开源软件构建与测试

_service:tar_scm:rubygem-actionpack.spec Changed

@@ -3,14 +3,26 @@
 
 Name:		rubygem-%{gem_name}
 Epoch:		1
-Version:	6.1.4.1
+Version:	7.0.4
 Release: 	2
 Summary: 	Web-flow and rendering framework putting the VC in MVC (part of Rails)
 License: 	MIT
 URL: 		http://rubyonrails.org
 Source0: 	https://rubygems.org/gems/%{gem_name}-%{version}.gem
+# ActionPack gem doesn't ship with the test suite.
+# You may check it out like so
+# git clone http://github.com/rails/rails.git
+# cd rails/actionpack && git archive -v -o actionpack-7.0.4-tests.txz v7.0.4 test/
 Source1: 	%{gem_name}-%{version}-tests.txz
+# The tools are needed for the test suite, are however unpackaged in gem file.
+# You may get them like so
+# git clone http://github.com/rails/rails.git --no-checkout
+# cd rails && git archive -v -o rails-7.0.4-tools.txz v7.0.4 tools/
 Source2: 	rails-%{version}-tools.txz
+# Fixes for Minitest 5.16+
+# https://github.com/rails/rails/pull/45370
+Patch0: rubygem-actionpack-7.0.2.3-Fix-tests-for-minitest-5.16.patch
+Patch1: CVE-2023-22797.patch
 
 # Let's keep Requires and BuildRequires sorted alphabeticaly
 BuildRequires: 	ruby(release)
@@ -30,7 +42,7 @@
 BuildRequires: 	rubygem(selenium-webdriver)
 BuildRequires: 	rubygem(rexml)
 %endif
-BuildRequires:  rubygem(did_you_mean)
+BuildRequires:  rubygem(did_you_mean) rubygem(matrix)
 BuildArch: 	noarch
 
 %description
@@ -48,6 +60,11 @@
 
 %prep
 %setup -q -n %{gem_name}-%{version}%{?prerelease} -b1 -b2
+%patch1 -p2
+
+pushd %{_builddir}
+%patch0 -p2
+popd
 
 %build
 gem build ../%{gem_name}-%{version}%{?prerelease}.gemspec
@@ -89,6 +106,12 @@
 %doc %{gem_instdir}/README.rdoc
 
 %changelog
+* Mon Feb 20 2023 jiangpeng <jiangpeng01@ncti-gba.cn> - 1:7.0.4-2
+- Fix CVE-2023-22797
+
+* Fri Jan 20 2023 wangkai <wangkai385@h-partners.com> - 1:7.0.4-1
+- Upgrade to version 7.0.4
+
 * Thu Jun 30 2022 houyingchao <houyingchao@h-partners.com> - 1:6.1.4.1-2
 - Fix compilation failed

_service:tar_scm:CVE-2023-22797.patch Added

@@ -0,0 +1,32 @@
+From e50e26d7a9f4a1e4fb5ef2538c30b2b5cc81bd92 Mon Sep 17 00:00:00 2001
+From: wonda-tea-coffee <lagrange.resolvent@gmail.com>
+Date: Mon, 5 Dec 2022 12:27:15 +0000
+Subject: PATCH Fix sec issue with _url_host_allowed?
+
+Disallow certain strings from `_url_host_allowed?` to avoid a redirect
+to malicious sites.
+
+CVE-2023-22797
+---
+ .../action_controller/metal/redirecting.rb    |  6 ++-
+ actionpack/test/controller/redirect_test.rb   | 38 +++++++++++++++++++
+ 2 files changed, 43 insertions(+), 1 deletion(-)
+
+diff --git a/actionpack/lib/action_controller/metal/redirecting.rb b/actionpack/lib/action_controller/metal/redirecting.rb
+index 721d5d3279..0ae6a48748 100644
+--- a/actionpack/lib/action_controller/metal/redirecting.rb
++++ b/actionpack/lib/action_controller/metal/redirecting.rb
+@@ -196,7 +196,11 @@ def _enforce_open_redirect_protection(location, allow_other_host:)
+ 
+       def _url_host_allowed?(url)
+         host = URI(url.to_s).host
+-        host == request.host || host.nil? && url.to_s.start_with?("/")
++
++        return true if host == request.host
++        return false unless host.nil?
++        return false unless url.to_s.start_with?("/")
++        return !url.to_s.start_with?("//")
+       rescue ArgumentError, URI::Error
+         false
+       end
+

_service:tar_scm:rubygem-actionpack-7.0.2.3-Fix-tests-for-minitest-5.16.patch Added

@@ -0,0 +1,140 @@
+From 9766eb4a833c26c64012230b96dd1157ebb8e8a2 Mon Sep 17 00:00:00 2001
+From: eileencodes <eileencodes@gmail.com>
+Date: Wed, 15 Jun 2022 12:44:11 -0400
+Subject: PATCH Fix tests for minitest 5.16
+
+In minitest/minitest@6e06ac9 minitest changed such that it now accepts
+`kwargs` instead of requiring kwargs to be shoved into the args array.
+This is a good change but required some updates to our test code to get
+the new version of minitest passing.
+
+Changes are as follows:
+
+1) Lock minitest to 5.15 for Ruby 2.7. We don't love this change but
+it's pretty difficult to get 2.7 and 3.0 to play nicely together with
+the new kwargs changes. Dropping 2.7 support isn't an option right
+now for Rails. This is safe because all of the code changes here are
+internal methods to Rails like assert_called_with. Applications
+shouldn't be consuming them as they are no-doc'd.
+2) Update the `assert_called_with` method to take any kwargs but also
+the returns kwarg.
+3) Update callers of `assert_called_with` to move the kwargs outside the
+args array.
+4) Update the message from marshaled exceptions. In 5.16 the exception
+message is "result not reported" instead of "Wrapped undumpable
+exception".
+
+Co-authored-by: Matthew Draper <matthew@trebex.net>
+---
+ .../test/controller/integration_test.rb       |  26 ++---
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/actionpack/test/controller/integration_test.rb b/actionpack/test/controller/integration_test.rb
+index 2fcd56e71a589..99f92b3c3d07c 100644
+--- a/actionpack/test/controller/integration_test.rb
++++ b/actionpack/test/controller/integration_test.rb
+@@ -36,91 +36,91 @@ def test_follow_redirect_raises_when_no_redirect
+   def test_get
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+ 
+-    assert_called_with @session, :process, :get, path, params: params, headers: headers do
++    assert_called_with @session, :process, :get, path, params: params, headers: headers do
+       @session.get(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_get_with_env_and_headers
+     path = "/index"; params = "blah"; headers = { location: "blah" }; env = { "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest" }
+-    assert_called_with @session, :process, :get, path, params: params, headers: headers, env: env do
++    assert_called_with @session, :process, :get, path, params: params, headers: headers, env: env do
+       @session.get(path, params: params, headers: headers, env: env)
+     end
+   end
+ 
+   def test_post
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :post, path, params: params, headers: headers do
++    assert_called_with @session, :process, :post, path, params: params, headers: headers do
+       @session.post(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_patch
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :patch, path, params: params, headers: headers do
++    assert_called_with @session, :process, :patch, path, params: params, headers: headers do
+       @session.patch(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_put
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :put, path, params: params, headers: headers do
++    assert_called_with @session, :process, :put, path, params: params, headers: headers do
+       @session.put(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_delete
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :delete, path, params: params, headers: headers do
++    assert_called_with @session, :process, :delete, path, params: params, headers: headers do
+       @session.delete(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_head
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :head, path, params: params, headers: headers do
++    assert_called_with @session, :process, :head, path, params: params, headers: headers do
+       @session.head(path, params: params, headers: headers)
+     end
+   end
+ 
+   def test_xml_http_request_get
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :get, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :get, path, params: params, headers: headers, xhr: true do
+       @session.get(path, params: params, headers: headers, xhr: true)
+     end
+   end
+ 
+   def test_xml_http_request_post
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :post, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :post, path, params: params, headers: headers, xhr: true do
+       @session.post(path, params: params, headers: headers, xhr: true)
+     end
+   end
+ 
+   def test_xml_http_request_patch
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :patch, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :patch, path, params: params, headers: headers, xhr: true do
+       @session.patch(path, params: params, headers: headers, xhr: true)
+     end
+   end
+ 
+   def test_xml_http_request_put
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :put, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :put, path, params: params, headers: headers, xhr: true do
+       @session.put(path, params: params, headers: headers, xhr: true)
+     end
+   end
+ 
+   def test_xml_http_request_delete
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :delete, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :delete, path, params: params, headers: headers, xhr: true do
+       @session.delete(path, params: params, headers: headers, xhr: true)
+     end
+   end
+ 
+   def test_xml_http_request_head
+     path = "/index"; params = "blah"; headers = { location: "blah" }
+-    assert_called_with @session, :process, :head, path, params: params, headers: headers, xhr: true do
++    assert_called_with @session, :process, :head, path, params: params, headers: headers, xhr: true do
+       @session.head(path, params: params, headers: headers, xhr: true)
+     end
+   end

_service Changed

_service:tar_scm:actionpack-6.1.4.1-tests.txz Deleted

_service:tar_scm:actionpack-7.0.4-tests.txz Added

_service:tar_scm:actionpack-6.1.4.1.gem/checksums.yaml.gz -> _service:tar_scm:actionpack-7.0.4.gem/checksums.yaml.gz Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/CHANGELOG.md -> _service:tar_scm:actionpack-7.0.4.gem/data/CHANGELOG.md Changed

@@ -1,528 +1,481 @@
-## Rails 6.1.4.1 (August 19, 2021) ##
+## Rails 7.0.4 (September 09, 2022) ##
 
-*   CVE-2021-22942 Fix possible open redirect in Host Authorization middleware.
+*   Prevent `ActionDispatch::ServerTiming` from overwriting existing values in `Server-Timing`.
 
-    Specially crafted "X-Forwarded-Host" headers in combination with certain
-    "allowed host" formats can cause the Host Authorization middleware in Action
-    Pack to redirect users to a malicious website.
+    Previously, if another middleware down the chain set `Server-Timing` header,
+    it would overwritten by `ActionDispatch::ServerTiming`.
 
-## Rails 6.1.4 (June 24, 2021) ##
+    *Jakub Malinowski*
 
-*   Ignore file fixtures on `db:fixtures:load`
 
-    *Kevin Sjöberg*
+## Rails 7.0.3.1 (July 12, 2022) ##
 
-*   Fix ActionController::Live controller test deadlocks by removing the body buffer size limit for tests.
+*   No changes.
 
-    *Dylan Thacker-Smith*
 
-*   Correctly place optional path parameter booleans.
+## Rails 7.0.3 (May 09, 2022) ##
 
-    Previously, if you specify a url parameter that is part of the path as false it would include that part
-    of the path as parameter for example:
+*   Allow relative redirects when `raise_on_open_redirects` is enabled.
 
-    ```
-    get "(/optional/:optional_id)/things" => "foo#foo", as: :things
-    things_path(optional_id: false) # => /things?optional_id=false
-    ```
+    *Tom Hughes*
 
-    After this change, true and false will be treated the same when used as optional path parameters. Meaning now:
+*   Fix `authenticate_with_http_basic` to allow for missing password.
 
-    ```
-    get '(this/:my_bool)/that' as: :that
+    Before Rails 7.0 it was possible to handle basic authentication with only a username.
 
-    that_path(my_bool: true) # => `/this/true/that`
-    that_path(my_bool: false) # => `/this/false/that`
+    ```ruby
+    authenticate_with_http_basic do |token, _|
+      ApiClient.authenticate(token)
+    end
     ```
 
-    *Adam Hess*
+    This ability is restored.
 
-*   Add support for 'private, no-store' Cache-Control headers.
+    *Jean Boussier*
 
-    Previously, 'no-store' was exclusive; no other directives could be specified.
+*   Fix `content_security_policy` returning invalid directives.
 
-    *Alex Smith*
+    Directives such as `self`, `unsafe-eval` and few others were not
+    single quoted when the directive was the result of calling a lambda
+    returning an array.
 
+    ```ruby
+    content_security_policy do |policy|
+      policy.frame_ancestors lambda { :self, "https://example.com" }
+    end
+    ```
 
-## Rails 6.1.3.2 (May 05, 2021) ##
+    With this fix the policy generated from above will now be valid.
 
-*   Prevent open redirects by correctly escaping the host allow list
-    CVE-2021-22903
+    *Edouard Chin*
 
-*   Prevent catastrophic backtracking during mime parsing
-    CVE-2021-22902
+*   Fix `skip_forgery_protection` to run without raising an error if forgery
+    protection has not been enabled / `verify_authenticity_token` is not a
+    defined callback.
 
-*   Prevent regex DoS in HTTP token authentication
-    CVE-2021-22904
+    This fix prevents the Rails 7.0 Welcome Page (`/`) from raising an
+    `ArgumentError` if `default_protect_from_forgery` is false.
 
-*   Prevent string polymorphic route arguments.
+    *Brad Trick*
 
-    `url_for` supports building polymorphic URLs via an array
-    of arguments (usually symbols and records). If a developer passes a
-    user input array, strings can result in unwanted route helper calls.
+*   Fix `ActionController::Live` to copy the IsolatedExecutionState in the ephemeral thread.
 
-    CVE-2021-22885
+    Since its inception `ActionController::Live` has been copying thread local variables
+    to keep things such as `CurrentAttributes` set from middlewares working in the controller action.
 
-    *Gannon McGibbon*
+    With the introduction of `IsolatedExecutionState` in 7.0, some of that global state was lost in
+    `ActionController::Live` controllers.
 
-## Rails 6.1.3.1 (March 26, 2021) ##
+    *Jean Boussier*
 
-*   No changes.
+*   Fix setting `trailing_slash: true` in route definition.
 
+    ```ruby
+    get '/test' => "test#index", as: :test, trailing_slash: true
 
-## Rails 6.1.3 (February 17, 2021) ##
+    test_path() # => "/test/"
+    ```
 
-*   Re-define routes when not set correctly via inheritance.
+    *Jean Boussier*
 
-    *John Hawthorn*
+## Rails 7.0.2.4 (April 26, 2022) ##
 
+*   Allow Content Security Policy DSL to generate for API responses.
 
-## Rails 6.1.2.1 (February 10, 2021) ##
+    *Tim Wade*
 
-*   Prevent open redirect when allowed host starts with a dot
+## Rails 7.0.2.3 (March 08, 2022) ##
 
-    CVE-2021-22881
+*   No changes.
 
-    Thanks to @tktech (https://hackerone.com/tktech) for reporting this
-    issue and the patch!
 
-    *Aaron Patterson*
+## Rails 7.0.2.2 (February 11, 2022) ##
 
+*   No changes.
 
-## Rails 6.1.2 (February 09, 2021) ##
 
-*   Fix error in `ActionController::LogSubscriber` that would happen when throwing inside a controller action.
+## Rails 7.0.2.1 (February 11, 2022) ##
 
-    *Janko Marohnić*
+*   Under certain circumstances, the middleware isn't informed that the
+    response body has been fully closed which result in request state not
+    being fully reset before the next request
 
-*   Fix `fixture_file_upload` deprecation when `file_fixture_path` is a relative path.
+    CVE-2022-23633
 
-    *Eugene Kenny*
 
+## Rails 7.0.2 (February 08, 2022) ##
 
-## Rails 6.1.1 (January 07, 2021) ##
+*   No changes.
 
-*   Fix nil translation key lookup in controllers/
 
-    *Jan Klimo*
+## Rails 7.0.1 (January 06, 2022) ##
 
-*   Quietly handle unknown HTTP methods in Action Dispatch SSL middleware.
+*   Fix `ActionController::Parameters` methods to keep the original logger context when creating a new copy
+    of the original object.
 
-    *Alex Robbin*
+    *Yutaka Kamei*
 
-*   Change the request method to a `GET` when passing failed requests down to `config.exceptions_app`.
 
-    *Alex Robbin*
+## Rails 7.0.0 (December 15, 2021) ##
 
+*   Deprecate `Rails.application.config.action_controller.urlsafe_csrf_tokens`. This config is now always enabled.
 
