a modern browser ignore 'unsafe-inline' which could still be set 
+          # for older browsers without nonce support.
+          # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
+          "script-src 'self' 'nonce-#{csp_nonce}' 'unsafe-inline'",
+          "style-src 'self' 'nonce-#{csp_nonce}' 'unsafe-inline'",
+          "img-src data:",
+          "connect-src 'self'",
+          "navigate-to 'self' #{BetterErrors.editor.scheme}",
+        ].join('; '),
+      }
+
+      response = Rack::Response.new(content, status_code, headers)
+
+      unless request.cookies[CSRF_TOKEN_COOKIE_NAME]
+        response.set_cookie(CSRF_TOKEN_COOKIE_NAME, value: csrf_token, path: "/", httponly: true, same_site: :strict)
+      end
+
+      # In older versions of Rack, the body returned here is actually a Rack::BodyProxy which seems to be a bug.
+      # (It contains status, headers and body and does not act like an array of strings.)
+      # Since we already have status code and body here, there's no need to use the ones in the Rack::Response.
+      (_status_code, headers, _body) = response.finish
+      [status_code, headers, [content]]
+    end
+
+    def text?(env)
+      env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" ||
+        !env["HTTP_ACCEPT"].to_s.include?('html')
+    end
+
+    def log_exception
+      return unless BetterErrors.logger
+
+      message = "\n#{@error_page.exception_type} - #{@error_page.exception_message}:\n"
+      message += backtrace_frames.map { |frame| "  #{frame}\n" }.join
+
+      BetterErrors.logger.fatal message
+    end
+
+    def backtrace_frames
+      if defined?(Rails) && defined?(Rails.backtrace_cleaner)
+        Rails.backtrace_cleaner.clean @error_page.backtrace_frames.map(&:to_s)
+      else
+        @error_page.backtrace_frames
+      end
+    end
+
+    def internal_call(env, id, method)
+      return not_found_json_response unless %w[variables eval].include?(method)
+      return no_errors_json_response unless @error_page
+      return invalid_error_json_response if id != @error_page.id
+
+      request = Rack::Request.new(env)
+      return invalid_csrf_token_json_response unless request.cookies[CSRF_TOKEN_COOKIE_NAME]
+
+      request.body.rewind
+      body = JSON.parse(request.body.read)
+      return invalid_csrf_token_json_response unless request.cookies[CSRF_TOKEN_COOKIE_NAME] == body['csrfToken']
+
+      return not_acceptable_json_response unless request.content_type == 'application/json'
+
+      response = @error_page.send("do_#{method}", body)
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(response)]]
+    end
+
+    def no_errors_page
+      "<h1>No errors</h1><p>No errors have been recorded yet.</p><hr>" +
+      "<code>Better Errors v#{BetterErrors::VERSION}</code>"
+    end
+
+    def no_errors_json_response
+      explanation = if defined? Middleman
+        "Middleman reloads all dependencies for each request, " +
+          "which breaks Better Errors."
+      elsif defined?(Shotgun) && defined?(Hanami)
+        "Hanami is likely running with code-reloading enabled, which is the default. " +
+          "You can disable this by running hanami with the `--no-code-reloading` option."
+      elsif defined? Shotgun
+        "The shotgun gem causes everything to be reloaded for every request. " +
+          "You can disable shotgun in the Gemfile temporarily to use Better Errors."
+      else
+        "The application has been restarted since this page loaded, " +
+          "or the framework is reloading all gems before each request "
+      end
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: 'No exception information available',
+        explanation: explanation,
+      )]]
+    end
+
+    def invalid_error_json_response
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Session expired",
+        explanation: "This page was likely opened from a previous exception, " +
+          "and the exception is no longer available in memory.",
+      )]]
+    end
+
+    def invalid_csrf_token_json_response
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Invalid CSRF Token",
+        explanation: "The browser session might have been cleared, " +
+          "or something went wrong.",
+      )]]
+    end
+
+    def not_found_json_response
+      [404, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Not found",
+        explanation: "Not a recognized internal call.",
+      )]]
+    end
+
+    def not_acceptable_json_response
+      [406, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Request not acceptable",
+        explanation: "The internal request did not match an acceptable content type.",
+      )]]
+    end
+  end
+end

data/better_errors-2.10.1/lib/better_errors/rails.rb

@@ -0,0 +1,28 @@
+module BetterErrors
+  # @private
+  class Railtie < Rails::Railtie
+    initializer "better_errors.configure_rails_initialization" do
+      if use_better_errors?
+        insert_middleware
+        BetterErrors.logger = Rails.logger
+        BetterErrors.application_root = Rails.root.to_s
+      end
+    end
+
+    def insert_middleware
+      if defined? ActionDispatch::DebugExceptions
+        app.middleware.insert_after ActionDispatch::DebugExceptions, BetterErrors::Middleware
+      else
+        app.middleware.use BetterErrors::Middleware
+      end
+    end
+
+    def use_better_errors?
+      !Rails.env.production? and app.config.consider_all_requests_local
+    end
+
+    def app
+      Rails.application
+    end
+  end
+end