www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
@comment $NetBSD: PLIST,v 1.21 2023/01/04 15:23:35 taca Exp $
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_HOME}/cache/${GEM_NAME}.gem
|
www/ruby-rack: update to 2.2.2
Update ruby-rack to 2.2.2.
## [2.2.2] - 2020-02-11
### Fixed
- Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix](https://github.com/ioquatix))
- Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans](https://github.com/jeremyevans))
- Double assignment is still needed to prevent an "unused variable" warning. ([#1589](https://github.com/rack/rack/pull/1589), [@kamipo](https://github.com/kamipo))
- Fix to handle same_site option for session pool. ([#1587](https://github.com/rack/rack/pull/1587), [@kamipo](https://github.com/kamipo))
## [2.2.1] - 2020-02-09
### Fixed
- Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix](https://github.com/ioquatix))
## [2.2.0] - 2020-02-08
### SPEC Changes
- `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
- Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
- CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
- Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
### Added
- `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
- `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
- `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
- `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
- `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
- Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix](https://github.com/ioquatix))
### Changed
- `Request#params` no longer rescues EOFError. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans](https://github.com/jeremyevans))
- `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans](https://github.com/jeremyevans))
- `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans](https://github.com/jeremyevans))
- `.ru` files supports the `frozen-string-literal` magic comment. ([@eregon](https://github.com/eregon))
- Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans](https://github.com/jeremyevans))
- `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
- `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
- All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
- `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
- `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix](https://github.com/ioquatix))
- `Rack::Directory` allow directory traversal inside root directory. ([#1417](https://github.com/rack/rack/pull/1417), [@ThomasSevestre](https://github.com/ThomasSevestre))
- Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix](https://github.com/ioquatix), [@wjordan](https://github.com/wjordan))
- Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
- `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix](https://github.com/ioquatix))
### Removed
- `Directory#path` as it was not used and always returned nil. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans](https://github.com/jeremyevans))
- `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
- Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
- Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
- Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix](https://github.com/ioquatix))
- Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix](https://github.com/ioquatix))
### Fixed
- `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans](https://github.com/jeremyevans))
- `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#host` and `Request#host_with_port` handle IPv6 addresses correctly. ([@AlexWayfer](https://github.com/AlexWayfer))
- `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans](https://github.com/jeremyevans))
- `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans](https://github.com/jeremyevans))
- `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
- `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
- `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
- `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
- Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
- WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans](https://github.com/jeremyevans))
- `ShowExceptions` handles invalid POST data. ([@jeremyevans](https://github.com/jeremyevans))
- Basic authentication requires a password, even if the password is empty. ([@jeremyevans](https://github.com/jeremyevans))
- `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans](https://github.com/jeremyevans))
- Support for using `:SSLEnable` option when using WEBrick handler. (Gregor Melhorn)
- Close response body after buffering it when buffering. ([@ioquatix](https://github.com/ioquatix))
- Only accept `;` as delimiter when parsing cookies. ([@mrageh](https://github.com/mrageh))
- `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
- Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix](https://github.com/ioquatix))
### Documentation
- CHANGELOG updates. ([@aupajo](https://github.com/aupajo))
- Added [CONTRIBUTING](CONTRIBUTING.md). ([@dblock](https://github.com/dblock))
## [2.1.2] - 2020-01-27
- Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
- Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
- Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
- Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
- Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
- Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
## [2.1.1] - 2020-01-12
- Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))
## 2.1.0
_Note: There are many unreleased changes in Rack (`master` is around 300 commits ahead of `2-0-stable`), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome._
### Added
- Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
- Add trailer headers. ([@eileencodes](https://github.com/eileencodes))
- Add MIME Types for video streaming. ([@styd](https://github.com/styd))
- Add MIME Type for WASM. ([@buildrtech](https://github.com/buildrtech))
- Add `Early Hints(103)` to status codes. ([@egtra](https://github.com/egtra))
- Add `Too Early(425)` to status codes. ([@y-yagi]((https://github.com/y-yagi)))
- Add `Bandwidth Limit Exceeded(509)` to status codes. ([@CJKinni](https://github.com/CJKinni))
- Add method for custom `ip_filter`. ([@svcastaneda](https://github.com/svcastaneda))
- Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
- Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
- Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
- Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
- Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
### Changed
- Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
- Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
- Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
- Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
- Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
- Expand the root path in `Rack::Static` upon initialization. ([@rosenfeld](https://github.com/rosenfeld))
- Make `ShowExceptions` work with binary data. ([@axyjo](https://github.com/axyjo))
- Use buffer string when parsing multipart requests. ([@janko-m](https://github.com/janko-m))
- Support optional UTF-8 Byte Order Mark (BOM) in config.ru. ([@mikegee](https://github.com/mikegee))
- Handle `X-Forwarded-For` with optional port. ([@dpritchett](https://github.com/dpritchett))
- Use `Time#httpdate` format for Expires, as proposed by RFC 7231. ([@nanaya](https://github.com/nanaya))
- Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
- Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
- Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
- Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
- Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
- Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
- Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
### Removed
- Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
- Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
### Documentation
- Update broken example in `Session::Abstract::ID` documentation. ([tonytonyjan](https://github.com/tonytonyjan))
- Add Padrino to the list of frameworks implmenting Rack. ([@wikimatze](https://github.com/wikimatze))
- Remove Mongrel from the suggested server options in the help output. ([@tricknotes](https://github.com/tricknotes))
- Replace `HISTORY.md` and `NEWS.md` with `CHANGELOG.md`. ([@twitnithegirl](https://github.com/twitnithegirl))
- Backfill `CHANGELOG.md` from 2.0.1 to 2.0.7 releases. ([@drenmi](https://github.com/Drenmi))
## [2.0.8] - 2019-12-08
- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
2020-03-20 17:19:33 +01:00
|
|
|
${GEM_LIBDIR}/CHANGELOG.md
|
|
|
|
|
${GEM_LIBDIR}/CONTRIBUTING.md
|
|
|
|
|
${GEM_LIBDIR}/MIT-LICENSE
|
www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
${GEM_LIBDIR}/README.md
|
www/ruby-rack: update to 2.2.2
Update ruby-rack to 2.2.2.