-## Rails 6.1.0 (December 09, 2020) ##
+    *Étienne Barrié*
 
-*   Support for the HTTP header `Feature-Policy` has been revised to reflect
-    its rename(https://github.com/w3c/webappsec-permissions-policy/pull/379) to `Permissions-Policy`(https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-http-header-field).
+*   Instance variables set in requests in a `ActionController::TestCase` are now cleared before the next request
 
-    ```ruby
-    Rails.application.config.permissions_policy do |p|
-      p.camera     :none
-      p.gyroscope  :none
-      p.microphone :none
-      p.usb        :none
-      p.fullscreen :self
-      p.payment    :self, "https://secure-example.com"

_service:tar_scm:actionpack-6.1.4.1.gem/data/MIT-LICENSE -> _service:tar_scm:actionpack-7.0.4.gem/data/MIT-LICENSE Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/README.rdoc -> _service:tar_scm:actionpack-7.0.4.gem/data/README.rdoc Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/asset_paths.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/asset_paths.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/base.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/base.rb Changed

@@ -9,35 +9,21 @@
 module AbstractController
   # Raised when a non-existing controller action is triggered.
   class ActionNotFound < StandardError
-    attr_reader :controller, :action
-    def initialize(message = nil, controller = nil, action = nil)
+    attr_reader :controller, :action # :nodoc:
+
+    def initialize(message = nil, controller = nil, action = nil) # :nodoc:
       @controller = controller
       @action = action
       super(message)
     end
 
-    class Correction
-      def initialize(error)
-        @error = error
-      end
-
-      def corrections
-        if @error.action
-          maybe_these = @error.controller.class.action_methods
+    if defined?(DidYouMean::Correctable) && defined?(DidYouMean::SpellChecker)
+      include DidYouMean::Correctable # :nodoc:
 
-          maybe_these.sort_by { |n|
-            DidYouMean::Jaro.distance(@error.action.to_s, n)
-          }.reverse.first(4)
-        else
-          
-        end
+      def corrections # :nodoc:
+        @corrections ||= DidYouMean::SpellChecker.new(dictionary: controller.class.action_methods).correct(action)
       end
     end
-
-    # We may not have DYM, and DYM might not let us register error handlers
-    if defined?(DidYouMean) && DidYouMean.respond_to?(:correct_error)
-      DidYouMean.correct_error(self, Correction)
-    end
   end
 
   # AbstractController::Base is a low-level API. Nobody should be
@@ -164,13 +150,14 @@
 
       process_action(action_name, *args)
     end
+    ruby2_keywords(:process)
 
-    # Delegates to the class' ::controller_path
+    # Delegates to the class's ::controller_path.
     def controller_path
       self.class.controller_path
     end
 
-    # Delegates to the class' ::action_methods
+    # Delegates to the class's ::action_methods.
     def action_methods
       self.class.action_methods
     end
@@ -191,7 +178,7 @@
 
     # Tests if a response body is set. Used to determine if the
     # +process_action+ callback needs to be terminated in
-    # +AbstractController::Callbacks+.
+    # AbstractController::Callbacks.
     def performed?
       response_body
     end
@@ -224,8 +211,8 @@
       #
       # Notice that the first argument is the method to be dispatched
       # which is *not* necessarily the same as the action name.
-      def process_action(method_name, *args)
-        send_action(method_name, *args)
+      def process_action(...)
+        send_action(...)
       end
 
       # Actually call the method associated with the action. Override

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/caching.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/caching.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/caching/fragments.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/caching/fragments.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/callbacks.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/callbacks.rb Changed

@@ -35,12 +35,18 @@
                        skip_after_callbacks_if_terminated: true
     end
 
-    # Override <tt>AbstractController::Base#process_action</tt> to run the
-    # <tt>process_action</tt> callbacks around the normal behavior.
-    def process_action(*)
-      run_callbacks(:process_action) do
-        super
+    class ActionFilter # :nodoc:
+      def initialize(actions)
+        @actions = Array(actions).map(&:to_s).to_set
       end
+
+      def match?(controller)
+        @actions.include?(controller.action_name)
+      end
+
+      alias after  match?
+      alias before match?
+      alias around match?
     end
 
     module ClassMethods
@@ -70,8 +76,7 @@
 
       def _normalize_callback_option(options, from, to) # :nodoc:
         if from = options.delete(from)
-          _from = Array(from).map(&:to_s).to_set
-          from = proc { |c| _from.include? c.action_name }
+          from = ActionFilter.new(from)
           optionsto = Array(optionsto).unshift(from)
         end
       end
@@ -220,5 +225,14 @@
         alias_method :"append_#{callback}_action", :"#{callback}_action"
       end
     end
+
+    private
+      # Override <tt>AbstractController::Base#process_action</tt> to run the
+      # <tt>process_action</tt> callbacks around the normal behavior.
+      def process_action(...)
+        run_callbacks(:process_action) do
+          super
+        end
+      end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/collector.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/collector.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/error.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/error.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/helpers.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/helpers.rb Changed

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "active_support/dependencies"
+require "active_support/core_ext/name_error"
 
 module AbstractController
   module Helpers
@@ -83,11 +84,11 @@
         file, line = location.path, location.lineno
 
         methods.each do |method|
-          _helpers_for_modification.class_eval <<-ruby_eval, file, line
+          _helpers_for_modification.class_eval <<~ruby_eval, file, line
             def #{method}(*args, &block)                    # def current_user(*args, &block)
               controller.send(:'#{method}', *args, &block)  #   controller.send(:'current_user', *args, &block)
             end                                             # end
-            ruby2_keywords(:'#{method}') if respond_to?(:ruby2_keywords, true)
+            ruby2_keywords(:'#{method}')
           ruby_eval
         end
       end
@@ -109,7 +110,7 @@
       # The last two assume that <tt>"foo".camelize</tt> returns "Foo".
       #
       # When strings or symbols are passed, the method finds the actual module
-      # object using +String#constantize+. Therefore, if the module has not been
+      # object using String#constantize. Therefore, if the module has not been
       # yet loaded, it has to be autoloadable, which is normally the case.
       #
       # Namespaces are supported. The following calls include +Foo::BarHelper+:

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/logger.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/logger.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/railties/routes_helpers.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/railties/routes_helpers.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/translation.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/translation.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/abstract_controller/url_for.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/abstract_controller/url_for.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/api.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/api.rb Changed

@@ -5,7 +5,7 @@
 require "action_controller/log_subscriber"
 
 module ActionController
-  # API Controller is a lightweight version of <tt>ActionController::Base</tt>,
+  # API Controller is a lightweight version of ActionController::Base,
   # created for applications that don't require all functionalities that a complete
   # \Rails controller provides, allowing you to create controllers with just the
   # features that you need for API only applications.
@@ -32,12 +32,12 @@
   #   end
   #
   # Request, response, and parameters objects all work the exact same way as
-  # <tt>ActionController::Base</tt>.
+  # ActionController::Base.
   #
   # == Renders
   #
   # The default API Controller stack includes all renderers, which means you
-  # can use <tt>render :json</tt> and brothers freely in your controllers. Keep
+  # can use <tt>render :json</tt> and siblings freely in your controllers. Keep
   # in mind that templates are not going to be rendered, so you need to ensure
   # your controller is calling either <tt>render</tt> or <tt>redirect_to</tt> in
   # all actions, otherwise it will return 204 No Content.
@@ -51,7 +51,7 @@
   #
   # Redirects are used to move from one action to another. You can use the
   # <tt>redirect_to</tt> method in your controllers in the same way as in
-  # <tt>ActionController::Base</tt>. For example:
+  # ActionController::Base. For example:
   #
   #   def create
   #     redirect_to root_url and return if not_authorized?
@@ -61,7 +61,7 @@
   # == Adding New Behavior
   #
   # In some scenarios you may want to add back some functionality provided by
-  # <tt>ActionController::Base</tt> that is not present by default in
+  # ActionController::Base that is not present by default in
   # <tt>ActionController::API</tt>, for instance <tt>MimeResponds</tt>. This
   # module gives you the <tt>respond_to</tt> method. Adding it is quite simple,
   # you just need to include the module in a specific controller or in
@@ -83,7 +83,7 @@
   #     end
   #   end
   #
-  # Make sure to check the modules included in <tt>ActionController::Base</tt>
+  # Make sure to check the modules included in ActionController::Base
   # if you want to use any other functionality that is not provided
   # by <tt>ActionController::API</tt> out of the box.
   class API < Metal

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/base.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/base.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/form_builder.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/form_builder.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/log_subscriber.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/log_subscriber.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal.rb Changed

@@ -2,8 +2,6 @@
 
 require "active_support/core_ext/array/extract_options"
 require "action_dispatch/middleware/stack"
-require "action_dispatch/http/request"
-require "action_dispatch/http/response"
 
 module ActionController
   # Extend ActionDispatch middleware stack to make it aware of options
@@ -13,8 +11,8 @@
   #     use AuthenticationMiddleware, except: :index, :show
   #   end
   #
-  class MiddlewareStack < ActionDispatch::MiddlewareStack #:nodoc:
-    class Middleware < ActionDispatch::MiddlewareStack::Middleware #:nodoc:
+  class MiddlewareStack < ActionDispatch::MiddlewareStack # :nodoc:
+    class Middleware < ActionDispatch::MiddlewareStack::Middleware # :nodoc:
       def initialize(klass, args, actions, strategy, block)
         @actions = actions
         @strategy = strategy
@@ -62,7 +60,7 @@
 
   # <tt>ActionController::Metal</tt> is the simplest possible controller, providing a
   # valid Rack interface without the additional niceties provided by
-  # <tt>ActionController::Base</tt>.
+  # ActionController::Base.
   #
   # A sample metal controller might look like this:
   #
@@ -113,7 +111,7 @@
   #
   # == Other Helpers
   #
-  # You can refer to the modules included in <tt>ActionController::Base</tt> to see
+  # You can refer to the modules included in ActionController::Base to see
   # other features you can bring into your metal controller.
   #
   class Metal < AbstractController::Base
@@ -139,7 +137,7 @@
       false
     end
 
-    # Delegates to the class' <tt>controller_name</tt>.
+    # Delegates to the class's ::controller_name.
     def controller_name
       self.class.controller_name
     end
@@ -184,7 +182,7 @@
       response_body || response.committed?
     end
 
-    def dispatch(name, request, response) #:nodoc:
+    def dispatch(name, request, response) # :nodoc:
       set_request!(request)
       set_response!(response)
       process(name)
@@ -196,12 +194,12 @@
       @_response = response
     end
 
-    def set_request!(request) #:nodoc:
+    def set_request!(request) # :nodoc:
       @_request = request
       @_request.controller_instance = self
     end
 
-    def to_a #:nodoc:
+    def to_a # :nodoc:
       response.to_a
     end
 
@@ -219,10 +217,9 @@
     class << self
       # Pushes the given Rack middleware and its arguments to the bottom of the
       # middleware stack.
-      def use(*args, &block)
-        middleware_stack.use(*args, &block)
+      def use(...)
+        middleware_stack.use(...)
       end
-      ruby2_keywords(:use) if respond_to?(:ruby2_keywords, true)
     end
 
     # Alias for +middleware_stack+.

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/conditional_get.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/conditional_get.rb Changed

@@ -57,6 +57,8 @@
     #   304 Not Modified response if last_modified <= If-Modified-Since.
     # * <tt>:public</tt> By default the Cache-Control header is private, set this to
     #   +true+ if you want your application to be cacheable by other devices (proxy caches).
+    # * <tt>:cache_control</tt> When given will overwrite an existing Cache-Control header.
+    #   See https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html for more possibilities.
     # * <tt>:template</tt> By default, the template digest for the current
     #   controller/action is included in ETags. If the action renders a
     #   different template, you can include its digest instead. If the action
@@ -98,12 +100,22 @@
     #     fresh_when(@article, public: true)
     #   end
     #
+    # When overwriting Cache-Control header:
+    #
+    #   def show
+    #     @article = Article.find(params:id)
+    #     fresh_when(@article, public: true, cache_control: { no_cache: true })
+    #   end
+    #
+    # This will set in the response Cache-Control = public, no-cache.
+    #
     # When rendering a different template than the default controller/action
     # style, you can indicate which digest to include in the ETag:
     #
     #   before_action { fresh_when @article, template: 'widgets/show' }
     #
-    def fresh_when(object = nil, etag: nil, weak_etag: nil, strong_etag: nil, last_modified: nil, public: false, template: nil)
+    def fresh_when(object = nil, etag: nil, weak_etag: nil, strong_etag: nil, last_modified: nil, public: false, cache_control: {}, template: nil)
+      response.cache_control.delete(:no_store)
       weak_etag ||= etag || object unless strong_etag
       last_modified ||= object.try(:updated_at) || object.try(:maximum, :updated_at)
 
@@ -117,6 +129,7 @@
 
       response.last_modified = last_modified if last_modified
       response.cache_control:public = true if public
+      response.cache_control.merge!(cache_control)
 
       head :not_modified if request.fresh?(response)
     end
@@ -147,6 +160,8 @@
     #   304 Not Modified response if last_modified <= If-Modified-Since.
     # * <tt>:public</tt> By default the Cache-Control header is private, set this to
     #   +true+ if you want your application to be cacheable by other devices (proxy caches).
+    # * <tt>:cache_control</tt> When given will overwrite an existing Cache-Control header.
+    #   See https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html for more possibilities.
     # * <tt>:template</tt> By default, the template digest for the current
     #   controller/action is included in ETags. If the action renders a
     #   different template, you can include its digest instead. If the action
@@ -209,6 +224,21 @@
     #     end
     #   end
     #
+    # When overwriting Cache-Control header:
+    #
+    #   def show
+    #     @article = Article.find(params:id)
+    #
+    #     if stale?(@article, public: true, cache_control: { no_cache: true })
+    #       @statistics = @articles.really_expensive_call
+    #       respond_to do |format|
+    #         # all the supported formats
+    #       end
+    #     end
+    #   end
+    #
+    # This will set in the response Cache-Control = public, no-cache.
+    #
     # When rendering a different template than the default controller/action
     # style, you can indicate which digest to include in the ETag:
     #
@@ -238,12 +268,13 @@
     #   expires_in 3.hours, public: true, stale_while_revalidate: 60.seconds, stale_if_error: 5.minutes
     #
     # HTTP Cache-Control Extensions other values: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
-    # Any additional key-value pairs are concatenated onto the `Cache-Control` header in the response:
+    # Any additional key-value pairs are concatenated onto the Cache-Control header in the response:
     #
     #   expires_in 3.hours, public: true, "s-maxage": 3.hours, "no-transform": true
     #
     # The method will also ensure an HTTP Date header for client compatibility.
     def expires_in(seconds, options = {})
+      response.cache_control.delete(:no_store)
       response.cache_control.merge!(
         max_age: seconds,
         public: options.delete(:public),
@@ -280,6 +311,12 @@
                       public: public)
     end
 
+    # Sets an HTTP 1.1 Cache-Control header of <tt>no-store</tt>. This means the
+    # resource may not be stored in any cache.
+    def no_store
+      response.cache_control.replace(no_store: true)
+    end
+
     private
       def combine_etags(validator, options)
         validator, *etaggers.map { |etagger| instance_exec(options, &etagger) }.compact

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/content_security_policy.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/content_security_policy.rb Changed

@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
-module ActionController #:nodoc:
+module ActionController # :nodoc:
   module ContentSecurityPolicy
-    # TODO: Documentation
     extend ActiveSupport::Concern
 
     include AbstractController::Helpers
@@ -14,6 +13,29 @@
     end
 
     module ClassMethods
+      # Overrides parts of the globally configured Content-Security-Policy
+      # header:
+      #
+      #   class PostsController < ApplicationController
+      #     content_security_policy do |policy|
+      #       policy.base_uri "https://www.example.com"
+      #     end
+      #   end
+      #
+      # Options can be passed similar to +before_action+. For example, pass
+      # <tt>only: :index</tt> to override the header on the index action only:
+      #
+      #   class PostsController < ApplicationController
+      #     content_security_policy(only: :index) do |policy|
+      #       policy.default_src :self, :https
+      #     end
+      #   end
+      #
+      # Pass +false+ to remove the Content-Security-Policy header:
+      #
+      #   class PostsController < ApplicationController
+      #     content_security_policy false, only: :index
+      #   end
       def content_security_policy(enabled = true, **options, &block)
         before_action(options) do
           if block_given?
@@ -28,6 +50,18 @@
         end
       end
 
+      # Overrides the globally configured Content-Security-Policy-Report-Only
+      # header:
+      #
+      #   class PostsController < ApplicationController
+      #     content_security_policy_report_only only: :index
+      #   end
+      #
+      # Pass +false+ to remove the Content-Security-Policy-Report-Only header:
+      #
+      #   class PostsController < ApplicationController
+      #     content_security_policy_report_only false, only: :index
+      #   end
       def content_security_policy_report_only(report_only = true, **options)
         before_action(options) do
           request.content_security_policy_report_only = report_only

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/cookies.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/cookies.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/data_streaming.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/data_streaming.rb Changed

@@ -3,7 +3,7 @@
 require "action_controller/metal/exceptions"
 require "action_dispatch/http/content_disposition"
 
-module ActionController #:nodoc:
+module ActionController # :nodoc:
   # Methods for sending arbitrary data and for streaming files to the browser,
   # instead of rendering.
   module DataStreaming
@@ -11,8 +11,8 @@
 
     include ActionController::Rendering
 
-    DEFAULT_SEND_FILE_TYPE        = "application/octet-stream" #:nodoc:
-    DEFAULT_SEND_FILE_DISPOSITION = "attachment" #:nodoc:
+    DEFAULT_SEND_FILE_TYPE        = "application/octet-stream" # :nodoc:
+    DEFAULT_SEND_FILE_DISPOSITION = "attachment" # :nodoc:
 
     private
       # Sends the file. This uses a server-appropriate method (such as X-Sendfile)
@@ -66,7 +66,7 @@
       # https://www.mnot.net/cache_docs/ for an overview of web caching and
       # https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9
       # for the Cache-Control header spec.
-      def send_file(path, options = {}) #:doc:
+      def send_file(path, options = {}) # :doc:
         raise MissingFile, "Cannot read file #{path}" unless File.file?(path) && File.readable?(path)
 
         options:filename ||= File.basename(path) unless options:url_based_filename
@@ -106,7 +106,7 @@
       #   send_data image.data, type: image.content_type, disposition: 'inline'
       #
       # See +send_file+ for more information on HTTP Content-* headers and caching.
-      def send_data(data, options = {}) #:doc:
+      def send_data(data, options = {}) # :doc:
         send_file_headers! options
         render options.slice(:status, :content_type).merge(body: data)
       end
@@ -138,14 +138,6 @@
         end
 
         headers"Content-Transfer-Encoding" = "binary"
-
-        # Fix a problem with IE 6.0 on opening downloaded files:
-        # If Cache-Control: no-cache is set (which Rails does by default),
-        # IE removes the file it just downloaded from its cache immediately
-        # after it displays the "open/save" dialog, which means that if you
-        # hit "open" the file isn't there anymore when the application that
-        # is called for handling the download is run, so let's workaround that
-        response.cache_control:public ||= false
       end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/exceptions.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/exceptions.rb Changed

@@ -1,20 +1,20 @@
 # frozen_string_literal: true
 
 module ActionController
-  class ActionControllerError < StandardError #:nodoc:
+  class ActionControllerError < StandardError # :nodoc:
   end
 
-  class BadRequest < ActionControllerError #:nodoc:
+  class BadRequest < ActionControllerError # :nodoc:
     def initialize(msg = nil)
       super(msg)
       set_backtrace $!.backtrace if $!
     end
   end
 
-  class RenderError < ActionControllerError #:nodoc:
+  class RenderError < ActionControllerError # :nodoc:
   end
 
-  class RoutingError < ActionControllerError #:nodoc:
+  class RoutingError < ActionControllerError # :nodoc:
     attr_reader :failures
     def initialize(message, failures = )
       super(message)
@@ -22,7 +22,7 @@
     end
   end
 
-  class UrlGenerationError < ActionControllerError #:nodoc:
+  class UrlGenerationError < ActionControllerError # :nodoc:
     attr_reader :routes, :route_name, :method_name
 
     def initialize(message, routes = nil, route_name = nil, method_name = nil)
@@ -33,44 +33,33 @@
       super(message)
     end
 
-    class Correction
-      def initialize(error)
-        @error = error
-      end
+    if defined?(DidYouMean::Correctable) && defined?(DidYouMean::SpellChecker)
+      include DidYouMean::Correctable
 
       def corrections
-        if @error.method_name
-          maybe_these = @error.routes.named_routes.helper_names.grep(/#{@error.route_name}/)
-          maybe_these -= @error.method_name.to_s # remove exact match
-
-          maybe_these.sort_by { |n|
-            DidYouMean::Jaro.distance(@error.route_name, n)
-          }.reverse.first(4)
-        else
-          
+        @corrections ||= begin
+          maybe_these = routes&.named_routes&.helper_names&.grep(/#{route_name}/) || 
+          maybe_these -= method_name.to_s # remove exact match
+
+          DidYouMean::SpellChecker.new(dictionary: maybe_these).correct(route_name)
         end
       end
     end
-
-    # We may not have DYM, and DYM might not let us register error handlers
-    if defined?(DidYouMean) && DidYouMean.respond_to?(:correct_error)
-      DidYouMean.correct_error(self, Correction)
-    end
   end
 
-  class MethodNotAllowed < ActionControllerError #:nodoc:
+  class MethodNotAllowed < ActionControllerError # :nodoc:
     def initialize(*allowed_methods)
       super("Only #{allowed_methods.to_sentence} requests are allowed.")
     end
   end
 
-  class NotImplemented < MethodNotAllowed #:nodoc:
+  class NotImplemented < MethodNotAllowed # :nodoc:
   end
 
-  class MissingFile < ActionControllerError #:nodoc:
+  class MissingFile < ActionControllerError # :nodoc:
   end
 
-  class SessionOverflowError < ActionControllerError #:nodoc:
+  class SessionOverflowError < ActionControllerError # :nodoc:
     DEFAULT_MESSAGE = "Your session data is larger than the data column in which it is to be stored. You must increase the size of your data column if you intend to store large data."
 
     def initialize(message = nil)
@@ -78,10 +67,10 @@
     end
   end
 
-  class UnknownHttpMethod < ActionControllerError #:nodoc:
+  class UnknownHttpMethod < ActionControllerError # :nodoc:
   end
 
-  class UnknownFormat < ActionControllerError #:nodoc:
+  class UnknownFormat < ActionControllerError # :nodoc:
   end
 
   # Raised when a nested respond_to is triggered and the content types of each
@@ -102,6 +91,6 @@
     end
   end
 
-  class MissingExactTemplate < UnknownFormat #:nodoc:
+  class MissingExactTemplate < UnknownFormat # :nodoc:
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/flash.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/flash.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/helpers.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/helpers.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/http_authentication.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/http_authentication.rb Changed

@@ -2,11 +2,12 @@
 
 require "base64"
 require "active_support/security_utils"
+require "active_support/core_ext/array/access"
 
 module ActionController
-  # Makes it dead easy to do HTTP Basic, Digest and Token authentication.
+  # HTTP Basic, Digest, and Token authentication.
   module HttpAuthentication
-    # Makes it dead easy to do HTTP \Basic authentication.
+    # = HTTP \Basic authentication
     #
     # === Simple \Basic example
     #
@@ -24,8 +25,8 @@
     #
     # === Advanced \Basic example
     #
-    # Here is a more advanced \Basic example where only Atom feeds and the XML API is protected by HTTP authentication,
-    # the regular HTML interface is protected by a session approach:
+    # Here is a more advanced \Basic example where only Atom feeds and the XML API are protected by HTTP authentication.
+    # The regular HTML interface is protected by a session approach:
     #
     #   class ApplicationController < ActionController::Base
     #     before_action :set_account, :authenticate
@@ -69,7 +70,12 @@
         extend ActiveSupport::Concern
 
