Commit Graph

15969 Commits

Author SHA1 Message Date
Hartley McGuire 8cbf969e09
Temporarily fix multi-paragraph definition lists
The rdoc markdown parser does not currently parse multi-paragraph
definition lists correctly. Instead of putting both paragraphs inside
a single definition, only the first paragraph ends up in the definition
and the second paragraph is rendered after the definition list as a code
block.

Since 7.2 appears to be coming soon, this commit fixes the second
paragraph rendering as a code block by turning it into a second
definition. This doesn't strictly seem like the "correct" fix (compared
to fixing the rdoc markdown parser) but it gives us the visual result
that we want until rdoc is fixed.
2024-05-21 11:48:01 -04:00
Rafael Mendonça França bf59d363fb
Clean CHANGELOG for 8.0 2024-05-13 16:55:52 +00:00
Rafael Mendonça França 37fd0e7fe4
Development of Rails 8.0 starts now
🎉
2024-05-13 16:45:20 +00:00
zzak 833c1c9a4d
Enable Lint/Debugger
This will prevent issues like be0cb4e8f9, which would have resulted in:

```
guides/rails_guides/generator.rb:16:1: W: Lint/Debugger: Remove debugger entry point require "debug".
require "debug"
^^^^^^^^^^^^^^^
```

Disabled the cop in actionpack tests for screenshot_helper and page_dump_helper:

```
actionpack/test/controller/integration_test.rb:1369:9: W: Lint/Debugger: Remove debugger entry point save_and_open_page.
        save_and_open_page
        ^^^^^^^^^^^^^^^^^^
actionpack/test/controller/integration_test.rb:1381:11: W: Lint/Debugger: Remove debugger entry point save_and_open_page.
          save_and_open_page
          ^^^^^^^^^^^^^^^^^^
actionpack/test/controller/integration_test.rb:1391:39: W: Lint/Debugger: Remove debugger entry point save_and_open_page.
      assert_raise(InvalidResponse) { save_and_open_page }
                                      ^^^^^^^^^^^^^^^^^^
```

```
actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb:111:13: W: Lint/Debugger: Remove debugger entry point page.save_page(absolute_html_path).
            page.save_page(absolute_html_path)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
actionpack/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb:115:13: W: Lint/Debugger: Remove debugger entry point page.save_screenshot(absolute_image
_path).
            page.save_screenshot(absolute_image_path)
```

The DebuggerRequires option was first available in rubocop v1.63.0, in rubocop/rubocop#12766.
2024-05-13 13:41:18 +09:00
Gannon McGibbon e97db3b395
Merge pull request #51614 from gmcgibbon/defer_route_drawing
Defer route drawing to the first request, or when url_helpers called
2024-05-12 10:17:57 -04:00
Gert Goet 111b6ab1fb
Example requires delimiter 2024-05-10 12:40:35 +02:00
Gannon McGibbon e54f869e43 Defer route drawing to the first request, or when url_helpers called.
Executes the first routes reload in middleware, or when the route set
url_helpers is called. Previously, this was executed unconditionally on
boot, which can slow down boot time unnecessarily for larger apps with
lots of routes.
2024-05-08 23:43:06 -04:00
Jean Boussier 06d3b358df Replace allocations count by GC time in request logs
Allocations count is often an interesting proxy for performance,
but not necessarily the most relevant thing to include in request
logs, given they aren't a per thread metric, so the reporting
is widely innacurate in multi-threaded environments.

