Commit Graph

14059 Commits

Author SHA1 Message Date
Andrew White 9232ba7119 Make engine check more explicit
Not everything that responds to `routes` is a Rails engine - for example
a Grape API endpoint will have a `routes` method but can't be used with
`assert_recognizes` as it doesn't respond to `recognize_path_with_request`.

Fixes #32312.
2018-03-25 11:07:26 +01:00
Andrew White 2ef1458833 Use ASCII-8BIT paths in ActionDispatch::Static
The rack gem returns PATH_INFO as an ASCII-8BIT encoded string but it
was being converted to US-ASCII by the match? method because it was
calling Rack::Utils.escape_path. To prevent incompatibile encoding
warnings use ASCII-8BIT strings for the root path and let Ruby handle
any filename encoding conversion.

Fixes #32294, Closes #32314.
2018-03-22 04:23:49 +00:00
Ryuta Kamizono 98224f8219
Merge pull request #32253 from zwass/before_action_docs
Add cancellation info to before filter docs

[ci skip]
2018-03-22 03:03:23 +09:00
Eileen M. Uchitelle 3791180d77
Merge pull request #32293 from dzirtusss/fix-system-tests-transactions
Fix system tests transactions not closed between examples
2018-03-21 09:38:52 -04:00
Andrew White 5368f25086 Cache url helpers module
The urls helpers module returned by Rails.application.routes.url_helpers
isn't cached so to prevent the cost of building the module cache it locally.
2018-03-21 10:22:14 +00:00
Sergey Tarasov 5c4e1338e2 Fix system tests transactions not closed between examples 2018-03-19 15:29:30 +02:00
Rafael Mendonça França 81843bcf65
Don't need to include in the changelog something that was release in 5.2
[ci skip]
2018-03-15 17:32:20 -04:00
Catherine Khuu 46ae2b18ea Check exclude before flagging cookies as secure in ActionDispatch::SSL (#32262)
* Check exclude before flagging cookies as secure.

* Update comments in ActionDispatch::SSL.

[Catherine Khuu + Rafael Mendonça França]
2018-03-15 17:29:21 -04:00
Zachary Wasserman 9c6b3204d4 Add cancellation info to before filter docs
It is important for users to know that a render or redirect in a "before"
filter causes the action to be cancelled. This was addressed in the guide, but
not the API docs
(http://guides.rubyonrails.org/action_controller_overview.html#filters).

[ci skip]
2018-03-14 12:18:10 -07:00
Kasper Timm Hansen f7e7fdc52c
Fix routing inspector tests broken in 6629d51a27
* Renames grep_pattern to grep throughout.
* Fixes setup not calling super by calling setup with a block.
* Converts test helper method to a private one, like we have it other places.
* Uses keyword arguments to get around awkward draw({ grep: "x" }, Action…)
  construction.
2018-03-13 21:30:21 +01:00
Kasper Timm Hansen 6629d51a27
Rely on Rails::Command's help output.
We end up with:

```
Usage:
  bin/rails routes [options]

Options:
  -c, [--controller=CONTROLLER]      # Filter by a specific controller, e.g. PostsController or Admin::PostsController.
  -g, [--grep=GREP]                  # Grep routes by a specific pattern.
  -E, [--expanded], [--no-expanded]  # Print routes expanded vertically with parts explained.
```

which does miss the bit about routes being printed in order.

Also:

* Renames options to ease help output readability, then clarifies each option.
* Fixes a bunch of indentation.
2018-03-13 20:56:37 +01:00
Rafael Mendonça França ba0ae542ca
Remove changelog header for unreleased version
We only add the header when releasing to avoid some conflicts.

[ci skip]
2018-03-13 15:20:57 -04:00
bogdanvlviv 304906f1bd
Introduce `ActionDispatch::Routing::ConsoleFormatter::Base`
- Create `Base` and inherit `Sheet` and `Expanded` in order to
- prevent code duplication.
  - Remove trailing "\n" for components of `Expanded`.
  - There is no need for `Expanded#header` to return `@buffer` so return `nil` instead.

- Change `no_routes` message "No routes were found for this controller"
  since if use `-g`, it sounds incorrect.
  - Display `No routes were found for this controller.` if apply `-c`.
  - Display `No routes were found for this grep pattern.` if apply `-g`.