## [2.2.2] - 2020-02-11
### Fixed
- Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix](https://github.com/ioquatix))
- Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans](https://github.com/jeremyevans))
- Double assignment is still needed to prevent an "unused variable" warning. ([#1589](https://github.com/rack/rack/pull/1589), [@kamipo](https://github.com/kamipo))
- Fix to handle same_site option for session pool. ([#1587](https://github.com/rack/rack/pull/1587), [@kamipo](https://github.com/kamipo))
## [2.2.1] - 2020-02-09
### Fixed
- Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix](https://github.com/ioquatix))
## [2.2.0] - 2020-02-08
### SPEC Changes
- `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
- Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
- CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
- Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
### Added
- `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
- `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
- `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
- `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
- `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
- Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix](https://github.com/ioquatix))
### Changed
- `Request#params` no longer rescues EOFError. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans](https://github.com/jeremyevans))
- `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans](https://github.com/jeremyevans))
- `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans](https://github.com/jeremyevans))
- `.ru` files supports the `frozen-string-literal` magic comment. ([@eregon](https://github.com/eregon))
- Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans](https://github.com/jeremyevans))
- `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
- `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
- All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
- `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
- `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix](https://github.com/ioquatix))
- `Rack::Directory` allow directory traversal inside root directory. ([#1417](https://github.com/rack/rack/pull/1417), [@ThomasSevestre](https://github.com/ThomasSevestre))
- Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix](https://github.com/ioquatix), [@wjordan](https://github.com/wjordan))
- Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
- `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix](https://github.com/ioquatix))
### Removed
- `Directory#path` as it was not used and always returned nil. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans](https://github.com/jeremyevans))
- `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
- Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
- Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
- Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix](https://github.com/ioquatix))
- Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix](https://github.com/ioquatix))
### Fixed
- `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans](https://github.com/jeremyevans))
- `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#host` and `Request#host_with_port` handle IPv6 addresses correctly. ([@AlexWayfer](https://github.com/AlexWayfer))
- `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans](https://github.com/jeremyevans))
- `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans](https://github.com/jeremyevans))
- `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
- `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
- `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
- `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
- Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
- WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans](https://github.com/jeremyevans))
- `ShowExceptions` handles invalid POST data. ([@jeremyevans](https://github.com/jeremyevans))
- Basic authentication requires a password, even if the password is empty. ([@jeremyevans](https://github.com/jeremyevans))
- `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans](https://github.com/jeremyevans))
- Support for using `:SSLEnable` option when using WEBrick handler. (Gregor Melhorn)
- Close response body after buffering it when buffering. ([@ioquatix](https://github.com/ioquatix))
- Only accept `;` as delimiter when parsing cookies. ([@mrageh](https://github.com/mrageh))
- `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
- Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix](https://github.com/ioquatix))
### Documentation
- CHANGELOG updates. ([@aupajo](https://github.com/aupajo))
- Added [CONTRIBUTING](CONTRIBUTING.md). ([@dblock](https://github.com/dblock))
## [2.1.2] - 2020-01-27
- Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
- Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
- Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
- Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
- Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
- Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
## [2.1.1] - 2020-01-12
- Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))
## 2.1.0
_Note: There are many unreleased changes in Rack (`master` is around 300 commits ahead of `2-0-stable`), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome._
### Added
- Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
- Add trailer headers. ([@eileencodes](https://github.com/eileencodes))
- Add MIME Types for video streaming. ([@styd](https://github.com/styd))
- Add MIME Type for WASM. ([@buildrtech](https://github.com/buildrtech))
- Add `Early Hints(103)` to status codes. ([@egtra](https://github.com/egtra))
- Add `Too Early(425)` to status codes. ([@y-yagi]((https://github.com/y-yagi)))
- Add `Bandwidth Limit Exceeded(509)` to status codes. ([@CJKinni](https://github.com/CJKinni))
- Add method for custom `ip_filter`. ([@svcastaneda](https://github.com/svcastaneda))
- Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
- Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
- Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
- Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
- Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
### Changed
- Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
- Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
- Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
- Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
- Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
- Expand the root path in `Rack::Static` upon initialization. ([@rosenfeld](https://github.com/rosenfeld))
- Make `ShowExceptions` work with binary data. ([@axyjo](https://github.com/axyjo))
- Use buffer string when parsing multipart requests. ([@janko-m](https://github.com/janko-m))
- Support optional UTF-8 Byte Order Mark (BOM) in config.ru. ([@mikegee](https://github.com/mikegee))
- Handle `X-Forwarded-For` with optional port. ([@dpritchett](https://github.com/dpritchett))
- Use `Time#httpdate` format for Expires, as proposed by RFC 7231. ([@nanaya](https://github.com/nanaya))
- Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
- Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
- Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
- Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
- Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
- Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
- Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
### Removed
- Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
- Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
### Documentation
- Update broken example in `Session::Abstract::ID` documentation. ([tonytonyjan](https://github.com/tonytonyjan))
- Add Padrino to the list of frameworks implmenting Rack. ([@wikimatze](https://github.com/wikimatze))
- Remove Mongrel from the suggested server options in the help output. ([@tricknotes](https://github.com/tricknotes))
- Replace `HISTORY.md` and `NEWS.md` with `CHANGELOG.md`. ([@twitnithegirl](https://github.com/twitnithegirl))
- Backfill `CHANGELOG.md` from 2.0.1 to 2.0.7 releases. ([@drenmi](https://github.com/Drenmi))
## [2.0.8] - 2019-12-08
- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
2020-03-20 17:19:33 +01:00
|
|
|
${GEM_LIBDIR}/SPEC.rdoc
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/abstract/handler.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/abstract/request.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/basic.rb
|
www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/auth/digest.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/auth/digest/md5.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/digest/nonce.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/digest/params.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/auth/digest/request.rb
|
Update ruby-rack package to 1.3.5.
