Sinatra doesn’t know this ditty.
-
Try this:
-HTML
+ HTML
end
end
diff --git a/lib/sinatra/version.rb b/lib/sinatra/version.rb
index 2c1a44fad8..7a21c28c89 100644
--- a/lib/sinatra/version.rb
+++ b/lib/sinatra/version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
module Sinatra
VERSION = '3.0.0'
end
diff --git a/rack-protection/Gemfile b/rack-protection/Gemfile
index f9631bf2fc..293cdb402d 100644
--- a/rack-protection/Gemfile
+++ b/rack-protection/Gemfile
@@ -1,11 +1,13 @@
-source "https://rubygems.org"
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
# encoding: utf-8
gem 'rake'
rack_version = ENV['rack'].to_s
-rack_version = nil if rack_version.empty? or rack_version == 'stable'
-rack_version = {:github => 'rack/rack'} if rack_version == 'master'
+rack_version = nil if rack_version.empty? || (rack_version == 'stable')
+rack_version = { github: 'rack/rack' } if rack_version == 'master'
gem 'rack', rack_version
gem 'sinatra', path: '..'
diff --git a/rack-protection/Rakefile b/rack-protection/Rakefile
index 5737bad66d..4ccffd5ffa 100644
--- a/rack-protection/Rakefile
+++ b/rack-protection/Rakefile
@@ -1,14 +1,15 @@
-# encoding: utf-8
+# frozen_string_literal: true
+
$LOAD_PATH.unshift File.expand_path('lib', __dir__)
begin
require 'bundler'
Bundler::GemHelper.install_tasks
rescue LoadError => e
- $stderr.puts e
+ warn e
end
-desc "run specs"
+desc 'run specs'
task(:spec) { ruby '-S rspec' }
namespace :doc do
@@ -16,38 +17,39 @@ namespace :doc do
Dir.glob 'lib/rack/protection/*.rb' do |file|
excluded_files = %w[lib/rack/protection/base.rb lib/rack/protection/version.rb]
next if excluded_files.include?(file)
+
doc = File.read(file)[/^ module Protection(\n)+( #[^\n]*\n)*/m].scan(/^ *#(?!#) ?(.*)\n/).join("\n")
- file = "doc/#{file[4..-4].tr("/_", "-")}.rdoc"
- Dir.mkdir "doc" unless File.directory? "doc"
+ file = "doc/#{file[4..-4].tr('/_', '-')}.rdoc"
+ Dir.mkdir 'doc' unless File.directory? 'doc'
puts "writing #{file}"
- File.open(file, "w") { |f| f << doc }
+ File.open(file, 'w') { |f| f << doc }
end
end
task :index do
- doc = File.read("README.md")
- file = "doc/rack-protection-readme.md"
- Dir.mkdir "doc" unless File.directory? "doc"
+ doc = File.read('README.md')
+ file = 'doc/rack-protection-readme.md'
+ Dir.mkdir 'doc' unless File.directory? 'doc'
puts "writing #{file}"
- File.open(file, "w") { |f| f << doc }
+ File.open(file, 'w') { |f| f << doc }
end
- task :all => [:readmes, :index]
+ task all: %i[readmes index]
end
-desc "generate documentation"
-task :doc => 'doc:all'
+desc 'generate documentation'
+task doc: 'doc:all'
-desc "generate gemspec"
+desc 'generate gemspec'
task 'rack-protection.gemspec' do
require 'rack/protection/version'
content = File.binread 'rack-protection.gemspec'
# fetch data
fields = {
- :authors => `git shortlog -sn`.force_encoding('utf-8').scan(/[^\d\s].*/),
- :email => ["mail@zzak.io", "konstantin.haase@gmail.com"],
- :files => %w(License README.md Rakefile Gemfile rack-protection.gemspec) + Dir['lib/**/*']
+ authors: `git shortlog -sn`.force_encoding('utf-8').scan(/[^\d\s].*/),
+ email: ['mail@zzak.io', 'konstantin.haase@gmail.com'],
+ files: %w[License README.md Rakefile Gemfile rack-protection.gemspec] + Dir['lib/**/*']
}
# insert data
@@ -67,6 +69,6 @@ task 'rack-protection.gemspec' do
File.open('rack-protection.gemspec', 'w') { |f| f << content }
end
-task :gemspec => 'rack-protection.gemspec'
-task :default => :spec
-task :test => :spec
+task gemspec: 'rack-protection.gemspec'
+task default: :spec
+task test: :spec
diff --git a/rack-protection/lib/rack-protection.rb b/rack-protection/lib/rack-protection.rb
deleted file mode 100644
index 1633086e2c..0000000000
--- a/rack-protection/lib/rack-protection.rb
+++ /dev/null
@@ -1 +0,0 @@
-require "rack/protection"
diff --git a/rack-protection/lib/rack/protection.rb b/rack-protection/lib/rack/protection.rb
index 1be25e4870..21d2ec9268 100644
--- a/rack-protection/lib/rack/protection.rb
+++ b/rack-protection/lib/rack/protection.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection/version'
require 'rack'
@@ -29,7 +31,7 @@ def self.new(app, options = {})
use_these = Array options[:use]
if options.fetch(:without_session, false)
- except += [:session_hijacking, :remote_token]
+ except += %i[session_hijacking remote_token]
end
Rack::Builder.new do
diff --git a/rack-protection/lib/rack/protection/authenticity_token.rb b/rack-protection/lib/rack/protection/authenticity_token.rb
index c55a40654c..f5c8db62d4 100644
--- a/rack-protection/lib/rack/protection/authenticity_token.rb
+++ b/rack-protection/lib/rack/protection/authenticity_token.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
require 'securerandom'
require 'openssl'
@@ -19,7 +21,7 @@ module Protection
#
# It is not OOTB-compatible with the {rack-csrf}[https://rubygems.org/gems/rack_csrf] gem.
# For that, the following patch needs to be applied:
- #
+ #
# Rack::Protection::AuthenticityToken.default_options(key: "csrf.token", authenticity_param: "_csrf")
#
# == Options
@@ -95,12 +97,12 @@ module Protection
class AuthenticityToken < Base
TOKEN_LENGTH = 32
- default_options :authenticity_param => 'authenticity_token',
- :key => :csrf,
- :allow_if => nil
+ default_options authenticity_param: 'authenticity_token',
+ key: :csrf,
+ allow_if: nil
def self.token(session, path: nil, method: :post)
- self.new(nil).mask_authenticity_token(session, path: path, method: method)
+ new(nil).mask_authenticity_token(session, path: path, method: method)
end
def self.random_token
@@ -114,8 +116,8 @@ def accepts?(env)
safe?(env) ||
valid_token?(env, env['HTTP_X_CSRF_TOKEN']) ||
valid_token?(env, Request.new(env).params[options[:authenticity_param]]) ||
- ( options[:allow_if] && options[:allow_if].call(env) )
- rescue
+ options[:allow_if]&.call(env)
+ rescue StandardError
false
end
@@ -123,10 +125,10 @@ def mask_authenticity_token(session, path: nil, method: :post)
set_token(session)
token = if path && method
- per_form_token(session, path, method)
- else
- global_token(session)
- end
+ per_form_token(session, path, method)
+ else
+ global_token(session)
+ end
mask_token(token)
end
@@ -185,7 +187,7 @@ def unmask_token(masked_token)
# value and decrypt it
token_length = masked_token.length / 2
one_time_pad = masked_token[0...token_length]
- encrypted_token = masked_token[token_length..-1]
+ encrypted_token = masked_token[token_length..]
xor_byte_strings(one_time_pad, encrypted_token)
end
@@ -207,8 +209,7 @@ def compare_with_global_token(token, session)
def compare_with_per_form_token(token, session, request)
secure_compare(token,
- per_form_token(session, request.path.chomp('/'), request.request_method)
- )
+ per_form_token(session, request.path.chomp('/'), request.request_method))
end
def real_token(session)
@@ -233,7 +234,7 @@ def decode_token(token)
def token_hmac(session, identifier)
OpenSSL::HMAC.digest(
- OpenSSL::Digest::SHA256.new,
+ OpenSSL::Digest.new('SHA256'),
real_token(session),
identifier
)
diff --git a/rack-protection/lib/rack/protection/base.rb b/rack-protection/lib/rack/protection/base.rb
index 83e724069b..a1314adb82 100644
--- a/rack-protection/lib/rack/protection/base.rb
+++ b/rack-protection/lib/rack/protection/base.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
require 'rack/utils'
require 'digest'
@@ -8,12 +10,12 @@ module Rack
module Protection
class Base
DEFAULT_OPTIONS = {
- :reaction => :default_reaction, :logging => true,
- :message => 'Forbidden', :encryptor => Digest::SHA1,
- :session_key => 'rack.session', :status => 403,
- :allow_empty_referrer => true,
- :report_key => "protection.failed",
- :html_types => %w[text/html application/xhtml text/xml application/xml]
+ reaction: :default_reaction, logging: true,
+ message: 'Forbidden', encryptor: Digest::SHA1,
+ session_key: 'rack.session', status: 403,
+ allow_empty_referrer: true,
+ report_key: 'protection.failed',
+ html_types: %w[text/html application/xhtml text/xml application/xml]
}
attr_reader :app, :options
@@ -31,7 +33,8 @@ def default_options
end
def initialize(app, options = {})
- @app, @options = app, default_options.merge(options)
+ @app = app
+ @options = default_options.merge(options)
end
def safe?(env)
@@ -52,24 +55,26 @@ def call(env)
def react(env)
result = send(options[:reaction], env)
- result if Array === result and result.size == 3
+ result if (Array === result) && (result.size == 3)
end
def warn(env, message)
return unless options[:logging]
+
l = options[:logger] || env['rack.logger'] || ::Logger.new(env['rack.errors'])
l.warn(message)
end
def instrument(env)
- return unless i = options[:instrumenter]
+ return unless (i = options[:instrumenter])
+
env['rack.protection.attack'] = self.class.name.split('::').last.downcase
i.instrument('rack.protection', env)
end
def deny(env)
warn env, "attack prevented by #{self.class}"
- [options[:status], {'Content-Type' => 'text/plain'}, [options[:message]]]
+ [options[:status], { 'Content-Type' => 'text/plain' }, [options[:message]]]
end
def report(env)
@@ -83,7 +88,8 @@ def session?(env)
def session(env)
return env[options[:session_key]] if session? env
- fail "you need to set up a session middleware *before* #{self.class}"
+
+ raise "you need to set up a session middleware *before* #{self.class}"
end
def drop_session(env)
@@ -92,7 +98,8 @@ def drop_session(env)
def referrer(env)
ref = env['HTTP_REFERER'].to_s
- return if !options[:allow_empty_referrer] and ref.empty?