         module ClassMethods
+          # Enables HTTP \Basic authentication.
+          #
+          # See ActionController::HttpAuthentication::Basic for example usage.
           def http_basic_authenticate_with(name:, password:, realm: nil, **options)
+            raise ArgumentError, "Expected name: to be a String, got #{name.class}" unless name.is_a?(String)
+            raise ArgumentError, "Expected password: to be a String, got #{password.class}" unless password.is_a?(String)
             before_action(options) { http_basic_authenticate_or_request_with name: name, password: password, realm: realm }
           end
         end
@@ -78,8 +84,8 @@
           authenticate_or_request_with_http_basic(realm, message) do |given_name, given_password|
             # This comparison uses & so that it doesn't short circuit and
             # uses `secure_compare` so that length information isn't leaked.
-            ActiveSupport::SecurityUtils.secure_compare(given_name, name) &
-              ActiveSupport::SecurityUtils.secure_compare(given_password, password)
+            ActiveSupport::SecurityUtils.secure_compare(given_name.to_s, name) &
+              ActiveSupport::SecurityUtils.secure_compare(given_password.to_s, password)
           end
         end
 
@@ -134,15 +140,15 @@
       end
     end
 
-    # Makes it dead easy to do HTTP \Digest authentication.
+    # = HTTP \Digest authentication
     #
     # === Simple \Digest example
     #
-    #   require "digest/md5"
+    #   require "openssl"
     #   class PostsController < ApplicationController
     #     REALM = "SuperSecret"
     #     USERS = {"dhh" => "secret", #plain text password
-    #              "dap" => Digest::MD5.hexdigest("dap",REALM,"secret".join(":"))}  #ha1 digest password
+    #              "dap" => OpenSSL::Digest::MD5.hexdigest("dap",REALM,"secret".join(":"))}  #ha1 digest password
     #
     #     before_action :authenticate, except: :index
     #
@@ -180,22 +186,28 @@
       extend self
 
       module ControllerMethods
+        # Authenticate using an HTTP \Digest, or otherwise render an HTTP header
+        # requesting the client to send a \Digest.
+        #
+        # See ActionController::HttpAuthentication::Digest for example usage.
         def authenticate_or_request_with_http_digest(realm = "Application", message = nil, &password_procedure)
           authenticate_with_http_digest(realm, &password_procedure) || request_http_digest_authentication(realm, message)
         end
 
-        # Authenticate with HTTP Digest, returns true or false
+        # Authenticate using an HTTP \Digest. Returns true if authentication is
+        # successful, false otherwise.
         def authenticate_with_http_digest(realm = "Application", &password_procedure)
           HttpAuthentication::Digest.authenticate(request, realm, &password_procedure)
         end
 
-        # Render output including the HTTP Digest authentication header
+        # Render an HTTP header requesting the client to send a \Digest for
+        # authentication.
         def request_http_digest_authentication(realm = "Application", message = nil)
           HttpAuthentication::Digest.authentication_request(self, realm, message)
         end
       end
 
-      # Returns false on a valid response, true otherwise
+      # Returns false on a valid response, true otherwise.
       def authenticate(request, realm, &password_procedure)
         request.authorization && validate_digest_response(request, realm, &password_procedure)
       end
@@ -230,12 +242,12 @@
       # of a plain-text password.
       def expected_response(http_method, uri, credentials, password, password_is_ha1 = true)
         ha1 = password_is_ha1 ? password : ha1(credentials, password)
-        ha2 = ::Digest::MD5.hexdigest(http_method.to_s.upcase, uri.join(":"))
-        ::Digest::MD5.hexdigest(ha1, credentials:nonce, credentials:nc, credentials:cnonce, credentials:qop, ha2.join(":"))
+        ha2 = OpenSSL::Digest::MD5.hexdigest(http_method.to_s.upcase, uri.join(":"))
+        OpenSSL::Digest::MD5.hexdigest(ha1, credentials:nonce, credentials:nc, credentials:cnonce, credentials:qop, ha2.join(":"))
       end
 
       def ha1(credentials, password)
-        ::Digest::MD5.hexdigest(credentials:username, credentials:realm, password.join(":"))
+        OpenSSL::Digest::MD5.hexdigest(credentials:username, credentials:realm, password.join(":"))
       end
 
       def encode_credentials(http_method, credentials, password, password_is_ha1)
@@ -300,7 +312,7 @@
       #
       # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
       # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
-      # POST, PUT, or PATCH requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
+      # POST, PUT, or PATCH requests, and a time-stamp for GET requests. For more details on the issues involved see Section 4
       # of this document.
       #
       # The nonce is opaque to the client. Composed of Time, and hash of Time with secret
@@ -309,7 +321,7 @@
       def nonce(secret_key, time = Time.now)
         t = time.to_i
         hashed = t, secret_key
-        digest = ::Digest::MD5.hexdigest(hashed.join(":"))
+        digest = OpenSSL::Digest::MD5.hexdigest(hashed.join(":"))
         ::Base64.strict_encode64("#{t}:#{digest}")
       end
 
@@ -326,13 +338,13 @@
 
       # Opaque based on digest of secret key
       def opaque(secret_key)
-        ::Digest::MD5.hexdigest(secret_key)
+        OpenSSL::Digest::MD5.hexdigest(secret_key)
       end
     end
 
-    # Makes it dead easy to do HTTP Token authentication.
+    # = HTTP \Token authentication
     #
-    # Simple Token example:
+    # === Simple \Token example
     #
     #   class PostsController < ApplicationController
     #     TOKEN = "secret"
@@ -358,8 +370,8 @@
     #   end
     #
     #
-    # Here is a more advanced Token example where only Atom feeds and the XML API is protected by HTTP token authentication,
-    # the regular HTML interface is protected by a session approach:
+    # Here is a more advanced Token example where only Atom feeds and the XML API are protected by HTTP token authentication.
+    # The regular HTML interface is protected by a session approach:
     #
     #   class ApplicationController < ActionController::Base
     #     before_action :set_account, :authenticate
@@ -411,14 +423,22 @@
       extend self
 
       module ControllerMethods
+        # Authenticate using an HTTP Bearer token, or otherwise render an HTTP
+        # header requesting the client to send a Bearer token.
+        #
+        # See ActionController::HttpAuthentication::Token for example usage.
         def authenticate_or_request_with_http_token(realm = "Application", message = nil, &login_procedure)
           authenticate_with_http_token(&login_procedure) || request_http_token_authentication(realm, message)
         end
 
+        # Authenticate using an HTTP Bearer token. Returns true if
+        # authentication is successful, false otherwise.
         def authenticate_with_http_token(&login_procedure)
           Token.authenticate(self, &login_procedure)
         end
 
+        # Render an HTTP header requesting the client to send a Bearer token for
+        # authentication.
         def request_http_token_authentication(realm = "Application", message = nil)
           Token.authentication_request(self, realm, message)
         end
@@ -427,17 +447,17 @@
       # If token Authorization header is present, call the login
       # procedure with the present token and options.
       #
-      # controller
-      #   ActionController::Base instance for the current request.
+      # Returns the return value of <tt>login_procedure</tt> if a
+      # token is found. Returns <tt>nil</tt> if no token is found.
+      #
+      # ==== Parameters
       #
-      # login_procedure
-      #   Proc to call if a token is present. The Proc should take two arguments:
+      # * +controller+ - ActionController::Base instance for the current request.

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/instrumentation.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/instrumentation.rb Changed

@@ -16,30 +16,6 @@
 
     attr_internal :view_runtime
 
-    def process_action(*)
-      raw_payload = {
-        controller: self.class.name,
-        action: action_name,
-        request: request,
-        params: request.filtered_parameters,
-        headers: request.headers,
-        format: request.format.ref,
-        method: request.request_method,
-        path: request.fullpath
-      }
-
-      ActiveSupport::Notifications.instrument("start_processing.action_controller", raw_payload)
-
-      ActiveSupport::Notifications.instrument("process_action.action_controller", raw_payload) do |payload|
-        result = super
-        payload:response = response
-        payload:status   = response.status
-        result
-      ensure
-        append_info_to_payload(payload)
-      end
-    end
-
     def render(*)
       render_output = nil
       self.view_runtime = cleanup_view_runtime do
@@ -70,37 +46,66 @@
       end
     end
 
-  private
-    # A hook invoked every time a before callback is halted.
-    def halted_callback_hook(filter, _)
-      ActiveSupport::Notifications.instrument("halted_callback.action_controller", filter: filter)
-    end
+    private
+      def process_action(*)
+        ActiveSupport::ExecutionContext:controller = self
 
-    # A hook which allows you to clean up any time, wrongly taken into account in
-    # views, like database querying time.
-    #
-    #   def cleanup_view_runtime
-    #     super - time_taken_in_something_expensive
-    #   end
-    def cleanup_view_runtime # :doc:
-      yield
-    end
+        raw_payload = {
+          controller: self.class.name,
+          action: action_name,
+          request: request,
+          params: request.filtered_parameters,
+          headers: request.headers,
+          format: request.format.ref,
+          method: request.request_method,
+          path: request.fullpath
+        }
 
-    # Every time after an action is processed, this method is invoked
-    # with the payload, so you can add more information.
-    def append_info_to_payload(payload) # :doc:
-      payload:view_runtime = view_runtime
-    end
+        ActiveSupport::Notifications.instrument("start_processing.action_controller", raw_payload)
 
-    module ClassMethods
-      # A hook which allows other frameworks to log what happened during
-      # controller process action. This method should return an array
-      # with the messages to be added.
-      def log_process_action(payload) #:nodoc:
-        messages, view_runtime = , payload:view_runtime
-        messages << ("Views: %.1fms" % view_runtime.to_f) if view_runtime
-        messages
+        ActiveSupport::Notifications.instrument("process_action.action_controller", raw_payload) do |payload|
+          result = super
+          payload:response = response
+          payload:status   = response.status
+          result
+        rescue => error
+          payload:status = ActionDispatch::ExceptionWrapper.status_code_for_exception(error.class.name)
+          raise
+        ensure
+          append_info_to_payload(payload)
+        end
+      end
+
+      # A hook invoked every time a before callback is halted.
+      def halted_callback_hook(filter, _)
+        ActiveSupport::Notifications.instrument("halted_callback.action_controller", filter: filter)
+      end
+
+      # A hook which allows you to clean up any time, wrongly taken into account in
+      # views, like database querying time.
+      #
+      #   def cleanup_view_runtime
+      #     super - time_taken_in_something_expensive
+      #   end
+      def cleanup_view_runtime # :doc:
+        yield
+      end
+
+      # Every time after an action is processed, this method is invoked
+      # with the payload, so you can add more information.
+      def append_info_to_payload(payload) # :doc:
+        payload:view_runtime = view_runtime
+      end
+
+      module ClassMethods
+        # A hook which allows other frameworks to log what happened during
+        # controller process action. This method should return an array
+        # with the messages to be added.
+        def log_process_action(payload) # :nodoc:
+          messages, view_runtime = , payload:view_runtime
+          messages << ("Views: %.1fms" % view_runtime.to_f) if view_runtime
+          messages
+        end
       end
-    end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/live.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/live.rb Changed

@@ -124,7 +124,7 @@
     class ClientDisconnected < RuntimeError
     end
 
-    class Buffer < ActionDispatch::Response::Buffer #:nodoc:
+    class Buffer < ActionDispatch::Response::Buffer # :nodoc:
       include MonitorMixin
 
       class << self
@@ -168,6 +168,11 @@
         end
       end
 
+      # Same as +write+ but automatically include a newline at the end of the string.
+      def writeln(string)
+        write string.end_with?("\n") ? string : "#{string}\n"
+      end
+
       # Write a 'close' event to the buffer; the producer/writing thread
       # uses this to notify us that it's finished supplying content.
       #
@@ -225,7 +230,7 @@
         end
     end
 
-    class Response < ActionDispatch::Response #:nodoc: all
+    class Response < ActionDispatch::Response # :nodoc: all
       private
         def before_committed
           super
@@ -256,6 +261,7 @@
           # Since we're processing the view in a different thread, copy the
           # thread locals from the main thread to the child thread. :'(
           locals.each { |k, v| t2k = v }
+          ActiveSupport::IsolatedExecutionState.share_with(t1)
 
           begin
             super(name)
@@ -291,6 +297,41 @@
       response.close if response
     end
 
+    # Sends a stream to the browser, which is helpful when you're generating exports or other running data where you
+    # don't want the entire file buffered in memory first. Similar to send_data, but where the data is generated live.
+    #
+    # Options:
+    # * <tt>:filename</tt> - suggests a filename for the browser to use.
+    # * <tt>:type</tt> - specifies an HTTP content type.
+    #   You can specify either a string or a symbol for a registered type with <tt>Mime::Type.register</tt>, for example :json.
+    #   If omitted, type will be inferred from the file extension specified in <tt>:filename</tt>.
+    #   If no content type is registered for the extension, the default type 'application/octet-stream' will be used.
+    # * <tt>:disposition</tt> - specifies whether the file will be shown inline or downloaded.
+    #   Valid values are 'inline' and 'attachment' (default).
+    #
+    # Example of generating a csv export:
+    #
+    #    send_stream(filename: "subscribers.csv") do |stream|
+    #      stream.write "email_address,updated_at\n"
+    #
+    #      @subscribers.find_each do |subscriber|
+    #        stream.write "#{subscriber.email_address},#{subscriber.updated_at}\n"
+    #      end
+    #    end
+    def send_stream(filename:, disposition: "attachment", type: nil)
+      response.headers"Content-Type" =
+        (type.is_a?(Symbol) ? Mimetype.to_s : type) ||
+        Mime::Type.lookup_by_extension(File.extname(filename).downcase.delete(".")) ||
+        "application/octet-stream"
+
+      response.headers"Content-Disposition" =
+        ActionDispatch::Http::ContentDisposition.format(disposition: disposition, filename: filename)
+
+      yield response.stream
+    ensure
+      response.stream.close
+    end
+
     private
       # Spawn a new thread to serve up the controller in. This is to get
       # around the fact that Rack isn't based around IOs and we need to use

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/mime_responds.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/mime_responds.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/params_wrapper.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/params_wrapper.rb Changed

@@ -9,11 +9,14 @@
   # Wraps the parameters hash into a nested hash. This will allow clients to
   # submit requests without having to specify any root elements.
   #
-  # This functionality is enabled in +config/initializers/wrap_parameters.rb+
-  # and can be customized.
+  # This functionality is enabled by default for JSON, and can be customized by
+  # setting the format array:
   #
-  # You could also turn it on per controller by setting the format array to
-  # a non-empty array:
+  #     class ApplicationController < ActionController::Base
+  #       wrap_parameters format: :json, :xml
+  #     end
+  #
+  # You could also turn it on per controller:
   #
   #     class UsersController < ApplicationController
   #       wrap_parameters format: :json, :xml, :url_encoded_form, :multipart_form
@@ -68,6 +71,12 @@
   # will try to check if <tt>Admin::User</tt> or +User+ model exists, and use it to
   # determine the wrapper key respectively. If both models don't exist,
   # it will then fallback to use +user+ as the key.
+  #
+  # To disable this functionality for a controller:
+  #
+  #     class UsersController < ApplicationController
+  #       wrap_parameters false
+  #     end
   module ParamsWrapper
     extend ActiveSupport::Concern
 
@@ -242,14 +251,14 @@
       end
     end
 
-    # Performs parameters wrapping upon the request. Called automatically
-    # by the metal call stack.
-    def process_action(*)
-      _perform_parameter_wrapping if _wrapper_enabled?
-      super
-    end
-
     private
+      # Performs parameters wrapping upon the request. Called automatically
+      # by the metal call stack.
+      def process_action(*)
+        _perform_parameter_wrapping if _wrapper_enabled?
+        super
+      end
+
       # Returns the wrapper key which will be used to store wrapped parameters.
       def _wrapper_key
         _wrapper_options.name

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/permissions_policy.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/permissions_policy.rb Changed

@@ -1,37 +1,28 @@
 # frozen_string_literal: true
 
-module ActionController #:nodoc:
-  # HTTP Permissions Policy is a web standard for defining a mechanism to
-  # allow and deny the use of browser permissions in its own context, and
-  # in content within any <iframe> elements in the document.
-  #
-  # Full details of HTTP Permissions Policy specification and guidelines can
-  # be found at MDN:
-  #
-  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
-  #
-  # Examples of usage:
-  #
-  #   # Global policy
-  #   Rails.application.config.permissions_policy do |f|
-  #     f.camera      :none
-  #     f.gyroscope   :none
-  #     f.microphone  :none
-  #     f.usb         :none
-  #     f.fullscreen  :self
-  #     f.payment     :self, "https://secure.example.com"
-  #   end
-  #
-  #   # Controller level policy
-  #   class PagesController < ApplicationController
-  #     permissions_policy do |p|
-  #       p.geolocation "https://example.com"
-  #     end
-  #   end
+module ActionController # :nodoc:
   module PermissionsPolicy
     extend ActiveSupport::Concern
 
     module ClassMethods
+      # Overrides parts of the globally configured Feature-Policy
+      # header:
+      #
+      #   class PagesController < ApplicationController
+      #     permissions_policy do |policy|
+      #       policy.geolocation "https://example.com"
+      #     end
+      #   end
+      #
+      # Options can be passed similar to +before_action+. For example, pass
+      # <tt>only: :index</tt> to override the header on the index action only:
+      #
+      #   class PagesController < ApplicationController
+      #     permissions_policy(only: :index) do |policy|
+      #       policy.camera :self
+      #     end
+      #   end
+      #
       def permissions_policy(**options, &block)
         before_action(options) do
           if block_given?

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/redirecting.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/redirecting.rb Changed

@@ -7,6 +7,12 @@
     include AbstractController::Logger
     include ActionController::UrlFor
 
+    class UnsafeRedirectError < StandardError; end
+
+    included do
+      mattr_accessor :raise_on_open_redirects, default: false
+    end
+
     # Redirects the browser to the target specified in +options+. This parameter can be any one of:
     #
     # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
@@ -54,16 +60,42 @@
     #
     # Statements after +redirect_to+ in our controller get executed, so +redirect_to+ doesn't stop the execution of the function.
     # To terminate the execution of the function immediately after the +redirect_to+, use return.
+    #
     #   redirect_to post_url(@post) and return
+    #
+    # === Open Redirect protection
+    #
+    # By default, Rails protects against redirecting to external hosts for your app's safety, so called open redirects.
+    # Note: this was a new default in Rails 7.0, after upgrading opt-in by uncommenting the line with +raise_on_open_redirects+ in <tt>config/initializers/new_framework_defaults_7_0.rb</tt>
+    #
+    # Here #redirect_to automatically validates the potentially-unsafe URL:
+    #
+    #   redirect_to params:redirect_url
+    #
+    # Raises UnsafeRedirectError in the case of an unsafe redirect.
+    #
+    # To allow any external redirects pass <tt>allow_other_host: true</tt>, though using a user-provided param in that case is unsafe.
+    #
+    #   redirect_to "https://rubyonrails.org", allow_other_host: true
+    #
+    # See #url_from for more information on what an internal and safe URL is, or how to fall back to an alternate redirect URL in the unsafe case.
     def redirect_to(options = {}, response_options = {})
       raise ActionControllerError.new("Cannot redirect to nil!") unless options
       raise AbstractController::DoubleRenderError if response_body
 
+      allow_other_host = response_options.delete(:allow_other_host) { _allow_other_host }
+
       self.status        = _extract_redirect_to_status(options, response_options)
-      self.location      = _compute_redirect_to_location(request, options)
+      self.location      = _enforce_open_redirect_protection(_compute_redirect_to_location(request, options), allow_other_host: allow_other_host)
       self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
     end
 
+    # Soft deprecated alias for #redirect_back_or_to where the +fallback_location+ location is supplied as a keyword argument instead
+    # of the first positional argument.
+    def redirect_back(fallback_location:, allow_other_host: _allow_other_host, **args)
+      redirect_back_or_to fallback_location, allow_other_host: allow_other_host, **args
+    end
+
     # Redirects the browser to the page that issued the request (the referrer)
     # if possible, otherwise redirects to the provided default fallback
     # location.
@@ -73,35 +105,37 @@
     # subject to browser security settings and user preferences. If the request
     # is missing this header, the <tt>fallback_location</tt> will be used.
     #
-    #   redirect_back fallback_location: { action: "show", id: 5 }
-    #   redirect_back fallback_location: @post
-    #   redirect_back fallback_location: "http://www.rubyonrails.org"
-    #   redirect_back fallback_location: "/images/screenshot.jpg"
-    #   redirect_back fallback_location: posts_url
-    #   redirect_back fallback_location: proc { edit_post_url(@post) }
-    #   redirect_back fallback_location: '/', allow_other_host: false
+    #   redirect_back_or_to({ action: "show", id: 5 })
+    #   redirect_back_or_to @post
+    #   redirect_back_or_to "http://www.rubyonrails.org"
+    #   redirect_back_or_to "/images/screenshot.jpg"
+    #   redirect_back_or_to posts_url
+    #   redirect_back_or_to proc { edit_post_url(@post) }
+    #   redirect_back_or_to '/', allow_other_host: false
     #
     # ==== Options
-    # * <tt>:fallback_location</tt> - The default fallback location that will be used on missing +Referer+ header.
     # * <tt>:allow_other_host</tt> - Allow or disallow redirection to the host that is different to the current host, defaults to true.
     #
     # All other options that can be passed to #redirect_to are accepted as
-    # options and the behavior is identical.
-    def redirect_back(fallback_location:, allow_other_host: true, **args)
-      referer = request.headers"Referer"
-      redirect_to_referer = referer && (allow_other_host || _url_host_allowed?(referer))
-      redirect_to redirect_to_referer ? referer : fallback_location, **args
+    # options, and the behavior is identical.
+    def redirect_back_or_to(fallback_location, allow_other_host: _allow_other_host, **options)
+      if request.referer && (allow_other_host || _url_host_allowed?(request.referer))
+        redirect_to request.referer, allow_other_host: allow_other_host, **options
+      else
+        # The method level `allow_other_host` doesn't apply in the fallback case, omit and let the `redirect_to` handling take over.
+        redirect_to fallback_location, **options
+      end
     end
 
-    def _compute_redirect_to_location(request, options) #:nodoc:
+    def _compute_redirect_to_location(request, options) # :nodoc:
       case options
       # The scheme name consist of a letter followed by any combination of
       # letters, digits, and the plus ("+"), period ("."), or hyphen ("-")
       # characters; and is terminated by a colon (":").
       # See https://tools.ietf.org/html/rfc3986#section-3.1
       # The protocol relative scheme starts with a double slash "//".
-      when /\A(a-za-z\d\-+\.*:|\/\/).*/i
-        options
+      when /\A(a-za-z\d\-+.*:|\/\/).*/i
+        options.to_str
       when String
         request.protocol + request.host_with_port + options
       when Proc
@@ -113,7 +147,35 @@
     module_function :_compute_redirect_to_location
     public :_compute_redirect_to_location
 
+    # Verifies the passed +location+ is an internal URL that's safe to redirect to and returns it, or nil if not.
+    # Useful to wrap a params provided redirect URL and fallback to an alternate URL to redirect to:
+    #
+    #   redirect_to url_from(params:redirect_url) || root_url
+    #
+    # The +location+ is considered internal, and safe, if it's on the same host as <tt>request.host</tt>:
+    #
+    #   # If request.host is example.com:
+    #   url_from("https://example.com/profile") # => "https://example.com/profile"
+    #   url_from("http://example.com/profile")  # => "http://example.com/profile"
+    #   url_from("http://evil.com/profile")     # => nil
+    #
+    # Subdomains are considered part of the host:
+    #
+    #   # If request.host is on https://example.com or https://app.example.com, you'd get:
+    #   url_from("https://dev.example.com/profile") # => nil
+    #
+    # NOTE: there's a similarity with {url_for}rdoc-ref:ActionDispatch::Routing::UrlFor#url_for, which generates an internal URL from various options from within the app, e.g. <tt>url_for(@post)</tt>.
+    # However, #url_from is meant to take an external parameter to verify as in <tt>url_from(params:redirect_url)</tt>.
+    def url_from(location)
+      location = location.presence
+      location if location && _url_host_allowed?(location)
+    end
+
     private
+      def _allow_other_host
+        !raise_on_open_redirects
+      end
+
       def _extract_redirect_to_status(options, response_options)
         if options.is_a?(Hash) && options.key?(:status)
           Rack::Utils.status_code(options.delete(:status))
@@ -124,8 +186,17 @@
         end
       end
 
+      def _enforce_open_redirect_protection(location, allow_other_host:)
+        if allow_other_host || _url_host_allowed?(location)
+          location
+        else
+          raise UnsafeRedirectError, "Unsafe redirect to #{location.truncate(100).inspect}, pass allow_other_host: true to redirect anyway."