Since Ruby 3.1 there is now `GC.total_time` which is a monotonically
increasing counter of time spent in GC. It still isn't really a per
thread metric, but is is more interesting because it uses the same
unit as the response time, allowing to better see when you have a GC
pause performance issue.
2024-05-08 23:02:35 +02:00
fatkodima 702638291c
Fix tests without assertions in the framework 2024-04-30 23:29:30 +00:00
Earlopain 6233309298
Resolve deprecation warning in latest `selenium-webdriver`
```
2024-04-26 09:36:45 INFO Selenium [:logger_info] Details on how to use and modify Selenium logger:
  https://selenium.dev/documentation/webdriver/troubleshooting/logging

2024-04-26 09:36:45 WARN Selenium [DEPRECATION] DriverFinder.path(options, service_class) is deprecated. Use DriverFinder.new(options, service).driver_path instead.
```
2024-04-26 12:28:42 +02:00
Taylor Chaparro 5889b8659e
Fix `Mime::Type.parse` for HTTP Accept with parameters
Fixes MIME parsing raising errors on valid parameters #51594.

Mime type lookups were updated to handle custom registered types as part of #48397.

This fix the strips out custom media range parameters before falling back to the default type creation.
2024-04-22 07:09:28 -07:00
Ryuta Kamizono 7db95ced41 Update comments for helper method generation
Follow up to #50596.
2024-04-22 22:14:42 +09:00
Rafael Mendonça França 73452ef8ca
Merge pull request #51096 from joshuay03/fix-missing-template-error-page-with-nested-controller-paths
[Fix #51095] Missing template error page showing incorrect view path example for nested controller path
2024-04-19 16:22:55 -03:00
Joshua Young 79f2099fb1
[Fix #51095] Missing template error page showing incorrect view path example for nested controller path 2024-04-19 19:06:17 +00:00
Nemanja Čorlija 8ba3144519
Fix typo in page_dump_helper.rb 2024-04-19 16:54:36 +02:00
Carlos Antonio da Silva 1e6938abcf Fix indentation on `save_and_open_page` tests 2024-04-19 10:15:11 -03:00
Jean Boussier d5c88d68c3 Fix some more ignored block warnings
Ref: https://bugs.ruby-lang.org/issues/15554

A couple are harmless, but another couple found actual problems
in the test suite where we passed blocks to `assert_*` methods that
didn't expect one.
2024-04-19 10:23:42 +02:00
Joé Dupuis 7f9ce6f62b
Add `save_and_open_page` helper to IntegrationTest
`save_and_open_page` is a capybara helper that lets developers
inspect the status of the page at any given point in their
test. This is helpful when trying to keep a short feedback loop while
working on a test.

This change adds a similar helper with matching signature to
integration tests.
2024-04-18 20:44:40 +00:00
Rafael Mendonça França d1236c4b8d
Merge pull request #51479 from nhorton/patch-5
Don't preload Selenium browser when remote
2024-04-18 14:32:51 -03:00
Jean Boussier b272be8f6b
Merge pull request #51523 from etiennebarrie/route-to-implicit-controller
Restore `to:` option in routes with an implicit controller
2024-04-17 17:14:04 +02:00
Sebastian Serth 33ee5d659d
Fix typo in Feature Policy for idle-detection
As listed in MDN, the policy is spelled as `idle-detection`, and not as `idle_detection`. Hence, browsers were unable to process the policy correctly, effectively ignoring it.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy/idle-detection
2024-04-13 18:34:30 +02:00
Étienne Barrié 1dc7620b9f Respond with 406 when a browser is blocked by allow_browser
RFC 9110 specifies:

	The server MUST send an Upgrade header field in a 426 response
	to indicate the required protocol(s)

https://httpwg.org/specs/rfc9110.html#status.426

Status 406 Not Acceptable is more appropriate because it indicates the
resource

	does not have a current representation that would be acceptable
	to the user agent, according to the proactive negotiation header
	fields received in the request

https://httpwg.org/specs/rfc9110.html#status.406

With the proactive negociation section mentionining:

	implicit characteristics, such as the client's network address
	or parts of the User-Agent field.