+ return if !options[:allow_empty_referrer] && ref.empty?
+
URI.parse(ref).host || Request.new(env).host
rescue URI::InvalidURIError
end
@@ -102,7 +109,7 @@ def origin(env)
end
def random_string(secure = defined? SecureRandom)
- secure ? SecureRandom.hex(16) : "%032x" % rand(2**128-1)
+ secure ? SecureRandom.hex(16) : '%032x' % rand((2**128) - 1)
rescue NotImplementedError
random_string false
end
@@ -118,8 +125,9 @@ def secure_compare(a, b)
alias default_reaction deny
def html?(headers)
- return false unless header = headers.detect { |k,v| k.downcase == 'content-type' }
- options[:html_types].include? header.last[/^\w+\/\w+/]
+ return false unless (header = headers.detect { |k, _v| k.downcase == 'content-type' })
+
+ options[:html_types].include? header.last[%r{^\w+/\w+}]
end
end
end
diff --git a/rack-protection/lib/rack/protection/content_security_policy.rb b/rack-protection/lib/rack/protection/content_security_policy.rb
index 91eea925ef..32d8ac70fa 100644
--- a/rack-protection/lib/rack/protection/content_security_policy.rb
+++ b/rack-protection/lib/rack/protection/content_security_policy.rb
@@ -1,4 +1,5 @@
-# -*- coding: utf-8 -*-
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -38,16 +39,16 @@ module Protection
class ContentSecurityPolicy < Base
default_options default_src: "'self'", report_only: false
- DIRECTIVES = %i(base_uri child_src connect_src default_src
+ DIRECTIVES = %i[base_uri child_src connect_src default_src
font_src form_action frame_ancestors frame_src
img_src manifest_src media_src object_src
plugin_types referrer reflected_xss report_to
report_uri require_sri_for sandbox script_src
style_src worker_src webrtc_src navigate_to
- prefetch_src).freeze
+ prefetch_src].freeze
- NO_ARG_DIRECTIVES = %i(block_all_mixed_content disown_opener
- upgrade_insecure_requests).freeze
+ NO_ARG_DIRECTIVES = %i[block_all_mixed_content disown_opener
+ upgrade_insecure_requests].freeze
def csp_policy
directives = []
diff --git a/rack-protection/lib/rack/protection/cookie_tossing.rb b/rack-protection/lib/rack/protection/cookie_tossing.rb
index 10614d5261..0a7f43ad54 100644
--- a/rack-protection/lib/rack/protection/cookie_tossing.rb
+++ b/rack-protection/lib/rack/protection/cookie_tossing.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
require 'pathname'
@@ -29,9 +31,8 @@ def accepts?(env)
cookie_header = env['HTTP_COOKIE']
cookies = Rack::Utils.parse_query(cookie_header, ';,') { |s| s }
cookies.each do |k, v|
- if k == session_key && Array(v).size > 1
- bad_cookies << k
- elsif k != session_key && Rack::Utils.unescape(k) == session_key
+ if (k == session_key && Array(v).size > 1) ||
+ (k != session_key && Rack::Utils.unescape(k) == session_key)
bad_cookies << k
end
end
@@ -40,6 +41,7 @@ def accepts?(env)
def remove_bad_cookies(request, response)
return if bad_cookies.empty?
+
paths = cookie_paths(request.path)
bad_cookies.each do |name|
paths.each { |path| response.set_cookie name, empty_cookie(request.host, path) }
@@ -49,7 +51,7 @@ def remove_bad_cookies(request, response)
def redirect(env)
request = Request.new(env)
warn env, "attack prevented by #{self.class}"
- [302, {'Content-Type' => 'text/html', 'Location' => request.path}, []]
+ [302, { 'Content-Type' => 'text/html', 'Location' => request.path }, []]
end
def bad_cookies
@@ -64,7 +66,7 @@ def cookie_paths(path)
end
def empty_cookie(host, path)
- {:value => '', :domain => host, :path => path, :expires => Time.at(0)}
+ { value: '', domain: host, path: path, expires: Time.at(0) }
end
def session_key
diff --git a/rack-protection/lib/rack/protection/encrypted_cookie.rb b/rack-protection/lib/rack/protection/encrypted_cookie.rb
index bb0dbacb38..bf682312a9 100644
--- a/rack-protection/lib/rack/protection/encrypted_cookie.rb
+++ b/rack-protection/lib/rack/protection/encrypted_cookie.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'openssl'
require 'zlib'
require 'json'
@@ -67,7 +69,7 @@ def encode(str)
end
def decode(str)
- str.unpack('m').first
+ str.unpack1('m')
end
# Encode session cookies as Marshaled Base64 data
@@ -78,7 +80,12 @@ def encode(str)
def decode(str)
return unless str
- ::Marshal.load(super(str)) rescue nil
+
+ begin
+ ::Marshal.load(super(str))
+ rescue StandardError
+ nil
+ end
end
end
@@ -91,7 +98,12 @@ def encode(obj)
def decode(str)
return unless str
- ::JSON.parse(super(str)) rescue nil
+
+ begin
+ ::JSON.parse(super(str))
+ rescue StandardError
+ nil
+ end
end
end
@@ -102,8 +114,9 @@ def encode(obj)
def decode(str)
return unless str
+
::JSON.parse(Zlib::Inflate.inflate(super(str)))
- rescue
+ rescue StandardError
nil
end
end
@@ -127,12 +140,12 @@ def decode(str)
attr_reader :coder
- def initialize(app, options={})
+ def initialize(app, options = {})
# Assume keys are hex strings and convert them to raw byte strings for
# actual key material
- @secrets = options.values_at(:secret, :old_secret).compact.map { |secret|
+ @secrets = options.values_at(:secret, :old_secret).compact.map do |secret|
[secret].pack('H*')
- }
+ end
warn <<-MSG unless secure?(options)
SECURITY WARNING: No secret option provided to Rack::Protection::EncryptedCookie.
@@ -154,7 +167,7 @@ def initialize(app, options={})
Called from: #{caller[0]}.
MSG
- if options.has_key?(:legacy_hmac_secret)
+ if options.key?(:legacy_hmac_secret)
@legacy_hmac = options.fetch(:legacy_hmac, OpenSSL::Digest::SHA1)
# Multiply the :digest_length: by 2 because this value is the length of
@@ -173,19 +186,19 @@ def initialize(app, options={})
# If no encryption is used, rely on the previous default (Base64::Marshal)
@coder = (options[:coder] ||= (@secrets.any? ? Marshal.new : Base64::Marshal.new))
- super(app, options.merge!(:cookie_only => true))
+ super(app, options.merge!(cookie_only: true))
end
private
- def find_session(req, sid)
+ def find_session(req, _sid)
data = unpacked_cookie_data(req)
data = persistent_session_id!(data)
- [data["session_id"], data]
+ [data['session_id'], data]
end
def extract_session_id(request)
- unpacked_cookie_data(request)["session_id"]
+ unpacked_cookie_data(request)['session_id']
end
def unpacked_cookie_data(request)
@@ -214,14 +227,14 @@ def unpacked_cookie_data(request)
end
end
- def persistent_session_id!(data, sid=nil)
+ def persistent_session_id!(data, sid = nil)
data ||= {}
- data["session_id"] ||= sid || generate_sid
+ data['session_id'] ||= sid || generate_sid
data
end
- def write_session(req, session_id, session, options)
- session = session.merge("session_id" => session_id)
+ def write_session(req, session_id, session, _options)
+ session = session.merge('session_id' => session_id)
session_data = coder.encode(session)
unless @secrets.empty?
@@ -229,14 +242,14 @@ def write_session(req, session_id, session, options)
end
if session_data.size > (4096 - @key.size)
- req.get_header(RACK_ERRORS).puts("Warning! Rack::Protection::EncryptedCookie data size exceeds 4K.")
+ req.get_header(RACK_ERRORS).puts('Warning! Rack::Protection::EncryptedCookie data size exceeds 4K.')
nil
else
session_data
end
end
- def delete_session(req, session_id, options)
+ def delete_session(_req, _session_id, options)
# Nothing to do here, data is in the client
generate_sid unless options[:drop]
end
@@ -253,7 +266,7 @@ def generate_hmac(data)
def secure?(options)
@secrets.size >= 1 ||
- (options[:coder] && options[:let_coder_handle_secure_encoding])
+ (options[:coder] && options[:let_coder_handle_secure_encoding])
end
end
end
diff --git a/rack-protection/lib/rack/protection/encryptor.rb b/rack-protection/lib/rack/protection/encryptor.rb
index e55c6aa96b..ded10c7e8e 100644
--- a/rack-protection/lib/rack/protection/encryptor.rb
+++ b/rack-protection/lib/rack/protection/encryptor.rb
@@ -1,21 +1,23 @@
+# frozen_string_literal: true
+
require 'openssl'
module Rack
module Protection
module Encryptor
- CIPHER = 'aes-256-gcm'.freeze
- DELIMITER = '--'.freeze
+ CIPHER = 'aes-256-gcm'
+ DELIMITER = '--'
def self.base64_encode(str)
[str].pack('m0')
end
def self.base64_decode(str)
- str.unpack('m0').first
+ str.unpack1('m0')
end
def self.encrypt_message(data, secret, auth_data = '')
- raise ArgumentError, "data cannot be nil" if data.nil?