+        end
+      end
+
       def _url_host_allowed?(url)
-        URI(url.to_s).host == request.host
+        host = URI(url.to_s).host
+        host == request.host || host.nil? && url.to_s.start_with?("/")
       rescue ArgumentError, URI::Error
         false
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/renderers.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/renderers.rb Changed

@@ -31,8 +31,7 @@
       class_attribute :_renderers, default: Set.new.freeze
     end
 
-    # Used in <tt>ActionController::Base</tt>
-    # and <tt>ActionController::API</tt> to include all
+    # Used in ActionController::Base and ActionController::API to include all
     # renderers by default.
     module All
       extend ActiveSupport::Concern
@@ -45,7 +44,7 @@
 
     # Adds a new renderer to call within controller actions.
     # A renderer is invoked by passing its name as an option to
-    # <tt>AbstractController::Rendering#render</tt>. To create a renderer
+    # AbstractController::Rendering#render. To create a renderer
     # pass it a name and a block. The block takes two arguments, the first
     # is the value paired with its key and the second is the remaining
     # hash of options passed to +render+.
@@ -96,18 +95,18 @@
       # Adds, by name, a renderer or renderers to the +_renderers+ available
       # to call within controller actions.
       #
-      # It is useful when rendering from an <tt>ActionController::Metal</tt> controller or
+      # It is useful when rendering from an ActionController::Metal controller or
       # otherwise to add an available renderer proc to a specific controller.
       #
-      # Both <tt>ActionController::Base</tt> and <tt>ActionController::API</tt>
-      # include <tt>ActionController::Renderers::All</tt>, making all renderers
+      # Both ActionController::Base and ActionController::API
+      # include ActionController::Renderers::All, making all renderers
       # available in the controller. See <tt>Renderers::RENDERERS</tt> and <tt>Renderers.add</tt>.
       #
-      # Since <tt>ActionController::Metal</tt> controllers cannot render, the controller
-      # must include <tt>AbstractController::Rendering</tt>, <tt>ActionController::Rendering</tt>,
-      # and <tt>ActionController::Renderers</tt>, and have at least one renderer.
+      # Since ActionController::Metal controllers cannot render, the controller
+      # must include AbstractController::Rendering, ActionController::Rendering,
+      # and ActionController::Renderers, and have at least one renderer.
       #
-      # Rather than including <tt>ActionController::Renderers::All</tt> and including all renderers,
+      # Rather than including ActionController::Renderers::All and including all renderers,
       # you may specify which renderers to include by passing the renderer name or names to
       # +use_renderers+. For example, a controller that includes only the <tt>:json</tt> renderer
       # (+_render_with_renderer_json+) might look like:
@@ -133,7 +132,7 @@
       alias use_renderer use_renderers
     end
 
-    # Called by +render+ in <tt>AbstractController::Rendering</tt>
+    # Called by +render+ in AbstractController::Rendering
     # which sets the return value as the +response_body+.
     #
     # If no renderer is found, +super+ returns control to

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/rendering.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/rendering.rb Changed

@@ -24,19 +24,13 @@
       end
     end
 
-    # Before processing, set the request formats in current controller formats.
-    def process_action(*) #:nodoc:
-      self.formats = request.formats.map(&:ref).compact
-      super
-    end
-
     # Check for double render errors and set the content_type after rendering.
-    def render(*args) #:nodoc:
+    def render(*args) # :nodoc:
       raise ::AbstractController::DoubleRenderError if response_body
       super
     end
 
-    # Overwrite render_to_string because body can now be set to a Rack body.
+    # Override render_to_string because body can now be set to a Rack body.
     def render_to_string(*)
       result = super
       if result.respond_to?(:each)
@@ -53,6 +47,12 @@
     end
 
     private
+      # Before processing, set the request formats in current controller formats.
+      def process_action(*) # :nodoc:
+        self.formats = request.formats.filter_map(&:ref)
+        super
+      end
+
       def _process_variant(options)
         if defined?(request) && !request.nil? && request.variant.present?
           options:variant = request.variant
@@ -78,8 +78,8 @@
       end
 
       def _set_vary_header
-        if self.headers"Vary".blank? && request.should_apply_vary_header?
-          self.headers"Vary" = "Accept"
+        if response.headers"Vary".blank? && request.should_apply_vary_header?
+          response.headers"Vary" = "Accept"
         end
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/request_forgery_protection.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/request_forgery_protection.rb Changed

@@ -4,11 +4,11 @@
 require "action_controller/metal/exceptions"
 require "active_support/security_utils"
 
-module ActionController #:nodoc:
-  class InvalidAuthenticityToken < ActionControllerError #:nodoc:
+module ActionController # :nodoc:
+  class InvalidAuthenticityToken < ActionControllerError # :nodoc:
   end
 
-  class InvalidCrossOriginRequest < ActionControllerError #:nodoc:
+  class InvalidCrossOriginRequest < ActionControllerError # :nodoc:
   end
 
   # Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks
@@ -32,7 +32,7 @@
   # response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or
   # Ajax) requests are allowed to make requests for JavaScript responses.
   #
-  # Subclasses of <tt>ActionController::Base</tt> are protected by default with the
+  # Subclasses of ActionController::Base are protected by default with the
   # <tt>:exception</tt> strategy, which raises an
   # <tt>ActionController::InvalidAuthenticityToken</tt> error on unverified requests.
   #
@@ -92,7 +92,16 @@
 
       # Controls whether URL-safe CSRF tokens are generated.
       config_accessor :urlsafe_csrf_tokens, instance_writer: false
-      self.urlsafe_csrf_tokens = false
+      self.urlsafe_csrf_tokens = true
+
+      singleton_class.redefine_method(:urlsafe_csrf_tokens=) do |urlsafe_csrf_tokens|
+        if urlsafe_csrf_tokens
+          ActiveSupport::Deprecation.warn("URL-safe CSRF tokens are now the default. Use 6.1 defaults or above.")
+        else
+          ActiveSupport::Deprecation.warn("Non-URL-safe CSRF tokens are deprecated. Use 6.1 defaults or above.")
+        end
+        config.urlsafe_csrf_tokens = urlsafe_csrf_tokens
+      end
 
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
@@ -115,8 +124,8 @@
       #
       # Valid Options:
       #
-      # * <tt>:only/:except</tt> - Only apply forgery protection to a subset of actions. For example <tt>only:  :create, :create_all </tt>.
-      # * <tt>:if/:unless</tt> - Turn off the forgery protection entirely depending on the passed Proc or method reference.
+      # * <tt>:only</tt> / <tt>:except</tt> - Only apply forgery protection to a subset of actions. For example <tt>only:  :create, :create_all </tt>.
+      # * <tt>:if</tt> / <tt>:unless</tt> - Turn off the forgery protection entirely depending on the passed Proc or method reference.
       # * <tt>:prepend</tt> - By default, the verification of the authentication token will be added at the position of the
       #   protect_from_forgery call in your application. This means any callbacks added before are run first. This is useful
       #   when you want your forgery protection to depend on other callbacks, like authentication methods (Oauth vs Cookie auth).
@@ -124,10 +133,26 @@
       #   If you need to add verification to the beginning of the callback chain, use <tt>prepend: true</tt>.
       # * <tt>:with</tt> - Set the method to handle unverified request.
       #
-      # Valid unverified request handling methods are:
+      # Built-in unverified request handling methods are:
       # * <tt>:exception</tt> - Raises ActionController::InvalidAuthenticityToken exception.
       # * <tt>:reset_session</tt> - Resets the session.
       # * <tt>:null_session</tt> - Provides an empty session during request but doesn't reset it completely. Used as default if <tt>:with</tt> option is not specified.
+      #
+      # You can also implement custom strategy classes for unverified request handling:
+      #
+      #    class CustomStrategy
+      #      def initialize(controller)
+      #        @controller = controller
+      #      end
+      #
+      #      def handle_unverified_request
+      #        # Custom behaviour for unverfied request
+      #      end
+      #    end
+      #
+      #    class ApplicationController < ActionController:x:Base
+      #      protect_from_forgery with: CustomStrategy
+      #    end
       def protect_from_forgery(options = {})
         options = options.reverse_merge(prepend: false)
 
@@ -143,14 +168,23 @@
       #
       # See +skip_before_action+ for allowed options.
       def skip_forgery_protection(options = {})
-        skip_before_action :verify_authenticity_token, options
+        skip_before_action :verify_authenticity_token, options.reverse_merge(raise: false)
       end
 
       private
         def protection_method_class(name)
-          ActionController::RequestForgeryProtection::ProtectionMethods.const_get(name.to_s.classify)
-        rescue NameError
-          raise ArgumentError, "Invalid request forgery protection method, use :null_session, :exception, or :reset_session"
+          case name
+          when :null_session
+            ProtectionMethods::NullSession
+          when :reset_session
+            ProtectionMethods::ResetSession
+          when :exception
+            ProtectionMethods::Exception
+          when Class
+            name
+          else
+            raise ArgumentError, "Invalid request forgery protection method, use :null_session, :exception, :reset_session, or a custom forgery protection class."
+          end
         end
     end
 
@@ -170,7 +204,7 @@
         end
 
         private
-          class NullSessionHash < Rack::Session::Abstract::SessionHash #:nodoc:
+          class NullSessionHash < Rack::Session::Abstract::SessionHash # :nodoc:
             def initialize(req)
               super(nil, req)
               @data = {}
@@ -183,9 +217,13 @@
             def exists?
               true
             end
+
+            def enabled?
+              false
+            end
           end
 
-          class NullCookieJar < ActionDispatch::Cookies::CookieJar #:nodoc:
+          class NullCookieJar < ActionDispatch::Cookies::CookieJar # :nodoc:
             def write(*)
               # nothing
             end
@@ -203,12 +241,14 @@
       end
 
       class Exception
+        attr_accessor :warning_message
+
         def initialize(controller)
           @controller = controller
         end
 
         def handle_unverified_request
-          raise ActionController::InvalidAuthenticityToken
+          raise ActionController::InvalidAuthenticityToken, warning_message
         end
       end
     end
@@ -228,22 +268,31 @@
         mark_for_same_origin_verification!
 
         if !verified_request?
-          if logger && log_warning_on_csrf_failure
-            if valid_request_origin?
-              logger.warn "Can't verify CSRF token authenticity."
-            else
-              logger.warn "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})"
-            end
-          end
+          logger.warn unverified_request_warning_message if logger && log_warning_on_csrf_failure
+
           handle_unverified_request
         end
       end
 
       def handle_unverified_request # :doc:
-        forgery_protection_strategy.new(self).handle_unverified_request
+        protection_strategy = forgery_protection_strategy.new(self)
+
+        if protection_strategy.respond_to?(:warning_message)
+          protection_strategy.warning_message = unverified_request_warning_message
+        end
+
+        protection_strategy.handle_unverified_request
+      end
+
+      def unverified_request_warning_message # :nodoc:
+        if valid_request_origin?
+          "Can't verify CSRF token authenticity."
+        else
+          "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})"
+        end
       end
 
-      #:nodoc:
+      # :nodoc:
       CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \
         "<script> tag on another site requested protected JavaScript. " \
         "If you know what you're doing, go ahead and disable forgery " \
@@ -303,15 +352,15 @@
         form_authenticity_param, request.x_csrf_token
       end
 
-      # Sets the token value for the current session.
-      def form_authenticity_token(form_options: {})
+      # Creates the authenticity token for the current request.
+      def form_authenticity_token(form_options: {}) # :doc:
         masked_authenticity_token(session, form_options: form_options)
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/rescue.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/rescue.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/streaming.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/streaming.rb Changed

@@ -2,7 +2,7 @@
 
 require "rack/chunked"
 
-module ActionController #:nodoc:
+module ActionController # :nodoc:
   # Allows views to be streamed back to the client as they are rendered.
   #
   # By default, Rails renders views by first rendering the template
@@ -24,7 +24,7 @@
   # Ruby implementation).
   #
   # Streaming can be added to a given template easily, all you need to do is
-  # to pass the :stream option.
+  # to pass the +:stream+ option.
   #
   #   class PostsController
   #     def index
@@ -59,8 +59,8 @@
   #     render stream: true
   #   end
   #
-  # Notice that :stream only works with templates. Rendering :json
-  # or :xml with :stream won't work.
+  # Notice that +:stream+ only works with templates. Rendering +:json+
+  # or +:xml+ with +:stream+ won't work.
   #
   # == Communication between layout and template
   #
@@ -72,7 +72,7 @@
   # variables set in the template to be used in the layout, they won't
   # work once you move to streaming. The proper way to communicate
   # between layout and template, regardless of whether you use streaming
-  # or not, is by using +content_for+, +provide+ and +yield+.
+  # or not, is by using +content_for+, +provide+, and +yield+.
   #
   # Take a simple example where the layout expects the template to tell
   # which title to use:
@@ -132,7 +132,7 @@
   # That said, when streaming, you need to properly check your templates
   # and choose when to use +provide+ and +content_for+.
   #
-  # == Headers, cookies, session and flash
+  # == Headers, cookies, session, and flash
   #
   # When streaming, the HTTP headers are sent to the client right before
   # it renders the first line. This means that, modifying headers, cookies,
@@ -193,8 +193,6 @@
   # To be described.
   #
   module Streaming
-    extend ActiveSupport::Concern
-
     private
       # Set proper cache control and transfer encoding when streaming
       def _process_options(options)

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/strong_parameters.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/strong_parameters.rb Changed

@@ -27,28 +27,13 @@
       super("param is missing or the value is empty: #{param}")
     end
 
-    class Correction
-      def initialize(error)
-        @error = error
-      end
-
-      def corrections
-        if @error.param && @error.keys
-          maybe_these = @error.keys
+    if defined?(DidYouMean::Correctable) && defined?(DidYouMean::SpellChecker)
+      include DidYouMean::Correctable # :nodoc:
 
-          maybe_these.sort_by { |n|
-            DidYouMean::Jaro.distance(@error.param.to_s, n)
-          }.reverse.first(4)
-        else
-          
-        end
+      def corrections # :nodoc:
+        @corrections ||= DidYouMean::SpellChecker.new(dictionary: keys).correct(param.to_s)
       end
     end
-
-    # We may not have DYM, and DYM might not let us register error handlers
-    if defined?(DidYouMean) && DidYouMean.respond_to?(:correct_error)
-      DidYouMean.correct_error(self, Correction)
-    end
   end
 
   # Raised when a supplied parameter is not expected and
@@ -96,7 +81,7 @@
   #   })
   #
   #   permitted = params.require(:person).permit(:name, :age)
-  #   permitted            # => <ActionController::Parameters {"name"=>"Francesco", "age"=>22} permitted: true>
+  #   permitted            # => #<ActionController::Parameters {"name"=>"Francesco", "age"=>22} permitted: true>
   #   permitted.permitted? # => true
   #
   #   Person.first.update!(permitted)
@@ -106,11 +91,13 @@
   #
   # * +permit_all_parameters+ - If it's +true+, all the parameters will be
   #   permitted by default. The default is +false+.
-  # * +action_on_unpermitted_parameters+ - Allow to control the behavior when parameters
-  #   that are not explicitly permitted are found. The values can be +false+ to just filter them
-  #   out, <tt>:log</tt> to additionally write a message on the logger, or <tt>:raise</tt> to raise
-  #   ActionController::UnpermittedParameters exception. The default value is <tt>:log</tt>
-  #   in test and development environments, +false+ otherwise.
+  # * +action_on_unpermitted_parameters+ - Controls behavior when parameters that are not explicitly
+  #    permitted are found. The default value is <tt>:log</tt> in test and development environments,
+  #    +false+ otherwise. The values can be:
+  #   * +false+ to take no action.
+  #   * <tt>:log</tt> to emit an <tt>ActiveSupport::Notifications.instrument</tt> event on the
+  #     <tt>unpermitted_parameters.action_controller</tt> topic and log at the DEBUG level.
+  #   * <tt>:raise</tt> to raise a <tt>ActionController::UnpermittedParameters</tt> exception.
   #
   # Examples:
   #
@@ -124,7 +111,7 @@
   #
   #   params = ActionController::Parameters.new(a: "123", b: "456")
   #   params.permit(:c)
-  #   # => <ActionController::Parameters {} permitted: true>
+  #   # => #<ActionController::Parameters {} permitted: true>
   #
   #   ActionController::Parameters.action_on_unpermitted_parameters = :raise
   #
@@ -249,7 +236,7 @@
     # By default, never raise an UnpermittedParameters exception if these
     # params are present. The default includes both 'controller' and 'action'
     # because they are added by Rails and should be of no concern. One way
-    # to change these is to specify `always_permitted_parameters` in your
+    # to change these is to specify +always_permitted_parameters+ in your
     # config. For instance:
     #
     #    config.action_controller.always_permitted_parameters = %w( controller action format )
@@ -277,8 +264,9 @@
     #   params = ActionController::Parameters.new(name: "Francesco")
     #   params.permitted?  # => true
     #   Person.new(params) # => #<Person id: nil, name: "Francesco">
-    def initialize(parameters = {})
+    def initialize(parameters = {}, logging_context = {})
       @parameters = parameters.with_indifferent_access
+      @logging_context = logging_context
       @permitted = self.class.permit_all_parameters
     end
 
@@ -291,10 +279,15 @@
         @parameters == other
       end
     end
-    alias eql? ==
+
+    def eql?(other)
+      self.class == other.class &&
+        permitted? == other.permitted? &&
+        parameters.eql?(other.parameters)
+    end
 
     def hash
-      @parameters.hash, @permitted.hash
+      self.class, @parameters, @permitted.hash
     end
 
     # Returns a safe <tt>ActiveSupport::HashWithIndifferentAccess</tt>
@@ -454,7 +447,7 @@
     # either present or the singleton +false+, returns said value:
     #
     #   ActionController::Parameters.new(person: { name: "Francesco" }).require(:person)
-    #   # => <ActionController::Parameters {"name"=>"Francesco"} permitted: false>
+    #   # => #<ActionController::Parameters {"name"=>"Francesco"} permitted: false>
     #
     # Otherwise raises <tt>ActionController::ParameterMissing</tt>:
     #
@@ -582,13 +575,48 @@
     #   })
     #
     #   params.require(:person).permit(:contact)
-    #   # => <ActionController::Parameters {} permitted: true>
+    #   # => #<ActionController::Parameters {} permitted: true>
     #
     #   params.require(:person).permit(contact: :phone)
-    #   # => <ActionController::Parameters {"contact"=><ActionController::Parameters {"phone"=>"555-1234"} permitted: true>} permitted: true>
+    #   # => #<ActionController::Parameters {"contact"=>#<ActionController::Parameters {"phone"=>"555-1234"} permitted: true>} permitted: true>
     #
     #   params.require(:person).permit(contact:  :email, :phone )
-    #   # => <ActionController::Parameters {"contact"=><ActionController::Parameters {"email"=>"none@test.com", "phone"=>"555-1234"} permitted: true>} permitted: true>
+    #   # => #<ActionController::Parameters {"contact"=>#<ActionController::Parameters {"email"=>"none@test.com", "phone"=>"555-1234"} permitted: true>} permitted: true>
+    #
+    # If your parameters specify multiple parameters indexed by a number,
+    # you can permit each set of parameters under the numeric key to be the same using the same syntax as permitting a single item.
+    #
+    #   params = ActionController::Parameters.new({
+    #     person: {
+    #       '0': {
+    #         email: "none@test.com",
+    #         phone: "555-1234"
+    #       },
+    #       '1': {
+    #         email: "nothing@test.com",
+    #         phone: "555-6789"
+    #       },
+    #     }
+    #   })
+    #   params.permit(person: :email).to_h
+    #   # => {"person"=>{"0"=>{"email"=>"none@test.com"}, "1"=>{"email"=>"nothing@test.com"}}}
+    #
+    # If you want to specify what keys you want from each numeric key, you can instead specify each one individually
+    #
+    #   params = ActionController::Parameters.new({
+    #     person: {
+    #       '0': {
+    #         email: "none@test.com",
+    #         phone: "555-1234"
+    #       },
+    #       '1': {
+    #         email: "nothing@test.com",
+    #         phone: "555-6789"
+    #       },
+    #     }
+    #   })
+    #   params.permit(person: { '0': :email, '1': :phone}).to_h
+    #   # => {"person"=>{"0"=>{"email"=>"none@test.com"}, "1"=>{"phone"=>"555-6789"}}}
     def permit(*filters)
       params = self.class.new
 
@@ -610,7 +638,7 @@
     # returns +nil+.
     #
     #   params = ActionController::Parameters.new(person: { name: "Francesco" })
-    #   params:person # => <ActionController::Parameters {"name"=>"Francesco"} permitted: false>
+    #   params:person # => #<ActionController::Parameters {"name"=>"Francesco"} permitted: false>
     #   params:none   # => nil
     def (key)
       convert_hashes_to_parameters(key, @parameterskey)
@@ -630,9 +658,9 @@
     # is given, then that will be run and its result returned.
     #
     #   params = ActionController::Parameters.new(person: { name: "Francesco" })
-    #   params.fetch(:person)               # => <ActionController::Parameters {"name"=>"Francesco"} permitted: false>
+    #   params.fetch(:person)               # => #<ActionController::Parameters {"name"=>"Francesco"} permitted: false>
     #   params.fetch(:none)                 # => ActionController::ParameterMissing: param is missing or the value is empty: none
-    #   params.fetch(:none, {})             # => <ActionController::Parameters {} permitted: false>
+    #   params.fetch(:none, {})             # => #<ActionController::Parameters {} permitted: false>
     #   params.fetch(:none, "Francesco")    # => "Francesco"
     #   params.fetch(:none) { "Francesco" } # => "Francesco"
     def fetch(key, *args)
@@ -666,8 +694,8 @@
     # don't exist, returns an empty hash.
     #
     #   params = ActionController::Parameters.new(a: 1, b: 2, c: 3)
-    #   params.slice(:a, :b) # => <ActionController::Parameters {"a"=>1, "b"=>2} permitted: false>
-    #   params.slice(:d)     # => <ActionController::Parameters {} permitted: false>
+    #   params.slice(:a, :b) # => #<ActionController::Parameters {"a"=>1, "b"=>2} permitted: false>
+    #   params.slice(:d)     # => #<ActionController::Parameters {} permitted: false>
     def slice(*keys)
       new_instance_with_inherited_permitted_status(@parameters.slice(*keys))

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/testing.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/testing.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/metal/url_for.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/metal/url_for.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/railtie.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/railtie.rb Changed

@@ -8,8 +8,11 @@
 require "action_view/railtie"
 
 module ActionController
-  class Railtie < Rails::Railtie #:nodoc:
+  class Railtie < Rails::Railtie # :nodoc:
     config.action_controller = ActiveSupport::OrderedOptions.new
+    config.action_controller.raise_on_open_redirects = false
+    config.action_controller.log_query_tags_around_actions = true
+    config.action_controller.wrap_parameters_by_default = false
 
     config.eager_load_namespaces << ActionController
 
@@ -25,14 +28,19 @@
       options = app.config.action_controller
 
       ActiveSupport.on_load(:action_controller, run_once: true) do
-        ActionController::Parameters.permit_all_parameters = options.delete(:permit_all_parameters) { false }
+        ActionController::Parameters.permit_all_parameters = options.permit_all_parameters || false
         if app.config.action_controller:always_permitted_parameters
           ActionController::Parameters.always_permitted_parameters =
-            app.config.action_controller.delete(:always_permitted_parameters)
+            app.config.action_controller.always_permitted_parameters
         end
-        ActionController::Parameters.action_on_unpermitted_parameters = options.delete(:action_on_unpermitted_parameters) do
-          (Rails.env.test? || Rails.env.development?) ? :log : false
+
+        action_on_unpermitted_parameters = options.action_on_unpermitted_parameters
+
+        if action_on_unpermitted_parameters.nil?
+          action_on_unpermitted_parameters = (Rails.env.test? || Rails.env.development?) ? :log : false
         end
+
+        ActionController::Parameters.action_on_unpermitted_parameters = action_on_unpermitted_parameters
       end
     end
 
@@ -55,7 +63,18 @@
         extend ::AbstractController::Railties::RoutesHelpers.with(app.routes)
         extend ::ActionController::Railties::Helpers
 
-        options.each do |k, v|
+        wrap_parameters format: :json if options.wrap_parameters_by_default && respond_to?(:wrap_parameters)
+
+        # Configs used in other initializers
+        filtered_options = options.except(
+          :log_query_tags_around_actions,
+          :permit_all_parameters,
+          :action_on_unpermitted_parameters,
+          :always_permitted_parameters,
+          :wrap_parameters_by_default
+        )
+
+        filtered_options.each do |k, v|
           k = "#{k}="
           if respond_to?(k)
             send(k, v)
@@ -85,5 +104,29 @@
         ActionController::Metal.descendants.each(&:action_methods) if config.eager_load
       end
     end
+
+    initializer "action_controller.query_log_tags" do |app|
+      query_logs_tags_enabled = app.config.respond_to?(:active_record) &&
+        app.config.active_record.query_log_tags_enabled &&
+        app.config.action_controller.log_query_tags_around_actions
+
+      if query_logs_tags_enabled
+        app.config.active_record.query_log_tags += :controller, :action
+
+        ActiveSupport.on_load(:active_record) do
+          ActiveRecord::QueryLogs.taggings.merge!(