* September 16, 2011: Eighteenth public release 1.2.4
* Fix a bug with MRI regex engine to prevent XSS by malformed unicode
* May 22nd, 2011: Thirteenth public release 1.3.0
* Various performance optimizations
* Various multipart fixes
* Various multipart refactors
* Infinite loop fix for multipart
* Test coverage for Rack::Server returns
* Allow files with '..', but not path components that are '..'
* rackup accepts handler-specific options on the command line
* Request#params no longer merges POST into GET (but returns the same)
* Use URI.encode_www_form_component instead. Use core methods for escaping.
* Allow multi-line comments in the config file
* Bug L#94 reported by Nikolai Lugovoi, query parameter unescaping.
* Rack::Response now deletes Content-Length when appropriate
* Rack::Deflater now supports streaming
* Improved Rack::Handler loading and searching
* Support for the PATCH verb
* env['rack.session.options'] now contains session options
* Cookies respect renew
* Session middleware uses SecureRandom.hex
* May 22nd, 2011: Fourteenth public release 1.2.3
* Pulled in relevant bug fixes from 1.3
* Fixed 1.8.6 support
* July 13, 2011: Fifteenth public release 1.3.1
* Fix 1.9.1 support
* Fix JRuby support
* Properly handle $KCODE in Rack::Utils.escape
* Make method_missing/respond_to behavior consistent for Rack::Lock,
Rack::Auth::Digest::Request and Rack::Multipart::UploadedFile
* Reenable passing rack.session to session middleware
* Rack::CommonLogger handles streaming responses correctly
* Rack::MockResponse calls close on the body object
* Fix a DOS vector from MRI stdlib backport
* July 16, 2011: Sixteenth public release 1.3.2
* Fix for Rails and rack-test, Rack::Utils#escape calls to_s
* September 16, 2011: Seventeenth public release 1.3.3
* Fix bug with broken query parameters in Rack::ShowExceptions
* Rack::Request#cookies no longer swallows exceptions on broken input
* Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
* Rack::ConditionalGet handles broken If-Modified-Since helpers
* October 1, 2011: Nineteenth public release 1.3.4
* Backport security fix from 1.9.3, also fixes some roundtrip issues in URI
* Small documentation update
* Fix an issue where BodyProxy could cause an infinite recursion
* Add some supporting files for travis-ci
* October 17, 2011: Twentieth public release 1.3.5
* Fix annoying warnings caused by the backport in 1.3.4
2011-12-15 15:58:34 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/body_proxy.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/builder.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/cascade.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/chunked.rb
|
2017-06-04 17:10:09 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/common_logger.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/conditional_get.rb
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/config.rb
|
www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/constants.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/content_length.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/content_type.rb
|
Update ruby-rack package to 0.4.0.
== Future specification changes
PLEASE NOTE: In versions of Rack LATER than 0.4, the following
changes will be commited to the Rack specification:
* 1xx, 204 and 304 status codes MUST not contain a Content-Type.
* A valid Content-Length header MUST be provided for non 1xx, 204 and 304
responses with a Transfer-Encoding of "identity" (default).
The Content-Length MUST be the same as the sum of the byte-sizes of
the chunks.
* The REQUEST_METHOD may be any HTTP token.
Internal Rack modules have been updated to follow this behavior, but
the Rack 0.4 Lint does NOT check it yet for compatibility reasons.
Please update your libraries accordingly.
== Changes
* August 21st, 2008: Fourth public release 0.4.
* New middleware, Rack::Deflater, by Christoffer Sawicki.
* OpenID authentication now needs ruby-openid 2.
* New Memcache sessions, by blink.
* Explicit EventedMongrel handler, by Joshua Peek.
* Rack::Reloader is not loaded in rackup development mode.
* rackup can daemonize with -D.
* Many bugfixes, especially for pool sessions, URLMap, thread safety
and tempfile handling.
* Improved tests.
* Rack moved to Git.
2008-09-15 10:31:47 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/deflater.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/directory.rb
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/etag.rb
|
2017-06-04 17:10:09 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/events.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/file.rb
|
www/ruby-rack: update to 2.2.2
Update ruby-rack to 2.2.2.