+ raise ArgumentError, 'data cannot be nil' if data.nil?
cipher = OpenSSL::Cipher.new(CIPHER)
cipher.encrypt
@@ -52,7 +54,6 @@ def self.decrypt_message(data, secret)
decrypted_data = cipher.update(cipher_text)
decrypted_data << cipher.final
decrypted_data
-
rescue OpenSSL::Cipher::CipherError, TypeError, ArgumentError
nil
end
diff --git a/rack-protection/lib/rack/protection/escaped_params.rb b/rack-protection/lib/rack/protection/escaped_params.rb
index 6706d1030e..17b35d5292 100644
--- a/rack-protection/lib/rack/protection/escaped_params.rb
+++ b/rack-protection/lib/rack/protection/escaped_params.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
require 'rack/utils'
require 'tempfile'
@@ -29,8 +31,8 @@ class << self
public :escape_html
end
- default_options :escape => :html,
- :escaper => defined?(EscapeUtils) ? EscapeUtils : self
+ default_options escape: :html,
+ escaper: defined?(EscapeUtils) ? EscapeUtils : self
def initialize(*)
super
@@ -41,15 +43,19 @@ def initialize(*)
@javascript = modes.include? :javascript
@url = modes.include? :url
- if @javascript and not @escaper.respond_to? :escape_javascript
- fail("Use EscapeUtils for JavaScript escaping.")
- end
+ return unless @javascript && (!@escaper.respond_to? :escape_javascript)
+
+ raise('Use EscapeUtils for JavaScript escaping.')
end
def call(env)
request = Request.new(env)
get_was = handle(request.GET)
- post_was = handle(request.POST) rescue nil
+ post_was = begin
+ handle(request.POST)
+ rescue StandardError
+ nil
+ end
app.call env
ensure
request.GET.replace get_was if get_was
@@ -68,13 +74,12 @@ def escape(object)
when Array then object.map { |o| escape(o) }
when String then escape_string(object)
when Tempfile then object
- else nil
end
end
def escape_hash(hash)
hash = hash.dup
- hash.each { |k,v| hash[k] = escape(v) }
+ hash.each { |k, v| hash[k] = escape(v) }
hash
end
diff --git a/rack-protection/lib/rack/protection/form_token.rb b/rack-protection/lib/rack/protection/form_token.rb
index 994740f83f..7e01976171 100644
--- a/rack-protection/lib/rack/protection/form_token.rb
+++ b/rack-protection/lib/rack/protection/form_token.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -16,7 +18,7 @@ module Protection
# Compatible with rack-csrf.
class FormToken < AuthenticityToken
def accepts?(env)
- env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" or super
+ env['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' or super
end
end
end
diff --git a/rack-protection/lib/rack/protection/frame_options.rb b/rack-protection/lib/rack/protection/frame_options.rb
index bce75c47e9..c159d4a985 100644
--- a/rack-protection/lib/rack/protection/frame_options.rb
+++ b/rack-protection/lib/rack/protection/frame_options.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -17,7 +19,7 @@ module Protection
# frame. Use :deny to forbid any embedding, :sameorigin
# to allow embedding from the same origin (default).
class FrameOptions < Base
- default_options :frame_options => :sameorigin
+ default_options frame_options: :sameorigin
def frame_options
@frame_options ||= begin
diff --git a/rack-protection/lib/rack/protection/http_origin.rb b/rack-protection/lib/rack/protection/http_origin.rb
index 834a185525..8eb25bbbd9 100644
--- a/rack-protection/lib/rack/protection/http_origin.rb
+++ b/rack-protection/lib/rack/protection/http_origin.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -19,7 +21,7 @@ module Protection
class HttpOrigin < Base
DEFAULT_PORTS = { 'http' => 80, 'https' => 443, 'coffee' => 80 }
default_reaction :deny
- default_options :allow_if => nil
+ default_options allow_if: nil
def base_url(env)
request = Rack::Request.new(env)
@@ -29,14 +31,13 @@ def base_url(env)
def accepts?(env)
return true if safe? env
- return true unless origin = env['HTTP_ORIGIN']
+ return true unless (origin = env['HTTP_ORIGIN'])
return true if base_url(env) == origin
- return true if options[:allow_if] && options[:allow_if].call(env)
+ return true if options[:allow_if]&.call(env)
permitted_origins = options[:permitted_origins]
Array(permitted_origins).include? origin
end
-
end
end
end
diff --git a/rack-protection/lib/rack/protection/ip_spoofing.rb b/rack-protection/lib/rack/protection/ip_spoofing.rb
index 3e404ad7c0..a8799324b6 100644
--- a/rack-protection/lib/rack/protection/ip_spoofing.rb
+++ b/rack-protection/lib/rack/protection/ip_spoofing.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -13,9 +15,11 @@ class IPSpoofing < Base
def accepts?(env)
return true unless env.include? 'HTTP_X_FORWARDED_FOR'
+
ips = env['HTTP_X_FORWARDED_FOR'].split(/\s*,\s*/)
- return false if env.include? 'HTTP_CLIENT_IP' and not ips.include? env['HTTP_CLIENT_IP']
- return false if env.include? 'HTTP_X_REAL_IP' and not ips.include? env['HTTP_X_REAL_IP']
+ return false if env.include?('HTTP_CLIENT_IP') && (!ips.include? env['HTTP_CLIENT_IP'])
+ return false if env.include?('HTTP_X_REAL_IP') && (!ips.include? env['HTTP_X_REAL_IP'])
+
true
end
end
diff --git a/rack-protection/lib/rack/protection/json_csrf.rb b/rack-protection/lib/rack/protection/json_csrf.rb
index 5ec826b719..9f6817ac18 100644
--- a/rack-protection/lib/rack/protection/json_csrf.rb
+++ b/rack-protection/lib/rack/protection/json_csrf.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -17,7 +19,7 @@ module Protection
#
# The `:allow_if` option can be set to a proc to use custom allow/deny logic.
class JsonCsrf < Base
- default_options :allow_if => nil
+ default_options allow_if: nil
alias react deny
@@ -36,8 +38,9 @@ def call(env)
def has_vector?(request, headers)
return false if request.xhr?
- return false if options[:allow_if] && options[:allow_if].call(request.env)
- return false unless headers['Content-Type'].to_s.split(';', 2).first =~ /^\s*application\/json\s*$/
+ return false if options[:allow_if]&.call(request.env)
+ return false unless headers['Content-Type'].to_s.split(';', 2).first =~ %r{^\s*application/json\s*$}
+
origin(request.env).nil? and referrer(request.env) != request.host
end
diff --git a/rack-protection/lib/rack/protection/path_traversal.rb b/rack-protection/lib/rack/protection/path_traversal.rb
index 4e8c94ca95..34e2e36eb5 100644
--- a/rack-protection/lib/rack/protection/path_traversal.rb
+++ b/rack-protection/lib/rack/protection/path_traversal.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -11,11 +13,11 @@ module Protection
# Thus GET /foo/%2e%2e%2fbar becomes GET /bar.
class PathTraversal < Base
def call(env)
- path_was = env["PATH_INFO"]
- env["PATH_INFO"] = cleanup path_was if path_was && !path_was.empty?
+ path_was = env['PATH_INFO']
+ env['PATH_INFO'] = cleanup path_was if path_was && !path_was.empty?
app.call env
ensure
- env["PATH_INFO"] = path_was
+ env['PATH_INFO'] = path_was
end
def cleanup(path)
@@ -29,12 +31,13 @@ def cleanup(path)
unescaped = unescaped.gsub(backslash, slash)
unescaped.split(slash).each do |part|
- next if part.empty? or part == dot
+ next if part.empty? || (part == dot)
+
part == '..' ? parts.pop : parts << part
end
cleaned = slash + parts.join(slash)
- cleaned << slash if parts.any? and unescaped =~ %r{/\.{0,2}$}
+ cleaned << slash if parts.any? && unescaped =~ (%r{/\.{0,2}$})
cleaned
end
end
diff --git a/rack-protection/lib/rack/protection/referrer_policy.rb b/rack-protection/lib/rack/protection/referrer_policy.rb
index f977d72e4b..eaff7020f9 100644
--- a/rack-protection/lib/rack/protection/referrer_policy.rb
+++ b/rack-protection/lib/rack/protection/referrer_policy.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -13,7 +15,7 @@ module Protection
# Options:
# referrer_policy:: The policy to use (default: 'strict-origin-when-cross-origin')
class ReferrerPolicy < Base
- default_options :referrer_policy => 'strict-origin-when-cross-origin'
+ default_options referrer_policy: 'strict-origin-when-cross-origin'
def call(env)
status, headers, body = @app.call(env)
diff --git a/rack-protection/lib/rack/protection/remote_referrer.rb b/rack-protection/lib/rack/protection/remote_referrer.rb
index 5375ebc3d2..f882567fa1 100644
--- a/rack-protection/lib/rack/protection/remote_referrer.rb
+++ b/rack-protection/lib/rack/protection/remote_referrer.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
diff --git a/rack-protection/lib/rack/protection/remote_token.rb b/rack-protection/lib/rack/protection/remote_token.rb
index f3922c8739..ef4f6e5744 100644
--- a/rack-protection/lib/rack/protection/remote_token.rb
+++ b/rack-protection/lib/rack/protection/remote_token.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
diff --git a/rack-protection/lib/rack/protection/session_hijacking.rb b/rack-protection/lib/rack/protection/session_hijacking.rb
index 55f4aad871..555121d8b9 100644
--- a/rack-protection/lib/rack/protection/session_hijacking.rb
+++ b/rack-protection/lib/rack/protection/session_hijacking.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -13,14 +15,14 @@ module Protection