Related to #32130
2018-03-13 11:58:52 +02:00
bogdanvlviv e78b1e5e61
Improve docs of `ActionDispatch::Routing`
- Add a mention about `-g`.
- Improve info about `--expanded` option of `rails routes`.
2018-03-13 11:56:33 +02:00
Kasper Timm Hansen ee01c753a3
Merge pull request #32160 from bogdanvlviv/improve-rails-routes-expanded
Draw line of a route name to the end of row console on `rails routes --expanded`
2018-03-11 20:48:50 +01:00
yuuji.yaginuma 58eda3cfd8 Remove unnecessary `Hash.method_defined?(:dig)` checking
Since Rails 6 requires Ruby 2.4.1+.
2018-03-11 10:00:26 +09:00
Mahmoud 07ed1c5c87 Change doc for "polymorphic_path" in polymorphic_routes.rb
The method 'polymorphic_path' is not using 'polymorphic_url'
with `routing_type: :path` anymore in polymorphic_routes.rb
2018-03-09 09:33:41 +02:00
Andrew White 190744cd8e Always yield a CSP policy instance
If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.
2018-03-08 14:14:09 +00:00
Andrew White af406a753c Add the ability to disable the global CSP in a controller
e.g:

    class LegacyPagesController < ApplicationController
      content_security_policy false, only: :index
    end
2018-03-08 14:01:15 +00:00
Andrew White ed0c8e9577 Quote string return values in doc examples [ci skip] 2018-03-08 11:55:01 +00:00
Andrew White 22777c80b4 Add example of maintaining context with `route_for`
[ci skip]
2018-03-08 09:59:52 +00:00
Andrew White e764336e71
Merge pull request #32175 from bogdanvlviv/express-route_for-as-public-api
Express `ActionDispatch::Routing::UrlFor#route_for` as public api
2018-03-08 09:49:36 +00:00
bogdanvlviv 046750aeeb
Express `ActionDispatch::Routing::UrlFor#route_for` as public api
This method was added by #28462 but marked as private api.
Since `route_for` looks good in pair with `ActionDispatch::Routing::Mapper::CustomUrls#direct`
let's make it as public api.
We use it in e83575ff53/activestorage/config/routes.rb

Closes #31417
2018-03-07 00:58:16 +02:00
Thomas Walpole 207536c063 Allow Capybara 3.x (#32151) 2018-03-05 17:44:39 -08:00
bogdanvlviv 012a4a3842
Draw line of a route name to the end of row console on `rails routes --expanded`
In order to get width of console use `IO::console_size`,
See https://ruby-doc.org/stdlib-2.4.1/libdoc/io/console/rdoc/IO.html#method-c-console_size

Related to #32130
2018-03-05 14:56:59 +02:00
Jeremy Daer 4b42c7e52a Ruby 2.4: take advantage of String#unpack1
https://bugs.ruby-lang.org/issues/12752
https://ruby-doc.org/core-2.4.0/String.html#method-i-unpack1
2018-03-01 22:42:51 -08:00
Ryuta Kamizono d4f7ea2db6 `ConsoleFormatter` is no longer used as a class
It is used as a namespace for `Sheet` and `Expanded`.
2018-03-02 04:04:49 +09:00
Rafael França c9fa561b2e
Merge pull request #32130 from benoittgt/rake-routes-compact-mode
Add "rails routes --expanded" mode
2018-02-28 18:34:00 -05:00
Benoit Tigeot c6d928f3ca Add --expanded option to "rails routes"
When using rails routes with small terminal or complicated routes it can be
very difficult to understand where is the element listed in header. psql
had the same issue, that's why they created "expanded mode" you can
switch using `\x` or by starting psql with
```
-x
--expanded

    Turn on the expanded table formatting mode. This is equivalent to the \x command.
```
The output is similar to one implemented here for rails routes:

db_user-# \du
List of roles
-[ RECORD 1 ]----------------------------------------------
Role name  | super
Attributes | Superuser, Create role, Create DB
Member of  | {}
-[ RECORD 2 ]----------------------------------------------
Role name  | role
Attributes | Superuser, Create role, Create DB, Replication
Member of  | {}
2018-02-28 22:32:34 +01:00
Ryuta Kamizono 9dbc475454 Remove CHANGELOG entries which were backported to 5-2-stable 2018-02-28 20:46:17 +09:00
Zamith fc7781646c Uses the absolute path for system test screenshots
Why:

* When getting an error that generates a screenshot it would be helpful
  to be able to ctrl+click it to quickly open it in the browser, which
  does not work with relative paths

This change addresses the need by:

* Changing `image_path` to disregard the relative path and use the
  absolute one instead
2018-02-27 13:49:38 +00:00
Guillermo Iguaran efd3338b19
Merge pull request #31720 from grantbdev/update_default_hsts_max_age
Update default HSTS max-age value to 1 year
2018-02-24 18:20:21 -05:00
Guillermo Iguaran c113bdc9d0
Support for automatic nonce generation was backported to 5.2 2018-02-24 18:08:38 -05:00
Guillermo Iguaran 697dd48b5e
Merge branch 'master' into update_default_hsts_max_age 2018-02-24 18:03:47 -05:00
Andrew White e20742f12b
Merge pull request #32018 from rails/add-nonce-support-to-csp
Add support for automatic nonce generation for Rails UJS
2018-02-22 15:32:23 +00:00
utilum 6f6fe69ea8 We should call methods with `.method_name` not `::method_name`.
Found several instances.

Follow up on 63d530c5e6
2018-02-22 00:54:40 +01:00
Andrew White 31abee0341 Add support for automatic nonce generation for Rails UJS
Because the UJS library creates a script tag to process responses it
normally requires the script-src attribute of the content security
policy to include 'unsafe-inline'.