+            controller:            ->(context) { context:controller&.controller_name },
+            action:                ->(context) { context:controller&.action_name },
+            namespaced_controller: ->(context) { context:controller.class.name if context:controller }
+          )
+        end
+      end
+    end
+
+    initializer "action_controller.test_case" do |app|
+      ActiveSupport.on_load(:action_controller_test_case) do
+        ActionController::TestCase.executor_around_each_request = app.config.active_support.executor_around_test_case
+      end
+    end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/renderer.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/renderer.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_controller/test_case.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_controller/test_case.rb Changed

@@ -31,7 +31,7 @@
 
   # ActionController::TestCase will be deprecated and moved to a gem in the future.
   # Please use ActionDispatch::IntegrationTest going forward.
-  class TestRequest < ActionDispatch::TestRequest #:nodoc:
+  class TestRequest < ActionDispatch::TestRequest # :nodoc:
     DEFAULT_ENV = ActionDispatch::TestRequest::DEFAULT_ENV.dup
     DEFAULT_ENV.delete "PATH_INFO"
 
@@ -179,7 +179,7 @@
 
   # Methods #destroy and #load! are overridden to avoid calling methods on the
   # @store object, which does not exist for the TestSession class.
-  class TestSession < Rack::Session::Abstract::PersistedSecure::SecureSessionHash #:nodoc:
+  class TestSession < Rack::Session::Abstract::PersistedSecure::SecureSessionHash # :nodoc:
     DEFAULT_OPTIONS = Rack::Session::Abstract::Persisted::DEFAULT_OPTIONS
 
     def initialize(session = {})
@@ -214,6 +214,10 @@
       @data.fetch(key.to_s, *args, &block)
     end
 
+    def enabled?
+      true
+    end
+
     private
       def load!
         @id
@@ -237,7 +241,7 @@
   # == Basic example
   #
   # Functional tests are written as follows:
-  # 1. First, one uses the +get+, +post+, +patch+, +put+, +delete+ or +head+ method to simulate
+  # 1. First, one uses the +get+, +post+, +patch+, +put+, +delete+, or +head+ method to simulate
   #    an HTTP request.
   # 2. Then, one asserts whether the current state is as expected. "State" can be anything:
   #    the controller's HTTP response, the database contents, etc.
@@ -329,6 +333,8 @@
   #
   #  assert_redirected_to page_url(title: 'foo')
   class TestCase < ActiveSupport::TestCase
+    singleton_class.attr_accessor :executor_around_each_request
+
     module Behavior
       extend ActiveSupport::Concern
       include ActionDispatch::TestProcess
@@ -385,7 +391,7 @@
       #
       # You can also simulate POST, PATCH, PUT, DELETE, and HEAD requests with
       # +post+, +patch+, +put+, +delete+, and +head+.
-      # Example sending parameters, session and setting a flash message:
+      # Example sending parameters, session, and setting a flash message:
       #
       #   get :show,
       #     params: { id: 7 },
@@ -455,13 +461,19 @@
       #     session: { user_id: 1 },
       #     flash: { notice: 'This is flash message' }
       #
-      # To simulate +GET+, +POST+, +PATCH+, +PUT+, +DELETE+ and +HEAD+ requests
+      # To simulate +GET+, +POST+, +PATCH+, +PUT+, +DELETE+, and +HEAD+ requests
       # prefer using #get, #post, #patch, #put, #delete and #head methods
       # respectively which will make tests more expressive.
       #
+      # It's not recommended to make more than one request in the same test. Instance
+      # variables that are set in one request will not persist to the next request,
+      # but it's not guaranteed that all Rails internal state will be reset. Prefer
+      # ActionDispatch::IntegrationTest for making multiple requests in the same test.
+      #
       # Note that the request method is not verified.
       def process(action, method: "GET", params: nil, session: nil, body: nil, flash: {}, format: nil, xhr: false, as: nil)
         check_required_ivars
+        @controller.clear_instance_variables_between_requests
 
         action = +action.to_s
         http_method = method.to_s.upcase
@@ -574,10 +586,19 @@
           end
         end
 
+        def wrap_execution(&block)
+          if ActionController::TestCase.executor_around_each_request && defined?(Rails.application) && Rails.application
+            Rails.application.executor.wrap(&block)
+          else
+            yield
+          end
+        end
+
         def process_controller_response(action, cookies, xhr)
           begin
             @controller.recycle!
-            @controller.dispatch(action, @request, @response)
+
+            wrap_execution { @controller.dispatch(action, @request, @response) }
           ensure
             @request = @controller.request
             @response = @controller.response
@@ -623,7 +644,7 @@
         end
 
         def check_required_ivars
-          # Sanity check for required instance variables so we can give an
+          # Check for required instance variables so we can give an
           # understandable error message.
           :@routes, :@controller, :@request, :@response.each do |iv_name|
             if !instance_variable_defined?(iv_name) || instance_variable_get(iv_name).nil?

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/cache.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/cache.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/content_security_policy.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/content_security_policy.rb Changed

@@ -1,8 +1,26 @@
 # frozen_string_literal: true
 
 require "active_support/core_ext/object/deep_dup"
-
-module ActionDispatch #:nodoc:
+require "active_support/core_ext/array/wrap"
+
+module ActionDispatch # :nodoc:
+  # Configures the HTTP
+  # {Content-Security-Policy}https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+  # response header to help protect against XSS and injection attacks.
+  #
+  # Example global policy:
+  #
+  #   Rails.application.config.content_security_policy do |policy|
+  #     policy.default_src :self, :https
+  #     policy.font_src    :self, :https, :data
+  #     policy.img_src     :self, :https, :data
+  #     policy.object_src  :none
+  #     policy.script_src  :self, :https
+  #     policy.style_src   :self, :https
+  #
+  #     # Specify URI for violation reports
+  #     policy.report_uri "/csp-violation-report-endpoint"
+  #   end
   class ContentSecurityPolicy
     class Middleware
       CONTENT_TYPE = "Content-Type"
@@ -17,7 +35,6 @@
         request = ActionDispatch::Request.new env
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         if policy = request.content_security_policy
@@ -31,12 +48,6 @@
       end
 
       private
-        def html_response?(headers)
-          if content_type = headersCONTENT_TYPE
-            /html/.match?(content_type)
-          end
-        end
-
         def header_name(request)
           if request.content_security_policy_report_only
             POLICY_REPORT_ONLY
@@ -106,43 +117,47 @@
     end
 
     MAPPINGS = {
-      self:           "'self'",
-      unsafe_eval:    "'unsafe-eval'",
-      unsafe_inline:  "'unsafe-inline'",
-      none:           "'none'",
-      http:           "http:",
-      https:          "https:",
-      data:           "data:",
-      mediastream:    "mediastream:",
-      blob:           "blob:",
-      filesystem:     "filesystem:",
-      report_sample:  "'report-sample'",
-      strict_dynamic: "'strict-dynamic'",
-      ws:             "ws:",
-      wss:            "wss:"
+      self:             "'self'",
+      unsafe_eval:      "'unsafe-eval'",
+      unsafe_inline:    "'unsafe-inline'",
+      none:             "'none'",
+      http:             "http:",
+      https:            "https:",
+      data:             "data:",
+      mediastream:      "mediastream:",
+      allow_duplicates: "'allow-duplicates'",
+      blob:             "blob:",
+      filesystem:       "filesystem:",
+      report_sample:    "'report-sample'",
+      script:           "'script'",
+      strict_dynamic:   "'strict-dynamic'",
+      ws:               "ws:",
+      wss:              "wss:"
     }.freeze
 
     DIRECTIVES = {
-      base_uri:        "base-uri",
-      child_src:       "child-src",
-      connect_src:     "connect-src",
-      default_src:     "default-src",
-      font_src:        "font-src",
-      form_action:     "form-action",
-      frame_ancestors: "frame-ancestors",
-      frame_src:       "frame-src",
-      img_src:         "img-src",
-      manifest_src:    "manifest-src",
-      media_src:       "media-src",
-      object_src:      "object-src",
-      prefetch_src:    "prefetch-src",
-      script_src:      "script-src",
-      script_src_attr: "script-src-attr",
-      script_src_elem: "script-src-elem",
-      style_src:       "style-src",
-      style_src_attr:  "style-src-attr",
-      style_src_elem:  "style-src-elem",
-      worker_src:      "worker-src"
+      base_uri:                   "base-uri",
+      child_src:                  "child-src",
+      connect_src:                "connect-src",
+      default_src:                "default-src",
+      font_src:                   "font-src",
+      form_action:                "form-action",
+      frame_ancestors:            "frame-ancestors",
+      frame_src:                  "frame-src",
+      img_src:                    "img-src",
+      manifest_src:               "manifest-src",
+      media_src:                  "media-src",
+      object_src:                 "object-src",
+      prefetch_src:               "prefetch-src",
+      require_trusted_types_for:  "require-trusted-types-for",
+      script_src:                 "script-src",
+      script_src_attr:            "script-src-attr",
+      script_src_elem:            "script-src-elem",
+      style_src:                  "style-src",
+      style_src_attr:             "style-src-attr",
+      style_src_elem:             "style-src-elem",
+      trusted_types:              "trusted-types",
+      worker_src:                 "worker-src"
     }.freeze
 
     DEFAULT_NONCE_DIRECTIVES = %wscript-src style-src.freeze
@@ -170,6 +185,15 @@
       end
     end
 
+    # Specify whether to prevent the user agent from loading any assets over
+    # HTTP when the page uses HTTPS:
+    #
+    #   policy.block_all_mixed_content
+    #
+    # Pass +false+ to allow it again:
+    #
+    #   policy.block_all_mixed_content false
+    #
     def block_all_mixed_content(enabled = true)
       if enabled
         @directives"block-all-mixed-content" = true
@@ -178,6 +202,14 @@
       end
     end
 
+    # Restricts the set of plugins that can be embedded:
+    #
+    #   policy.plugin_types "application/x-shockwave-flash"
+    #
+    # Leave empty to allow all plugins:
+    #
+    #   policy.plugin_types
+    #
     def plugin_types(*types)
       if types.first
         @directives"plugin-types" = types
@@ -186,10 +218,24 @@
       end
     end
 
+    # Enable the {report-uri}https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
+    # directive. Violation reports will be sent to the specified URI:
+    #
+    #   policy.report_uri "/csp-violation-report-endpoint"
+    #
     def report_uri(uri)
       @directives"report-uri" = uri
     end
 
+    # Specify asset types for which {Subresource Integrity}https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
+    # is required:
+    #
+    #   policy.require_sri_for :script, :style
+    #
+    # Leave empty to not require Subresource Integrity:
+    #
+    #   policy.require_sri_for
+    #
     def require_sri_for(*types)
       if types.first
         @directives"require-sri-for" = types
@@ -198,6 +244,19 @@
       end
     end
 
+    # Specify whether a {sandbox}https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+    # should be enabled for the requested resource:
+    #
+    #   policy.sandbox
+    #
+    # Values can be passed as arguments:
+    #
+    #   policy.sandbox "allow-scripts", "allow-modals"

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/filter_parameters.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/filter_parameters.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/mime_negotiation.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/mime_negotiation.rb Changed

@@ -16,12 +16,13 @@
 
       included do
         mattr_accessor :ignore_accept_header, default: false
+        cattr_accessor :return_only_media_type_on_content_type, default: false
       end
 
       # The MIME type of the HTTP request, such as Mime:xml.
       def content_mime_type
         fetch_header("action_dispatch.request.content_type") do |k|
-          v = if get_header("CONTENT_TYPE") =~ /^(^,\;*)/
+          v = if get_header("CONTENT_TYPE") =~ /^(^,;*)/
             Mime::Type.lookup($1.strip.downcase)
           else
             nil
@@ -33,7 +34,16 @@
       end
 
       def content_type
-        content_mime_type && content_mime_type.to_s
+        if self.class.return_only_media_type_on_content_type
+          ActiveSupport::Deprecation.warn(
+            "Rails 7.1 will return Content-Type header without modification." \
+            " If you want just the MIME type, please use `#media_type` instead."
+          )
+
+          content_mime_type&.to_s
+        else
+          super
+        end
       end
 
       def has_content_type? # :nodoc:
@@ -92,7 +102,7 @@
       def variant=(variant)
         variant = Array(variant)
 
-        if variant.all? { |v| v.is_a?(Symbol) }
+        if variant.all?(Symbol)
           @variant = ActiveSupport::ArrayInquirer.new(variant)
         else
           raise ArgumentError, "request.variant must be set to a Symbol or an Array of Symbols."
@@ -122,8 +132,8 @@
       # Sets the \formats by string extensions. This differs from #format= by allowing you
       # to set multiple, ordered formats, which is useful when you want to have a fallback.
       #
-      # In this example, the :iphone format will be used if it's available, otherwise it'll fallback
-      # to the :html format.
+      # In this example, the +:iphone+ format will be used if it's available, otherwise it'll fallback
+      # to the +:html+ format.
       #
       #   class ApplicationController < ActionController::Base
       #     before_action :adjust_format_for_iphone_with_html_fallback

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/mime_type.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/mime_type.rb Changed

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "singleton"
-require "active_support/core_ext/symbol/starts_ends_with"
 
 module Mime
   class Mimes
@@ -14,8 +13,8 @@
       @symbols = 
     end
 
-    def each
-      @mimes.each { |x| yield x }
+    def each(&block)
+      @mimes.each(&block)
     end
 
     def <<(type)
@@ -43,9 +42,9 @@
       Type.lookup_by_extension(type)
     end
 
-    def fetch(type)
+    def fetch(type, &block)
       return type if type.is_a?(Type)
-      EXTENSION_LOOKUP.fetch(type.to_s) { |k| yield k }
+      EXTENSION_LOOKUP.fetch(type.to_s, &block)
     end
   end
 
@@ -68,7 +67,7 @@
     @register_callbacks = 
 
     # A simple helper class used in parsing the accept header.
-    class AcceptItem #:nodoc:
+    class AcceptItem # :nodoc:
       attr_accessor :index, :name, :q
       alias :to_s :name
 
@@ -86,7 +85,7 @@
       end
     end
 
-    class AcceptList #:nodoc:
+    class AcceptList # :nodoc:
       def self.sort!(list)
         list.sort!
 
@@ -226,10 +225,9 @@
     attr_reader :hash
 
     MIME_NAME = "a-zA-Z0-9a-zA-Z0-9#{Regexp.escape('!#$&-^_.+')}{0,126}"
-    MIME_PARAMETER_KEY = "a-zA-Z0-9a-zA-Z0-9#{Regexp.escape('!#$&-^_.+')}{0,126}"
-    MIME_PARAMETER_VALUE = "#{Regexp.escape('"')}?a-zA-Z0-9a-zA-Z0-9#{Regexp.escape('!#$&-^_.+')}{0,126}#{Regexp.escape('"')}?"
-    MIME_PARAMETER = "\s*\;\s*#{MIME_PARAMETER_KEY}(?:\=#{MIME_PARAMETER_VALUE})?"
-    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
+    MIME_PARAMETER_VALUE = "#{Regexp.escape('"')}?#{MIME_NAME}#{Regexp.escape('"')}?"
+    MIME_PARAMETER = "\s*;\s*#{MIME_NAME}(?:=#{MIME_PARAMETER_VALUE})?"
+    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>#{MIME_PARAMETER})*\s*)\z/
 
     class InvalidMimeType < StandardError; end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/parameters.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/parameters.rb Changed

@@ -17,8 +17,8 @@
       # Raised when raw data from the request cannot be parsed by the parser
       # defined for request's content MIME type.
       class ParseError < StandardError
-        def initialize
-          super($!.message)
+        def initialize(message = $!.message)
+          super(message)
         end
       end
 
@@ -62,7 +62,7 @@
       end
       alias :params :parameters
 
-      def path_parameters=(parameters) #:nodoc:
+      def path_parameters=(parameters) # :nodoc:
         delete_header("action_dispatch.request.parameters")
 
         parameters = Request::Utils.set_binary_encoding(self, parameters, parameters:controller, parameters:action)
@@ -78,7 +78,7 @@
       # Returns a hash with the \parameters used to form the \path of the request.
       # Returned hash keys are strings:
       #
-      #   {'action' => 'my_action', 'controller' => 'my_controller'}
+      #   { action: "my_action", controller: "my_controller" }
       def path_parameters
         get_header(PARAMETERS_KEY) || set_header(PARAMETERS_KEY, {})
       end
@@ -93,7 +93,7 @@
             strategy.call(raw_post)
           rescue # JSON or Ruby code block errors.
             log_parse_error_once
-            raise ParseError
+            raise ParseError, "Error occurred while parsing request parameters"
           end
         end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/permissions_policy.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/permissions_policy.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/request.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/request.rb Changed

@@ -42,11 +42,8 @@
         HTTP_NEGOTIATE HTTP_PRAGMA HTTP_CLIENT_IP
         HTTP_X_FORWARDED_FOR HTTP_ORIGIN HTTP_VERSION
         HTTP_X_CSRF_TOKEN HTTP_X_REQUEST_ID HTTP_X_FORWARDED_HOST
-        SERVER_ADDR
         .freeze
 
-    # TODO: Remove SERVER_ADDR when we remove support to Rack 2.1.
-    # See https://github.com/rack/rack/commit/c173b188d81ee437b588c1e046a1c9f031dea550
     ENV_METHODS.each do |env|
       class_eval <<-METHOD, __FILE__, __LINE__ + 1
         # frozen_string_literal: true
@@ -90,7 +87,7 @@
         controller_param = name.underscore
         const_name = controller_param.camelize << "Controller"
         begin
-          ActiveSupport::Dependencies.constantize(const_name)
+          const_name.constantize
         rescue NameError => error
           if error.missing_name == const_name || const_name.start_with?("#{error.missing_name}::")
             raise MissingController.new(error.message, error.name)
@@ -165,7 +162,7 @@
       set_header(routes.env_key, name.dup)
     end
 
-    def request_method=(request_method) #:nodoc:
+    def request_method=(request_method) # :nodoc:
       if check_method(request_method)
         @request_method = set_header("REQUEST_METHOD", request_method)
       end
@@ -266,7 +263,7 @@
     #    # get "/articles"
     #    request.media_type # => "application/x-www-form-urlencoded"
     def media_type
-      content_mime_type.to_s
+      content_mime_type&.to_s
     end
 
     # Returns the content length of the request as an integer.
@@ -301,8 +298,8 @@
     ACTION_DISPATCH_REQUEST_ID = "action_dispatch.request_id" # :nodoc:
 
     # Returns the unique request id, which is based on either the X-Request-Id header that can
-    # be generated by a firewall, load balancer, or web server or by the RequestId middleware
-    # (which sets the action_dispatch.request_id environment variable).
+    # be generated by a firewall, load balancer, or web server, or by the RequestId middleware
+    # (which sets the +action_dispatch.request_id+ environment variable).
     #
     # This unique ID is useful for tracing a request from end-to-end as part of logging or debugging.
     # This relies on the Rack variable set by the ActionDispatch::RequestId middleware.
@@ -355,21 +352,15 @@
       FORM_DATA_MEDIA_TYPES.include?(media_type)
     end
 
-    def body_stream #:nodoc:
+    def body_stream # :nodoc:
       get_header("rack.input")
     end
 
-    # TODO This should be broken apart into AD::Request::Session and probably
-    # be included by the session middleware.
     def reset_session
-      if session && session.respond_to?(:destroy)
-        session.destroy
-      else
-        self.session = {}
-      end
+      session.destroy
     end
 
-    def session=(session) #:nodoc:
+    def session=(session) # :nodoc:
       Session.set self, session
     end
 
@@ -434,10 +425,6 @@
     def commit_flash
     end
 
-    def ssl?
-      super || scheme == "wss"
-    end
-
     def inspect # :nodoc:
       "#<#{self.class.name} #{method} #{original_url.dump} for #{remote_ip}>"
     end
@@ -447,6 +434,10 @@
         HTTP_METHOD_LOOKUPname || raise(ActionController::UnknownHttpMethod, "#{name}, accepted HTTP methods are #{HTTP_METHODS0...-1.join(', ')}, and #{HTTP_METHODS-1}")
         name
       end
+
+      def default_session
+        Session.disabled(self)
+      end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/response.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/response.rb Changed

@@ -21,9 +21,8 @@
   # Nevertheless, integration tests may want to inspect controller responses in
   # more detail, and that's when \Response can be useful for application
   # developers. Integration test methods such as
-  # ActionDispatch::Integration::Session#get and
-  # ActionDispatch::Integration::Session#post return objects of type
-  # TestResponse (which are of course also of type \Response).
+  # Integration::RequestHelpers#get and Integration::RequestHelpers#post return
+  # objects of type TestResponse (which are of course also of type \Response).
   #
   # For example, the following demo integration test prints the body of the
   # controller response to the console:
@@ -86,18 +85,6 @@
     cattr_accessor :default_charset, default: "utf-8"
     cattr_accessor :default_headers
 
-    def self.return_only_media_type_on_content_type=(*)
-      ActiveSupport::Deprecation.warn(
-        ".return_only_media_type_on_content_type= is dreprecated with no replacement and will be removed in 6.2."
-      )
-    end
-
-    def self.return_only_media_type_on_content_type
-      ActiveSupport::Deprecation.warn(
-        ".return_only_media_type_on_content_type is dreprecated with no replacement and will be removed in 6.2."
-      )
-    end
-
     include Rack::Response::Helpers
     # Aliasing these off because AD::Http::Cache::Response defines them.
     alias :_cache_control :cache_control
@@ -336,7 +323,7 @@
     # Avoid having to pass an open file handle as the response body.
     # Rack::Sendfile will usually intercept the response and uses
     # the path directly, so there is no reason to open the file.
-    class FileBody #:nodoc:
+    class FileBody # :nodoc:
       attr_reader :to_path
 
       def initialize(path)

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/http/url.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/http/url.rb Changed

@@ -71,7 +71,8 @@
           path = options:script_name.to_s.chomp("/")
           path << options:path if options.key?(:path)
 
-          add_trailing_slash(path) if options:trailing_slash
+          path = "/" if options:trailing_slash && path.blank?
+
           add_params(path, options:params) if options.key?(:params)
           add_anchor(path, options:anchor) if options.key?(:anchor)
 
@@ -101,14 +102,6 @@
             parts0..-(tld_length + 2)
           end
 
-          def add_trailing_slash(path)
-            if path.include?("?")
-              path.sub!(/\?/, '/\&')
-            elsif !path.include?(".")
-              path.sub!(/^\/\z|\A\z/, '\&/')
-            end
-          end
-
           def build_host_url(host, port, protocol, options, path)
             if match = host.match(HOST_REGEXP)
               protocol ||= match1 unless protocol == false
@@ -222,7 +215,7 @@
         if forwarded = x_forwarded_host.presence
           forwarded.split(/,\s?/).last
         else
-          get_header("HTTP_HOST") || "#{server_name || server_addr}:#{get_header('SERVER_PORT')}"
+          get_header("HTTP_HOST") || "#{server_name}:#{get_header('SERVER_PORT')}"
         end
       end
 
@@ -258,12 +251,10 @@
       #   req = ActionDispatch::Request.new 'HTTP_HOST' => 'example.com:8080'
       #   req.port # => 8080
       def port
-        @port ||= begin
-          if raw_host_with_port =~ /:(\d+)$/
-            $1.to_i
-          else
-            standard_port
-          end
+        @port ||= if raw_host_with_port =~ /:(\d+)$/
+          $1.to_i
+        else
+          standard_port
         end
       end
 
@@ -272,9 +263,10 @@
       #   req = ActionDispatch::Request.new 'HTTP_HOST' => 'example.com:8080'
       #   req.standard_port # => 80
       def standard_port
-        case protocol
-        when "https://" then 443
-        else 80
+        if "https://" == protocol
+          443
+        else
+          80
         end
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/gtg/builder.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/gtg/builder.rb Changed

@@ -6,13 +6,13 @@
   module Journey # :nodoc:
     module GTG # :nodoc:
       class Builder # :nodoc:
-        DUMMY = Nodes::Dummy.new
+        DUMMY_END_NODE = Nodes::Dummy.new
 
         attr_reader :root, :ast, :endpoints
 
         def initialize(root)
           @root      = root
-          @ast       = Nodes::Cat.new root, DUMMY
+          @ast       = Nodes::Cat.new root, DUMMY_END_NODE
           @followpos = build_followpos
         end
 
@@ -28,12 +28,12 @@
             markeds = true # mark s
 
             s.group_by { |state| symbol(state) }.each do |sym, ps|
-              u = ps.flat_map { |l| @followposl }
+              u = ps.flat_map { |l| @followposl }.uniq
               next if u.empty?
 
               from = state_ids
 
-              if u.all? { |pos| pos == DUMMY }
+              if u.all? { |pos| pos == DUMMY_END_NODE }
                 to = state_idObject.new
                 dtransfrom, to = sym
                 dtrans.add_accepting(to)
@@ -43,9 +43,9 @@
                 to = state_idu
                 dtransfrom, to = sym
 
-                if u.include?(DUMMY)
+                if u.include?(DUMMY_END_NODE)
                   ps.each do |state|
-                    if @followposstate.include?(DUMMY)
+                    if @followposstate.include?(DUMMY_END_NODE)
                       dtrans.add_memo(to, state.memo)
                     end
                   end
@@ -66,7 +66,10 @@
           when Nodes::Group
             true
           when Nodes::Star
-            true
+            # the default star regex is /(.+)/ which is NOT nullable
+            # but since different constraints can be provided we must
+            # actually check if this is the case or not.
+            node.regexp.match?("")
           when Nodes::Or
             node.children.any? { |c| nullable?(c) }
           when Nodes::Cat
@@ -104,7 +107,7 @@
         def lastpos(node)
           case node
           when Nodes::Star
-            firstpos(node.left)
+            lastpos(node.left)
           when Nodes::Or
             node.children.flat_map { |c| lastpos(c) }.tap(&:uniq!)
           when Nodes::Cat
@@ -131,10 +134,6 @@
                 lastpos(n.left).each do |i|
                   tablei += firstpos(n.right)
                 end
-              when Nodes::Star
-                lastpos(n).each do |i|
-                  tablei += firstpos(n)
-                end
               end
             end
             table