# spoofed, too, this will not prevent determined hijacking attempts.
class SessionHijacking < Base
default_reaction :drop_session
- default_options :tracking_key => :tracking,
- :track => %w[HTTP_USER_AGENT]
+ default_options tracking_key: :tracking,
+ track: %w[HTTP_USER_AGENT]
def accepts?(env)
session = session env
key = options[:tracking_key]
if session.include? key
- session[key].all? { |k,v| v == encode(env[k]) }
+ session[key].all? { |k, v| v == encode(env[k]) }
else
session[key] = {}
options[:track].each { |k| session[key][k] = encode(env[k]) }
diff --git a/rack-protection/lib/rack/protection/strict_transport.rb b/rack-protection/lib/rack/protection/strict_transport.rb
index b4283bab36..05fe4ae6a8 100644
--- a/rack-protection/lib/rack/protection/strict_transport.rb
+++ b/rack-protection/lib/rack/protection/strict_transport.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -18,11 +20,11 @@ module Protection
# preload:: Allow this domain to be included in browsers HSTS preload list. See https://hstspreload.appspot.com/
class StrictTransport < Base
- default_options :max_age => 31_536_000, :include_subdomains => false, :preload => false
+ default_options max_age: 31_536_000, include_subdomains: false, preload: false
def strict_transport
@strict_transport ||= begin
- strict_transport = 'max-age=' + options[:max_age].to_s
+ strict_transport = "max-age=#{options[:max_age]}"
strict_transport += '; includeSubDomains' if options[:include_subdomains]
strict_transport += '; preload' if options[:preload]
strict_transport.to_str
diff --git a/rack-protection/lib/rack/protection/version.rb b/rack-protection/lib/rack/protection/version.rb
index 5c581ee170..ac5d076b97 100644
--- a/rack-protection/lib/rack/protection/version.rb
+++ b/rack-protection/lib/rack/protection/version.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
module Rack
module Protection
VERSION = '3.0.0'
diff --git a/rack-protection/lib/rack/protection/xss_header.rb b/rack-protection/lib/rack/protection/xss_header.rb
index eb6f92fe36..14c679d9fb 100644
--- a/rack-protection/lib/rack/protection/xss_header.rb
+++ b/rack-protection/lib/rack/protection/xss_header.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
require 'rack/protection'
module Rack
@@ -12,7 +14,7 @@ module Protection
# Options:
# xss_mode:: How the browser should prevent the attack (default: :block)
class XSSHeader < Base
- default_options :xss_mode => :block, :nosniff => true
+ default_options xss_mode: :block, nosniff: true
def call(env)
status, headers, body = @app.call(env)
diff --git a/rack-protection/lib/rack_protection.rb b/rack-protection/lib/rack_protection.rb
new file mode 100644
index 0000000000..fa36f00450
--- /dev/null
+++ b/rack-protection/lib/rack_protection.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require 'rack/protection'
diff --git a/rack-protection/rack-protection.gemspec b/rack-protection/rack-protection.gemspec
index c8e0f2d1b8..354a66b227 100644
--- a/rack-protection/rack-protection.gemspec
+++ b/rack-protection/rack-protection.gemspec
@@ -1,40 +1,45 @@
-version = File.read(File.expand_path("../VERSION", __dir__)).strip
+# frozen_string_literal: true
+
+version = File.read(File.expand_path('../VERSION', __dir__)).strip
Gem::Specification.new do |s|
# general infos
- s.name = "rack-protection"
+ s.name = 'rack-protection'
s.version = version
- s.description = "Protect against typical web attacks, works with all Rack apps, including Rails."
- s.homepage = "http://sinatrarb.com/protection/"
+ s.description = 'Protect against typical web attacks, works with all Rack apps, including Rails.'
+ s.homepage = 'http://sinatrarb.com/protection/'
s.summary = s.description
s.license = 'MIT'
- s.authors = ["https://github.com/sinatra/sinatra/graphs/contributors"]
- s.email = "sinatrarb@googlegroups.com"
- s.files = Dir["lib/**/*.rb"] + [
- "License",
- "README.md",
- "Rakefile",
- "Gemfile",
- "rack-protection.gemspec"
+ s.authors = ['https://github.com/sinatra/sinatra/graphs/contributors']
+ s.email = 'sinatrarb@googlegroups.com'
+ s.files = Dir['lib/**/*.rb'] + [
+ 'License',
+ 'README.md',
+ 'Rakefile',
+ 'Gemfile',
+ 'rack-protection.gemspec'
]
- if s.respond_to?(:metadata)
- s.metadata = {
- 'source_code_uri' => 'https://github.com/sinatra/sinatra/tree/master/rack-protection',
- 'homepage_uri' => 'http://sinatrarb.com/protection/',
- 'documentation_uri' => 'https://www.rubydoc.info/gems/rack-protection'
- }
- else
- raise <<-EOF
+ unless s.respond_to?(:metadata)
+ raise <<-WARN
RubyGems 2.0 or newer is required to protect against public gem pushes. You can update your rubygems version by running:
gem install rubygems-update
update_rubygems:
gem update --system
-EOF
+ WARN
end
+ s.metadata = {
+ 'source_code_uri' => 'https://github.com/sinatra/sinatra/tree/master/rack-protection',
+ 'homepage_uri' => 'http://sinatrarb.com/protection/',
+ 'documentation_uri' => 'https://www.rubydoc.info/gems/rack-protection',
+ 'rubygems_mfa_required' => 'true'
+ }
+
+ s.required_ruby_version = '>= 2.6.0'
+
# dependencies
- s.add_dependency "rack"
- s.add_development_dependency "rack-test", "~> 2"
- s.add_development_dependency "rspec", "~> 3"
+ s.add_dependency 'rack'
+ s.add_development_dependency 'rack-test', '~> 2'
+ s.add_development_dependency 'rspec', '~> 3'
end
diff --git a/rack-protection/spec/lib/rack/protection/authenticity_token_spec.rb b/rack-protection/spec/lib/rack/protection/authenticity_token_spec.rb
index 433e6ea58f..e589726be5 100644
--- a/rack-protection/spec/lib/rack/protection/authenticity_token_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/authenticity_token_spec.rb
@@ -1,68 +1,70 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::AuthenticityToken do
let(:token) { described_class.random_token }
let(:masked_token) { described_class.token(session) }
- let(:bad_token) { Base64.strict_encode64("badtoken") }
- let(:session) { {:csrf => token} }
+ let(:bad_token) { Base64.strict_encode64('badtoken') }
+ let(:session) { { csrf: token } }
- it_behaves_like "any rack application"
+ it_behaves_like 'any rack application'
- it "denies post requests without any token" do
+ it 'denies post requests without any token' do
expect(post('/')).not_to be_ok
end
- it "accepts post requests with correct X-CSRF-Token header" do
+ it 'accepts post requests with correct X-CSRF-Token header' do
post('/', {}, 'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => token)
expect(last_response).to be_ok
end
- it "accepts post requests with masked X-CSRF-Token header" do
+ it 'accepts post requests with masked X-CSRF-Token header' do
post('/', {}, 'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => masked_token)
expect(last_response).to be_ok
end
- it "denies post requests with wrong X-CSRF-Token header" do
+ it 'denies post requests with wrong X-CSRF-Token header' do
post('/', {}, 'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => bad_token)
expect(last_response).not_to be_ok
end
- it "accepts post form requests with correct authenticity_token field" do
- post('/', {"authenticity_token" => token}, 'rack.session' => session)
+ it 'accepts post form requests with correct authenticity_token field' do
+ post('/', { 'authenticity_token' => token }, 'rack.session' => session)
expect(last_response).to be_ok
end
- it "accepts post form requests with masked authenticity_token field" do
- post('/', {"authenticity_token" => masked_token}, 'rack.session' => session)
+ it 'accepts post form requests with masked authenticity_token field' do
+ post('/', { 'authenticity_token' => masked_token }, 'rack.session' => session)
expect(last_response).to be_ok
end
- it "denies post form requests with wrong authenticity_token field" do
- post('/', {"authenticity_token" => bad_token}, 'rack.session' => session)
+ it 'denies post form requests with wrong authenticity_token field' do
+ post('/', { 'authenticity_token' => bad_token }, 'rack.session' => session)
expect(last_response).not_to be_ok
end
- it "accepts post form requests with a valid per form token" do
+ it 'accepts post form requests with a valid per form token' do
token = Rack::Protection::AuthenticityToken.token(session, path: '/foo')
- post('/foo', {"authenticity_token" => token}, 'rack.session' => session)
+ post('/foo', { 'authenticity_token' => token }, 'rack.session' => session)
expect(last_response).to be_ok
end
- it "denies post form requests with an invalid per form token" do
+ it 'denies post form requests with an invalid per form token' do
token = Rack::Protection::AuthenticityToken.token(session, path: '/foo')
- post('/bar', {"authenticity_token" => token}, 'rack.session' => session)
+ post('/bar', { 'authenticity_token' => token }, 'rack.session' => session)
expect(last_response).not_to be_ok
end
- it "prevents ajax requests without a valid token" do
- expect(post('/', {}, "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest")).not_to be_ok
+ it 'prevents ajax requests without a valid token' do
+ expect(post('/', {}, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')).not_to be_ok
end
- it "allows for a custom authenticity token param" do
+ it 'allows for a custom authenticity token param' do
mock_app do
- use Rack::Protection::AuthenticityToken, :authenticity_param => 'csrf_param'
- run proc { |e| [200, {'Content-Type' => 'text/plain'}, ['hi']] }
+ use Rack::Protection::AuthenticityToken, authenticity_param: 'csrf_param'
+ run proc { |_e| [200, { 'Content-Type' => 'text/plain' }, ['hi']] }
end
- post('/', {"csrf_param" => token}, 'rack.session' => {:csrf => token})
+ post('/', { 'csrf_param' => token }, 'rack.session' => { csrf: token })
expect(last_response).to be_ok
end
@@ -71,10 +73,10 @@
expect(env['rack.session'][:csrf]).not_to be_nil
end
- it "allows for a custom token session key" do
+ it 'allows for a custom token session key' do
mock_app do
- use Rack::Session::Cookie, :key => 'rack.session'
