mirror of https://github.com/rails/rails
Ruby code block indentation issue fix
[skip ci] indentation fix [skip ci] review changes added [skip ci] indentation fix
This commit is contained in:
parent
9044d35c2f
commit
61a9c1a92a
|
@ -80,6 +80,7 @@
|
|||
This is very useful in situations where you only want to add a required param that is part of the route's URL but for other route not append an extraneous query param.
|
||||
|
||||
Given the following router...
|
||||
|
||||
```ruby
|
||||
Rails.application.routes.draw do
|
||||
scope ":account_id" do
|
||||
|
@ -91,6 +92,7 @@
|
|||
```
|
||||
|
||||
And given the following `ApplicationController`
|
||||
|
||||
```ruby
|
||||
class ApplicationController < ActionController::Base
|
||||
def default_url_options
|
||||
|
|
|
@ -96,6 +96,7 @@ Please refer to the [Changelog][action-view] for detailed changes.
|
|||
#=> <input type="hidden" name="_method" value="post" autocomplete="off" />
|
||||
# After
|
||||
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
||||
```
|
||||
|
||||
Action Mailer
|
||||
-------------
|
||||
|
|
|
@ -102,7 +102,7 @@ View Timings from Instrumentation in Your Browser
|
|||
Rails implements the [Server Timing](https://www.w3.org/TR/server-timing/) standard to make timing information available in the web browser. To enable, edit your environment configuration (usually `development.rb` as this is most-used in development) to include the following:
|
||||
|
||||
```ruby
|
||||
config.server_timing = true
|
||||
config.server_timing = true
|
||||
```
|
||||
|
||||
Once configured (including restarting your server), you can go to the Developer Tools pane of your browser, then select Network and reload your page. You can then select any request to your Rails server, and will see server timings in the timings tab. For an example of doing this, see the [Firefox Documentation](https://firefox-source-docs.mozilla.org/devtools-user/network_monitor/request_details/index.html#server-timing).
|
||||
|
|
|
@ -527,7 +527,7 @@ INFO: _A common pitfall in Ruby's regular expressions is to match the string's b
|
|||
Ruby uses a slightly different approach than many other languages to match the end and the beginning of a string. That is why even many Ruby and Rails books get this wrong. So how is this a security threat? Say you wanted to loosely validate a URL field and you used a simple regular expression like this:
|
||||
|
||||
```ruby
|
||||
/^https?:\/\/[^\n]+$/i
|
||||
/^https?:\/\/[^\n]+$/i
|
||||
```
|
||||
|
||||
This may work fine in some languages. However, _in Ruby `^` and `$` match the **line** beginning and line end_. And thus a URL like this passes the filter without problems:
|
||||
|
@ -541,7 +541,7 @@ http://hi.com
|
|||
This URL passes the filter because the regular expression matches - the second line, the rest does not matter. Now imagine we had a view that showed the URL like this:
|
||||
|
||||
```ruby
|
||||
link_to "Homepage", @user.homepage
|
||||
link_to "Homepage", @user.homepage
|
||||
```
|
||||
|
||||
The link looks innocent to visitors, but when it's clicked, it will execute the JavaScript function "exploit_code" or any other JavaScript the attacker provides.
|
||||
|
@ -549,14 +549,14 @@ The link looks innocent to visitors, but when it's clicked, it will execute the
|
|||
To fix the regular expression, `\A` and `\z` should be used instead of `^` and `$`, like so:
|
||||
|
||||
```ruby
|
||||
/\Ahttps?:\/\/[^\n]+\z/i
|
||||
/\Ahttps?:\/\/[^\n]+\z/i
|
||||
```
|
||||
|
||||
Since this is a frequent mistake, the format validator (validates_format_of) now raises an exception if the provided regular expression starts with ^ or ends with $. If you do need to use ^ and $ instead of \A and \z (which is rare), you can set the :multiline option to true, like so:
|
||||
|
||||
```ruby
|
||||
# content should include a line "Meanwhile" anywhere in the string
|
||||
validates :content, format: { with: /^Meanwhile$/, multiline: true }
|
||||
# content should include a line "Meanwhile" anywhere in the string
|
||||
validates :content, format: { with: /^Meanwhile$/, multiline: true }
|
||||
```
|
||||
|
||||
Note that this only protects you against the most common mistake when using the format validator - you always need to keep in mind that ^ and $ match the **line** beginning and line end in Ruby, and not the beginning and end of a string.
|
||||
|
@ -1143,7 +1143,7 @@ browser automatically upgrades to HTTPS for current and future connections.
|
|||
The header is added to the response when enabling the `force_ssl` option:
|
||||
|
||||
```ruby
|
||||
config.force_ssl = true
|
||||
config.force_ssl = true
|
||||
```
|
||||
|
||||
[`Strict-Transport-Security`]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
||||
|
|
Loading…
Reference in New Issue