## [2.2.2] - 2020-02-11
### Fixed
- Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix](https://github.com/ioquatix))
- Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans](https://github.com/jeremyevans))
- Double assignment is still needed to prevent an "unused variable" warning. ([#1589](https://github.com/rack/rack/pull/1589), [@kamipo](https://github.com/kamipo))
- Fix to handle same_site option for session pool. ([#1587](https://github.com/rack/rack/pull/1587), [@kamipo](https://github.com/kamipo))
## [2.2.1] - 2020-02-09
### Fixed
- Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix](https://github.com/ioquatix))
## [2.2.0] - 2020-02-08
### SPEC Changes
- `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
- Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
- CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
- Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
### Added
- `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
- `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
- `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
- `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
- `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
- Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix](https://github.com/ioquatix))
### Changed
- `Request#params` no longer rescues EOFError. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans](https://github.com/jeremyevans))
- `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans](https://github.com/jeremyevans))
- `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans](https://github.com/jeremyevans))
- `.ru` files supports the `frozen-string-literal` magic comment. ([@eregon](https://github.com/eregon))
- Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans](https://github.com/jeremyevans))
- `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
- `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
- All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
- `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
- `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix](https://github.com/ioquatix))
- `Rack::Directory` allow directory traversal inside root directory. ([#1417](https://github.com/rack/rack/pull/1417), [@ThomasSevestre](https://github.com/ThomasSevestre))
- Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix](https://github.com/ioquatix), [@wjordan](https://github.com/wjordan))
- Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
- `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix](https://github.com/ioquatix))
### Removed
- `Directory#path` as it was not used and always returned nil. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans](https://github.com/jeremyevans))
- `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
- Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
- Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
- Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix](https://github.com/ioquatix))
- Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix](https://github.com/ioquatix))
### Fixed
- `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans](https://github.com/jeremyevans))
- `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#host` and `Request#host_with_port` handle IPv6 addresses correctly. ([@AlexWayfer](https://github.com/AlexWayfer))
- `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans](https://github.com/jeremyevans))
- `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans](https://github.com/jeremyevans))
- `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
- `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
- `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
- `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
- Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
- WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans](https://github.com/jeremyevans))
- `ShowExceptions` handles invalid POST data. ([@jeremyevans](https://github.com/jeremyevans))
- Basic authentication requires a password, even if the password is empty. ([@jeremyevans](https://github.com/jeremyevans))
- `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans](https://github.com/jeremyevans))
- Support for using `:SSLEnable` option when using WEBrick handler. (Gregor Melhorn)
- Close response body after buffering it when buffering. ([@ioquatix](https://github.com/ioquatix))
- Only accept `;` as delimiter when parsing cookies. ([@mrageh](https://github.com/mrageh))
- `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
- Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix](https://github.com/ioquatix))
### Documentation
- CHANGELOG updates. ([@aupajo](https://github.com/aupajo))
- Added [CONTRIBUTING](CONTRIBUTING.md). ([@dblock](https://github.com/dblock))
## [2.1.2] - 2020-01-27
- Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
- Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
- Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
- Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
- Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
- Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
## [2.1.1] - 2020-01-12
- Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))
## 2.1.0
_Note: There are many unreleased changes in Rack (`master` is around 300 commits ahead of `2-0-stable`), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome._
### Added
- Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
- Add trailer headers. ([@eileencodes](https://github.com/eileencodes))
- Add MIME Types for video streaming. ([@styd](https://github.com/styd))
- Add MIME Type for WASM. ([@buildrtech](https://github.com/buildrtech))
- Add `Early Hints(103)` to status codes. ([@egtra](https://github.com/egtra))
- Add `Too Early(425)` to status codes. ([@y-yagi]((https://github.com/y-yagi)))
- Add `Bandwidth Limit Exceeded(509)` to status codes. ([@CJKinni](https://github.com/CJKinni))
- Add method for custom `ip_filter`. ([@svcastaneda](https://github.com/svcastaneda))
- Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
- Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
- Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
- Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
- Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
### Changed
- Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
- Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
- Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
- Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
- Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
- Expand the root path in `Rack::Static` upon initialization. ([@rosenfeld](https://github.com/rosenfeld))
- Make `ShowExceptions` work with binary data. ([@axyjo](https://github.com/axyjo))
- Use buffer string when parsing multipart requests. ([@janko-m](https://github.com/janko-m))
- Support optional UTF-8 Byte Order Mark (BOM) in config.ru. ([@mikegee](https://github.com/mikegee))
- Handle `X-Forwarded-For` with optional port. ([@dpritchett](https://github.com/dpritchett))
- Use `Time#httpdate` format for Expires, as proposed by RFC 7231. ([@nanaya](https://github.com/nanaya))
- Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
- Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
- Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
- Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
- Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
- Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
- Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
### Removed
- Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
- Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
### Documentation
- Update broken example in `Session::Abstract::ID` documentation. ([tonytonyjan](https://github.com/tonytonyjan))
- Add Padrino to the list of frameworks implmenting Rack. ([@wikimatze](https://github.com/wikimatze))
- Remove Mongrel from the suggested server options in the help output. ([@tricknotes](https://github.com/tricknotes))
- Replace `HISTORY.md` and `NEWS.md` with `CHANGELOG.md`. ([@twitnithegirl](https://github.com/twitnithegirl))
- Backfill `CHANGELOG.md` from 2.0.1 to 2.0.7 releases. ([@drenmi](https://github.com/Drenmi))
## [2.0.8] - 2019-12-08
- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
2020-03-20 17:19:33 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/files.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/head.rb
|
www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/headers.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/lint.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/lock.rb
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/logger.rb
|
2017-06-04 17:10:09 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/media_type.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/method_override.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/mime.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/mock.rb
|
www/ruby-rack: update to 3.0.3
3.0.3 (2022-12-26)
* Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
3.0.2 (2022-12-05)
Fixed
* Utils.build_nested_query URL-encodes nested field names including the
square brackets.
* Allow Rack::Response to pass through streaming bodies. (#1993, @ioquatix)
3.0.1 (2022-11-18)
Fixed
* MethodOverride does not look for an override if a request does not include
form/parseable data.
* Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call
and to_path, forwarding to the body. (#1981, @ioquatix)
3.0.0 (2022-09-06)
* No changes
3.0.0.rc1 (2022-09-04)
SPEC Changes
* Stream argument must implement << #1959
* close may be called on rack.input #1956
* rack.response_finished may be used for executing code after the response
has been finished #1952
3.0.0.beta1 (2022-08-08)
Security
* Do not use semicolon as GET parameter separator. (#1733, @jeremyevans)
SPEC Changes
* Response array must now be non-frozen.
* Response status must now be an integer greater than or equal to 100.
* Response headers must now be an unfrozen hash.
* Response header keys can no longer include uppercase characters.
* Response header values can be an Array to handle multiple values (and no
longer supports \n encoded headers).
* Response body can now respond to #call (streaming body) instead of #each
(enumerable body), for the equivalent of response hijacking in previous
versions.
* Middleware must no longer call #each on the body, but they can call
#to_ary on the body if it responds to #to_ary.
* rack.input is no longer required to be rewindable.
* rack.multithread/rack.multiprocess/rack.run_once/rack.version are no
longer required environment keys.
* SERVER_PROTOCOL is now a required environment key, matching the HTTP
protocol used in the request.
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional.