- use Rack::Protection::AuthenticityToken, :key => :_csrf
+ use Rack::Session::Cookie, key: 'rack.session'
+ use Rack::Protection::AuthenticityToken, key: :_csrf
run DummyApp
end
@@ -82,12 +84,12 @@
expect(env['rack.session'][:_csrf]).not_to be_nil
end
- describe ".token" do
- it "returns a unique masked version of the authenticity token" do
+ describe '.token' do
+ it 'returns a unique masked version of the authenticity token' do
expect(Rack::Protection::AuthenticityToken.token(session)).not_to eq(masked_token)
end
- it "sets a session authenticity token if one does not exist" do
+ it 'sets a session authenticity token if one does not exist' do
session = {}
allow(Rack::Protection::AuthenticityToken).to receive(:random_token).and_return(token)
allow_any_instance_of(Rack::Protection::AuthenticityToken).to receive(:mask_token).and_return(masked_token)
@@ -96,8 +98,8 @@
end
end
- describe ".random_token" do
- it "generates a base64 encoded 32 character string" do
+ describe '.random_token' do
+ it 'generates a base64 encoded 32 character string' do
expect(Base64.urlsafe_decode64(token).length).to eq(32)
end
end
diff --git a/rack-protection/spec/lib/rack/protection/base_spec.rb b/rack-protection/spec/lib/rack/protection/base_spec.rb
index 46a4d901d4..c4b8f8c86e 100644
--- a/rack-protection/spec/lib/rack/protection/base_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/base_spec.rb
@@ -1,37 +1,38 @@
-RSpec.describe Rack::Protection::Base do
+# frozen_string_literal: true
- subject { described_class.new(lambda {}) }
+RSpec.describe Rack::Protection::Base do
+ subject { described_class.new(-> {}) }
- describe "#random_string" do
- it "outputs a string of 32 characters" do
+ describe '#random_string' do
+ it 'outputs a string of 32 characters' do
expect(subject.random_string.length).to eq(32)
end
end
- describe "#referrer" do
- it "Reads referrer from Referer header" do
- env = {"HTTP_HOST" => "foo.com", "HTTP_REFERER" => "http://bar.com/valid"}
- expect(subject.referrer(env)).to eq("bar.com")
+ describe '#referrer' do
+ it 'Reads referrer from Referer header' do
+ env = { 'HTTP_HOST' => 'foo.com', 'HTTP_REFERER' => 'http://bar.com/valid' }
+ expect(subject.referrer(env)).to eq('bar.com')
end
- it "Reads referrer from Host header when Referer header is relative" do
- env = {"HTTP_HOST" => "foo.com", "HTTP_REFERER" => "/valid"}
- expect(subject.referrer(env)).to eq("foo.com")
+ it 'Reads referrer from Host header when Referer header is relative' do
+ env = { 'HTTP_HOST' => 'foo.com', 'HTTP_REFERER' => '/valid' }
+ expect(subject.referrer(env)).to eq('foo.com')
end
- it "Reads referrer from Host header when Referer header is missing" do
- env = {"HTTP_HOST" => "foo.com"}
- expect(subject.referrer(env)).to eq("foo.com")
+ it 'Reads referrer from Host header when Referer header is missing' do
+ env = { 'HTTP_HOST' => 'foo.com' }
+ expect(subject.referrer(env)).to eq('foo.com')
end
- it "Returns nil when Referer header is missing and allow_empty_referrer is false" do
- env = {"HTTP_HOST" => "foo.com"}
+ it 'Returns nil when Referer header is missing and allow_empty_referrer is false' do
+ env = { 'HTTP_HOST' => 'foo.com' }
subject.options[:allow_empty_referrer] = false
expect(subject.referrer(env)).to be_nil
end
- it "Returns nil when Referer header is invalid" do
- env = {"HTTP_HOST" => "foo.com", "HTTP_REFERER" => "http://bar.com/bad|uri"}
+ it 'Returns nil when Referer header is invalid' do
+ env = { 'HTTP_HOST' => 'foo.com', 'HTTP_REFERER' => 'http://bar.com/bad|uri' }
expect(subject.referrer(env)).to be_nil
end
end
diff --git a/rack-protection/spec/lib/rack/protection/content_security_policy_spec.rb b/rack-protection/spec/lib/rack/protection/content_security_policy_spec.rb
index 0df46ba83b..35a26ad837 100644
--- a/rack-protection/spec/lib/rack/protection/content_security_policy_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/content_security_policy_spec.rb
@@ -1,66 +1,68 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::ContentSecurityPolicy do
- it_behaves_like "any rack application"
+ it_behaves_like 'any rack application'
it 'should set the Content Security Policy' do
expect(
- get('/', {}, 'wants' => 'text/html').headers["Content-Security-Policy"]
+ get('/', {}, 'wants' => 'text/html').headers['Content-Security-Policy']
).to eq("default-src 'self'")
end
it 'should not set the Content Security Policy for other content types' do
headers = get('/', {}, 'wants' => 'text/foo').headers
- expect(headers["Content-Security-Policy"]).to be_nil
- expect(headers["Content-Security-Policy-Report-Only"]).to be_nil
+ expect(headers['Content-Security-Policy']).to be_nil
+ expect(headers['Content-Security-Policy-Report-Only']).to be_nil
end
it 'should allow changing the protection settings' do
mock_app do
- use Rack::Protection::ContentSecurityPolicy, :default_src => 'none', :script_src => 'https://cdn.mybank.net', :style_src => 'https://cdn.mybank.net', :img_src => 'https://cdn.mybank.net', :connect_src => 'https://api.mybank.com', :frame_src => 'self', :font_src => 'https://cdn.mybank.net', :object_src => 'https://cdn.mybank.net', :media_src => 'https://cdn.mybank.net', :report_uri => '/my_amazing_csp_report_parser', :sandbox => 'allow-scripts'
+ use Rack::Protection::ContentSecurityPolicy, default_src: 'none', script_src: 'https://cdn.mybank.net', style_src: 'https://cdn.mybank.net', img_src: 'https://cdn.mybank.net', connect_src: 'https://api.mybank.com', frame_src: 'self', font_src: 'https://cdn.mybank.net', object_src: 'https://cdn.mybank.net', media_src: 'https://cdn.mybank.net', report_uri: '/my_amazing_csp_report_parser', sandbox: 'allow-scripts'
run DummyApp
end
headers = get('/', {}, 'wants' => 'text/html').headers
- expect(headers["Content-Security-Policy"]).to eq("connect-src https://api.mybank.com; default-src none; font-src https://cdn.mybank.net; frame-src self; img-src https://cdn.mybank.net; media-src https://cdn.mybank.net; object-src https://cdn.mybank.net; report-uri /my_amazing_csp_report_parser; sandbox allow-scripts; script-src https://cdn.mybank.net; style-src https://cdn.mybank.net")
- expect(headers["Content-Security-Policy-Report-Only"]).to be_nil
+ expect(headers['Content-Security-Policy']).to eq('connect-src https://api.mybank.com; default-src none; font-src https://cdn.mybank.net; frame-src self; img-src https://cdn.mybank.net; media-src https://cdn.mybank.net; object-src https://cdn.mybank.net; report-uri /my_amazing_csp_report_parser; sandbox allow-scripts; script-src https://cdn.mybank.net; style-src https://cdn.mybank.net')
+ expect(headers['Content-Security-Policy-Report-Only']).to be_nil
end
it 'should allow setting CSP3 no arg directives' do
mock_app do
- use Rack::Protection::ContentSecurityPolicy, :block_all_mixed_content => true, :disown_opener => true, :upgrade_insecure_requests => true
+ use Rack::Protection::ContentSecurityPolicy, block_all_mixed_content: true, disown_opener: true, upgrade_insecure_requests: true
run DummyApp
end
headers = get('/', {}, 'wants' => 'text/html').headers
- expect(headers["Content-Security-Policy"]).to eq("block-all-mixed-content; default-src 'self'; disown-opener; upgrade-insecure-requests")
+ expect(headers['Content-Security-Policy']).to eq("block-all-mixed-content; default-src 'self'; disown-opener; upgrade-insecure-requests")
end
it 'should ignore CSP3 no arg directives unless they are set to true' do
mock_app do
- use Rack::Protection::ContentSecurityPolicy, :block_all_mixed_content => false, :disown_opener => 'false', :upgrade_insecure_requests => 'foo'
+ use Rack::Protection::ContentSecurityPolicy, block_all_mixed_content: false, disown_opener: 'false', upgrade_insecure_requests: 'foo'
run DummyApp
end
headers = get('/', {}, 'wants' => 'text/html').headers
- expect(headers["Content-Security-Policy"]).to eq("default-src 'self'")
+ expect(headers['Content-Security-Policy']).to eq("default-src 'self'")
end
it 'should allow changing report only' do
# I have no clue what other modes are available
mock_app do
- use Rack::Protection::ContentSecurityPolicy, :report_uri => '/my_amazing_csp_report_parser', :report_only => true
+ use Rack::Protection::ContentSecurityPolicy, report_uri: '/my_amazing_csp_report_parser', report_only: true
run DummyApp
end
headers = get('/', {}, 'wants' => 'text/html').headers
- expect(headers["Content-Security-Policy"]).to be_nil
- expect(headers["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; report-uri /my_amazing_csp_report_parser")
+ expect(headers['Content-Security-Policy']).to be_nil
+ expect(headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; report-uri /my_amazing_csp_report_parser")
end
it 'should not override the header if already set' do
- mock_app with_headers("Content-Security-Policy" => "default-src: none")
- expect(get('/', {}, 'wants' => 'text/html').headers["Content-Security-Policy"]).to eq("default-src: none")
+ mock_app with_headers('Content-Security-Policy' => 'default-src: none')
+ expect(get('/', {}, 'wants' => 'text/html').headers['Content-Security-Policy']).to eq('default-src: none')
end
end
diff --git a/rack-protection/spec/lib/rack/protection/cookie_tossing_spec.rb b/rack-protection/spec/lib/rack/protection/cookie_tossing_spec.rb
index af6d888296..f24b9920b6 100644
--- a/rack-protection/spec/lib/rack/protection/cookie_tossing_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/cookie_tossing_spec.rb
@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::CookieTossing do
- it_behaves_like "any rack application"
+ it_behaves_like 'any rack application'
context 'with default reaction' do
before(:each) do
@@ -34,7 +36,7 @@
rack.session=; domain=example.org; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.session=; domain=example.org; path=/some; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.session=; domain=example.org; path=/some/path; expires=Thu, 01 Jan 1970 00:00:00 GMT
-END
+ END
