Hello community,
here is the log from the commit of package rubygem-rack-1_6 for
openSUSE:Factory checked in at 2020-03-07 21:39:25
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-rack-1_6 (Old)
and /work/SRC/openSUSE:Factory/.rubygem-rack-1_6.new.26092 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rack-1_6"
Sat Mar 7 21:39:25 2020 rev:7 rq:773836 version:1.6.13
Changes:
--------
--- /work/SRC/openSUSE:Factory/rubygem-rack-1_6/rubygem-rack-1_6.changes
2018-12-04 20:57:07.036667188 +0100
+++
/work/SRC/openSUSE:Factory/.rubygem-rack-1_6.new.26092/rubygem-rack-1_6.changes
2020-03-07 21:39:31.492324262 +0100
@@ -1,0 +2,6 @@
+Mon Feb 10 15:27:04 UTC 2020 - Stephan Kulow <[email protected]>
+
+- updated to version 1.6.13
+ see installed HISTORY.md
+
+-------------------------------------------------------------------
Old:
----
rack-1.6.11.gem
New:
----
rack-1.6.13.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-rack-1_6.spec ++++++
--- /var/tmp/diff_new_pack.SFNxoq/_old 2020-03-07 21:39:32.048324638 +0100
+++ /var/tmp/diff_new_pack.SFNxoq/_new 2020-03-07 21:39:32.052324640 +0100
@@ -1,7 +1,7 @@
#
# spec file for package rubygem-rack-1_6
#
-# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -24,7 +24,7 @@
#
Name: rubygem-rack-1_6
-Version: 1.6.11
+Version: 1.6.13
Release: 0
%define mod_name rack
%define mod_full_name %{mod_name}-%{version}
@@ -37,7 +37,7 @@
BuildRequires: %{ruby}
BuildRequires: ruby-macros >= 5
BuildRequires: update-alternatives
-Url: http://rack.github.io/
+URL: http://rack.github.io/
Source: https://rubygems.org/gems/%{mod_full_name}.gem
Source1: rubygem-rack-1_6-rpmlintrc
Source2: gem2rpm.yml
++++++ rack-1.6.11.gem -> rack-1.6.13.gem ++++++
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/session/abstract/id.rb
new/lib/rack/session/abstract/id.rb
--- old/lib/rack/session/abstract/id.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/lib/rack/session/abstract/id.rb 2020-02-08 19:19:17.000000000 +0100
@@ -9,11 +9,38 @@
rescue LoadError
# We just won't get securerandom
end
+require "digest/sha2"
module Rack
module Session
+ class SessionId
+ ID_VERSION = 2
+
+ attr_reader :public_id
+
+ def initialize(public_id)
+ @public_id = public_id
+ end
+
+ def private_id
+ "#{ID_VERSION}::#{hash_sid(public_id)}"
+ end
+
+ alias :cookie_value :public_id
+ alias :to_s :public_id
+
+ def empty?; false; end
+ def inspect; public_id.inspect; end
+
+ private
+
+ def hash_sid(sid)
+ Digest::SHA256.hexdigest(sid)
+ end
+ end
+
module Abstract
ENV_SESSION_KEY = 'rack.session'.freeze
ENV_SESSION_OPTIONS_KEY = 'rack.session.options'.freeze
@@ -191,7 +218,7 @@
# Not included by default; you must require 'rack/session/abstract/id'
# to use.
- class ID
+ class Persisted
DEFAULT_OPTIONS = {
:key => 'rack.session',
:path => '/',
@@ -342,10 +369,10 @@
if not data = set_session(env, session_id, session_data, options)
env["rack.errors"].puts("Warning! #{self.class.name} failed to
save session. Content dropped.")
elsif options[:defer] and not options[:renew]
- env["rack.errors"].puts("Deferring cookie for #{session_id}") if
$VERBOSE
+ env["rack.errors"].puts("Deferring cookie for
#{session_id.public_id}") if $VERBOSE
else
cookie = Hash.new
- cookie[:value] = data
+ cookie[:value] = cookie_value(data)
cookie[:expires] = Time.now + options[:expire_after] if
options[:expire_after]
cookie[:expires] = Time.now + options[:max_age] if
options[:max_age]
set_cookie(env, headers, cookie.merge!(options))
@@ -354,6 +381,10 @@
[status, headers, body]
end
+ def cookie_value(data)
+ data
+ end
+
# Sets the cookie back to the client with session id. We skip the
cookie
# setting if the value didn't change (sid is the same) or expires was
given.