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/gtg/simulator.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/gtg/simulator.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/gtg/transition_table.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/gtg/transition_table.rb Changed

@@ -10,11 +10,15 @@
 
         attr_reader :memos
 
+        DEFAULT_EXP = /^.\/?+/
+        DEFAULT_EXP_ANCHORED = /\A#{DEFAULT_EXP}\Z/
+
         def initialize
-          @regexp_states = {}
-          @string_states = {}
-          @accepting     = {}
-          @memos         = Hash.new { |h, k| hk =  }
+          @stdparam_states = {}
+          @regexp_states   = {}
+          @string_states   = {}
+          @accepting       = {}
+          @memos           = Hash.new { |h, k| hk =  }
         end
 
         def add_accepting(state)
@@ -41,22 +45,54 @@
           Array(t)
         end
 
-        def move(t, a)
+        def move(t, full_string, start_index, end_index)
           return  if t.empty?
 
-          regexps = 
-          strings = 
+          next_states = 
 
-          t.each { |s|
-            if states = @regexp_statess
-              states.each { |re, v| regexps << v if re.match?(a) && !v.nil? }
+          tok = full_string.slice(start_index, end_index - start_index)
+          token_matches_default_component = DEFAULT_EXP_ANCHORED.match?(tok)
+
+          t.each { |s, previous_start|
+            if previous_start.nil?
+              # In the simple case of a "default" param regex do this fast-path
+              # and add all next states.
+              if token_matches_default_component && states = @stdparam_statess
+                states.each { |re, v| next_states << v, nil.freeze if !v.nil? }
+              end
+
+              # When we have a literal string, we can just pull the next state
+              if states = @string_statess
+                next_states << statestok, nil.freeze unless statestok.nil?
+              end
             end
 
-            if states = @string_statess
-              strings << statesa unless statesa.nil?
+            # For regexes that aren't the "default" style, they may potentially
+            # not be terminated by the first "token" ./?, so we need to continue
+            # to attempt to match this regexp as well as any successful paths that
+            # continue out of it. both paths could be valid.
+            if states = @regexp_statess
+              slice_start = if previous_start.nil?
+                start_index
+              else
+                previous_start
+              end
+
+              slice_length = end_index - slice_start
+              curr_slice = full_string.slice(slice_start, slice_length)
+
+              states.each { |re, v|
+                # if we match, we can try moving past this
+                next_states << v, nil.freeze if !v.nil? && re.match?(curr_slice)
+              }
+
+              # and regardless, we must continue accepting tokens and retrying this regexp.
+              # we need to remember where we started as well so we can take bigger slices.
+              next_states << s, slice_start.freeze
             end
           }
-          strings.concat regexps
+
+          next_states
         end
 
         def as_json(options = nil)
@@ -69,9 +105,10 @@
           end
 
           {
-            regexp_states: simple_regexp,
-            string_states: @string_states,
-            accepting:     @accepting
+            regexp_states:   simple_regexp,
+            string_states:   @string_states,
+            stdparam_states: @stdparam_states,
+            accepting:       @accepting
           }
         end
 
@@ -93,7 +130,7 @@
           states    = "function tt() { return #{to_json}; }"
 
           fun_routes = paths.sample(3).map do |ast|
-            ast.map { |n|
+            ast.filter_map { |n|
               case n
               when Nodes::Symbol
                 case n.left
@@ -106,7 +143,7 @@
               else
                 nil
               end
-            }.compact.join
+            }.join
           end
 
           stylesheets = fsm_css
@@ -125,18 +162,33 @@
 
         def =(from, to, sym)
           to_mappings = states_hash_for(sym)from ||= {}
+          case sym
+          when Regexp
+            # we must match the whole string to a token boundary
+            if sym == DEFAULT_EXP
+              sym = DEFAULT_EXP_ANCHORED
+            else
+              sym = /\A#{sym}\Z/
+            end
+          when Symbol
+            # account for symbols in the constraints the same as strings
+            sym = sym.to_s
+          end
           to_mappingssym = to
         end
 
         def states
           ss = @string_states.keys + @string_states.values.flat_map(&:values)
+          ps = @stdparam_states.keys + @stdparam_states.values.flat_map(&:values)
           rs = @regexp_states.keys + @regexp_states.values.flat_map(&:values)
-          (ss + rs).uniq
+          (ss + ps + rs).uniq
         end
 
         def transitions
           @string_states.flat_map { |from, hash|
             hash.map { |s, to| from, s, to }
+          } + @stdparam_states.flat_map { |from, hash|
+            hash.map { |s, to| from, s, to }
           } + @regexp_states.flat_map { |from, hash|
             hash.map { |s, to| from, s, to }
           }
@@ -145,10 +197,14 @@
         private
           def states_hash_for(sym)
             case sym
-            when String
+            when String, Symbol
               @string_states
             when Regexp
-              @regexp_states
+              if sym == DEFAULT_EXP
+                @stdparam_states
+              else
+                @regexp_states
+              end
             else
               raise ArgumentError, "unknown symbol: %s" % sym.class
             end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/nodes/node.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/nodes/node.rb Changed

@@ -4,6 +4,66 @@
 
 module ActionDispatch
   module Journey # :nodoc:
+    class Ast # :nodoc:
+      attr_reader :names, :path_params, :tree, :wildcard_options, :terminals
+      alias :root :tree
+
+      def initialize(tree, formatted)
+        @tree = tree
+        @path_params = 
+        @names = 
+        @symbols = 
+        @stars = 
+        @terminals = 
+        @wildcard_options = {}
+
+        visit_tree(formatted)
+      end
+
+      def requirements=(requirements)
+        # inject any regexp requirements for `star` nodes so they can be
+        # determined nullable, which requires knowing if the regex accepts an
+        # empty string.
+        (symbols + stars).each do |node|
+          re = requirementsnode.to_sym
+          node.regexp = re if re
+        end
+      end
+
+      def route=(route)
+        terminals.each { |n| n.memo = route }
+      end
+
+      def glob?
+        stars.any?
+      end
+
+      private
+        attr_reader :symbols, :stars
+
+        def visit_tree(formatted)
+          tree.each do |node|
+            if node.symbol?
+              path_params << node.to_sym
+              names << node.name
+              symbols << node
+            elsif node.star?
+              stars << node
+
+              if formatted != false
+                # Add a constraint for wildcard route to make it non-greedy and
+                # match the optional format part of the route by default.
+                wildcard_optionsnode.name.to_sym ||= /.+?/m
+              end
+            end
+
+            if node.terminal?
+              terminals << node
+            end
+          end
+        end
+    end
+
     module Nodes # :nodoc:
       class Node # :nodoc:
         include Enumerable
@@ -78,7 +138,7 @@
         alias :symbol :regexp
         attr_reader :name
 
-        DEFAULT_EXP = /^\.\/\?+/
+        DEFAULT_EXP = /^.\/?+/
         GREEDY_EXP = /(.+)/
         def initialize(left, regexp = DEFAULT_EXP)
           super(left)
@@ -86,10 +146,6 @@
           @name = -left.tr("*:", "")
         end
 
-        def default_regexp?
-          regexp == DEFAULT_EXP
-        end
-
         def type; :SYMBOL; end
         def symbol?; true; end
       end
@@ -104,6 +160,15 @@
       end
 
       class Star < Unary # :nodoc:
+        attr_accessor :regexp
+
+        def initialize(left)
+          super(left)
+
+          # By default wildcard routes are non-greedy and must match something.
+          @regexp = /.+?/m
+        end
+
         def star?; true; end
         def type; :STAR; end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/path/pattern.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/path/pattern.rb Changed

@@ -4,15 +4,16 @@
   module Journey # :nodoc:
     module Path # :nodoc:
       class Pattern # :nodoc:
-        attr_reader :spec, :requirements, :anchored
+        attr_reader :ast, :names, :requirements, :anchored, :spec
 
         def initialize(ast, requirements, separators, anchored)
-          @spec         = ast
+          @ast          = ast
+          @spec         = ast.root
           @requirements = requirements
           @separators   = separators
           @anchored     = anchored
 
-          @names          = nil
+          @names          = ast.names
           @optional_names = nil
           @required_names = nil
           @re             = nil
@@ -27,20 +28,28 @@
           required_names
           offsets
           to_regexp
-          nil
+          @ast = nil
         end
 
-        def ast
-          @spec.find_all(&:symbol?).each do |node|
-            re = @requirementsnode.to_sym
-            node.regexp = re if re
-          end
+        def requirements_anchored?
+          # each required param must not be surrounded by a literal, otherwise it isn't simple to chunk-match the url piecemeal
+          terminals = ast.terminals
 
-          @spec
-        end
+          terminals.each_with_index { |s, index|
+            next if index < 1
+            next if s.type == :DOT || s.type == :SLASH
+
+            back = terminalsindex - 1
+            fwd = terminalsindex + 1
+
+            # we also don't support this yet, constraints must be regexps
+            return false if s.symbol? && s.regexp.is_a?(Array)
+
+            return false if back.literal?
+            return false if !fwd.nil? && fwd.literal?
+          }
 
-        def names
-          @names ||= spec.find_all(&:symbol?).map(&:name)
+          true
         end
 
         def required_names

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/route.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/route.rb Changed

@@ -5,7 +5,7 @@
   module Journey
     class Route
       attr_reader :app, :path, :defaults, :name, :precedence, :constraints,
-                  :internal, :scope_options
+                  :internal, :scope_options, :ast
 
       alias :conditions :constraints
 
@@ -65,29 +65,22 @@
         @_required_defaults = required_defaults
         @required_parts    = nil
         @parts             = nil
-        @decorated_ast     = nil
         @precedence        = precedence
         @path_formatter    = @path.build_formatter
         @scope_options     = scope_options
         @internal          = internal
+
+        @ast = @path.ast.root
+        @path.ast.route = self
       end
 
       def eager_load!
         path.eager_load!
-        ast
         parts
         required_defaults
         nil
       end
 
-      def ast
-        @decorated_ast ||= begin
-          decorated_ast = path.ast
-          decorated_ast.find_all(&:terminal?).each { |n| n.memo = self }
-          decorated_ast
-        end
-      end
-
       # Needed for `bin/rails routes`. Picks up succinctly defined requirements
       # for a route, for example route
       #
@@ -98,7 +91,7 @@
       # as requirements.
       def requirements
         @defaults.merge(path.requirements).delete_if { |_, v|
-          /.+?/ == v
+          /.+?/m == v
         }
       end
 
@@ -142,7 +135,7 @@
       end
 
       def glob?
-        path.spec.any?(Nodes::Star)
+        path.ast.glob?
       end
 
       def dispatcher?

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/router.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/router.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/router/utils.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/router/utils.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/routes.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/routes.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/visualizer/fsm.js -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/visualizer/fsm.js Changed

@@ -68,7 +68,7 @@
 }
 
 function highlight_finish(index) {
-  svg_nodesindex.select('polygon')
+  svg_nodesindex.select('ellipse')
     .style("fill", "while")
     .transition().duration(500)
     .style("fill", "blue");
@@ -76,54 +76,79 @@
 
 function match(input) {
   reset_graph();
-  var table         = tt();
-  var states        = 0;
-  var regexp_states = table'regexp_states';
-  var string_states = table'string_states';
-  var accepting     = table'accepting';
+  var table           = tt();
+  var states          = 0, null;
+  var regexp_states   = table'regexp_states';
+  var string_states   = table'string_states';
+  var stdparam_states = table'stdparam_states';
+  var accepting       = table'accepting';
+  var default_re      = new RegExp("^^.\/?+$");
+  var start_index     = 0;
 
   highlight_state(0);
 
   tokenize(input, function(token) {
+    var end_index = start_index + token.length;
+
     var new_states = ;
     for(var key in states) {
-      var state = stateskey;
+      var state_parts = stateskey;
+      var state = state_parts0;
+      var previous_start = state_parts1;
+
+      if(previous_start == null) {
+        if(string_statesstate && string_statesstatetoken) {
+          var new_state = string_statesstatetoken;
+          highlight_edge(state, new_state);
+          highlight_state(new_state);
+          new_states.push(new_state, null);
+        }
 
-      if(string_statesstate && string_statesstatetoken) {
-        var new_state = string_statesstatetoken;
-        highlight_edge(state, new_state);
-        highlight_state(new_state);
-        new_states.push(new_state);
+        if(stdparam_statesstate && default_re.test(token)) {
+          for(var key in stdparam_statesstate) {
+            var new_state = stdparam_statesstatekey;
+            highlight_edge(state, new_state);
+            highlight_state(new_state);
+            new_states.push(new_state, null);
+          }
+        }
       }
 
       if(regexp_statesstate) {
+        var slice_start = previous_start != null ? previous_start : start_index;
+
         for(var key in regexp_statesstate) {
           var re = new RegExp("^" + key + "$");
-          if(re.test(token)) {
+
+          var accumulation = input.slice(slice_start, end_index);
+
+          if(re.test(accumulation)) {
             var new_state = regexp_statesstatekey;
             highlight_edge(state, new_state);
             highlight_state(new_state);
-            new_states.push(new_state);
+            new_states.push(new_state, null);
           }
+
+          // retry the same regexp with the accumulated data either way
+          new_states.push(state, slice_start);
         }
       }
     }
 
-    if(new_states.length == 0) {
-      return;
-    }
     states = new_states;
+    start_index = end_index;
   });
 
   for(var key in states) {
-    var state = stateskey;
+    var state_parts = stateskey;
+    var state = state_parts0;
+    var slice_start = state_parts1;
+
+    // we must ignore ones that are still accepting more data
+    if (slice_start != null) continue;
+
     if(acceptingstate) {
-      for(var mkey in svg_edgesstate) {
-        if(!regexp_statesmkey && !string_statesmkey) {
-          highlight_edge(state, mkey);
-          highlight_finish(mkey);
-        }
-      }
+      highlight_finish(state);
     } else {
       highlight_state(state, "red");
     }

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/journey/visualizer/index.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/journey/visualizer/index.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/actionable_exceptions.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/actionable_exceptions.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/cookies.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/cookies.rb Changed

@@ -7,7 +7,7 @@
 require "rack/utils"
 
 module ActionDispatch
-  class Request
+  module RequestCookieMethods
     def cookie_jar
       fetch_header("action_dispatch.cookies") do
         self.cookie_jar = Cookies::CookieJar.build(self, cookies)
@@ -88,7 +88,11 @@
     # :startdoc:
   end
 
-  # Read and write data to cookies through ActionController#cookies.
+  ActiveSupport.on_load(:action_dispatch_request) do
+    include RequestCookieMethods
+  end
+
+  # Read and write data to cookies through ActionController::Base#cookies.
   #
   # When reading cookie data, the data is read from the HTTP request header, Cookie.
   # When writing cookie data, the data is sent out in the HTTP response header, Set-Cookie.
@@ -99,7 +103,7 @@
   #   # This cookie will be deleted when the user's browser is closed.
   #   cookies:user_name = "david"
   #
-  #   # Cookie values are String based. Other data types need to be serialized.
+  #   # Cookie values are String-based. Other data types need to be serialized.
   #   cookies:lat_lon = JSON.generate(47.68, -122.37)
   #
   #   # Sets a cookie that expires in 1 hour.
@@ -135,7 +139,7 @@
   #
   #   cookies.delete :user_name
   #
-  # Please note that if you specify a :domain when setting a cookie, you must also specify the domain when deleting the cookie:
+  # Please note that if you specify a +:domain+ when setting a cookie, you must also specify the domain when deleting the cookie:
   #
   #  cookies:name = {
   #    value: 'a yummy cookie',
@@ -172,6 +176,9 @@
   #   Default is +false+.
   # * <tt>:httponly</tt> - Whether this cookie is accessible via scripting or
   #   only HTTP. Defaults to +false+.
+  # * <tt>:same_site</tt> - The value of the +SameSite+ cookie attribute, which
+  #   determines how this cookie should be restricted in cross-site contexts.
+  #   Possible values are +:none+, +:lax+, and +:strict+. Defaults to +:lax+.
   class Cookies
     HTTP_HEADER   = "Set-Cookie"
     GENERATOR_KEY = "action_dispatch.key_generator"
@@ -195,7 +202,7 @@
     # Raised when storing more than 4K of session data.
     CookieOverflow = Class.new StandardError
 
-    # Include in a cookie jar to allow chaining, e.g. cookies.permanent.signed.
+    # Include in a cookie jar to allow chaining, e.g. +cookies.permanent.signed+.
     module ChainedCookieJars
       # Returns a jar that'll automatically set the assigned cookies to have an expiration date 20 years from now. Example:
       #
@@ -280,7 +287,7 @@
         end
     end
 
-    class CookieJar #:nodoc:
+    class CookieJar # :nodoc:
       include Enumerable, ChainedCookieJars
 
       # This regular expression is used to split the levels of a domain.
@@ -435,7 +442,7 @@
         end
 
         def write_cookie?(cookie)
-          request.ssl? || !cookie:secure || always_write_cookie
+          request.ssl? || !cookie:secure || always_write_cookie || request.host.end_with?(".onion")
         end
 
         def handle_options(options)

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/debug_exceptions.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/debug_exceptions.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/debug_locks.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/debug_locks.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/exception_wrapper.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/exception_wrapper.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/executor.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/executor.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/flash.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/flash.rb Changed

@@ -20,10 +20,11 @@
   #     end
   #   end
   #
-  #   show.html.erb
-  #     <% if flash:notice %>
-  #       <div class="notice"><%= flash:notice %></div>
-  #     <% end %>
+  # Then in +show.html.erb+:
+  #
+  #   <% if flash:notice %>
+  #     <div class="notice"><%= flash:notice %></div>
+  #   <% end %>
   #
   # Since the +notice+ and +alert+ keys are a common idiom, convenience accessors are available:
   #
@@ -41,9 +42,9 @@
     KEY = "action_dispatch.request.flash_hash"
 
     module RequestMethods
-      # Access the contents of the flash. Use <tt>flash"notice"</tt> to
-      # read a notice you put there or <tt>flash"notice" = "hello"</tt>
-      # to put a new one.
+      # Access the contents of the flash. Returns a ActionDispatch::Flash::FlashHash.
+      #
+      # See ActionDispatch::Flash for example usage.
       def flash
         flash = flash_hash
         return flash if flash
@@ -59,16 +60,14 @@
       end
 
       def commit_flash # :nodoc:
-        session    = self.session || {}
-        flash_hash = self.flash_hash
+        return unless session.enabled?
 
         if flash_hash && (flash_hash.present? || session.key?("flash"))
           session"flash" = flash_hash.to_session_value
           self.flash = flash_hash.dup
         end
 
-        if (!session.respond_to?(:loaded?) || session.loaded?) && # reset_session uses {}, which doesn't implement #loaded?
-            session.key?("flash") && session"flash".nil?
+        if session.loaded? && session.key?("flash") && session"flash".nil?
           session.delete("flash")
         end
       end
@@ -79,7 +78,7 @@
       end
     end
 
-    class FlashNow #:nodoc:
+    class FlashNow # :nodoc:
       attr_accessor :flash
 
       def initialize(flash)
@@ -111,7 +110,7 @@
     class FlashHash
       include Enumerable
 
-      def self.from_session_value(value) #:nodoc:
+      def self.from_session_value(value) # :nodoc:
         case value
         when FlashHash # Rails 3.1, 3.2
           flashes = value.instance_variable_get(:@flashes)
@@ -132,13 +131,13 @@
 
       # Builds a hash containing the flashes to keep for the next request.
       # If there are none to keep, returns +nil+.
-      def to_session_value #:nodoc:
+      def to_session_value # :nodoc:
         flashes_to_keep = @flashes.except(*@discard)
         return nil if flashes_to_keep.empty?
         { "discard" => , "flashes" => flashes_to_keep }
       end
 
-      def initialize(flashes = {}, discard = ) #:nodoc:
+      def initialize(flashes = {}, discard = ) # :nodoc:
         @discard = Set.new(stringify_array(discard))
         @flashes = flashes.stringify_keys
         @now     = nil
@@ -162,7 +161,7 @@
         @flashesk.to_s
       end
 
-      def update(h) #:nodoc:
+      def update(h) # :nodoc:
         @discard.subtract stringify_array(h.keys)
         @flashes.update h.stringify_keys
         self
@@ -202,7 +201,7 @@
 
       alias :merge! :update
 
-      def replace(h) #:nodoc:
+      def replace(h) # :nodoc:
         @discard.clear
         @flashes.replace h.stringify_keys
         self
@@ -253,7 +252,7 @@
       # Mark for removal entries that were kept, and delete unkept ones.
       #
       # This method is called automatically by filters, so you generally don't need to care about it.
-      def sweep #:nodoc:
+      def sweep # :nodoc:
         @discard.each { |k| @flashes.delete k }
         @discard.replace @flashes.keys
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/host_authorization.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/host_authorization.rb Changed

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "action_dispatch/http/request"
-
 module ActionDispatch
   # This middleware guards from DNS rebinding attacks by explicitly permitting
   # the hosts a request can be sent to, and is passed the options set in
@@ -13,8 +11,22 @@
   #
   # When a request comes to an unauthorized host, the +response_app+
   # application will be executed and rendered. If no +response_app+ is given, a
-  # default one will run, which responds with <tt>403 Forbidden</tt>.
+  # default one will run.
+  # The default response app logs blocked host info with level 'error' and
+  # responds with <tt>403 Forbidden</tt>. The body of the response contains debug info
+  # if +config.consider_all_requests_local+ is set to true, otherwise the body is empty.
   class HostAuthorization
+    ALLOWED_HOSTS_IN_DEVELOPMENT = ".localhost", IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")
+    PORT_REGEX = /(?::\d+)/ # :nodoc:
+    IPV4_HOSTNAME = /(?<host>\d+\.\d+\.\d+\.\d+)#{PORT_REGEX}?/ # :nodoc:
+    IPV6_HOSTNAME = /(?<host>a-f0-9*:a-f0-9.:+)/i # :nodoc:
+    IPV6_HOSTNAME_WITH_PORT = /\#{IPV6_HOSTNAME}\#{PORT_REGEX}/i # :nodoc:
+    VALID_IP_HOSTNAME = Regexp.union( # :nodoc:
+      /\A#{IPV4_HOSTNAME}\z/,
+      /\A#{IPV6_HOSTNAME}\z/,
+      /\A#{IPV6_HOSTNAME_WITH_PORT}\z/,
+    )
+
     class Permissions # :nodoc:
       def initialize(hosts)
         @hosts = sanitize_hosts(hosts)
@@ -26,11 +38,17 @@
 
       def allows?(host)
         @hosts.any? do |allowed|
-          allowed === host
-        rescue
-          # IPAddr#=== raises an error if you give it a hostname instead of
-          # IP. Treat similar errors as blocked access.
-          false
+          if allowed.is_a?(IPAddr)
+            begin
+              allowed === extract_hostname(host)
+            rescue
+              # IPAddr#=== raises an error if you give it a hostname instead of
+              # IP. Treat similar errors as blocked access.
+              false
+            end
+          else
+            allowed === host
+          end
         end
       end
 
@@ -46,46 +64,67 @@
         end
 
         def sanitize_regexp(host)
-          /\A#{host}\z/
+          /\A#{host}#{PORT_REGEX}?\z/
         end
 
         def sanitize_string(host)
           if host.start_with?(".")
-            /\A(.+\.)?#{Regexp.escape(host1..-1)}\z/i
+            /\A(a-z0-9-+\.)?#{Regexp.escape(host1..-1)}#{PORT_REGEX}?\z/i
           else
-            /\A#{Regexp.escape host}\z/i
+            /\A#{Regexp.escape host}#{PORT_REGEX}?\z/i
           end
         end
+
+        def extract_hostname(host)
+          host.slice(VALID_IP_HOSTNAME, "host") || host
+        end
     end
 
-    DEFAULT_RESPONSE_APP = -> env do
-      request = Request.new(env)
+    class DefaultResponseApp # :nodoc:
+      RESPONSE_STATUS = 403
+
+      def call(env)
+        request = Request.new(env)
+        format = request.xhr? ? "text/plain" : "text/html"
+
+        log_error(request)
+        response(format, response_body(request))
+      end
 
-      format = request.xhr? ? "text/plain" : "text/html"
-      template = DebugView.new(host: request.host)
-      body = template.render(template: "rescues/blocked_host", layout: "rescues/layout")
+      private
+        def response_body(request)
+          return "" unless request.get_header("action_dispatch.show_detailed_exceptions")
 
-      403, {
-        "Content-Type" => "#{format}; charset=#{Response.default_charset}",
-        "Content-Length" => body.bytesize.to_s,
-      }, body
+          template = DebugView.new(host: request.host)
+          template.render(template: "rescues/blocked_host", layout: "rescues/layout")
+        end
+
+        def response(format, body)
+          RESPONSE_STATUS,
+           { "Content-Type" => "#{format}; charset=#{Response.default_charset}",
+             "Content-Length" => body.bytesize.to_s },
+           body
+        end
+
+        def log_error(request)
+          logger = available_logger(request)
+
+          return unless logger
+
+          logger.error("#{self.class.name} Blocked host: #{request.host}")
+        end
+
+        def available_logger(request)
+          request.logger || ActionView::Base.logger
+        end
     end
 