https://httpwg.org/specs/rfc9110.html#proactive.negotiation
2024-04-11 10:50:24 +02:00
Étienne Barrié 36ff424c3b Restore to: option with an implicit controller
The `:to` option for routes can once again be a String without a
controller if the controller is implicitly provided by a nesting
`controller` or `resources` call.
2024-04-10 16:47:20 +02:00
fatkodima 041de49399 Remove usage of `OpenStruct` 2024-04-09 21:35:08 +03:00
fatkodima cac9c3e9e0 Add missing `ostruct` require to `http_token_authentication_test.rb` 2024-04-04 15:47:53 +03:00
Noah Horton ce910c72da
Don't preload Selenium browser when remote 2024-04-03 13:06:50 -06:00
Yasuo Honda a2d2155e0e
Merge pull request #51357 from yahonda/ruby_chilled_strings
Address `RendererTest#test_rendering_with_a_class_renderer` failure against Ruby 3.4.0dev
2024-03-26 22:45:32 +09:00
Hartley McGuire 5df5ddc75e
Regenerate some broken markdown in Action Pack
This can be reproduced using a version of rdoc that includes this fix:
- c65266437c

The fix correctly adds a newline between definition list items, which
was not added previously.

This commit was generated with the following commands:

```
$ git checkout 3079e8b0f8 -- actionpack/lib/action_controller/metal/conditional_get.rb
$ ./tools/rdoc-to-md --only=actionpack -a
```
2024-03-25 19:39:17 -04:00
Yasuo Honda 41939a0ed5 Address `RendererTest#test_rendering_with_a_class_renderer` failure against Ruby 3.4.0dev
This commit addresses the following Rails Nightly CI error since https://github.com/ruby/ruby/pull/10262 .
https://buildkite.com/rails/rails-nightly/builds/310#018e5929-ff70-4397-b978-9a0a03cd4706/1255-1265

- Without this commit:
```ruby
$ ruby -v
ruby 3.4.0dev (2024-03-19T08:26:49Z master 12be40ae6b) [x86_64-linux]
$ cd actionpack
$ RAILS_STRICT_WARNINGS=true bin/test test/controller/renderer_test.rb:37
Running 25 tests in a single process (parallelization threshold is 50)
Run options: --seed 14013

/home/yahonda/src/github.com/rails/rails/actionpack/test/fixtures/ruby_template.ruby:2: warning: literal string will be frozen in the future
E

Error:
RendererTest#test_rendering_with_a_class_renderer:
RuntimeError: Neutered Exception ActionView::Template::Error: /home/yahonda/src/github.com/rails/rails/actionpack/test/fixtures/ruby_template.ruby:2: warning: literal string will be frozen in the future

    /home/yahonda/src/github.com/rails/rails/activesupport/lib/active_support/testing/strict_warnings.rb:33:in 'ActiveSupport::RaiseWarnings#warn'
    test/fixtures/ruby_template.ruby:2:in '_home_yahonda_src_github_com_rails_rails_actionpack_test_fixtures_ruby_template_ruby__3648742137162546161_6360'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/base.rb:282:in 'Kernel#public_send'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/base.rb:282:in 'ActionView::Base#_run'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/template.rb:275:in 'block in ActionView::Template#render'
    /home/yahonda/src/github.com/rails/rails/activesupport/lib/active_support/notifications.rb:212:in 'ActiveSupport::Notifications.instrument'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/template.rb:567:in 'ActionView::Template#instrument_render_template'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/template.rb:263:in 'ActionView::Template#render'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/template_renderer.rb:66:in 'block (2 levels) in ActionView::TemplateRenderer#render_template'
    /home/yahonda/src/github.com/rails/rails/activesupport/lib/active_support/notifications.rb:212:in 'ActiveSupport::Notifications.instrument'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/template_renderer.rb:60:in 'block in ActionView::TemplateRenderer#render_template'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/template_renderer.rb:80:in 'ActionView::TemplateRenderer#render_with_layout'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/template_renderer.rb:59:in 'ActionView::TemplateRenderer#render_template'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/template_renderer.rb:11:in 'ActionView::TemplateRenderer#render'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/renderer.rb:58:in 'ActionView::Renderer#render_template_to_object'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/renderer/renderer.rb:31:in 'ActionView::Renderer#render_to_object'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/rendering.rb:135:in 'block in ActionView::Rendering#_render_template'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/base.rb:309:in 'ActionView::Base#in_rendering_context'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/rendering.rb:134:in 'ActionView::Rendering#_render_template'
    lib/action_controller/metal/streaming.rb:258:in 'ActionController::Streaming#_render_template'
    /home/yahonda/src/github.com/rails/rails/actionview/lib/action_view/rendering.rb:121:in 'ActionView::Rendering#render_to_body'
    lib/action_controller/metal/rendering.rb:186:in 'ActionController::Rendering#render_to_body'
    lib/action_controller/metal/renderers.rb:142:in 'ActionController::Renderers#render_to_body'
    lib/abstract_controller/rendering.rb:47:in 'AbstractController::Rendering#render_to_string'
    lib/action_controller/metal/rendering.rb:175:in 'ActionController::Rendering#render_to_string'
    lib/action_controller/renderer.rb:136:in 'ActionController::Renderer#render'
    test/controller/renderer_test.rb:37:in 'block in <class:RendererTest>'

bin/test test/controller/renderer_test.rb:35

Finished in 0.294798s, 3.3921 runs/s, 0.0000 assertions/s.
1 runs, 0 assertions, 0 failures, 1 errors, 0 skips
$
```