@@ -394,6 +425,51 @@
raise '#destroy_session not implemented'
end
end
+
+ class PersistedSecure < Persisted
+ class SecureSessionHash < SessionHash
+ def [](key)
+ if key == "session_id"
+ load_for_read!
+ id.public_id if id
+ else
+ super
+ end
+ end
+ end
+
+ def generate_sid(*)
+ public_id = super
+
+ SessionId.new(public_id)
+ end
+
+ def extract_session_id(*)
+ public_id = super
+ public_id && SessionId.new(public_id)
+ end
+
+ private
+
+ def session_class
+ SecureSessionHash
+ end
+
+ def cookie_value(data)
+ data.cookie_value
+ end
+ end
+
+ class ID < Persisted
+ def self.inherited(klass)
+ k = klass.ancestors.find { |kl| kl.respond_to?(:superclass) &&
kl.superclass == ID }
+ unless k.instance_variable_defined?(:"@_rack_warned")
+ warn "#{klass} is inheriting from #{ID}. Inheriting from #{ID} is
deprecated, please inherit from #{Persisted} instead" if $VERBOSE
+ k.instance_variable_set(:"@_rack_warned", true)
+ end
+ super
+ end
+ end
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/session/cookie.rb
new/lib/rack/session/cookie.rb
--- old/lib/rack/session/cookie.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/lib/rack/session/cookie.rb 2020-02-08 19:19:17.000000000 +0100
@@ -44,7 +44,7 @@
# })
#
- class Cookie < Abstract::ID
+ class Cookie < Abstract::PersistedSecure
# Encode session cookies as Base64
class Base64
def encode(str)
@@ -151,6 +151,15 @@
data
end
+ class SessionId < DelegateClass(Session::SessionId)
+ attr_reader :cookie_value
+
+ def initialize(session_id, cookie_value)
+ super(session_id)
+ @cookie_value = cookie_value
+ end
+ end
+
def set_session(env, session_id, session, options)
session = session.merge("session_id" => session_id)
session_data = coder.encode(session)
@@ -163,7 +172,7 @@
env["rack.errors"].puts("Warning! Rack::Session::Cookie data size
exceeds 4K.")
nil
else
- session_data
+ SessionId.new(session_id, session_data)
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/session/memcache.rb
new/lib/rack/session/memcache.rb
--- old/lib/rack/session/memcache.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/lib/rack/session/memcache.rb 2020-02-08 19:19:17.000000000 +0100
@@ -19,7 +19,7 @@
# Note that memcache does drop data before it may be listed to expire. For
# a full description of behaviour, please see memcache's documentation.
- class Memcache < Abstract::ID
+ class Memcache < Abstract::PersistedSecure
attr_reader :mutex, :pool
DEFAULT_OPTIONS = Abstract::ID::DEFAULT_OPTIONS.merge \
@@ -42,15 +42,15 @@
def generate_sid
loop do
sid = super
- break sid unless @pool.get(sid, true)
+ break sid unless @pool.get(sid.private_id, true)
end
end
def get_session(env, sid)
with_lock(env) do
- unless sid and session = @pool.get(sid)
+ unless sid and session = get_session_with_fallback(sid)
sid, session = generate_sid, {}
- unless /^STORED/ =~ @pool.add(sid, session)
+ unless /^STORED/ =~ @pool.add(sid.private_id, session)
raise "Session collision on '#{sid.inspect}'"
end
end
@@ -63,14 +63,15 @@
expiry = expiry.nil? ? 0 : expiry + 1
with_lock(env) do
- @pool.set session_id, new_session, expiry
+ @pool.set session_id.private_id, new_session, expiry
session_id
end
end
def destroy_session(env, session_id, options)
with_lock(env) do
- @pool.delete(session_id)
+ @pool.delete(session_id.public_id)
+ @pool.delete(session_id.private_id)
generate_sid unless options[:drop]
end
end
@@ -88,6 +89,11 @@
@mutex.unlock if @mutex.locked?