* rack.hijack_io has been removed completely.
* rack.response_finished is an optional environment key which contains an
array of callable objects that must accept #call(env, status, headers,
error) and are invoked after the response is finished (either successfully
or unsuccessfully).
* It is okay to call #close on rack.input to indicate that you no longer
need or care about the input.
* The stream argument supplied to the streaming body and hijack must support
#<< for writing output.
Removed
* Remove rack.multithread/rack.multiprocess/rack.run_once. These variables
generally come too late to be useful. (#1720, @ioquatix, @jeremyevans))
* Remove deprecated Rack::Request::SCHEME_WHITELIST. (@jeremyevans)
* Remove internal cookie deletion using pattern matching, there are very few
practical cases where it would be useful and browsers handle it correctly
without us doing anything special. (#1844, @ioquatix)
* Remove rack.version as it comes too late to be useful. (#1938, @ioquatix)
* Extract rackup command, Rack::Server, Rack::Handler, Rack::Lobster and
related code into a separate gem. (#1937, @ioquatix)
Added
* Rack::Headers added to support lower-case header keys. (@jeremyevans)
* Rack::Utils#set_cookie_header now supports escape_key: false to avoid key
escaping. (@jeremyevans)
* Rack::RewindableInput supports size. (@ahorek)
* Rack::RewindableInput::Middleware added for making rack.input
rewindable. (@jeremyevans)
* The RFC 7239 Forwarded header is now supported and considered by default
when looking for information on forwarding, falling back to the
X-Forwarded-* headers. Rack::Request.forwarded_priority accessor has been
added for configuring the priority of which header to check. (#1423,
@jeremyevans)
* Allow response headers to contain array of values. (#1598, @ioquatix)
* Support callable body for explicit streaming support and clarify streaming
response body behaviour. (#1745, @ioquatix, #1748, @wjordan)
* Allow Rack::Builder#run to take a block instead of an argument. (#1942,
@ioquatix)
* Add rack.response_finished to Rack::Lint. (#1802, @BlakeWilliams, #1952,
@ioquatix)
* The stream argument must implement #<<. (#1959, @ioquatix)
Changed
* BREAKING CHANGE: Require status to be an Integer. (#1662, @olleolleolle)
* BREAKING CHANGE: Query parsing now treats parameters without = as having
the empty string value instead of nil value, to conform to the URL
spec. (#1696, @jeremyevans)
* Relax validations around Rack::Request#host and
Rack::Request#hostname. (#1606, @pvande)
* Removed antiquated handlers: FCGI, LSWS, SCGI, Thin. (#1658, @ioquatix)
* Removed options from Rack::Builder.parse_file and
Rack::Builder.load_file. (#1663, @ioquatix)
* Rack::HTTP_VERSION has been removed and the HTTP_VERSION env setting is no
longer set in the CGI and Webrick handlers. (#970, @jeremyevans)
* Rack::Request#[] and #[]= now warn even in non-verbose mode. (#1277,
@jeremyevans)
* Decrease default allowed parameter recursion level from 100 to 32. (#1640,
@jeremyevans)
* Attempting to parse a multipart response with an empty body now raises
Rack::Multipart::EmptyContentError. (#1603, @jeremyevans)
* Rack::Utils.secure_compare uses OpenSSL's faster implementation if
available. (#1711, @bdewater)
* Rack::Request#POST now caches an empty hash if input content type is not
parseable. (#749, @jeremyevans)
* BREAKING CHANGE: Updated trusted_proxy? to match full 127.0.0.0/8
network. (#1781, @snbloch)
* Explicitly deprecate Rack::File which was an alias for
Rack::Files. (#1811, @ioquatix).
* Moved Rack::Session into separate gem. (#1805, @ioquatix)
* rackup -D option to daemonizes no longer changes the working directory to
the root. (#1813, @jeremyevans)
* The x-forwarded-proto header is now considered before the
x-forwarded-scheme header for determining the forwarded
protocol. Rack::Request.x_forwarded_proto_priority accessor has been added
for configuring the priority of which header to check. (#1809,
@jeremyevans)
* Rack::Request.forwarded_authority (and methods that call it, such as host)
now returns the last authority in the forwarded header, instead of the
first, as earlier forwarded authorities can be forged by clients. This
restores the Rack 2.1 behavior. (#1829, @jeremyevans)
* Use lower case cookie attributes when creating cookies, and fold cookie
attributes to lower case when reading cookies (specifically impacting
secure and httponly attributes). (#1849, @ioquatix)
* The response array must now be mutable (non-frozen) so middleware can
modify it without allocating a new Array,therefore reducing object
allocations. (#1887, #1927, @amatsuda, @ioquatix)
* rack.hijack? (partial hijack) and rack.hijack (full hijack) are now
independently optional. rack.hijack_io is no longer
required/specified. (#1939, @ioquatix)
* Allow calling close on rack.input. (#1956, @ioquatix)
Fixed
* Make Rack::MockResponse handle non-hash headers. (#1629, @jeremyevans)
* TempfileReaper now deletes temp files if application raises an
exception. (#1679, @jeremyevans)
* Handle cookies with values that end in '=' (#1645, @lukaso)
* Make Rack::NullLogger respond to #fatal! @jeremyevans)
* Fix multipart filename generation for filenames that contain
spaces. Encode spaces as "%20" instead of "+" which will be decoded
properly by the multipart parser. (#1736, @muirdm)
* Rack::Request#scheme returns ws or wss when one of the X-Forwarded-Scheme
/ X-Forwarded-Proto headers is set to ws or wss, respectively. (#1730,
@erwanst)
2023-01-04 16:23:35 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/mock_request.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/mock_response.rb
|
Update ruby-rack package to 1.3.5.