Refer to these Ruby issue and pull request for this change:
https://bugs.ruby-lang.org/issues/20205
https://github.com/ruby/ruby/pull/10262

Co-authored-by: Rafael Mendonça França <rafael@franca.dev>
2024-03-21 07:08:38 +09:00
Rafael Mendonça França 8922180af5
Merge pull request #51270 from skipkayhil/hm-fix-bold-label-list
Fix md label-lists rendering incorrectly [ci-skip]
2024-03-07 16:19:49 -05:00
Gabriel Amaral 2cd7460152 Making code branches explicit
Co-authored-by: Rafael Mendonça França <rafael@franca.dev>
2024-03-07 20:20:25 +00:00
Gabriel Amaral b8e4640d72 Handling relative paths with extra URI parts. 2024-03-07 19:44:32 +00:00
Hartley McGuire 6640b85b69
Fix md label-lists rendering incorrectly
When converting docs from RDoc to Markdown, some label-lists ended up
not rendering properly. This appears to be due to RDoc's Markdown
parser not recognizing label-list labels if the label has additional
markup around it (in this case, bold markers `**`).

Additionally, the markdown label-list was missing newlines between list
items which also caused the label-list to not render correctly.

This commit fixes both of these issues for cases where the RDoc
originally used <b> tags in a label-list label. Since label-list labels
will already be bolded, there is no reason to also use `**` on the
labels.
2024-03-06 18:11:14 -05:00
Earlopain f080d8f5d0
Fix crash for invalid Content-Type in ShowExceptions middleware 2024-03-04 09:12:35 +01:00
Rafael Mendonça França a3f884f7a7
Merge pull request #50128 from thiagopradi/main
Removing not used fixtures from ActionPack test suite
2024-02-26 20:52:10 -05:00
Rafael Mendonça França ada3d775bd
Use `Kernel#Array` to wrap the default value 2024-02-27 01:37:54 +00:00
Rafael Mendonça França d216d1ede7
Do not always mark the default translation as html safe
If the `_html` suffis isn't provided we should not mark the default
translation as html safe and escape it.
2024-02-27 01:36:40 +00:00
Thiago Pradi 4a91897831
Merge branch 'rails:main' into main 2024-02-25 11:37:47 -03:00
Gannon McGibbon 61b0a68940 Handle bad URIs when filtering redirects
rails/rails#51131 introduced parameter filtering for redirects. We
didn't account for invalid URIs though, and it changes the behaviour of
redirect_to to raise URI errors when we try to filter a bad URI.
Instead, we should fallback to filtering bad URIs entirely to preserve behaviour.
2024-02-23 00:11:24 -06:00
John Hawthorn 0f870c4354 Respect raise_on_missing_ in controller
Previously raise_on_missing_translations was not being respected in a
controller. This commit brings back the correct behaviour.
2024-02-21 13:18:58 -08:00
ooooooo_q 857f2e4a6a
fix XSS vulnerability when using translation
[CVE-2024-26143]
2024-02-21 10:20:05 -08:00
Aaron Patterson a3f3c3e5d6
Fix ReDoS in accept header scanning
Thanks svalkanov for the patch!

