summary refs log tree commit
DateCommit message (Collapse)
2014-07-14Record Tempfiles from multipart form data in env[rack.tempfiles]
To facilitate cleanup without depending on garbage collection.
2014-07-14chunked: do not chunk on pre-HTTP/1.0 clients
Ancient HTTP clients which predate HTTP/1.0 may not set HTTP_VERSION at all, and those do not support chunking. RFC 1945 describes HTTP/0.9 as well as HTTP/1.0 Signed-off-by: James Tucker <jftucker@gmail.com>
2014-07-14builder: avoid to_app on every request when using map
By calling to_app immediately after initializing the per-map Rack::Builder instances. Otherwise, benefits of warmup and web servers taking advantage of CoW are lost. This passes tests, and is lightly tested and I have not verified this for any negative consequences or incompatibilities. Signed-off-by: James Tucker <jftucker@gmail.com>
2014-07-14README: update to add yahns to the list of servers
yahns will eventually support more than Rack, but for now it only knows Rack. ref: http://yahns.yhbt.net/README Signed-off-by: James Tucker <jftucker@gmail.com>
2014-07-14ParameterTypeError for parse_nested_query
Inherits from TypeError, so existing code that checks types by is_a? and friends should still work fine. This should enable users to be more confident that they are only catching this error case, not other exceptional conditions. Closes #524
2014-07-13remove incorrect comment in PR 706
2014-07-13Simplify default middleware construction.
- Removed concat, the DRYness isn't worth the loss of clarity. - Removed ||=, no need to memoize such a small operation. - Removed the array-default hash usage; if this behavior is supported, we should add a test for it.
2014-07-13Give @middleware a more semantic name.
Had to put the class method definitions in an eigenclass wrapper to use the 'alias' keyword sanely. It wouldn't be necessary if old behavior of the middleware was unsupported, but that would be too invasive for just a small clarity change.
2014-07-13whitespace
2014-07-13Fix URI parsing on 1.8.7, also address perf
2014-07-13Fix cycle tests on 1.8.7
2014-07-13Fix showexceptions specs on 1.8. Need travis back.
2014-07-13Merge pull request #705 from stevehodgkiss/fix_ip_spoofing_vulnerability
Prevent IP spoofing via X-Forwarded-For and Client-IP headers
2014-07-13Gracefully handle cycles in parameters
Might close 632, pending more information.
2014-07-13correct typo and refactor tests for coverage
Closes #592
2014-07-13Flip to best_q_match, so we provide html to */*
2014-07-13Undo template refactoring
As this is orthoganol to HTML rendering change.
2014-07-13Restore public API
2014-07-13ShowExceptions minor refactoring
* Load HTML exception template only if needed * Only #call is public * Enumerable body concern in one place
2014-07-13ShowException only serves HTML Accept header contains text/html
Rather than be concerned with whether a request is an asynchronous browser request or not it is better to simply consider the Accept header and only serve HTML to clients that specifically ask for it. This way you will not find your pure JSON API application splitting out HTML error messages to your console when using curl :)
2014-07-13Do not truncate POST data on `;`, closes #543
It appears Rack has been doing this for years. It's not correct behavior for any generators that I can remember. It comes from the cookie parsing code.
2014-07-11Prevent IP spoofing via X-Forwarded-For and Client-IP headers
By specifying the same IP in X-Forwarded-For and Client-IP an attacker is able to easily spoof the value of `request.ip`, unless a trusted proxy is configured to remove any user supplied Client-IP headers. The value of request.ip should be the value after the last trusted proxy IP in X-Forwarded-For (from right to left).
2014-07-08use RFC 2396 URI parser in the mock object
this fixes `env_for` on ruby trunk
2014-07-08Fixed stray return
2014-07-06Merge pull request #675 from keithduncan/fix-clean-path-for-slash
Fix `clean_path_info` for paths with only a slash
2014-07-06Rack::Utils#best_q_match returns nil with no match
2014-07-06Rename clean slash only test
2014-07-05Merge pull request #646 from KitaitiMakoto/close-body-when-fresh
Close body if content is fresh enough
2014-07-05Merge pull request #648 from ArtemPyanykh/lint-doc-formatting
Reformat Rack::Lint docs.
2014-07-05Merge pull request #659 from jodosha/utils-best_q_match-respect-content-type
Ensure Rack::Utils.best_q_match to respect requested content type
2014-07-05Merge pull request #660 from graysonwright/better_lobster_flip
Flip the lobster better
2014-07-05Merge pull request #667 from mattkasa/feature/add_rfc2324_status_code
Add support for RFC2324
2014-07-05Monkey patch to fix WEBrick chunking semantics.
* Previously proposed in #707, unfortunately that patch caused double encoding * Fixes #707, #618 * The longevity of this patch is dubious. If WEBrick makes identical semantics modifications as I think should be done, this patch will have no effect. If WEBrick introduces changes to internal header handling, class structure, etc, we'll break.
2014-07-05Merge pull request #708 from lengarvey/fix_uri_encoding_ruby_220_rfc3986
Fix spec_request on ruby-trunk (2.2.0dev)
2014-07-05Merge pull request #709 from davidcelis/patch-1
Fix AccessLog documentation typo
2014-06-30Fix AccessLog documentation typo
2014-06-28Fix spec_request on ruby-trunk (2.2.0dev)
Manually percent-encode square brackets in query string. This fixes current travis build issues. 2.2.0dev has recently changed URI parsing from RFC2396 to RFC3986. Square brackets in RFC3986 are required to be percent-encoded when present in the query string of a URI. URI.encode on 2.2.0dev isn't currently updated to support this encoding (see: https://bugs.ruby-lang.org/issues/9990)
2014-06-23Merge pull request #700 from espadrine/patch-1
Readme: Use an SVG badge.
2014-06-19Readme: Use an SVG badge.
Badges will look more consistent and less blurry on Retina screens (and the like).
2014-06-16Fixed build_nested_query to handle empty arrays and hashes
2014-06-12max-age settings forces Set-Cookie parameter
With patch https://github.com/rack/rack/commit/74e0acd36353cf619bf56fce17bcb9ef1ab30547, there is ability on rack to set max-age parameter. Which is fine. Unfortunately this parameter is sent to browser only when the session cookie is created. Which is afaik wrong. You usually want to refresh the cookie with each page request. And setting 'expires' parameter behaves in this way as well. So this patch doest: 1) When max-age parameter is present, the Set-Cookie HTTP header is sent with each request 2) When both max-age and expires parameter are set, max-age has precedence 3) Added max-age conversion to string where aplicable, because user might not want to use string for "time interval"
2014-05-20Move ["POST"] to a constant
2014-05-19Merge pull request #687 from dwilkie/master
Refactor methodoverride to make it easier to inherit and extend
2014-05-17Refactor methodoverride to make it easier to inherit and extend
2014-05-14add support for application/json content type requests
2014-04-14Proxy body if it is fresh enough
In order to prevent response body resulting in race conditions.
2014-04-10Fix `clean_path_info` for paths with only a slash
2014-03-24request.scheme supports multiple x-http-forwarded-proto values
2014-03-07Add helper method for 418
2014-03-07Add support for RFC2324 status code