* September 16, 2011: Eighteenth public release 1.2.4
* Fix a bug with MRI regex engine to prevent XSS by malformed unicode
* May 22nd, 2011: Thirteenth public release 1.3.0
* Various performance optimizations
* Various multipart fixes
* Various multipart refactors
* Infinite loop fix for multipart
* Test coverage for Rack::Server returns
* Allow files with '..', but not path components that are '..'
* rackup accepts handler-specific options on the command line
* Request#params no longer merges POST into GET (but returns the same)
* Use URI.encode_www_form_component instead. Use core methods for escaping.
* Allow multi-line comments in the config file
* Bug L#94 reported by Nikolai Lugovoi, query parameter unescaping.
* Rack::Response now deletes Content-Length when appropriate
* Rack::Deflater now supports streaming
* Improved Rack::Handler loading and searching
* Support for the PATCH verb
* env['rack.session.options'] now contains session options
* Cookies respect renew
* Session middleware uses SecureRandom.hex
* May 22nd, 2011: Fourteenth public release 1.2.3
* Pulled in relevant bug fixes from 1.3
* Fixed 1.8.6 support
* July 13, 2011: Fifteenth public release 1.3.1
* Fix 1.9.1 support
* Fix JRuby support
* Properly handle $KCODE in Rack::Utils.escape
* Make method_missing/respond_to behavior consistent for Rack::Lock,
Rack::Auth::Digest::Request and Rack::Multipart::UploadedFile
* Reenable passing rack.session to session middleware
* Rack::CommonLogger handles streaming responses correctly
* Rack::MockResponse calls close on the body object
* Fix a DOS vector from MRI stdlib backport
* July 16, 2011: Sixteenth public release 1.3.2
* Fix for Rails and rack-test, Rack::Utils#escape calls to_s
* September 16, 2011: Seventeenth public release 1.3.3
* Fix bug with broken query parameters in Rack::ShowExceptions
* Rack::Request#cookies no longer swallows exceptions on broken input
* Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
* Rack::ConditionalGet handles broken If-Modified-Since helpers
* October 1, 2011: Nineteenth public release 1.3.4
* Backport security fix from 1.9.3, also fixes some roundtrip issues in URI
* Small documentation update
* Fix an issue where BodyProxy could cause an infinite recursion
* Add some supporting files for travis-ci
* October 17, 2011: Twentieth public release 1.3.5
* Fix annoying warnings caused by the backport in 1.3.4
2011-12-15 15:58:34 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/multipart.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/multipart/generator.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/multipart/parser.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/multipart/uploaded_file.rb
|
2017-06-04 17:10:09 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/null_logger.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/query_parser.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/recursive.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/reloader.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/request.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/response.rb
|
2009-06-14 19:58:55 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/rewindable_input.rb
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/runtime.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/sendfile.rb
|
2017-06-04 17:10:09 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/show_exceptions.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/show_status.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/static.rb
|
2015-03-13 18:21:19 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/tempfile_reaper.rb
|
2008-04-04 17:26:37 +02:00
|
|
|
${GEM_LIBDIR}/lib/rack/urlmap.rb
|
|
|
|
|
${GEM_LIBDIR}/lib/rack/utils.rb
|
www/ruby-rack: update to 2.2.2
Update ruby-rack to 2.2.2.
## [2.2.2] - 2020-02-11
### Fixed
- Fix incorrect `Rack::Request#host` value. ([#1591](https://github.com/rack/rack/pull/1591), [@ioquatix](https://github.com/ioquatix))
- Revert `Rack::Handler::Thin` implementation. ([#1583](https://github.com/rack/rack/pull/1583), [@jeremyevans](https://github.com/jeremyevans))
- Double assignment is still needed to prevent an "unused variable" warning. ([#1589](https://github.com/rack/rack/pull/1589), [@kamipo](https://github.com/kamipo))
- Fix to handle same_site option for session pool. ([#1587](https://github.com/rack/rack/pull/1587), [@kamipo](https://github.com/kamipo))
## [2.2.1] - 2020-02-09
### Fixed
- Rework `Rack::Request#ip` to handle empty `forwarded_for`. ([#1577](https://github.com/rack/rack/pull/1577), [@ioquatix](https://github.com/ioquatix))
## [2.2.0] - 2020-02-08
### SPEC Changes
- `rack.session` request environment entry must respond to `to_hash` and return unfrozen Hash. ([@jeremyevans](https://github.com/jeremyevans))
- Request environment cannot be frozen. ([@jeremyevans](https://github.com/jeremyevans))
- CGI values in the request environment with non-ASCII characters must use ASCII-8BIT encoding. ([@jeremyevans](https://github.com/jeremyevans))
- Improve SPEC/lint relating to SERVER_NAME, SERVER_PORT and HTTP_HOST. ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
### Added
- `rackup` supports multiple `-r` options and will require all arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Server` supports an array of paths to require for the `:require` option. ([@khotta](https://github.com/khotta))
- `Files` supports multipart range requests. ([@fatkodima](https://github.com/fatkodima))
- `Multipart::UploadedFile` supports an IO-like object instead of using the filesystem, using `:filename` and `:io` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::UploadedFile` supports keyword arguments `:path`, `:content_type`, and `:binary` in addition to positional arguments. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` supports a `:cascade` option for calling the app if there is no matching file. ([@jeremyevans](https://github.com/jeremyevans))
- `Session::Abstract::SessionHash#dig`. ([@jeremyevans](https://github.com/jeremyevans))