-    def initialize(app, hosts, deprecated_response_app = nil, exclude: nil, response_app: nil)
+    def initialize(app, hosts, exclude: nil, response_app: nil)
       @app = app
       @permissions = Permissions.new(hosts)
       @exclude = exclude
 
-      unless deprecated_response_app.nil?
-        ActiveSupport::Deprecation.warn(<<-MSG.squish)
-          `action_dispatch.hosts_response_app` is deprecated and will be ignored in Rails 6.2.
-          Use the Host Authorization `response_app` setting instead.
-        MSG
-
-        response_app ||= deprecated_response_app
-      end
-
-      @response_app = response_app || DEFAULT_RESPONSE_APP
+      @response_app = response_app || DefaultResponseApp.new
     end
 
     def call(env)
@@ -102,13 +141,9 @@
     end
 
     private
-      HOSTNAME = /a-z0-9.-+|\a-f0-9*:a-f0-9.:+\/i
-      VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
-      VALID_FORWARDED_HOST = /(?:\A|, ?)(#{HOSTNAME})(?::\d+)?\z/
-
       def authorized?(request)
-        origin_host = request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
-        forwarded_host = request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
+        origin_host = request.get_header("HTTP_HOST")
+        forwarded_host = request.x_forwarded_host&.split(/,\s?/)&.last
 
         @permissions.allows?(origin_host) && (forwarded_host.blank? || @permissions.allows?(forwarded_host))
       end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/remote_ip.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/remote_ip.rb Changed

@@ -51,10 +51,8 @@
     # clients (like WAP devices), or behind proxies that set headers in an
     # incorrect or confusing way (like AWS ELB).
     #
-    # The +custom_proxies+ argument can take an Array of string, IPAddr, or
-    # Regexp objects which will be used instead of +TRUSTED_PROXIES+. If a
-    # single string, IPAddr, or Regexp object is provided, it will be used in
-    # addition to +TRUSTED_PROXIES+. Any proxy setup will put the value you
+    # The +custom_proxies+ argument can take an enumerable which will be used
+    # instead of +TRUSTED_PROXIES+. Any proxy setup will put the value you
     # want in the middle (or at the beginning) of the X-Forwarded-For list,
     # with your proxy servers after it. If your proxies aren't removed, pass
     # them in via the +custom_proxies+ parameter. That way, the middleware will
@@ -67,6 +65,20 @@
       elsif custom_proxies.respond_to?(:any?)
         custom_proxies
       else
+        ActiveSupport::Deprecation.warn(<<~EOM)
+          Setting config.action_dispatch.trusted_proxies to a single value has
+          been deprecated. Please set this to an enumerable instead. For
+          example, instead of:
+
+          config.action_dispatch.trusted_proxies = IPAddr.new("10.0.0.0/8")
+
+          Wrap the value in an Array:
+
+          config.action_dispatch.trusted_proxies = IPAddr.new("10.0.0.0/8")
+
+          Note that unlike passing a single argument, passing an enumerable
+          will *replace* the default set of trusted proxies.
+        EOM
         Array(custom_proxies) + TRUSTED_PROXIES
       end
     end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/request_id.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/request_id.rb Changed

_service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/server_timing.rb Added

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "active_support/notifications"
+
+module ActionDispatch
+  class ServerTiming
+    SERVER_TIMING_HEADER = "Server-Timing"
+
+    class Subscriber # :nodoc:
+      include Singleton
+      KEY = :action_dispatch_server_timing_events
+
+      def initialize
+        @mutex = Mutex.new
+      end
+
+      def call(event)
+        if events = ActiveSupport::IsolatedExecutionStateKEY
+          events << event
+        end
+      end
+
+      def collect_events
+        events = 
+        ActiveSupport::IsolatedExecutionStateKEY = events
+        yield
+        events
+      ensure
+        ActiveSupport::IsolatedExecutionState.delete(KEY)
+      end
+
+      def ensure_subscribed
+        @mutex.synchronize do
+          # Subscribe to all events, except those beginning with "!"
+          # Ideally we would be more selective of what is being measured
+          @subscriber ||= ActiveSupport::Notifications.subscribe(/\A^!/, self)
+        end
+      end
+
+      def unsubscribe
+        @mutex.synchronize do
+          ActiveSupport::Notifications.unsubscribe @subscriber
+          @subscriber = nil
+        end
+      end
+    end
+
+    def self.unsubscribe # :nodoc:
+      Subscriber.instance.unsubscribe
+    end
+
+    def initialize(app)
+      @app = app
+      @subscriber = Subscriber.instance
+      @subscriber.ensure_subscribed
+    end
+
+    def call(env)
+      response = nil
+      events = @subscriber.collect_events do
+        response = @app.call(env)
+      end
+
+      headers = response1
+
+      header_info = events.group_by(&:name).map do |event_name, events_collection|
+        "%s;dur=%.2f" % event_name, events_collection.sum(&:duration)
+      end
+
+      header_info.prepend(headersSERVER_TIMING_HEADER) if headersSERVER_TIMING_HEADER.present?
+      headersSERVER_TIMING_HEADER = header_info.join(", ")
+
+      response
+    end
+  end
+end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/session/abstract_store.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/session/abstract_store.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/session/cookie_store.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/session/cookie_store.rb Changed

@@ -9,14 +9,14 @@
     # This cookie-based session store is the Rails default. It is
     # dramatically faster than the alternatives.
     #
-    # Sessions typically contain at most a user_id and flash message; both fit
-    # within the 4096 bytes cookie size limit. A CookieOverflow exception is raised if
+    # Sessions typically contain at most a user ID and flash message; both fit
+    # within the 4096 bytes cookie size limit. A +CookieOverflow+ exception is raised if
     # you attempt to store more than 4096 bytes of data.
     #
     # The cookie jar used for storage is automatically configured to be the
     # best possible option given your application's configuration.
     #
-    # Your cookies will be encrypted using your apps secret_key_base. This
+    # Your cookies will be encrypted using your application's +secret_key_base+. This
     # goes a step further than signed cookies in that encrypted cookies cannot
     # be altered or read by users. This is the default starting in Rails 4.
     #
@@ -24,28 +24,28 @@
     #
     #   Rails.application.config.session_store :cookie_store, key: '_your_app_session'
     #
-    # In the development and test environments your application's secret key base is
+    # In the development and test environments your application's +secret_key_base+ is
     # generated by Rails and stored in a temporary file in <tt>tmp/development_secret.txt</tt>.
     # In all other environments, it is stored encrypted in the
     # <tt>config/credentials.yml.enc</tt> file.
     #
-    # If your application was not updated to Rails 5.2 defaults, the secret_key_base
+    # If your application was not updated to Rails 5.2 defaults, the +secret_key_base+
     # will be found in the old <tt>config/secrets.yml</tt> file.
     #
-    # Note that changing your secret_key_base will invalidate all existing session.
+    # Note that changing your +secret_key_base+ will invalidate all existing session.
     # Additionally, you should take care to make sure you are not relying on the
     # ability to decode signed cookies generated by your app in external
     # applications or JavaScript before changing it.
     #
-    # Because CookieStore extends Rack::Session::Abstract::Persisted, many of the
+    # Because CookieStore extends +Rack::Session::Abstract::Persisted+, many of the
     # options described there can be used to customize the session cookie that
     # is generated. For example:
     #
     #   Rails.application.config.session_store :cookie_store, expire_after: 14.days
     #
     # would set the session cookie to expire automatically 14 days after creation.
-    # Other useful options include <tt>:key</tt>, <tt>:secure</tt> and
-    # <tt>:httponly</tt>.
+    # Other useful options include <tt>:key</tt>, <tt>:secure</tt>,
+    # <tt>:httponly</tt>, and <tt>:same_site</tt>.
     class CookieStore < AbstractSecureStore
       class SessionId < DelegateClass(Rack::Session::SessionId)
         attr_reader :cookie_value

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/show_exceptions.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/show_exceptions.rb Changed

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "action_dispatch/http/request"
 require "action_dispatch/middleware/exception_wrapper"
 
 module ActionDispatch
@@ -15,14 +14,8 @@
   # If the application returns a "X-Cascade" pass response, this middleware
   # will send an empty response as result with the correct status code.
   # If any exception happens inside the exceptions app, this middleware
-  # catches the exceptions and returns a FAILSAFE_RESPONSE.
+  # catches the exceptions and returns a failsafe response.
   class ShowExceptions
-    FAILSAFE_RESPONSE = 500, { "Content-Type" => "text/plain" },
-      "500 Internal Server Error\n" \
-       "If you are the administrator of this website, then please read this web " \
-       "application's log file and/or the web server's log file to find out what " \
-       "went wrong."
-
     def initialize(app, exceptions_app)
       @app = app
       @exceptions_app = exceptions_app
@@ -47,13 +40,28 @@
         request.set_header "action_dispatch.exception", wrapper.unwrapped_exception
         request.set_header "action_dispatch.original_path", request.path_info
         request.set_header "action_dispatch.original_request_method", request.raw_request_method
+        fallback_to_html_format_if_invalid_mime_type(request)
         request.path_info = "/#{status}"
         request.request_method = "GET"
         response = @exceptions_app.call(request.env)
         response1"X-Cascade" == "pass" ? pass_response(status) : response
       rescue Exception => failsafe_error
         $stderr.puts "Error during failsafe response: #{failsafe_error}\n  #{failsafe_error.backtrace * "\n  "}"
-        FAILSAFE_RESPONSE
+
+        500, { "Content-Type" => "text/plain" },
+          "500 Internal Server Error\n" \
+          "If you are the administrator of this website, then please read this web " \
+          "application's log file and/or the web server's log file to find out what " \
+          "went wrong."
+      end
+
+      def fallback_to_html_format_if_invalid_mime_type(request)
+        # If the MIME type for the request is invalid then the
+        # @exceptions_app may not be able to handle it. To make it
+        # easier to handle, we switch to HTML.
+        request.formats
+      rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+        request.set_header "HTTP_ACCEPT", "text/html"
       end
 
       def pass_response(status)

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/stack.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/stack.rb Changed

@@ -72,8 +72,8 @@
       yield(self) if block_given?
     end
 
-    def each
-      @middlewares.each { |x| yield x }
+    def each(&block)
+      @middlewares.each(&block)
     end
 
     def size
@@ -91,7 +91,7 @@
     def unshift(klass, *args, &block)
       middlewares.unshift(build_middleware(klass, args, block))
     end
-    ruby2_keywords(:unshift) if respond_to?(:ruby2_keywords, true)
+    ruby2_keywords(:unshift)
 
     def initialize_copy(other)
       self.middlewares = other.middlewares.dup
@@ -101,7 +101,7 @@
       index = assert_index(index, :before)
       middlewares.insert(index, build_middleware(klass, args, block))
     end
-    ruby2_keywords(:insert) if respond_to?(:ruby2_keywords, true)
+    ruby2_keywords(:insert)
 
     alias_method :insert_before, :insert
 
@@ -109,17 +109,29 @@
       index = assert_index(index, :after)
       insert(index + 1, *args, &block)
     end
-    ruby2_keywords(:insert_after) if respond_to?(:ruby2_keywords, true)
+    ruby2_keywords(:insert_after)
 
     def swap(target, *args, &block)
       index = assert_index(target, :before)
       insert(index, *args, &block)
       middlewares.delete_at(index + 1)
     end
-    ruby2_keywords(:swap) if respond_to?(:ruby2_keywords, true)
+    ruby2_keywords(:swap)
 
+    # Deletes a middleware from the middleware stack.
+    #
+    # Returns the array of middlewares not including the deleted item, or
+    # returns nil if the target is not found.
     def delete(target)
-      middlewares.delete_if { |m| m.klass == target }
+      middlewares.reject! { |m| m.name == target.name }
+    end
+
+    # Deletes a middleware from the middleware stack.
+    #
+    # Returns the array of middlewares not including the deleted item, or
+    # raises +RuntimeError+ if the target is not found.
+    def delete!(target)
+      delete(target) || (raise "No such middleware to remove: #{target.inspect}")
     end
 
     def move(target, source)
@@ -143,7 +155,7 @@
     def use(klass, *args, &block)
       middlewares.push(build_middleware(klass, args, block))
     end
-    ruby2_keywords(:use) if respond_to?(:ruby2_keywords, true)
+    ruby2_keywords(:use)
 
     def build(app = nil, &block)
       instrumenting = ActiveSupport::Notifications.notifier.listening?(InstrumentationProxy::EVENT_NAME)
@@ -158,7 +170,7 @@
 
     private
       def assert_index(index, where)
-        i = index.is_a?(Integer) ? index : middlewares.index { |m| m.klass == index }
+        i = index.is_a?(Integer) ? index : index_of(index)
         raise "No such middleware to insert #{where}: #{index.inspect}" unless i
         i
       end
@@ -166,5 +178,11 @@
       def build_middleware(klass, args, block)
         Middleware.new(klass, args, block)
       end
+
+      def index_of(klass)
+        middlewares.index do |m|
+          m.name == klass.name
+        end
+      end
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/static.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/static.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/_message_and_suggestions.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/_message_and_suggestions.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb Changed

@@ -1,24 +1,17 @@
-<% unless @exception.blamed_files.blank? %>
-  <% if (hide = @exception.blamed_files.length > 8) %>
-    <a href="#" onclick="return toggleTrace()">Toggle blamed files</a>
-  <% end %>
-  <pre id="blame_trace" <%='style="display:none"' if hide %>><code><%= @exception.describe_blame %></code></pre>
-<% end %>
-
-<h2 style="margin-top: 30px">Request</h2>
+<h2 class="request-heading">Request</h2>
 <% if params_valid? %>
   <p><b>Parameters</b>:</p> <pre><%= debug_params(@request.filtered_parameters) %></pre>
 <% end %>
 
 <div class="details">
   <div class="summary"><a href="#" onclick="return toggleSessionDump()">Toggle session dump</a></div>
-  <div id="session_dump" style="display:none"><pre><%= debug_hash @request.session %></pre></div>
+  <div id="session_dump" class="hidden"><pre><%= debug_hash @request.session %></pre></div>
 </div>
 
 <div class="details">
   <div class="summary"><a href="#" onclick="return toggleEnvDump()">Toggle env dump</a></div>
-  <div id="env_dump" style="display:none"><pre><%= debug_hash @request.env.slice(*@request.class::ENV_METHODS) %></pre></div>
+  <div id="env_dump" class="hidden"><pre><%= debug_hash @request.env.slice(*@request.class::ENV_METHODS) %></pre></div>
 </div>
 
-<h2 style="margin-top: 30px">Response</h2>
+<h2 class="response-heading">Response</h2>
 <p><b>Headers</b>:</p> <pre><%= debug_headers(defined?(@response) ? @response.headers : {}) %></pre>

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb Changed

@@ -7,7 +7,7 @@
   </h1>
 </header>
 
-<div id="container">
+<main role="main" id="container">
   <%= render "rescues/message_and_suggestions", exception: @exception %>
   <%= render "rescues/actions", exception: @exception, request: @request %>
 
@@ -20,16 +20,16 @@
 
   <% @exception_wrapper.wrapped_causes.each.with_index(1) do |wrapper, index| %>
     <div class="details">
-      <a class="summary" href="#" style="color: #F0F0F0; text-decoration: none; background: #C52F24; border-bottom: none;" onclick="return toggle(<%= wrapper.exception.object_id %>)">
+      <a class="summary" href="#" onclick="return toggle(<%= wrapper.exception.object_id %>)">
         <%= wrapper.exception.class.name %>: <%= h wrapper.exception.message %>
       </a>
     </div>
 
-    <div id="<%= wrapper.exception.object_id %>" style="display: none;">
+    <div id="<%= wrapper.exception.object_id %>" class="hidden">
       <%= render "rescues/source", source_extracts: wrapper.source_extracts, show_source_idx: wrapper.source_to_show_id, error_index: index %>
       <%= render "rescues/trace", traces: wrapper.traces, trace_to_show: wrapper.trace_to_show, error_index: index %>
     </div>
   <% end %>
 
   <%= render template: "rescues/_request_and_response" %>
-</div>
+</main>

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/layout.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/layout.erb Changed

@@ -49,11 +49,19 @@
       line-height: 25px;
     }
 
+    code.traces {
+      font-size: 11px;
+    }
+
+    .response-heading, .request-heading {
+      margin-top: 30px;
+    }
+
     .exception-message {
       padding: 8px 0;
     }
 
-    .exception-message .message{
+    .exception-message .message {
       margin-bottom: 8px;
       line-height: 25px;
       font-size: 1.5em;
@@ -75,6 +83,13 @@
       display: block;
     }
 
+    a.summary {
+      color: #F0F0F0;
+      text-decoration: none;
+      background: #C52F24;
+      border-bottom: none;
+    }
+
     .details pre {
       margin: 5px;
       border: none;
@@ -114,7 +129,7 @@
 
     .source .data .line_numbers {
       background-color: #ECECEC;
-      color: #AAA;
+      color: #555;
       padding: 1em .5em;
       border-right: 1px solid #DDD;
       text-align: right;
@@ -143,6 +158,10 @@
       display: none;
     }
 
+    .correction {
+      list-style-type: none;
+    }
+
     inputtype="submit" {
       color: white;
       background-color: #C00;
@@ -153,6 +172,7 @@
       font-weight: bold;
       margin: 0;
       padding: 10px 18px;
+      cursor: pointer;
       -webkit-appearance: none;
     }
     inputtype="submit":focus,
@@ -164,15 +184,14 @@
       transform: translateY(1px)
     }
 
-
     a { color: #980905; }
     a:visited { color: #666; }
     a.trace-frames {
       color: #666;
       overflow-wrap: break-word;
     }
-    a:hover { color: #C00; }
-    a.trace-frames.selected { color: #C00 }
+    a:hover, a.trace-frames.selected { color: #C00; }
+    a.summary:hover { color: #FFF; }
 
     @media (prefers-color-scheme: dark) {
       body {
@@ -180,11 +199,7 @@
         color: #ECECEC;
       }
 
-      .details {
-        border-color: #666;
-      }
-
-      .summary {
+      .details, .summary {
         border-color: #666;
       }
 
@@ -219,8 +234,7 @@
 
       a { color: #C00; }
       a.trace-frames { color: #999; }
-      a:hover { color: #E9382B; }
-      a.trace-frames.selected { color: #E9382B; }
+      a:hover, a.trace-frames.selected { color: #E9382B; }
     }
 
     <%= yield :style %>
@@ -228,8 +242,7 @@
 
   <script>
     var toggle = function(id) {
-      var s = document.getElementById(id).style;
-      s.display = s.display == 'none' ? 'block' : 'none';
+      document.getElementById(id).classList.toggle('hidden');
       return false;
     }
     var show = function(id) {
@@ -238,9 +251,6 @@
     var hide = function(id) {
       document.getElementById(id).style.display = 'none';
     }
-    var toggleTrace = function() {
-      return toggle('blame_trace');
-    }
     var toggleSessionDump = function() {
       return toggle('session_dump');
     }
@@ -251,7 +261,7 @@
 </head>
 <body>
 
-<%= yield %>
+  <%= yield %>
 
 </body>
 </html>

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/middleware/templates/routes/_table.html.erb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/middleware/templates/routes/_table.html.erb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/railtie.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/railtie.rb Changed

@@ -24,6 +24,8 @@
     config.action_dispatch.use_cookies_with_metadata = false
     config.action_dispatch.perform_deep_munge = true
     config.action_dispatch.request_id_header = "X-Request-Id"
+    config.action_dispatch.return_only_request_media_type_on_content_type = true
+    config.action_dispatch.log_rescued_responses = true
 
     config.action_dispatch.default_headers = {
       "X-Frame-Options" => "SAMEORIGIN",
@@ -41,8 +43,12 @@
     initializer "action_dispatch.configure" do |app|
       ActionDispatch::Http::URL.secure_protocol = app.config.force_ssl
       ActionDispatch::Http::URL.tld_length = app.config.action_dispatch.tld_length
-      ActionDispatch::Request.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
-      ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge
+
+      ActiveSupport.on_load(:action_dispatch_request) do
+        self.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
+        self.return_only_media_type_on_content_type = app.config.action_dispatch.return_only_request_media_type_on_content_type
+        ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge
+      end
 
       ActiveSupport.on_load(:action_dispatch_response) do
         self.default_charset = app.config.action_dispatch.default_charset || app.config.encoding

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/request/session.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/request/session.rb Changed

@@ -6,6 +6,7 @@
   class Request
     # Session is responsible for lazily loading the session from store.
     class Session # :nodoc:
+      DisabledSessionError    = Class.new(StandardError)
       ENV_SESSION_KEY         = Rack::RACK_SESSION # :nodoc:
       ENV_SESSION_OPTIONS_KEY = Rack::RACK_SESSION_OPTIONS # :nodoc:
 
@@ -23,6 +24,12 @@
         session
       end
 
+      def self.disabled(req)
+        new(nil, req, enabled: false).tap do
+          Session::Options.set(req, Session::Options.new(nil, { id: nil }))
+        end
+      end
+
       def self.find(req)
         req.get_header ENV_SESSION_KEY
       end
@@ -31,7 +38,11 @@
         req.set_header ENV_SESSION_KEY, session
       end
 
-      class Options #:nodoc:
+      def self.delete(req)
+        req.delete_header ENV_SESSION_KEY
+      end
+
+      class Options # :nodoc:
         def self.set(req, options)
           req.set_header ENV_SESSION_OPTIONS_KEY, options
         end
@@ -60,30 +71,38 @@
         def values_at(*args); @delegate.values_at(*args); end
       end
 
-      def initialize(by, req)
+      def initialize(by, req, enabled: true)
         @by       = by
         @req      = req
         @delegate = {}
         @loaded   = false
         @exists   = nil # We haven't checked yet.
+        @enabled  = enabled
       end
 
       def id
         options.id(@req)
       end
 
+      def enabled?
+        @enabled
+      end
+
       def options
         Options.find @req
       end
 
       def destroy
         clear
-        options = self.options || {}
-        @by.send(:delete_session, @req, options.id(@req), options)
 
-        # Load the new sid to be written with the response.
-        @loaded = false
-        load_for_write!
+        if enabled?
+          options = self.options || {}
+          @by.send(:delete_session, @req, options.id(@req), options)
+
+          # Load the new sid to be written with the response.
+          @loaded = false
+          load_for_write!
+        end
       end
 
       # Returns value of the key stored in the session or
@@ -135,7 +154,7 @@
 
       # Clears the session.
       def clear
-        load_for_write!
+        load_for_delete!
         @delegate.clear
       end
 
@@ -163,7 +182,7 @@
 
       # Deletes given key from the session.
       def delete(key)
-        load_for_write!
+        load_for_delete!
         @delegate.delete key.to_s
       end
 
@@ -199,6 +218,7 @@
       end
 
       def exists?
+        return false unless enabled?
         return @exists unless @exists.nil?
         @exists = @by.send(:session_exists?, @req)
       end
@@ -227,13 +247,23 @@
         end
 
         def load_for_write!
-          load! unless loaded?
+          if enabled?
+            load! unless loaded?
+          else
+            raise DisabledSessionError, "Your application has sessions disabled. To write to the session you must first configure a session store"
+          end
+        end
+
+        def load_for_delete!
+          load! if enabled? && !loaded?
         end
 
         def load!
-          id, session = @by.load_session @req
-          options:id = id
-          @delegate.replace(session.stringify_keys)
+          if enabled?
+            id, session = @by.load_session @req
+            options:id = id
+            @delegate.replace(session.stringify_keys)
+          end
           @loaded = true
         end
     end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing.rb Changed

@@ -28,7 +28,7 @@
   #
   # Resource routing allows you to quickly declare all of the common routes
   # for a given resourceful controller. Instead of declaring separate routes
-  # for your +index+, +show+, +new+, +edit+, +create+, +update+ and +destroy+
+  # for your +index+, +show+, +new+, +edit+, +create+, +update+, and +destroy+
   # actions, a resourceful route declares them in a single line of code:
   #
   #  resources :photos
@@ -65,9 +65,8 @@
   #     resources :posts, :comments
   #   end
   #
-  # For more, see <tt>Routing::Mapper::Resources#resources</tt>,
-  # <tt>Routing::Mapper::Scoping#namespace</tt>, and
-  # <tt>Routing::Mapper::Scoping#scope</tt>.
+  # For more, see Routing::Mapper::Resources#resources,
+  # Routing::Mapper::Scoping#namespace, and Routing::Mapper::Scoping#scope.
   #
   # == Non-resourceful routes
   #
@@ -255,7 +254,7 @@
     autoload :UrlFor
     autoload :PolymorphicRoutes
 
-    SEPARATORS = %w( / . ? ) #:nodoc:
-    HTTP_METHODS = :get, :head, :post, :patch, :put, :delete, :options #:nodoc:
+    SEPARATORS = %w( / . ? ) # :nodoc:
+    HTTP_METHODS = :get, :head, :post, :patch, :put, :delete, :options # :nodoc:
   end
 end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/inspector.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/inspector.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/mapper.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/mapper.rb Changed

@@ -4,7 +4,6 @@
 require "active_support/core_ext/enumerable"
 require "active_support/core_ext/array/extract_options"
 require "active_support/core_ext/regexp"
-require "active_support/core_ext/symbol/starts_ends_with"
 require "action_dispatch/routing/redirection"
 require "action_dispatch/routing/endpoint"
 
@@ -13,7 +12,7 @@
     class Mapper
       URL_OPTIONS = :protocol, :subdomain, :domain, :host, :port
 
-      class Constraints < Routing::Endpoint #:nodoc:
+      class Constraints < Routing::Endpoint # :nodoc:
         attr_reader :app, :constraints
 
         SERVE = ->(app, req) { app.serve req }
@@ -67,11 +66,11 @@
           end
       end
 
-      class Mapping #:nodoc:
+      class Mapping # :nodoc:
         ANCHOR_CHARACTERS_REGEX = %r{\A(\\A|\^)|(\\Z|\\z|\$)\Z}
         OPTIONAL_FORMAT_REGEX = %r{(?:$\.:format$+|\.:format|/)\Z}
 
-        attr_reader :requirements, :defaults, :to, :default_controller,
+        attr_reader :path, :requirements, :defaults, :to, :default_controller,
                     :default_action, :required_defaults, :ast, :scope_options
 