end
+ private
+
+ def get_session_with_fallback(sid)
+ @pool.get(sid.private_id) || @pool.get(sid.public_id)
+ end
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/session/pool.rb new/lib/rack/session/pool.rb
--- old/lib/rack/session/pool.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/lib/rack/session/pool.rb 2020-02-08 19:19:17.000000000 +0100
@@ -24,7 +24,7 @@
# )
# Rack::Handler::WEBrick.run sessioned
- class Pool < Abstract::ID
+ class Pool < Abstract::PersistedSecure
attr_reader :mutex, :pool
DEFAULT_OPTIONS = Abstract::ID::DEFAULT_OPTIONS.merge :drop => false
@@ -37,15 +37,15 @@
def generate_sid
loop do
sid = super
- break sid unless @pool.key? sid
+ break sid unless @pool.key? sid.private_id
end
end
def get_session(env, sid)
with_lock(env) do
- unless sid and session = @pool[sid]
+ unless sid and session = get_session_with_fallback(sid)
sid, session = generate_sid, {}
- @pool.store sid, session
+ @pool.store sid.private_id, session
end
[sid, session]
end
@@ -53,14 +53,15 @@
def set_session(env, session_id, new_session, options)
with_lock(env) do
- @pool.store session_id, new_session
+ @pool.store session_id.private_id, new_session
session_id
end
end
def destroy_session(env, session_id, options)
with_lock(env) do
- @pool.delete(session_id)
+ @pool.delete(session_id.public_id)
+ @pool.delete(session_id.private_id)
generate_sid unless options[:drop]
end
end
@@ -71,6 +72,12 @@
ensure
@mutex.unlock if @mutex.locked?
end
+
+ private
+
+ def get_session_with_fallback(sid)
+ @pool[sid.private_id] || @pool[sid.public_id]
+ end
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack.rb new/lib/rack.rb
--- old/lib/rack.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/lib/rack.rb 2020-02-08 19:19:17.000000000 +0100
@@ -20,7 +20,7 @@
# Return the Rack release as a dotted string.
def self.release
- "1.6.11"
+ "1.6.13"
end
PATH_INFO = 'PATH_INFO'.freeze
REQUEST_METHOD = 'REQUEST_METHOD'.freeze
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 2018-11-05 20:58:43.000000000 +0100
+++ new/metadata 2020-02-08 19:19:17.000000000 +0100
@@ -1,14 +1,14 @@
--- !ruby/object:Gem::Specification
name: rack
version: !ruby/object:Gem::Version
- version: 1.6.11
+ version: 1.6.13
platform: ruby
authors:
- Christian Neukirchen
autorequire:
bindir: bin
cert_chain: []
-date: 2018-11-05 00:00:00.000000000 Z
+date: 2020-02-08 00:00:00.000000000 Z
dependencies:
- !ruby/object:Gem::Dependency
name: bacon
@@ -221,6 +221,7 @@
- test/spec_session_abstract_id.rb
- test/spec_session_cookie.rb
- test/spec_session_memcache.rb
+- test/spec_session_persisted_secure_secure_session_hash.rb
- test/spec_session_pool.rb
- test/spec_showexceptions.rb
- test/spec_showstatus.rb
@@ -255,8 +256,7 @@
- !ruby/object:Gem::Version
version: '0'
requirements: []
-rubyforge_project: rack
-rubygems_version: 2.7.6
+rubygems_version: 3.1.2
signing_key:
specification_version: 4
summary: a modular Ruby webserver interface
@@ -282,6 +282,7 @@
- test/spec_showstatus.rb
- test/spec_chunked.rb
- test/spec_runtime.rb
+- test/spec_session_persisted_secure_secure_session_hash.rb
- test/spec_fastcgi.rb
- test/spec_builder.rb
- test/spec_config.rb
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/rack.gemspec new/rack.gemspec
--- old/rack.gemspec 2018-11-05 20:58:43.000000000 +0100
+++ new/rack.gemspec 2020-02-08 19:19:17.000000000 +0100
@@ -1,6 +1,6 @@
Gem::Specification.new do |s|
s.name = "rack"
- s.version = "1.6.11"
+ s.version = "1.6.13"
s.platform = Gem::Platform::RUBY
s.summary = "a modular Ruby webserver interface"
s.license = "MIT"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/test/spec_session_abstract_id.rb
new/test/spec_session_abstract_id.rb
--- old/test/spec_session_abstract_id.rb 2018-11-05 20:58:43.000000000
+0100