- `Response.[]` and `MockResponse.[]` for creating instances using status, headers, and body. ([@ioquatix](https://github.com/ioquatix))
- Convenient cache and content type methods for `Rack::Response`. ([#1555](https://github.com/rack/rack/pull/1555), [@ioquatix](https://github.com/ioquatix))
### Changed
- `Request#params` no longer rescues EOFError. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` uses a streaming approach, significantly improving time to first byte for large directories. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` no longer includes a Parent directory link in the root directory index. ([@jeremyevans](https://github.com/jeremyevans))
- `QueryParser#parse_nested_query` uses original backtrace when reraising exception with new class. ([@jeremyevans](https://github.com/jeremyevans))
- `ConditionalGet` follows RFC 7232 precedence if both If-None-Match and If-Modified-Since headers are provided. ([@jeremyevans](https://github.com/jeremyevans))
- `.ru` files supports the `frozen-string-literal` magic comment. ([@eregon](https://github.com/eregon))
- Rely on autoload to load constants instead of requiring internal files, make sure to require 'rack' and not just 'rack/...'. ([@jeremyevans](https://github.com/jeremyevans))
- `Etag` will continue sending ETag even if the response should not be cached. ([@henm](https://github.com/henm))
- `Request#host_with_port` no longer includes a colon for a missing or empty port. ([@AlexWayfer](https://github.com/AlexWayfer))
- All handlers uses keywords arguments instead of an options hash argument. ([@ioquatix](https://github.com/ioquatix))
- `Files` handling of range requests no longer return a body that supports `to_path`, to ensure range requests are handled correctly. ([@jeremyevans](https://github.com/jeremyevans))
- `Multipart::Generator` only includes `Content-Length` for files with paths, and `Content-Disposition` `filename` if the `UploadedFile` instance has one. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#ssl?` is true for the `wss` scheme (secure websockets). ([@jeremyevans](https://github.com/jeremyevans))
- `Rack::HeaderHash` is memoized by default. ([#1549](https://github.com/rack/rack/pull/1549), [@ioquatix](https://github.com/ioquatix))
- `Rack::Directory` allow directory traversal inside root directory. ([#1417](https://github.com/rack/rack/pull/1417), [@ThomasSevestre](https://github.com/ThomasSevestre))
- Sort encodings by server preference. ([#1184](https://github.com/rack/rack/pull/1184), [@ioquatix](https://github.com/ioquatix), [@wjordan](https://github.com/wjordan))
- Rework host/hostname/authority implementation in `Rack::Request`. `#host` and `#host_with_port` have been changed to correctly return IPv6 addresses formatted with square brackets, as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.2.2). ([#1561](https://github.com/rack/rack/pull/1561), [@ioquatix](https://github.com/ioquatix))
- `Rack::Builder` parsing options on first `#\` line is deprecated. ([#1574](https://github.com/rack/rack/pull/1574), [@ioquatix](https://github.com/ioquatix))
### Removed
- `Directory#path` as it was not used and always returned nil. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#each` as it was only needed to work around a bug in Ruby <1.9.3. ([@jeremyevans](https://github.com/jeremyevans))
- `URLMap::INFINITY` and `URLMap::NEGATIVE_INFINITY`, in favor of `Float::INFINITY`. ([@ch1c0t](https://github.com/ch1c0t))
- Deprecation of `Rack::File`. It will be deprecated again in rack 2.2 or 3.0. ([@rafaelfranca](https://github.com/rafaelfranca))
- Support for Ruby 2.2 as it is well past EOL. ([@ioquatix](https://github.com/ioquatix))
- Remove `Rack::Files#response_body` as the implementation was broken. ([#1153](https://github.com/rack/rack/pull/1153), [@ioquatix](https://github.com/ioquatix))
- Remove `SERVER_ADDR` which was never part of the original SPEC. ([#1573](https://github.com/rack/rack/pull/1573), [@ioquatix](https://github.com/ioquatix))
### Fixed
- `Directory` correctly handles root paths containing glob metacharacters. ([@jeremyevans](https://github.com/jeremyevans))
- `Cascade` uses a new response object for each call if initialized with no apps. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy` correctly delegates keyword arguments to the body object on Ruby 2.7+. ([@jeremyevans](https://github.com/jeremyevans))
- `BodyProxy#method` correctly handles methods delegated to the body object. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#host` and `Request#host_with_port` handle IPv6 addresses correctly. ([@AlexWayfer](https://github.com/AlexWayfer))
- `Lint` checks when response hijacking that `rack.hijack` is called with a valid object. ([@jeremyevans](https://github.com/jeremyevans))
- `Response#write` correctly updates `Content-Length` if initialized with a body. ([@jeremyevans](https://github.com/jeremyevans))
- `CommonLogger` includes `SCRIPT_NAME` when logging. ([@Erol](https://github.com/Erol))
- `Utils.parse_nested_query` correctly handles empty queries, using an empty instance of the params class instead of a hash. ([@jeremyevans](https://github.com/jeremyevans))
- `Directory` correctly escapes paths in links. ([@yous](https://github.com/yous))
- `Request#delete_cookie` and related `Utils` methods handle `:domain` and `:path` options in same call. ([@jeremyevans](https://github.com/jeremyevans))
- `Request#delete_cookie` and related `Utils` methods do an exact match on `:domain` and `:path` options. ([@jeremyevans](https://github.com/jeremyevans))
- `Static` no longer adds headers when a gzipped file request has a 304 response. ([@chooh](https://github.com/chooh))
- `ContentLength` sets `Content-Length` response header even for bodies not responding to `to_ary`. ([@jeremyevans](https://github.com/jeremyevans))
- Thin handler supports options passed directly to `Thin::Controllers::Controller`. ([@jeremyevans](https://github.com/jeremyevans))
- WEBrick handler no longer ignores `:BindAddress` option. ([@jeremyevans](https://github.com/jeremyevans))
