1
0
Fork 0
mirror of https://github.com/sinatra/sinatra synced 2023-03-27 23:18:01 -04:00
Commit graph

23 commits

Author SHA1 Message Date
Vasiliy
8ae87a87f3
Setup Rubocop (#1537)
* Initialize rubocop

* Style/StringLiterals: prefer single quotes

* Style/AndOr: use `&&` and `||`, instead of `and` and `or`

* Style/HashSyntax: use new hash syntax

* Layout/EmptyLineAfterGuardClause: add empty lines after guard clause

* Style/SingleLineMethods: temporary disable

It breaks layout of the code, it is better to fix it manually

* Style/Proc: prefer `proc` vs `Proc.new`

* Disable Lint/AmbiguousBlockAssociation

It affects proc definitions for sinatra DSL

* Disable Style/CaseEquality

* Lint/UnusedBlockArgument: put underscore in front of it

* Style/Alias: prefer alias vs alias_method in a class body

* Layout/EmptyLineBetweenDefs: add empty lines between defs

* Style/ParallelAssignment: don't use parallel assigment

* Style/RegexpLiteral: prefer %r for regular expressions

* Naming/UncommunicativeMethodParamName: fix abbrevs

* Style/PerlBackrefs: disable cop

* Layout/SpaceAfterComma: add missing spaces

* Style/Documentation: disable cop

* Style/FrozenStringLiteralComment: add frozen_string_literal

* Layout/AlignHash: align hash

* Layout/ExtraSpacing: allow for alignment

* Layout/SpaceAroundOperators: add missing spaces

* Style/Not: prefer `!` instead of `not`

* Style/GuardClause: add guard conditions

* Style/MutableConstant: freeze contants

* Lint/IneffectiveAccessModifier: disable cop

* Lint/RescueException: disable cop

* Style/SpecialGlobalVars: disable cop

* Layout/DotPosition: fix position of dot for multiline method chains

* Layout/SpaceInsideArrayLiteralBrackets: don't use spaces inside arrays

* Layout/SpaceInsideBlockBraces: add space for blocks

* Layout/SpaceInsideHashLiteralBraces: add spaces for hashes

* Style/FormatString: use format string syntax

* Style/StderrPuts: `warn` is preferable to `$stderr.puts`

* Bundler/DuplicatedGem: disable cop

* Layout/AlignArray: fix warning

* Lint/AssignmentInCondition: remove assignments from conditions

* Layout/IndentHeredoc: disable cop

* Layout/SpaceInsideParens: remove extra spaces

* Lint/UnusedMethodArgument: put underscore in front of unused arg

* Naming/RescuedExceptionsVariableName: use `e` for exceptions

* Style/CommentedKeyword: put comments before the method

* Style/FormatStringToken: disable cop

* Style/MultilineIfModifier: move condition before the method

* Style/SignalException: prefer `raise` to `fail`

* Style/SymbolArray: prefer %i for array of symbols

* Gemspec/OrderedDependencies: Use alphabetical order for dependencies

* Lint/UselessAccessModifier: disable cop

* Naming/HeredocDelimiterNaming: change delimiter's name

* Style/ClassCheck: prefer `is_a?` to `kind_of?`

* Style/ClassVars: disable cop

* Style/Encoding: remove coding comment

* Style/RedundantParentheses: remove extra parentheses

* Style/StringLiteralsInInterpolation: prefer singl quotes

* Layout/AlignArguments: fix alignment

* Layout/ClosingHeredocIndentation: align heredoc

* Layout/EmptyLineAfterMagicComment: add empty line

* Set RubyVersion for rubocop

* Lint/UselessAssignment: disable cop

* Style/EmptyLiteral: disable cop

Causes test failures

* Minor code-style fixes with --safe-auto-correct option

* Disable the rest of the cops that cause warnings

It would be easier to re-enable them in separate PRs

* Add rubocop check to the default Rake task

* Update to rubocop 1.32.0

* Rubocop updates for rack-protection and sinatra-contrib

* Disable Style/SlicingWithRange cop

* Make suggested updates

Co-authored-by: Jordan Owens <jkowens@gmail.com>
2022-07-31 08:56:44 -04:00
Reenan Arbitrario
99897fa5d1 include application/xml and text/xml content-types to valid html_types for Rack::Protection
create additional unit test

add application/xml content-type
2018-03-30 13:15:20 -07:00
Andreas Karlsson
8aa6c42ef7 Use secure_compare when checking CSRF token
Since string comparisions may return early we want to use a constant
time comparsion function to protect the CSRF token against timing
attacks. Rack::Utils provides a such function.
2016-07-26 15:31:31 +09:00
Josef Stribny
270ab97e17 Fix permissions back to 0644 2015-01-16 15:13:23 +01:00
Igor Bochkariov
690dbeffaa clarify reaction warning, test it 2014-03-13 11:55:59 +04:00
Jason Staten
5f7be397a2 Discard invalid Referer header
If an invalid Referer header such as "http://example.com/bad|uri" is
provided, ignore the value of it and skip using the Host header fallback.
2014-01-23 15:15:44 -07:00
Patrick Ellis
06ce831fb2 ensure Rack::Protection::Base#random_string always outputs 32 characters 2013-09-09 15:27:17 -07:00
brookemckim
4121d4cd16 Add instrumentation support 2013-08-21 15:02:02 -04:00
Florian Gilcher
3835ec3ea8 Add a report reaction
This reaction does not halt the request, but leaves it up to the
app to react on this information. This allows e.g. frameworks to
ignore failures in certain conditions.
2013-03-10 23:34:37 +01:00
Konstantin Haase
1fb10858b8 small refactor 2012-12-10 22:04:43 +01:00
Chris Heald
ea010df020 Don't choke on requests that end up without a content-type header 2012-12-10 13:54:27 -07:00
Konstantin Haase
13f0d4dac3 only set protection headers for html, fixes #31 2012-12-10 16:42:48 +01:00
Bjørge Næss
fd4687f331 Bypass referer check if Origin header is given 2012-09-05 10:08:09 +02:00
Akzhan Abdulin
eea798e787 NotImpelentedError typo fix 2011-11-08 17:44:32 +03:00
Konstantin Haase
fcce195bc8 remove NoReferrer, instead, take an option for that 2011-06-20 13:08:39 +02:00
Konstantin Haase
f644adcbeb default reaction to deny 2011-06-20 09:16:15 +02:00
Konstantin Haase
62dd794011 add JSON CSRF protection 2011-06-19 15:26:39 +02:00
Konstantin Haase
012cd7be0f implement session hijacking prevention 2011-05-29 13:01:47 +02:00
Konstantin Haase
3588ba5d33 move stuff around, add remote_token protection 2011-05-29 12:10:15 +02:00
Konstantin Haase
ab177702bb import authenticity token implementation 2011-05-28 17:51:54 +02:00
Konstantin Haase
725d26b502 implement NoReferrer 2011-05-25 12:27:18 +02:00
Konstantin Haase
40f5a0c0fa fix default options not overriding options 2011-05-24 10:56:19 +02:00
Konstantin Haase
0985552f33 initial commit 2011-05-23 10:07:54 +02:00