To work around this we generate a per-request nonce value that is
embedded in a meta tag in a similar fashion to how CSRF protection
embeds its token in a meta tag. The UJS library can then read the
nonce value and set it on the dynamically generated script tag to
enable it to execute without needing 'unsafe-inline' enabled.

Nonce generation isn't 100% safe - if your script tag is including
user generated content in someway then it may be possible to exploit
an XSS vulnerability which can take advantage of the nonce. It is
however an improvement on a blanket permission for inline scripts.

It is also possible to use the nonce within your own script tags by
using `nonce: true` to set the nonce value on the tag, e.g

    <%= javascript_tag nonce: true do %>
      alert('Hello, World!');
    <% end %>

Fixes #31689.
2018-02-19 15:59:34 +00:00
Andrew White 0f05c87e7a
Merge pull request #32032 from utilum/method_redefined
Avoid method_redefined warnings in  RouteSet::NamedRouteCollection
2018-02-19 15:04:23 +00:00
utilum 899e2dad03 Avoid method_redefined warnings in RouteSet::NamedRouteCollection
Before:
```
~/.rbenv/versions/2.5.0/bin/ruby -w -Itest -Ilib -I../activesupport/lib -I../actionpack/lib -I../actionview/lib -I../activemodel/lib test/application/routing_test.rb
Run options: --seed 5851

.......~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
....~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
..........~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
.....

Finished in 13.233638s, 1.9647 runs/s, 5.8185 assertions/s.
26 runs, 77 assertions, 0 failures, 0 errors, 0 skips
```

After:
```
~/.rbenv/versions/2.5.0/bin/ruby -w -Itest -Ilib -I../activesupport/lib -I../actionpack/lib -I../actionview/lib -I../activemodel/lib test/application/routing_test.rb
Run options: --seed 38072

..........................

Finished in 12.009632s, 2.1649 runs/s, 6.4115 assertions/s.
26 runs, 77 assertions, 0 failures, 0 errors, 0 skips
```
2018-02-19 13:50:32 +01:00
Andrew White d85283cc42 Remove trailing semi-colon from CSP
Although the spec[1] is defined in such a way that a trailing semi-colon
is valid it also doesn't allow a semi-colon by itself to indicate an
empty policy. Therefore it's easier (and valid) just to omit it rather
than to detect whether the policy is empty or not.

[1]: https://www.w3.org/TR/CSP2/#policy-syntax
2018-02-19 12:20:43 +00:00
Andrew White 52a1f1c226 Revert "Merge pull request #32045 from eagletmt/skip-csp-header"
This reverts commit 86f7c26907, reversing
changes made to 5ece2e4a44.

If a policy is set then we should generate it even if it's empty.
However what is happening is that we're accidentally generating an
empty policy when the initializer is commented out by default.
2018-02-19 12:00:29 +00:00
Kohei Suzuki 53d863d4bb
Skip generating empty CSP header when no policy is configured
`Rails.application.config.content_security_policy` is configured with no
policies by default. In this case, Content-Security-Policy header should
not be generated instead of generating the header with no directives.
Firefox also warns "Content Security Policy: Couldn't process unknown
directive ''".
2018-02-18 23:45:57 +09:00
Jeremy Daer d4eb0dc89e Rails 6 requires Ruby 2.4.1+
Skipping over 2.4.0 to sidestep the `"symbol_from_string".to_sym.dup` bug.

References #32028
2018-02-17 15:34:57 -08:00
bogdanvlviv 0f98954a83
Clean up and consolidate .gitignores
* Global ignores at toplevel .gitignore
* Component-specific ignores in each toplevel directory
* Remove `actionview/test/tmp/.keep` for JRuby

```
rm actionview/test/tmp/ -fr
cd actionview/
bundle exec jruby -Itest test/template/digestor_test.rb
```

Related to #11743, #30392.

Closes #29978.
2018-02-17 14:26:19 -08:00
bogdanvlviv 56278a7a1e Partly revert 1e526788e6
Some attr_readers should be `protected` instead of `private`

See https://travis-ci.org/rails/rails/builds/342800276
2018-02-17 13:09:30 -08:00
Jeremy Daer 1e526788e6 Rails 6 requires Ruby 2.3+ 2018-02-17 10:03:37 -08:00
fatkodima 94a27cb2b5 Fix array routing constraints 2018-02-17 02:44:58 +02:00
Rafael Mendonça França 89bcca59e9 Remove usage of strip_heredoc in the framework in favor of <<~
Some places we can't remove because Ruby still don't have a method
equivalent to strip_heredoc to be called in an already existent string.
2018-02-16 19:28:30 -05:00
Rafael Mendonça França 2c89d1dda4 Write the code in a more natural way. 2018-02-16 18:55:36 -05:00
Rafael Mendonça França 0ea8e7db1a Remove support to Ruby 2.2
Rails 6 will only support Ruby >= 2.3.
2018-02-16 18:52:10 -05:00