         def self.build(scope, set, ast, controller, default_action, to, via, formatted, options_constraints, anchor, options)
@@ -122,31 +121,17 @@
           @to                 = intern(to)
           @default_controller = intern(controller)
           @default_action     = intern(default_action)
-          @ast                = ast
           @anchor             = anchor
           @via                = via
           @internal           = options.delete(:internal)
           @scope_options      = scope_params:options
+          ast                 = Journey::Ast.new(ast, formatted)
 
-          path_params = 
-          wildcard_options = {}
-          ast.each do |node|
-            if node.symbol?
-              path_params << node.to_sym
-            elsif formatted != false && node.star?
-              # Add a constraint for wildcard route to make it non-greedy and match the
-              # optional format part of the route by default.
-              wildcard_optionsnode.name.to_sym ||= /.+?/
-            elsif node.cat?
-              alter_regex_for_custom_routes(node)
-            end
-          end
-
-          options = wildcard_options.merge!(options)
+          options = ast.wildcard_options.merge!(options)
 
-          options = normalize_options!(options, path_params, scope_params:module)
+          options = normalize_options!(options, ast.path_params, scope_params:module)
 
-          split_options = constraints(options, path_params)
+          split_options = constraints(options, ast.path_params)
 
           constraints = scope_params:constraints.merge Hashsplit_options:constraints || 
 
@@ -160,8 +145,8 @@
             @blocks = blocks(options_constraints)
           end
 
-          requirements, conditions = split_constraints path_params, constraints
-          verify_regexp_requirements requirements.map(&:last).grep(Regexp)
+          requirements, conditions = split_constraints ast.path_params, constraints
+          verify_regexp_requirements requirements, ast.wildcard_options
 
           formats = normalize_format(formatted)
 
@@ -169,13 +154,18 @@
           @conditions = Hashconditions
           @defaults = formats:defaults.merge(@defaults).merge(normalize_defaults(options))
 
-          if path_params.include?(:action) && !@requirements.key?(:action)
+          if ast.path_params.include?(:action) && !@requirements.key?(:action)
             @defaults:action ||= "index"
           end
 
           @required_defaults = (split_options:required_defaults || ).map(&:first)
+
+          ast.requirements = @requirements
+          @path = Journey::Path::Pattern.new(ast, @requirements, JOINED_SEPARATORS, @anchor)
         end
 
+        JOINED_SEPARATORS = SEPARATORS.join # :nodoc:
+
         def make_route(name, precedence)
           Journey::Route.new(name: name, app: application, path: path, constraints: conditions,
                              required_defaults: required_defaults, defaults: defaults,
@@ -187,12 +177,6 @@
           app(@blocks)
         end
 
-        JOINED_SEPARATORS = SEPARATORS.join # :nodoc:
-
-        def path
-          Journey::Path::Pattern.new(@ast, requirements, JOINED_SEPARATORS, @anchor)
-        end
-
         def conditions
           build_conditions @conditions, @set.request_class
         end
@@ -212,24 +196,6 @@
         private :request_method
 
         private
-          # Find all the symbol nodes that are adjacent to literal nodes and alter
-          # the regexp so that Journey will partition them into custom routes.
-          def alter_regex_for_custom_routes(node)
-            if node.left.literal? && node.right.symbol?
-              symbol = node.right
-            elsif node.left.literal? && node.right.cat? && node.right.left.symbol?
-              symbol = node.right.left
-            elsif node.left.symbol? && node.right.literal?
-              symbol = node.left
-            elsif node.left.symbol? && node.right.cat? && node.right.left.literal?
-              symbol = node.left
-            end
-
-            if symbol
-              symbol.regexp = /(?:#{Regexp.union(symbol.regexp, '-')})+/
-            end
-          end
-
           def intern(object)
             object.is_a?(String) ? -object : object
           end
@@ -280,14 +246,18 @@
             end
           end
 
-          def verify_regexp_requirements(requirements)
-            requirements.each do |requirement|
-              if ANCHOR_CHARACTERS_REGEX.match?(requirement.source)
+          def verify_regexp_requirements(requirements, wildcard_options)
+            requirements.each do |requirement, regex|
+              next unless regex.is_a? Regexp
+
+              if ANCHOR_CHARACTERS_REGEX.match?(regex.source)
                 raise ArgumentError, "Regexp anchor characters are not allowed in routing requirements: #{requirement.inspect}"
               end
 
-              if requirement.multiline?
-                raise ArgumentError, "Regexp multiline option is not allowed in routing requirements: #{requirement.inspect}"
+              if regex.multiline?
+                next if wildcard_options.key?(requirement)
+
+                raise ArgumentError, "Regexp multiline option is not allowed in routing requirements: #{regex.inspect}"
               end
             end
           end
@@ -420,10 +390,10 @@
         #
         # If you want to expose your action to both GET and POST, use:
         #
-        #   # sets :controller, :action and :id in params
+        #   # sets :controller, :action, and :id in params
         #   match ':controller/:action/:id', via: :get, :post
         #
-        # Note that +:controller+, +:action+ and +:id+ are interpreted as URL
+        # Note that +:controller+, +:action+, and +:id+ are interpreted as URL
         # query parameters and thus available through +params+ in an action.
         #
         # If you want to expose your action to GET, use +get+ in the router:
@@ -639,7 +609,7 @@
           target_as       = name_for_action(options:as, path)
           options:via ||= :all
 
-          match(path, options.merge(to: app, anchor: false, format: false))
+          match(path, { to: app, anchor: false, format: false }.merge(options))
 
           define_generate_prefix(app, target_as) if rails_app
           self
@@ -936,7 +906,7 @@
         #
         # === Options
         #
-        # The +:path+, +:as+, +:module+, +:shallow_path+ and +:shallow_prefix+
+        # The +:path+, +:as+, +:module+, +:shallow_path+, and +:shallow_prefix+
         # options all default to the name of the namespace.
         #
         # For options, see <tt>Base#match</tt>. For +:shallow_path+ option, see
@@ -956,7 +926,7 @@
         #   namespace :admin, as: "sekret" do
         #     resources :posts
         #   end
-        def namespace(path, options = {})
+        def namespace(path, options = {}, &block)
           path = path.to_s
 
           defaults = {

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/redirection.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/redirection.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/route_set.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/route_set.rb Changed

@@ -6,7 +6,6 @@
 require "active_support/core_ext/module/remove_method"
 require "active_support/core_ext/array/extract_options"
 require "action_controller/metal/exceptions"
-require "action_dispatch/http/request"
 require "action_dispatch/routing/endpoint"
 
 module ActionDispatch
@@ -132,8 +131,8 @@
         alias     get
         alias clear clear!
 
-        def each
-          routes.each { |name, route| yield name, route }
+        def each(&block)
+          routes.each(&block)
           self
         end
 
@@ -197,7 +196,9 @@
             def call(t, method_name, args, inner_options, url_strategy)
               if args.size == arg_size && !inner_options && optimize_routes_generation?(t)
                 options = t.url_options.merge @options
-                options:path = optimized_helper(args)
+                path = optimized_helper(args)
+                path << "/" if options:trailing_slash && !path.end_with?("/")
+                options:path = path
 
                 original_script_name = options.delete(:original_script_name)
                 script_name = t._routes.find_script_name(options)
@@ -597,14 +598,14 @@
         if route.segment_keys.include?(:controller)
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
             Using a dynamic :controller segment in a route is deprecated and
-            will be removed in Rails 6.2.
+            will be removed in Rails 7.1.
           MSG
         end
 
         if route.segment_keys.include?(:action)
           ActiveSupport::Deprecation.warn(<<-MSG.squish)
             Using a dynamic :action segment in a route is deprecated and
-            will be removed in Rails 6.2.
+            will be removed in Rails 7.1.
           MSG
         end
 
@@ -821,10 +822,19 @@
 
         route_with_params = generate(route_name, path_options, recall)
         path = route_with_params.path(method_name)
+
+        if options:trailing_slash && !options:format && !path.end_with?("/")
+          path += "/"
+        end
+
         params = route_with_params.params
 
         if options.key? :params
-          params.merge! options:params
+          if options:params&.respond_to?(:to_hash)
+            params.merge! options:params
+          else
+            params:params = options:params
+          end
         end
 
         options:path        = path

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/routes_proxy.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/routes_proxy.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/routing/url_for.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/routing/url_for.rb Changed

@@ -70,7 +70,7 @@
     #   resources :users
     #
     # This generates, among other things, the method <tt>users_path</tt>. By default,
-    # this method is accessible from your controllers, views and mailers. If you need
+    # this method is accessible from your controllers, views, and mailers. If you need
     # to access this auto-generated method from other places (such as a model), then
     # you can do that by including Rails.application.routes.url_helpers in your class:
     #
@@ -103,11 +103,10 @@
         include(*_url_for_modules) if respond_to?(:_url_for_modules)
       end
 
-      def initialize(*)
+      def initialize(...)
         @_routes = nil
         super
       end
-      ruby2_keywords(:initialize) if respond_to?(:ruby2_keywords, true)
 
       # Hook overridden in controller to add request information
       # with +default_url_options+. Application logic should not
@@ -116,7 +115,7 @@
         default_url_options
       end
 
-      # Generate a URL based on the options provided, default_url_options and the
+      # Generate a URL based on the options provided, default_url_options, and the
       # routes defined in routes.rb. The following options are supported:
       #
       # * <tt>:only_path</tt> - If true, the relative URL is returned. Defaults to +false+.
@@ -155,7 +154,7 @@
       #    # => '/myapp/tasks/testing'
       #
       # Missing routes keys may be filled in from the current request's parameters
-      # (e.g. +:controller+, +:action+, +:id+ and any other parameters that are
+      # (e.g. +:controller+, +:action+, +:id+, and any other parameters that are
       # placed in the path). Given that the current action has been reached
       # through <tt>GET /users/1</tt>:
       #

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/system_test_case.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/system_test_case.rb Changed

@@ -72,8 +72,8 @@
   # Headless browsers such as headless Chrome and headless Firefox are also supported.
   # You can use these browsers by setting the +:using+ argument to +:headless_chrome+ or +:headless_firefox+.
   #
-  # To use a headless driver, like Poltergeist, update your Gemfile to use
-  # Poltergeist instead of Selenium and then declare the driver name in the
+  # To use a headless driver, like Cuprite, update your Gemfile to use
+  # Cuprite instead of Selenium and then declare the driver name in the
   # +application_system_test_case.rb+ file. In this case, you would leave out
   # the +:using+ option because the driver is headless, but you can still use
   # +:screen_size+ to change the size of the browser screen, also you can use
@@ -81,10 +81,10 @@
   # driver documentation to learn about supported options.
   #
   #   require "test_helper"
-  #   require "capybara/poltergeist"
+  #   require "capybara/cuprite"
   #
   #   class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
-  #     driven_by :poltergeist, screen_size: 1400, 1400, options:
+  #     driven_by :cuprite, screen_size: 1400, 1400, options:
   #       { js_errors: true }
   #   end
   #
@@ -115,6 +115,8 @@
     include SystemTesting::TestHelpers::SetupAndTeardown
     include SystemTesting::TestHelpers::ScreenshotHelper
 
+    DEFAULT_HOST = "http://127.0.0.1"
+
     def initialize(*) # :nodoc:
       super
       self.class.driven_by(:selenium) unless self.class.driver?
@@ -140,7 +142,7 @@
     #
     # Examples:
     #
-    #   driven_by :poltergeist
+    #   driven_by :cuprite
     #
     #   driven_by :selenium, screen_size: 800, 800
     #
@@ -166,7 +168,11 @@
               include ActionDispatch.test_app.routes.mounted_helpers
 
               def url_options
-                default_url_options.reverse_merge(host: Capybara.app_host || Capybara.current_session.server_url)
+                default_url_options.reverse_merge(host: app_host)
+              end
+
+              def app_host
+                Capybara.app_host || Capybara.current_session.server_url || DEFAULT_HOST
               end
             end.new
           end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/system_testing/browser.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/system_testing/browser.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/system_testing/driver.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/system_testing/driver.rb Changed

@@ -3,16 +3,30 @@
 module ActionDispatch
   module SystemTesting
     class Driver # :nodoc:
-      def initialize(name, **options, &capabilities)
-        @name = name
-        @browser = Browser.new(options:using)
+      attr_reader :name
+
+      def initialize(driver_type, **options, &capabilities)
+        @driver_type = driver_type
         @screen_size = options:screen_size
         @options = options:options || {}
+        @name = @options.delete(:name) || driver_type
         @capabilities = capabilities
 
-        if name == :selenium
+        if :poltergeist, :webkit.include?(driver_type)
+          ActiveSupport::Deprecation.warn <<~MSG.squish
+            Poltergeist and capybara-webkit are not maintained already.
+            Driver registration of :poltergeist or :webkit is deprecated and will be removed in Rails 7.1.
+            You can still use :selenium, and also :cuprite is available for alternative to Poltergeist.
+          MSG
+        end
+
+        if driver_type == :selenium
+          gem "selenium-webdriver", ">= 4.0.0"
           require "selenium/webdriver"
+          @browser = Browser.new(options:using)
           @browser.preload
+        else
+          @browser = nil
         end
       end
 
@@ -24,27 +38,29 @@
 
       private
         def registerable?
-          :selenium, :poltergeist, :webkit.include?(@name)
+          :selenium, :poltergeist, :webkit, :cuprite, :rack_test.include?(@driver_type)
         end
 
         def register
-          @browser.configure(&@capabilities)
+          @browser&.configure(&@capabilities)
 
-          Capybara.register_driver @name do |app|
-            case @name
+          Capybara.register_driver name do |app|
+            case @driver_type
             when :selenium then register_selenium(app)
             when :poltergeist then register_poltergeist(app)
             when :webkit then register_webkit(app)
+            when :cuprite then register_cuprite(app)
+            when :rack_test then register_rack_test(app)
             end
           end
         end
 
         def browser_options
-          @options.merge(options: @browser.options).compact
+          @options.merge(capabilities: @browser.options).compact
         end
 
         def register_selenium(app)
-          Capybara::Selenium::Driver.new(app, **{ browser: @browser.type }.merge(browser_options)).tap do |driver|
+          Capybara::Selenium::Driver.new(app, browser: @browser.type, **browser_options).tap do |driver|
             driver.browser.manage.window.size = Selenium::WebDriver::Dimension.new(*@screen_size)
           end
         end
@@ -59,8 +75,16 @@
           end
         end
 
+        def register_cuprite(app)
+          Capybara::Cuprite::Driver.new(app, @options.merge(window_size: @screen_size))
+        end
+
+        def register_rack_test(app)
+          Capybara::RackTest::Driver.new(app, respect_data_method: true, **@options)
+        end
+
         def setup
-          Capybara.current_driver = @name
+          Capybara.current_driver = name
         end
     end
   end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb Changed

@@ -15,8 +15,11 @@
         #
         # The screenshot will be displayed in your console, if supported.
         #
+        # The default screenshots directory is +tmp/screenshots+ but you can set a different
+        # one with +Capybara.save_path+
+        #
         # You can set the +RAILS_SYSTEM_TESTING_SCREENSHOT_HTML+ environment variable to
-        # save the HTML from the page that is being screenhoted so you can investigate the
+        # save the HTML from the page that is being screenshotted so you can investigate the
         # elements on the page at the time of the screenshot
         #
         # You can set the +RAILS_SYSTEM_TESTING_SCREENSHOT+ environment variable to
@@ -37,12 +40,9 @@
         # Takes a screenshot of the current page in the browser if the test
         # failed.
         #
-        # +take_failed_screenshot+ is included in <tt>application_system_test_case.rb</tt>
-        # that is generated with the application. To take screenshots when a test
-        # fails add +take_failed_screenshot+ to the teardown block before clearing
-        # sessions.
+        # +take_failed_screenshot+ is called during system test teardown.
         def take_failed_screenshot
-          take_screenshot if failed? && supports_screenshot?
+          take_screenshot if failed? && supports_screenshot? && Capybara::Session.instance_created?
         end
 
         private
@@ -76,7 +76,11 @@
           end
 
           def absolute_path
-            Rails.root.join("tmp/screenshots/#{image_name}")
+            Rails.root.join(screenshots_dir, image_name)
+          end
+
+          def screenshots_dir
+            Capybara.save_path.presence || "tmp/screenshots"
           end
 
           def absolute_image_path

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/testing/assertions.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/testing/assertions.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/testing/assertions/routing.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/testing/assertions/routing.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/testing/integration.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/testing/integration.rb Changed

@@ -8,7 +8,7 @@
 require "action_dispatch/testing/request_encoder"
 
 module ActionDispatch
-  module Integration #:nodoc:
+  module Integration # :nodoc:
     module RequestHelpers
       # Performs a GET request with the given parameters. See ActionDispatch::Integration::Session#process
       # for more details.
@@ -199,7 +199,7 @@
       #   merged into the Rack env hash.
       # - +env+: Additional env to pass, as a Hash. The headers will be
       #   merged into the Rack env hash.
-      # - +xhr+: Set to +true+ if you want to make and Ajax request.
+      # - +xhr+: Set to +true+ if you want to make an Ajax request.
       #   Adds request headers characteristic of XMLHttpRequest e.g. HTTP_X_REQUESTED_WITH.
       #   The headers will be merged into the Rack env hash.
       # - +as+: Used for encoding the request with different content type.
@@ -363,13 +363,11 @@
           reset_html_document = "@html_document = nil"
         end
 
-        definition = RUBY_VERSION >= "2.7" ? "..." : "*args"
-
         module_eval <<~RUBY, __FILE__, __LINE__ + 1
-          def #{method}(#{definition})
+          def #{method}(...)
             #{reset_html_document}
 
-            result = integration_session.#{method}(#{definition})
+            result = integration_session.#{method}(...)
             copy_session_variables!
             result
           end
@@ -404,7 +402,7 @@
 
       # Copy the instance variables from the current session instance into the
       # test instance.
-      def copy_session_variables! #:nodoc:
+      def copy_session_variables! # :nodoc:
         @controller = @integration_session.controller
         @response   = @integration_session.response
         @request    = @integration_session.request
@@ -433,7 +431,7 @@
           super
         end
       end
-      ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true)
+      ruby2_keywords(:method_missing)
     end
   end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/testing/test_process.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/testing/test_process.rb Changed

@@ -8,39 +8,16 @@
     module FixtureFile
       # Shortcut for <tt>Rack::Test::UploadedFile.new(File.join(ActionDispatch::IntegrationTest.file_fixture_path, path), type)</tt>:
       #
-      #   post :change_avatar, params: { avatar: fixture_file_upload('spongebob.png', 'image/png') }
+      #   post :change_avatar, params: { avatar: fixture_file_upload('david.png', 'image/png') }
       #
       # Default fixture files location is <tt>test/fixtures/files</tt>.
       #
       # To upload binary files on Windows, pass <tt>:binary</tt> as the last parameter.
       # This will not affect other platforms:
       #
-      #   post :change_avatar, params: { avatar: fixture_file_upload('spongebob.png', 'image/png', :binary) }
+      #   post :change_avatar, params: { avatar: fixture_file_upload('david.png', 'image/png', :binary) }
       def fixture_file_upload(path, mime_type = nil, binary = false)
-        if self.class.respond_to?(:fixture_path) && self.class.fixture_path &&
-            !File.exist?(path)
-          original_path = path
-          path = Pathname.new(self.class.fixture_path).join(path)
-
-          if !self.class.file_fixture_path
-            ActiveSupport::Deprecation.warn(<<~EOM)
-              Passing a path to `fixture_file_upload` relative to `fixture_path` is deprecated.
-              In Rails 6.2, the path needs to be relative to `file_fixture_path` which you
-              haven't set yet. Set `file_fixture_path` to discard this warning.
-            EOM
-          elsif path.exist?
-            non_deprecated_path = Pathname(File.absolute_path(path)).relative_path_from(Pathname(File.absolute_path(self.class.file_fixture_path)))
-            ActiveSupport::Deprecation.warn(<<~EOM)
-              Passing a path to `fixture_file_upload` relative to `fixture_path` is deprecated.
-              In Rails 6.2, the path needs to be relative to `file_fixture_path`.
-
-              Please modify the call from
-              `fixture_file_upload("#{original_path}")` to `fixture_file_upload("#{non_deprecated_path}")`.
-            EOM
-          else
-            path = file_fixture(original_path)
-          end
-        elsif self.class.file_fixture_path && !File.exist?(path)
+        if self.class.file_fixture_path && !File.exist?(path)
           path = file_fixture(path)
         end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_dispatch/testing/test_response.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_dispatch/testing/test_response.rb Changed

@@ -3,8 +3,8 @@
 require "action_dispatch/testing/request_encoder"
 
 module ActionDispatch
-  # Integration test methods such as ActionDispatch::Integration::Session#get
-  # and ActionDispatch::Integration::Session#post return objects of class
+  # Integration test methods such as Integration::RequestHelpers#get
+  # and Integration::RequestHelpers#post return objects of class
   # TestResponse, which represent the HTTP response results of the requested
   # controller actions.
   #
@@ -14,6 +14,24 @@
       new response.status, response.headers, response.body
     end
 
+    # Returns a parsed body depending on the response MIME type. When a parser
+    # corresponding to the MIME type is not found, it returns the raw body.
+    #
+    # ==== Examples
+    #   get "/posts"
+    #   response.content_type      # => "text/html; charset=utf-8"
+    #   response.parsed_body.class # => String
+    #   response.parsed_body       # => "<!DOCTYPE html>\n<html>\n..."
+    #
+    #   get "/posts.json"
+    #   response.content_type      # => "application/json; charset=utf-8"
+    #   response.parsed_body.class # => Array
+    #   response.parsed_body       # => {"id"=>42, "title"=>"Title"},...
+    #
+    #   get "/posts/42.json"
+    #   response.content_type      # => "application/json; charset=utf-8"
+    #   response.parsed_body.class # => Hash
+    #   response.parsed_body       # => {"id"=>42, "title"=>"Title"}
     def parsed_body
       @parsed_body ||= response_parser.call(body)
     end

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_pack.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_pack.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_pack/gem_version.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_pack/gem_version.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/data/lib/action_pack/version.rb -> _service:tar_scm:actionpack-7.0.4.gem/data/lib/action_pack/version.rb Changed

_service:tar_scm:actionpack-6.1.4.1.gem/metadata.gz -> _service:tar_scm:actionpack-7.0.4.gem/metadata.gz Changed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.1.4.1
+  version: 7.0.4
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: 
-date: 2021-08-19 00:00:00.000000000 Z
+date: 2022-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -33,7 +33,7 @@
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.9
+        version: 2.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -43,7 +43,7 @@
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.9
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: rack-test
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.4.1
+        version: 7.0.4
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -238,6 +238,7 @@
 - lib/action_dispatch/middleware/reloader.rb
 - lib/action_dispatch/middleware/remote_ip.rb
 - lib/action_dispatch/middleware/request_id.rb
+- lib/action_dispatch/middleware/server_timing.rb
 - lib/action_dispatch/middleware/session/abstract_store.rb
 - lib/action_dispatch/middleware/session/cache_store.rb
 - lib/action_dispatch/middleware/session/cookie_store.rb
@@ -309,10 +310,11 @@
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.4.1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.4.1/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.4/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.4/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.4.1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.4/actionpack
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: 
 require_paths:
@@ -321,7 +323,7 @@
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -329,7 +331,7 @@
       version: '0'
 requirements:
 - none
-rubygems_version: 3.2.15
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).

_service:tar_scm:rails-6.1.4.1-tools.txz Deleted

_service:tar_scm:rails-7.0.4-tools.txz Added

Changes of Revision 2