1. 23 2月, 2018 2 次提交
  2. 22 2月, 2018 12 次提交
  3. 21 2月, 2018 9 次提交
  4. 20 2月, 2018 4 次提交
  5. 19 2月, 2018 13 次提交
    • A
      Add support for automatic nonce generation for Rails UJS · 31abee03
      Andrew White 提交于
      Because the UJS library creates a script tag to process responses it
      normally requires the script-src attribute of the content security
      policy to include 'unsafe-inline'.
      
      To work around this we generate a per-request nonce value that is
      embedded in a meta tag in a similar fashion to how CSRF protection
      embeds its token in a meta tag. The UJS library can then read the
      nonce value and set it on the dynamically generated script tag to
      enable it to execute without needing 'unsafe-inline' enabled.
      
      Nonce generation isn't 100% safe - if your script tag is including
      user generated content in someway then it may be possible to exploit
      an XSS vulnerability which can take advantage of the nonce. It is
      however an improvement on a blanket permission for inline scripts.
      
      It is also possible to use the nonce within your own script tags by
      using `nonce: true` to set the nonce value on the tag, e.g
      
          <%= javascript_tag nonce: true do %>
            alert('Hello, World!');
          <% end %>
      
      Fixes #31689.
      31abee03
    • A
      Merge pull request #32032 from utilum/method_redefined · 0f05c87e
      Andrew White 提交于
      Avoid method_redefined warnings in  RouteSet::NamedRouteCollection
      0f05c87e
    • A
      Merge pull request #32054 from rails/fix-generation-of-empty-csp · dc6185b4
      Andrew White 提交于
      Fix generation of empty content security policy
      dc6185b4
    • U
      Avoid method_redefined warnings in RouteSet::NamedRouteCollection · 899e2dad
      utilum 提交于
      Before:
      ```
      ~/.rbenv/versions/2.5.0/bin/ruby -w -Itest -Ilib -I../activesupport/lib -I../actionpack/lib -I../actionview/lib -I../activemodel/lib test/application/routing_test.rb
      Run options: --seed 5851
      
      .......~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
      ....~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
      ..........~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:156: warning: method redefined; discarding old custom_path
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_path was here
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:162: warning: method redefined; discarding old custom_url
      ~/code/rails/actionpack/lib/action_dispatch/routing/route_set.rb:321: warning: previous definition of custom_url was here
      .....
      
      Finished in 13.233638s, 1.9647 runs/s, 5.8185 assertions/s.
      26 runs, 77 assertions, 0 failures, 0 errors, 0 skips
      ```
      
      After:
      ```
      ~/.rbenv/versions/2.5.0/bin/ruby -w -Itest -Ilib -I../activesupport/lib -I../actionpack/lib -I../actionview/lib -I../activemodel/lib test/application/routing_test.rb
      Run options: --seed 38072
      
      ..........................
      
      Finished in 12.009632s, 2.1649 runs/s, 6.4115 assertions/s.
      26 runs, 77 assertions, 0 failures, 0 errors, 0 skips
      ```
      899e2dad
    • A
      Merge pull request #32052 from rails/fix-country-zones-with-multiple-mappings · 0d41a76d
      Andrew White 提交于
      Return all mappings for a timezone id in country_zones
      0d41a76d
    • A
      Remove trailing semi-colon from CSP · d85283cc
      Andrew White 提交于
      Although the spec[1] is defined in such a way that a trailing semi-colon
      is valid it also doesn't allow a semi-colon by itself to indicate an
      empty policy. Therefore it's easier (and valid) just to omit it rather
      than to detect whether the policy is empty or not.
      
      [1]: https://www.w3.org/TR/CSP2/#policy-syntax
      d85283cc
    • A
      Don't accidentally create an empty CSP · 57f9c363
      Andrew White 提交于
      Setting up the request environment was accidentally creating a CSP
      as a consequence of accessing the option - only set the instance
      variable if a block is passed.
      57f9c363
    • A
      Revert "Merge pull request #32045 from eagletmt/skip-csp-header" · 52a1f1c2
      Andrew White 提交于
      This reverts commit 86f7c269, reversing
      changes made to 5ece2e4a.
      
      If a policy is set then we should generate it even if it's empty.
      However what is happening is that we're accidentally generating an
      empty policy when the initializer is commented out by default.
      52a1f1c2
    • A
      Return all mappings for a timezone id in `country_zones` · 2d95956e
      Andrew White 提交于
      Some timezones like `Europe/London` have multiple mappings in
      `ActiveSupport::TimeZone::MAPPING` so return all of them instead
      of the first one found by using `Hash#value`. e.g:
      
        # Before
        ActiveSupport::TimeZone.country_zones("GB") # => ["Edinburgh"]
      
        # After
        ActiveSupport::TimeZone.country_zones("GB") # => ["Edinburgh", "London"]
      
      Fixes #31668.
      2d95956e
    • R
      Merge pull request #32051 from dixitp012/rubocop_single_space · f712ef27
      Ryuta Kamizono 提交于
      rubocop single space after assignment
      f712ef27
    • D
      rubocop single space after assignment · f0af84df
      Dixit Patel 提交于
      f0af84df
    • Y
      Use the query cache when connection is already connected · 0d9fb7eb
      yuuji.yaginuma 提交于
      Fixes #32021.
      0d9fb7eb
    • G
      bec1751e