- `ShowExceptions` handles invalid POST data. ([@jeremyevans](https://github.com/jeremyevans))
- Basic authentication requires a password, even if the password is empty. ([@jeremyevans](https://github.com/jeremyevans))
- `Lint` checks response is array with 3 elements, per SPEC. ([@jeremyevans](https://github.com/jeremyevans))
- Support for using `:SSLEnable` option when using WEBrick handler. (Gregor Melhorn)
- Close response body after buffering it when buffering. ([@ioquatix](https://github.com/ioquatix))
- Only accept `;` as delimiter when parsing cookies. ([@mrageh](https://github.com/mrageh))
- `Utils::HeaderHash#clear` clears the name mapping as well. ([@raxoft](https://github.com/raxoft))
- Support for passing `nil` `Rack::Files.new`, which notably fixes Rails' current `ActiveStorage::FileServer` implementation. ([@ioquatix](https://github.com/ioquatix))
### Documentation
- CHANGELOG updates. ([@aupajo](https://github.com/aupajo))
- Added [CONTRIBUTING](CONTRIBUTING.md). ([@dblock](https://github.com/dblock))
## [2.1.2] - 2020-01-27
- Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
- Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
- Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
- Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
- Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
- Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
## [2.1.1] - 2020-01-12
- Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))
## 2.1.0
_Note: There are many unreleased changes in Rack (`master` is around 300 commits ahead of `2-0-stable`), and below is not an exhaustive list. If you would like to help out and document some of the unreleased changes, PRs are welcome._
### Added
- Add support for `SameSite=None` cookie value. ([@hennikul](https://github.com/hennikul))
- Add trailer headers. ([@eileencodes](https://github.com/eileencodes))
- Add MIME Types for video streaming. ([@styd](https://github.com/styd))
- Add MIME Type for WASM. ([@buildrtech](https://github.com/buildrtech))
- Add `Early Hints(103)` to status codes. ([@egtra](https://github.com/egtra))
- Add `Too Early(425)` to status codes. ([@y-yagi]((https://github.com/y-yagi)))
- Add `Bandwidth Limit Exceeded(509)` to status codes. ([@CJKinni](https://github.com/CJKinni))
- Add method for custom `ip_filter`. ([@svcastaneda](https://github.com/svcastaneda))
- Add boot-time profiling capabilities to `rackup`. ([@tenderlove](https://github.com/tenderlove))
- Add multi mapping support for `X-Accel-Mappings` header. ([@yoshuki](https://github.com/yoshuki))
- Add `sync: false` option to `Rack::Deflater`. (Eric Wong)
- Add `Builder#freeze_app` to freeze application and all middleware instances. ([@jeremyevans](https://github.com/jeremyevans))
- Add API to extract cookies from `Rack::MockResponse`. ([@petercline](https://github.com/petercline))
### Changed
- Don't propagate nil values from middleware. ([@ioquatix](https://github.com/ioquatix))
- Lazily initialize the response body and only buffer it if required. ([@ioquatix](https://github.com/ioquatix))
- Fix deflater zlib buffer errors on empty body part. ([@felixbuenemann](https://github.com/felixbuenemann))
- Set `X-Accel-Redirect` to percent-encoded path. ([@diskkid](https://github.com/diskkid))
- Remove unnecessary buffer growing when parsing multipart. ([@tainoe](https://github.com/tainoe))
- Expand the root path in `Rack::Static` upon initialization. ([@rosenfeld](https://github.com/rosenfeld))
- Make `ShowExceptions` work with binary data. ([@axyjo](https://github.com/axyjo))
- Use buffer string when parsing multipart requests. ([@janko-m](https://github.com/janko-m))
- Support optional UTF-8 Byte Order Mark (BOM) in config.ru. ([@mikegee](https://github.com/mikegee))
- Handle `X-Forwarded-For` with optional port. ([@dpritchett](https://github.com/dpritchett))
- Use `Time#httpdate` format for Expires, as proposed by RFC 7231. ([@nanaya](https://github.com/nanaya))
- Make `Utils.status_code` raise an error when the status symbol is invalid instead of `500`. ([@adambutler](https://github.com/adambutler))
- Rename `Request::SCHEME_WHITELIST` to `Request::ALLOWED_SCHEMES`.
- Make `Multipart::Parser.get_filename` accept files with `+` in their name. ([@lucaskanashiro](https://github.com/lucaskanashiro))
- Add Falcon to the default handler fallbacks. ([@ioquatix](https://github.com/ioquatix))
- Update codebase to avoid string mutations in preparation for `frozen_string_literals`. ([@pat](https://github.com/pat))
- Change `MockRequest#env_for` to rely on the input optionally responding to `#size` instead of `#length`. ([@janko](https://github.com/janko))
- Rename `Rack::File` -> `Rack::Files` and add deprecation notice. ([@postmodern](https://github.com/postmodern)).
### Removed
- Remove `to_ary` from Response ([@tenderlove](https://github.com/tenderlove))
- Deprecate `Rack::Session::Memcache` in favor of `Rack::Session::Dalli` from dalli gem ([@fatkodima](https://github.com/fatkodima))
### Documentation
- Update broken example in `Session::Abstract::ID` documentation. ([tonytonyjan](https://github.com/tonytonyjan))
- Add Padrino to the list of frameworks implmenting Rack. ([@wikimatze](https://github.com/wikimatze))
- Remove Mongrel from the suggested server options in the help output. ([@tricknotes](https://github.com/tricknotes))
- Replace `HISTORY.md` and `NEWS.md` with `CHANGELOG.md`. ([@twitnithegirl](https://github.com/twitnithegirl))
- Backfill `CHANGELOG.md` from 2.0.1 to 2.0.7 releases. ([@drenmi](https://github.com/Drenmi))
## [2.0.8] - 2019-12-08
- [[CVE-2019-16782](https://nvd.nist.gov/vuln/detail/CVE-2019-16782)] Prevent timing attacks targeted at session ID lookup. BREAKING CHANGE: Session ID is now a SessionId instance instead of a String. ([@tenderlove](https://github.com/tenderlove), [@rafaelfranca](https://github.com/rafaelfranca))
2020-03-20 17:19:33 +01:00
|
|
|
${GEM_LIBDIR}/lib/rack/version.rb
|
2010-09-10 15:16:50 +02:00
|
|
|
${GEM_HOME}/specifications/${GEM_NAME}.gemspec
|