[CVE-2024-26142]
2024-02-21 10:17:42 -08:00
Iago Pimenta 32587c3bdd
Fix inconsistent results of params.deep_transform_keys (#50361)
* Fix inconsistent results of params.deep_transform_keys

* fix: specs

* fix: implements own deep_transform methods to ActionController::Parameters

Co-authored-by: Rafael Mendonça França <rafael@rubyonrails.org>
2024-02-21 12:55:30 -05:00
Stefan Wienert e2a8bfa1f2
Request Forgery takes relative paths into account
Passing relative paths into form_for and related helpers led to invalid
token generations, as the tokens did not match the request.path on the
POST endpoint. Variants, such as:

form_for url:
* ""
* "./"
* "./post_one"
* "post_one"

are now handled according to [RFC 3986 5.2 - 5.4](https://tools.ietf.org/html/rfc3986#section-5.2)

Limitations: double dots are not handled (../../path)

relevant issue: #31191
2024-02-20 23:35:17 +00:00
Roque Pinel f4f3ef7781
Add parameter filter capability for redirect locations
It uses the `config.filter_parameters` to match what needs to be
filtered. The result would be like this:

```
Redirected to http://secret.foo.bar?username=roque&password=[FILTERED]
```
2024-02-20 11:31:12 +08:00
Nikita Vasilevsky a8d1d927e8
Do not report rendered errors except 500
In `4067c9565a5da78a72e375a2d959000147f02c34` `ActionDispatch::Executor`
started to report all errors, even the ones that were "handled" by the application.
This leads to errors like `ActionController::RoutingError` polluting error trackers
while not being actionable since they do not represent an exceptional situation.

This commit changes the behavior to only report errors that are not
considered "handled" based on the `ActionDispatch::ExceptionWrapper.rescue_responses` list.
2024-02-16 19:19:47 +00:00
Jean Boussier 50daadaa71 Update test suite for compatibility with Ruby 3.4-dev
https://bugs.ruby-lang.org/issues/19117 and https://bugs.ruby-lang.org/issues/16495
slightly change how backtrace are rendered which makes a few tests fail.
2024-02-16 11:55:44 +01:00
Eugene Kenny 53079761a5 Add autoload for ActionController::TestRequest
This constant is referenced in
actionpack/lib/action_dispatch/testing/assertions/routing.rb,
which doesn't directly depend on ActionController::TestCase.
2024-02-14 23:42:31 +00:00
Andrew Novoselac c90a8701e5
Generate a .devcontainer folder and its contents when creating a new app.
The .devcontainer folder includes everything needed to boot the app and do development in a remote container.

The container setup includes:
 - A redis container for Kredis, ActionCable etc.
 - A database (SQLite, Postgres, MySQL or MariaDB)
 - A Headless chrome container for system tests
 - Active Storage configured to use the local disk and with preview features working

If any of these options are skipped in the app setup they will not be included in the container configuration.

These files can be skipped using the `--no-devcontainer` option.

Co-authored-by: Rafael Mendonça França <rafael@franca.dev>
2024-02-14 20:59:48 +00:00
Andrew Novoselac 30506d2ef3
Devcontainers: Introduce SystemTestCase#served_by
When working in a devcontainer, for system tests we need to manually set the host and port serving the application. Let's introduce a method for this, so we don't have to expose the implementation details of Capybara to the developer.

Co-authored-by: Rafael Mendonça França <rafael@franca.dev>
2024-02-14 20:58:57 +00:00