+++ new/test/spec_session_abstract_id.rb 2020-02-08 19:19:17.000000000
+0100
@@ -47,7 +47,7 @@
end
end
id = Rack::Session::Abstract::ID.new nil, :secure_random =>
secure_random.new
- id.send(:generate_sid).should.eql 'fake_hex'
+ id.send(:generate_sid).should.equal 'fake_hex'
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/test/spec_session_memcache.rb
new/test/spec_session_memcache.rb
--- old/test/spec_session_memcache.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/test/spec_session_memcache.rb 2020-02-08 19:19:17.000000000 +0100
@@ -225,15 +225,52 @@
req = Rack::MockRequest.new(pool)
res0 = req.get("/")
- session_id = (cookie = res0["Set-Cookie"])[session_match, 1]
- ses0 = pool.pool.get(session_id, true)
+ session_id = Rack::Session::SessionId.new (cookie =
res0["Set-Cookie"])[session_match, 1]
+ ses0 = pool.pool.get(session_id.private_id, true)
req.get("/", "HTTP_COOKIE" => cookie)
- ses1 = pool.pool.get(session_id, true)
+ ses1 = pool.pool.get(session_id.private_id, true)
ses1.should.not.equal ses0
end
+ it "can read the session with the legacy id" do
+ pool = Rack::Session::Memcache.new(incrementor)
+ req = Rack::MockRequest.new(pool)
+
+ res0 = req.get("/")
+ cookie = res0["Set-Cookie"]
+ session_id = Rack::Session::SessionId.new cookie[session_match, 1]
+ ses0 = pool.pool.get(session_id.private_id, true)
+ pool.pool.set(session_id.public_id, ses0, 0, true)
+ pool.pool.delete(session_id.private_id)
+
+ res1 = req.get("/", "HTTP_COOKIE" => cookie)
+ res1["Set-Cookie"].should.be.nil
+ res1.body.should.equal '{"counter"=>2}'
+ pool.pool.get(session_id.private_id, true).should.not.be.nil
+ end
+
+ it "drops the session in the legacy id as well" do
+ pool = Rack::Session::Memcache.new(incrementor)
+ req = Rack::MockRequest.new(pool)
+ drop = Rack::Utils::Context.new(pool, drop_session)
+ dreq = Rack::MockRequest.new(drop)
+
+ res0 = req.get("/")
+ cookie = res0["Set-Cookie"]
+ session_id = Rack::Session::SessionId.new cookie[session_match, 1]
+ ses0 = pool.pool.get(session_id.private_id, true)
+ pool.pool.set(session_id.public_id, ses0, 0, true)
+ pool.pool.delete(session_id.private_id)
+
+ res2 = dreq.get("/", "HTTP_COOKIE" => cookie)
+ res2["Set-Cookie"].should.be.nil
+ res2.body.should.equal '{"counter"=>2}'
+ pool.pool.get(session_id.private_id, true).should.be.nil
+ pool.pool.get(session_id.public_id, true).should.be.nil
+ end
+
# anyone know how to do this better?
it "cleanly merges sessions when multithreaded" do
unless $DEBUG
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/test/spec_session_persisted_secure_secure_session_hash.rb
new/test/spec_session_persisted_secure_secure_session_hash.rb
--- old/test/spec_session_persisted_secure_secure_session_hash.rb
1970-01-01 01:00:00.000000000 +0100
+++ new/test/spec_session_persisted_secure_secure_session_hash.rb
2020-02-08 19:19:17.000000000 +0100
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'minitest/global_expectations/autorun'
+require 'rack/session/abstract/id'
+
+describe Rack::Session::Abstract::PersistedSecure::SecureSessionHash do
+ attr_reader :hash
+
+ def setup
+ super
+ @store = Class.new do
+ def load_session(req)
+ [Rack::Session::SessionId.new("id"), { foo: :bar, baz: :qux }]
+ end
+ def session_exists?(req)
+ true
+ end
+ end
+ @hash =
Rack::Session::Abstract::PersistedSecure::SecureSessionHash.new(@store.new, nil)
+ end
+
+ it "returns keys" do
+ assert_equal ["foo", "baz"], hash.keys
+ end
+
+ it "returns values" do
+ assert_equal [:bar, :qux], hash.values
+ end
+
+ describe "#[]" do
+ it "returns value for a matching key" do
+ assert_equal :bar, hash[:foo]
+ end
+
+ it "returns value for a 'session_id' key" do
+ assert_equal "id", hash['session_id']
+ end
+
+ it "returns nil value for missing 'session_id' key" do
+ store = @store.new