expect(last_response.headers['Set-Cookie']).to eq(expected_header)
end
end
@@ -42,7 +44,7 @@
context 'with redirect reaction' do
before(:each) do
mock_app do
- use Rack::Protection::CookieTossing, :reaction => :redirect
+ use Rack::Protection::CookieTossing, reaction: :redirect
run DummyApp
end
end
@@ -63,7 +65,7 @@
context 'with custom session key' do
it 'denies requests with duplicate session cookies' do
mock_app do
- use Rack::Protection::CookieTossing, :session_key => '_session'
+ use Rack::Protection::CookieTossing, session_key: '_session'
run DummyApp
end
diff --git a/rack-protection/spec/lib/rack/protection/encrypted_cookie_spec.rb b/rack-protection/spec/lib/rack/protection/encrypted_cookie_spec.rb
index 726687c2ac..de2a659bc1 100644
--- a/rack-protection/spec/lib/rack/protection/encrypted_cookie_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/encrypted_cookie_spec.rb
@@ -1,77 +1,79 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::EncryptedCookie do
let(:incrementor) do
lambda do |env|
- env["rack.session"]["counter"] ||= 0
- env["rack.session"]["counter"] += 1
- hash = env["rack.session"].dup
- hash.delete("session_id")
+ env['rack.session']['counter'] ||= 0
+ env['rack.session']['counter'] += 1
+ hash = env['rack.session'].dup
+ hash.delete('session_id')
Rack::Response.new(hash.inspect).to_a
end
end
let(:session_id) do
lambda do |env|
- Rack::Response.new(env["rack.session"].to_hash.inspect).to_a
+ Rack::Response.new(env['rack.session'].to_hash.inspect).to_a
end
end
let(:session_option) do
lambda do |opt|
lambda do |env|
- Rack::Response.new(env["rack.session.options"][opt].inspect).to_a
+ Rack::Response.new(env['rack.session.options'][opt].inspect).to_a
end
end
end
let(:nothing) do
- lambda do |env|
- Rack::Response.new("Nothing").to_a
+ lambda do |_env|
+ Rack::Response.new('Nothing').to_a
end
end
let(:renewer) do
lambda do |env|
- env["rack.session.options"][:renew] = true
- Rack::Response.new("Nothing").to_a
+ env['rack.session.options'][:renew] = true
+ Rack::Response.new('Nothing').to_a
end
end
let(:only_session_id) do
lambda do |env|
- Rack::Response.new(env["rack.session"]["session_id"].to_s).to_a
+ Rack::Response.new(env['rack.session']['session_id'].to_s).to_a
end
end
let(:bigcookie) do
lambda do |env|
- env["rack.session"]["cookie"] = "big" * 3000
- Rack::Response.new(env["rack.session"].inspect).to_a
+ env['rack.session']['cookie'] = 'big' * 3000
+ Rack::Response.new(env['rack.session'].inspect).to_a
end
end
let(:destroy_session) do
lambda do |env|
- env["rack.session"].destroy
- Rack::Response.new("Nothing").to_a
+ env['rack.session'].destroy
+ Rack::Response.new('Nothing').to_a
end
end
- def response_for(options={})
+ def response_for(options = {})
request_options = options.fetch(:request, {})
cookie = if options[:cookie].is_a?(Rack::Response)
- options[:cookie]["Set-Cookie"]
- else
- options[:cookie]
- end
- request_options["HTTP_COOKIE"] = cookie || ""
+ options[:cookie]['Set-Cookie']
+ else
+ options[:cookie]
+ end
+ request_options['HTTP_COOKIE'] = cookie || ''
app_with_cookie = Rack::Protection::EncryptedCookie.new(*options[:app])
app_with_cookie = Rack::Lint.new(app_with_cookie)
- Rack::MockRequest.new(app_with_cookie).get("/", request_options)
+ Rack::MockRequest.new(app_with_cookie).get('/', request_options)
end
def random_cipher_secret
- OpenSSL::Cipher.new('aes-256-gcm').random_key.unpack('H*').first
+ OpenSSL::Cipher.new('aes-256-gcm').random_key.unpack1('H*')
end
let(:secret) { random_cipher_secret }
@@ -99,7 +101,7 @@ def random_cipher_secret
it 'uses base64 to decode' do
coder = Rack::Protection::EncryptedCookie::Base64.new
str = ['fuuuuu'].pack('m0')
- expect(coder.decode(str)).to eq(str.unpack('m0').first)
+ expect(coder.decode(str)).to eq(str.unpack1('m0'))
end
it 'handles non-strict base64 encoding' do
@@ -118,7 +120,7 @@ def random_cipher_secret
it 'marshals and base64 decodes' do
coder = Rack::Protection::EncryptedCookie::Base64::Marshal.new
str = [::Marshal.dump('fuuuuu')].pack('m0')
- expect(coder.decode(str)).to eq(::Marshal.load(str.unpack('m0').first))
+ expect(coder.decode(str)).to eq(::Marshal.load(str.unpack1('m0')))
end
it 'rescues failures on decode' do
@@ -137,7 +139,7 @@ def random_cipher_secret
it 'JSON and base64 decodes' do
coder = Rack::Protection::EncryptedCookie::Base64::JSON.new
str = [::JSON.dump(%w[fuuuuu])].pack('m0')
- expect(coder.decode(str)).to eq(::JSON.parse(str.unpack('m0').first))
+ expect(coder.decode(str)).to eq(::JSON.parse(str.unpack1('m0')))
end
it 'rescues failures on decode' do
@@ -169,7 +171,7 @@ def random_cipher_secret
end
end
- it "warns if no secret is given" do
+ it 'warns if no secret is given' do
Rack::Protection::EncryptedCookie.new(incrementor)
expect(warnings.first).to match(/no secret/i)
warnings.clear
@@ -178,7 +180,7 @@ def random_cipher_secret
end
it 'warns if secret is to short' do
- Rack::Protection::EncryptedCookie.new(incrementor, secret: secret[0,16])
+ Rack::Protection::EncryptedCookie.new(incrementor, secret: secret[0, 16])
expect(warnings.first).to match(/secret is not long enough/i)
warnings.clear
Rack::Protection::EncryptedCookie.new(incrementor, secret: secret)
@@ -192,38 +194,46 @@ def random_cipher_secret
expect(warnings).to be_empty
end
- it "still warns if coder is not set" do
+ it 'still warns if coder is not set' do
Rack::Protection::EncryptedCookie.new(
incrementor,
- let_coder_handle_secure_encoding: true)
+ let_coder_handle_secure_encoding: true
+ )
expect(warnings.first).to match(/no secret/i)
end
it 'uses a coder' do
- identity = Class.new {
+ identity = Class.new do
attr_reader :calls
def initialize
@calls = []
end
- def encode(str); @calls << :encode; str; end
- def decode(str); @calls << :decode; str; end
- }.new
+ def encode(str)
+ @calls << :encode
+ str
+ end
+
+ def decode(str)
+ @calls << :decode
+ str
+ end
+ end.new
response = response_for(app: [incrementor, { coder: identity }])
- expect(response["Set-Cookie"]).to include("rack.session=")
+ expect(response['Set-Cookie']).to include('rack.session=')
expect(response.body).to eq('{"counter"=>1}')
- expect(identity.calls).to eq([:decode, :encode])
+ expect(identity.calls).to eq(%i[decode encode])
end
- it "creates a new cookie" do
+ it 'creates a new cookie' do
response = response_for(app: incrementor)
- expect(response["Set-Cookie"]).to include("rack.session=")
+ expect(response['Set-Cookie']).to include('rack.session=')
expect(response.body).to eq('{"counter"=>1}')
end
- it "loads from a cookie" do
+ it 'loads from a cookie' do
response = response_for(app: incrementor)
response = response_for(app: incrementor, cookie: response)
@@ -233,58 +243,58 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>3}')
end
- it "renew session id" do
+ it 'renew session id' do
response = response_for(app: incrementor)
cookie = response['Set-Cookie']
response = response_for(app: only_session_id, cookie: cookie)
cookie = response['Set-Cookie'] if response['Set-Cookie']
- expect(response.body).to_not eq("")
+ expect(response.body).to_not eq('')
old_session_id = response.body
response = response_for(app: renewer, cookie: cookie)
cookie = response['Set-Cookie'] if response['Set-Cookie']
response = response_for(app: only_session_id, cookie: cookie)
- expect(response.body).to_not eq("")
+ expect(response.body).to_not eq('')
expect(response.body).to_not eq(old_session_id)
end
- it "destroys session" do
+ it 'destroys session' do
response = response_for(app: incrementor)
response = response_for(app: only_session_id, cookie: response)
- expect(response.body).to_not eq("")
+ expect(response.body).to_not eq('')
old_session_id = response.body
response = response_for(app: destroy_session, cookie: response)
response = response_for(app: only_session_id, cookie: response)
- expect(response.body).to_not eq("")
+ expect(response.body).to_not eq('')
expect(response.body).to_not eq(old_session_id)
end
- it "survives broken cookies" do
+ it 'survives broken cookies' do
response = response_for(
app: incrementor,
- cookie: "rack.session=blarghfasel"
+ cookie: 'rack.session=blarghfasel'
)
expect(response.body).to eq('{"counter"=>1}')
response = response_for(
app: [incrementor, { secret: secret }],
- cookie: "rack.session="
+ cookie: 'rack.session='
)
expect(response.body).to eq('{"counter"=>1}')
end
- it "barks on too big cookies" do
- expect {
+ it 'barks on too big cookies' do
+ expect do
response_for(app: bigcookie, request: { fatal: true })
- }.to raise_error Rack::MockRequest::FatalWarning
+ end.to raise_error Rack::MockRequest::FatalWarning
end
- it "loads from a cookie with integrity hash" do
+ it 'loads from a cookie with integrity hash' do
app = [incrementor, { secret: secret }]
response = response_for(app: app)
@@ -300,7 +310,7 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>1}')
end
- it "loads from a cookie with accept-only integrity hash for graceful key rotation" do
+ it 'loads from a cookie with accept-only integrity hash for graceful key rotation' do
response = response_for(app: [incrementor, { secret: secret }])
new_secret = random_cipher_secret
@@ -319,7 +329,7 @@ def decode(str); @calls << :decode; str; end
it 'loads from a legacy hmac cookie' do
legacy_session = Rack::Protection::EncryptedCookie::Base64::Marshal.new.encode({ 'counter' => 1, 'session_id' => 'abcdef' })
legacy_secret = 'test legacy secret'
- legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, legacy_secret, legacy_session)
+ legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA1'), legacy_secret, legacy_session)
legacy_cookie = "rack.session=#{legacy_session}--#{legacy_digest}; path=/; HttpOnly"
@@ -328,7 +338,7 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>2}')
end
- it "ignores tampered with session cookies" do
+ it 'ignores tampered with session cookies' do
app = [incrementor, { secret: secret }]
response = response_for(app: app)
expect(response.body).to eq('{"counter"=>1}')
@@ -336,7 +346,7 @@ def decode(str); @calls << :decode; str; end