+ def store.load_session(req)
+ [nil, {}]
+ end
+ @hash =
Rack::Session::Abstract::PersistedSecure::SecureSessionHash.new(store, nil)
+ assert_nil hash['session_id']
+ end
+ end
+
+ describe "#fetch" do
+ it "returns value for a matching key" do
+ assert_equal :bar, hash.fetch(:foo)
+ end
+
+ it "works with a default value" do
+ assert_equal :default, hash.fetch(:unknown, :default)
+ end
+
+ it "works with a block" do
+ assert_equal :default, hash.fetch(:unkown) { :default }
+ end
+
+ it "it raises when fetching unknown keys without defaults" do
+ lambda { hash.fetch(:unknown) }.must_raise KeyError
+ end
+ end
+
+ describe "#stringify_keys" do
+ it "returns hash or session hash with keys stringified" do
+ assert_equal({ "foo" => :bar, "baz" => :qux },
hash.send(:stringify_keys, hash).to_h)
+ end
+ end
+end
+
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/test/spec_session_pool.rb
new/test/spec_session_pool.rb
--- old/test/spec_session_pool.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/test/spec_session_pool.rb 2020-02-08 19:19:17.000000000 +0100
@@ -5,7 +5,7 @@
describe Rack::Session::Pool do
session_key = Rack::Session::Pool::DEFAULT_OPTIONS[:key]
- session_match = /#{session_key}=[0-9a-fA-F]+;/
+ session_match = /#{session_key}=([0-9a-fA-F]+);/
incrementor = lambda do |env|
env["rack.session"]["counter"] ||= 0
@@ -13,7 +13,7 @@
Rack::Response.new(env["rack.session"].inspect).to_a
end
- session_id = Rack::Lint.new(lambda do |env|
+ get_session_id = Rack::Lint.new(lambda do |env|
Rack::Response.new(env["rack.session"].inspect).to_a
end)
@@ -142,6 +142,43 @@
pool.pool.size.should.equal 1
end
+ it "can read the session with the legacy id" do
+ pool = Rack::Session::Pool.new(incrementor)
+ req = Rack::MockRequest.new(pool)
+
+ res0 = req.get("/")
+ cookie = res0["Set-Cookie"]
+ session_id = Rack::Session::SessionId.new cookie[session_match, 1]
+ ses0 = pool.pool[session_id.private_id]
+ pool.pool[session_id.public_id] = ses0
+ pool.pool.delete(session_id.private_id)
+
+ res1 = req.get("/", "HTTP_COOKIE" => cookie)
+ res1["Set-Cookie"].should.be.nil
+ res1.body.should.equal '{"counter"=>2}'
+ pool.pool[session_id.private_id].should.not.be.nil
+ end
+
+ it "drops the session in the legacy id as well" do
+ pool = Rack::Session::Pool.new(incrementor)
+ req = Rack::MockRequest.new(pool)
+ drop = Rack::Utils::Context.new(pool, drop_session)
+ dreq = Rack::MockRequest.new(drop)
+
+ res0 = req.get("/")
+ cookie = res0["Set-Cookie"]
+ session_id = Rack::Session::SessionId.new cookie[session_match, 1]
+ ses0 = pool.pool[session_id.private_id]
+ pool.pool[session_id.public_id] = ses0
+ pool.pool.delete(session_id.private_id)
+
+ res2 = dreq.get("/", "HTTP_COOKIE" => cookie)
+ res2["Set-Cookie"].should.be.nil
+ res2.body.should.equal '{"counter"=>2}'
+ pool.pool[session_id.private_id].should.be.nil
+ pool.pool[session_id.public_id].should.be.nil
+ end
+
# anyone know how to do this better?
it "should merge sessions when multithreaded" do
unless $DEBUG
@@ -190,7 +227,7 @@
end
it "does not return a cookie if cookie was not written (only read)" do
- app = Rack::Session::Pool.new(session_id)
+ app = Rack::Session::Pool.new(get_session_id)
res = Rack::MockRequest.new(app).get("/")
res["Set-Cookie"].should.be.nil
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/test/spec_showexceptions.rb
new/test/spec_showexceptions.rb
--- old/test/spec_showexceptions.rb 2018-11-05 20:58:43.000000000 +0100
+++ new/test/spec_showexceptions.rb 2020-02-08 19:19:17.000000000 +0100
@@ -92,7 +92,7 @@
[{ "HTTP_ACCEPT" => "text/foo" }, true],
[{ "HTTP_ACCEPT" => "text/html" }, false]
].each do |env, expected|
- assert_equal(expected, exc.prefers_plaintext?(env))
+ expected.should.equal exc.prefers_plaintext?(env)
end
end
end