response = response_for(app: app, cookie: response)
expect(response.body).to eq('{"counter"=>2}')
- ctxt, iv, auth_tag = response["Set-Cookie"].split("--", 3)
+ ctxt, iv, auth_tag = response['Set-Cookie'].split('--', 3)
tampered_with_cookie = [ctxt, iv, auth_tag.reverse].join('--')
response = response_for(app: app, cookie: tampered_with_cookie)
@@ -346,7 +356,7 @@ def decode(str); @calls << :decode; str; end
it 'ignores tampered with legacy hmac cookie' do
legacy_session = Rack::Protection::EncryptedCookie::Base64::Marshal.new.encode({ 'counter' => 1, 'session_id' => 'abcdef' })
legacy_secret = 'test legacy secret'
- legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, legacy_secret, legacy_session).reverse
+ legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA1'), legacy_secret, legacy_session).reverse
legacy_cookie = "rack.session=#{legacy_session}--#{legacy_digest}; path=/; HttpOnly"
@@ -355,7 +365,7 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>1}')
end
- it "supports either of secret or old_secret" do
+ it 'supports either of secret or old_secret' do
app = [incrementor, { secret: secret }]
response = response_for(app: app)
expect(response.body).to eq('{"counter"=>1}')
@@ -371,7 +381,7 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>2}')
end
- it "supports custom digest class for legacy hmac cookie" do
+ it 'supports custom digest class for legacy hmac cookie' do
legacy_hmac = OpenSSL::Digest::SHA256
legacy_session = Rack::Protection::EncryptedCookie::Base64::Marshal.new.encode({ 'counter' => 1, 'session_id' => 'abcdef' })
legacy_secret = 'test legacy secret'
@@ -379,7 +389,8 @@ def decode(str); @calls << :decode; str; end
legacy_cookie = "rack.session=#{Rack::Utils.escape legacy_session}--#{legacy_digest}; path=/; HttpOnly"
app = [incrementor, {
- secret: secret, legacy_hmac_secret: legacy_secret, legacy_hmac: legacy_hmac }]
+ secret: secret, legacy_hmac_secret: legacy_secret, legacy_hmac: legacy_hmac
+ }]
response = response_for(app: app, cookie: legacy_cookie)
expect(response.body).to eq('{"counter"=>2}')
@@ -388,7 +399,7 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to eq('{"counter"=>3}')
end
- it "can handle Rack::Lint middleware" do
+ it 'can handle Rack::Lint middleware' do
response = response_for(app: incrementor)
lint = Rack::Lint.new(session_id)
@@ -396,11 +407,12 @@ def decode(str); @calls << :decode; str; end
expect(response.body).to_not be_nil
end
- it "can handle middleware that inspects the env" do
+ it 'can handle middleware that inspects the env' do
class TestEnvInspector
def initialize(app)
@app = app
end
+
def call(env)
env.inspect
@app.call(env)
@@ -414,7 +426,7 @@ def call(env)
expect(response.body).to_not be_nil
end
- it "returns the session id in the session hash" do
+ it 'returns the session id in the session hash' do
response = response_for(app: incrementor)
expect(response.body).to eq('{"counter"=>1}')
@@ -423,38 +435,38 @@ def call(env)
expect(response.body).to match(/"counter"=>1/)
end
- it "does not return a cookie if set to secure but not using ssl" do
+ it 'does not return a cookie if set to secure but not using ssl' do
app = [incrementor, { secure: true }]
response = response_for(app: app)
- expect(response["Set-Cookie"]).to be_nil
+ expect(response['Set-Cookie']).to be_nil
- response = response_for(app: app, request: { "HTTPS" => "on" })
- expect(response["Set-Cookie"]).to_not be_nil
- expect(response["Set-Cookie"]).to match(/secure/)
+ response = response_for(app: app, request: { 'HTTPS' => 'on' })
+ expect(response['Set-Cookie']).to_not be_nil
+ expect(response['Set-Cookie']).to match(/secure/)
end
- it "does not return a cookie if cookie was not read/written" do
+ it 'does not return a cookie if cookie was not read/written' do
response = response_for(app: nothing)
- expect(response["Set-Cookie"]).to be_nil
+ expect(response['Set-Cookie']).to be_nil
end
- it "does not return a cookie if cookie was not written (only read)" do
+ it 'does not return a cookie if cookie was not written (only read)' do
response = response_for(app: session_id)
- expect(response["Set-Cookie"]).to be_nil
+ expect(response['Set-Cookie']).to be_nil
end
- it "returns even if not read/written if :expire_after is set" do
+ it 'returns even if not read/written if :expire_after is set' do
app = [nothing, { expire_after: 3600 }]
- request = { "rack.session" => { "not" => "empty" }}
+ request = { 'rack.session' => { 'not' => 'empty' } }
response = response_for(app: app, request: request)
- expect(response["Set-Cookie"]).to_not be_nil
+ expect(response['Set-Cookie']).to_not be_nil
end
- it "returns no cookie if no data was written and no session was created previously, even if :expire_after is set" do
+ it 'returns no cookie if no data was written and no session was created previously, even if :expire_after is set' do
app = [nothing, { expire_after: 3600 }]
response = response_for(app: app)
- expect(response["Set-Cookie"]).to be_nil
+ expect(response['Set-Cookie']).to be_nil
end
it "exposes :secret in env['rack.session.option']" do
@@ -472,14 +484,14 @@ def call(env)
expect(response.body).to match(/Marshal/)
end
- it "allows passing in a hash with session data from middleware in front" do
- request = { 'rack.session' => { foo: 'bar' }}
+ it 'allows passing in a hash with session data from middleware in front' do
+ request = { 'rack.session' => { foo: 'bar' } }
response = response_for(app: session_id, request: request)
expect(response.body).to match(/foo/)
end
- it "allows modifying session data with session data from middleware in front" do
- request = { 'rack.session' => { foo: 'bar' }}
+ it 'allows modifying session data with session data from middleware in front' do
+ request = { 'rack.session' => { foo: 'bar' } }
response = response_for(app: incrementor, request: request)
expect(response.body).to match(/counter/)
expect(response.body).to match(/foo/)
@@ -488,41 +500,42 @@ def call(env)
it "allows more than one '--' in the cookie when calculating legacy digests" do
@counter = 0
app = lambda do |env|
- env["rack.session"]["message"] ||= ""
- env["rack.session"]["message"] << "#{(@counter += 1).to_s}--"
- hash = env["rack.session"].dup
- hash.delete("session_id")
- Rack::Response.new(hash["message"]).to_a
+ env['rack.session']['message'] ||= ''
+ env['rack.session']['message'] << "#{@counter += 1}--"
+ hash = env['rack.session'].dup
+ hash.delete('session_id')
+ Rack::Response.new(hash['message']).to_a
end
# another example of an unsafe coder is Base64.urlsafe_encode64
- unsafe_coder = Class.new {
+ unsafe_coder = Class.new do
def encode(hash); hash.inspect end
def decode(str); eval(str) if str; end
- }.new
+ end.new
legacy_session = unsafe_coder.encode('message' => "#{@counter += 1}--#{@counter += 1}--", 'session_id' => 'abcdef')
legacy_secret = 'test legacy secret'
- legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, legacy_secret, legacy_session)
+ legacy_digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA1'), legacy_secret, legacy_session)
legacy_cookie = "rack.session=#{Rack::Utils.escape legacy_session}--#{legacy_digest}; path=/; HttpOnly"
- _app = [ app, {
+ _app = [app, {
secret: secret, legacy_hmac_secret: legacy_secret,
- legacy_hmac_coder: unsafe_coder } ]
+ legacy_hmac_coder: unsafe_coder
+ }]
response = response_for(app: _app, cookie: legacy_cookie)
- expect(response.body).to eq("1--2--3--")
+ expect(response.body).to eq('1--2--3--')
end
it 'allows for non-strict encoded cookie' do
long_session_app = lambda do |env|
env['rack.session']['value'] = 'A' * 256
env['rack.session']['counter'] = 1
- hash = env["rack.session"].dup
- hash.delete("session_id")
+ hash = env['rack.session'].dup
+ hash.delete('session_id')
Rack::Response.new(hash.inspect).to_a
end
- non_strict_coder = Class.new {
+ non_strict_coder = Class.new do
def encode(str)
[Marshal.dump(str)].pack('m')
end
@@ -530,19 +543,19 @@ def encode(str)
def decode(str)
return unless str
- Marshal.load(str.unpack('m').first)
+ Marshal.load(str.unpack1('m'))
end
- }.new
+ end.new
non_strict_response = response_for(app: [
- long_session_app, { coder: non_strict_coder }
- ])
+ long_session_app, { coder: non_strict_coder }
+ ])
response = response_for(app: [
- incrementor
- ], cookie: non_strict_response)
+ incrementor
+ ], cookie: non_strict_response)
- expect(response.body).to match(%Q["value"=>"#{'A' * 256}"])
+ expect(response.body).to match(%("value"=>"#{'A' * 256}"))
expect(response.body).to match('"counter"=>2')
expect(response.body).to match(/\A{[^}]+}\z/)
end
diff --git a/rack-protection/spec/lib/rack/protection/encryptor_spec.rb b/rack-protection/spec/lib/rack/protection/encryptor_spec.rb
index ce11d75e74..cb7a2a401f 100644
--- a/rack-protection/spec/lib/rack/protection/encryptor_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/encryptor_spec.rb
@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::Encryptor do
- let(:secret) {
+ let(:secret) do
OpenSSL::Cipher.new(Rack::Protection::Encryptor::CIPHER).random_key
- }
+ end
it 'encrypted message contains ciphertext iv and auth_tag' do
msg = Rack::Protection::Encryptor.encrypt_message('hello world', secret)
diff --git a/rack-protection/spec/lib/rack/protection/escaped_params_spec.rb b/rack-protection/spec/lib/rack/protection/escaped_params_spec.rb
index 01c4f3a672..d6b1727b3e 100644
--- a/rack-protection/spec/lib/rack/protection/escaped_params_spec.rb
+++ b/rack-protection/spec/lib/rack/protection/escaped_params_spec.rb
@@ -1,37 +1,39 @@
+# frozen_string_literal: true
+
RSpec.describe Rack::Protection::EscapedParams do
- it_behaves_like "any rack application"
+ it_behaves_like 'any rack application'
context 'escaping' do
it 'escapes html entities' do
mock_app do |env|
request = Rack::Request.new(env)
- [200, {'Content-Type' => 'text/plain'}, [request.params['foo']]]
+ [200, { 'Content-Type' => 'text/plain' }, [request.params['foo']]]
end
- get '/', :foo => "#{Rack::Utils.escape_html(code)}
@@ -1869,12 +1936,12 @@ class #{self.class}
# top-level. Subclassing Sinatra::Base is highly recommended for
# modular applications.
class Application < Base
- set :logging, Proc.new { !test? }
+ set :logging, proc { !test? }
set :method_override, true
- set :run, Proc.new { !test? }
+ set :run, proc { !test? }
set :app_file, nil
- def self.register(*extensions, &block) #:nodoc:
+ def self.register(*extensions, &block) # :nodoc:
added_methods = extensions.flat_map(&:public_instance_methods)
Delegator.delegate(*added_methods)
super(*extensions, &block)
@@ -1884,11 +1951,12 @@ def self.register(*extensions, &block) #:nodoc:
# Sinatra delegation mixin. Mixing this module into an object causes all
# methods to be delegated to the Sinatra::Application class. Used primarily
# at the top-level.
- module Delegator #:nodoc:
+ module Delegator # :nodoc:
def self.delegate(*methods)
methods.each do |method_name|
define_method(method_name) do |*args, &block|
return super(*args, &block) if respond_to? method_name
+
Delegator.target.send(method_name, *args, &block)
end
# ensure keyword argument passing is compatible with ruby >= 2.7
@@ -1911,7 +1979,8 @@ class << self
class Wrapper
def initialize(stack, instance)
- @stack, @instance = stack, instance
+ @stack = stack
+ @instance = instance
end
def settings
diff --git a/lib/sinatra/indifferent_hash.rb b/lib/sinatra/indifferent_hash.rb
index 6951527472..a3a96d5c4d 100644
--- a/lib/sinatra/indifferent_hash.rb
+++ b/lib/sinatra/indifferent_hash.rb
@@ -79,7 +79,7 @@ def []=(key, value)
super(convert_key(key), convert_value(value))
end
- alias_method :store, :[]=
+ alias store []=
def key(value)
super(convert_value(value))
@@ -89,20 +89,21 @@ def key?(key)
super(convert_key(key))
end
- alias_method :has_key?, :key?
- alias_method :include?, :key?
- alias_method :member?, :key?
+ alias has_key? key?
+ alias include? key?
+ alias member? key?
def value?(value)
super(convert_value(value))
end
- alias_method :has_value?, :value?
+ alias has_value? value?
def delete(key)
super(convert_key(key))
end
+ # Added in Ruby 2.3
def dig(key, *other_keys)
super(convert_key(key), *other_keys)
end
@@ -141,7 +142,7 @@ def merge!(*other_hashes)
self
end
- alias_method :update, :merge!
+ alias update merge!
def merge(*other_hashes, &block)
dup.merge!(*other_hashes, &block)
@@ -171,17 +172,19 @@ def transform_keys!
def select(*args, &block)
return to_enum(:select) unless block_given?
+
dup.tap { |hash| hash.select!(*args, &block) }
end
def reject(*args, &block)
return to_enum(:reject) unless block_given?
+
dup.tap { |hash| hash.reject!(*args, &block) }
end
def compact
dup.tap(&:compact!)
- end if method_defined?(:compact) # Added in Ruby 2.4
+ end
private
diff --git a/lib/sinatra/main.rb b/lib/sinatra/main.rb
index e4231c30f9..bca7fc1a09 100644
--- a/lib/sinatra/main.rb
+++ b/lib/sinatra/main.rb
@@ -1,47 +1,49 @@
+# frozen_string_literal: true
+
module Sinatra
- ParamsConfig = {}
+ PARAMS_CONFIG = {}
if ARGV.any?
require 'optparse'
- parser = OptionParser.new { |op|
- op.on('-p port', 'set the port (default is 4567)') { |val| ParamsConfig[:port] = Integer(val) }
- op.on('-s server', 'specify rack server/handler') { |val| ParamsConfig[:server] = val }
- op.on('-q', 'turn on quiet mode (default is off)') { ParamsConfig[:quiet] = true }
- op.on('-x', 'turn on the mutex lock (default is off)') { ParamsConfig[:lock] = true }
+ parser = OptionParser.new do |op|
+ op.on('-p port', 'set the port (default is 4567)') { |val| PARAMS_CONFIG[:port] = Integer(val) }
+ op.on('-s server', 'specify rack server/handler') { |val| PARAMS_CONFIG[:server] = val }
+ op.on('-q', 'turn on quiet mode (default is off)') { PARAMS_CONFIG[:quiet] = true }
+ op.on('-x', 'turn on the mutex lock (default is off)') { PARAMS_CONFIG[:lock] = true }
op.on('-e env', 'set the environment (default is development)') do |val|
ENV['RACK_ENV'] = val
- ParamsConfig[:environment] = val.to_sym
+ PARAMS_CONFIG[:environment] = val.to_sym
end
op.on('-o addr', "set the host (default is (env == 'development' ? 'localhost' : '0.0.0.0'))") do |val|
- ParamsConfig[:bind] = val
+ PARAMS_CONFIG[:bind] = val
end
- }
+ end
begin
parser.parse!(ARGV.dup)
- rescue => evar
- ParamsConfig[:optparse_error] = evar
+ rescue StandardError => e
+ PARAMS_CONFIG[:optparse_error] = e
end
end
require 'sinatra/base'
class Application < Base
-
# we assume that the first file that requires 'sinatra' is the
# app_file. all other path related options are calculated based
# on this path by default.
set :app_file, caller_files.first || $0
- set :run, Proc.new { File.expand_path($0) == File.expand_path(app_file) }
+ set :run, proc { File.expand_path($0) == File.expand_path(app_file) }
if run? && ARGV.any?
- error = ParamsConfig.delete(:optparse_error)
+ error = PARAMS_CONFIG.delete(:optparse_error)
raise error if error
- ParamsConfig.each { |k, v| set k, v }
+
+ PARAMS_CONFIG.each { |k, v| set k, v }
end
end
- remove_const(:ParamsConfig)
+ remove_const(:PARAMS_CONFIG)
at_exit { Application.run! if $!.nil? && Application.run? }
end
diff --git a/lib/sinatra/show_exceptions.rb b/lib/sinatra/show_exceptions.rb
index de468c0a4f..db847ffab7 100644
--- a/lib/sinatra/show_exceptions.rb
+++ b/lib/sinatra/show_exceptions.rb
@@ -12,6 +12,7 @@ module Sinatra
class ShowExceptions < Rack::ShowExceptions
@@eats_errors = Object.new
def @@eats_errors.flush(*) end
+
def @@eats_errors.puts(*) end
def initialize(app)
@@ -21,23 +22,24 @@ def initialize(app)
def call(env)
@app.call(env)
rescue Exception => e
- errors, env["rack.errors"] = env["rack.errors"], @@eats_errors
+ errors = env['rack.errors']
+ env['rack.errors'] = @@eats_errors
if prefers_plain_text?(env)
- content_type = "text/plain"
+ content_type = 'text/plain'
body = dump_exception(e)
else
- content_type = "text/html"
+ content_type = 'text/html'
body = pretty(env, e)
end
- env["rack.errors"] = errors
+ env['rack.errors'] = errors
[
500,
{
- "Content-Type" => content_type,
- "Content-Length" => body.bytesize.to_s
+ 'Content-Type' => content_type,
+ 'Content-Length' => body.bytesize.to_s
},
[body]
]
@@ -49,27 +51,27 @@ def template
private
- def bad_request?(e)
- Sinatra::BadRequest === e
+ def bad_request?(exception)
+ Sinatra::BadRequest === exception
end
def prefers_plain_text?(env)
- !(Request.new(env).preferred_type("text/plain","text/html") == "text/html") &&
- [/curl/].index { |item| item =~ env["HTTP_USER_AGENT"] }
+ Request.new(env).preferred_type('text/plain', 'text/html') != 'text/html' &&
+ [/curl/].index { |item| item =~ env['HTTP_USER_AGENT'] }
end
def frame_class(frame)
if frame.filename =~ %r{lib/sinatra.*\.rb}
- "framework"
+ 'framework'
elsif (defined?(Gem) && frame.filename.include?(Gem.dir)) ||
frame.filename =~ %r{/bin/(\w+)\z}
- "system"
+ 'system'
else
- "app"
+ 'app'
end
end
-TEMPLATE = ERB.new <<-HTML # :nodoc:
+ TEMPLATE = ERB.new <<-HTML # :nodoc:
@@ -357,6 +359,6 @@ def frame_class(frame)