Commit Graph

574 Commits

Author SHA1 Message Date
Sergio Benitez
51ed332127 Make trailing slashes significant during routing.
This commit modifies request routing in a backwards incompatible manner.
The change is summarized as: trailing slashes are now significant and
never transparently disregarded. This has the following implications,
all representing behavior that differs from that before this change:

  * Route URIs with trailing slashes (`/foo/`, `/<a>/`) are legal.
  * A request `/foo/` is routed to route `/foo/` but not `/foo`.
  * Similarly, a request `/bar/` is routed to `/<a>/` but not `/<a>`.
  * A request `/bar/foo` is not routed to `/<a>/<b>/<c..>`.

A new `AdHoc::uri_normalizer()` fairing was added that recovers the
previous behavior.

In addition to the above, the `Options::NormalizeDirs` `FileServer`
option is now enabled by default to remain consistent with the above
changes and reduce breaking changes at the `FileServer` level.
2023-04-10 12:40:39 -07:00
Sergio Benitez
908a918e8b Fuzz to validate routing collision safety.
The fuzzing target introduced in this commit attemps to assert
"collision safety". Formally, this is the property that:

  matches(request, route) := request is matched to route
  collides(route1, route2) := there is a a collision between routes

  forall requests req. !exist routes r1, r2 s.t.
    matches(req, r1) AND matches(req, r2) AND not collides(r1, r2)

Alternatively:

  forall requests req, routes r1, r2.
    matches(req, r1) AND matches(req, r2) => collides(r1, r2)

The target was run for 20 CPU hours without failure.
2023-04-07 20:27:56 -07:00
Sergio Benitez
ac0a77bae2 Allow dynamic parameters to match empty segments.
The net effect of this commit is three-fold:

  * A request to `/` now matches `/<a>`. `/foo/` matches `/<a>/<b>`.
  * A segment matched to a dynamic parameter may be empty.
  * A request to `/foo/` no longer matches `/foo` or `/<a>`. Instead,
    such a request would match `/foo/<a>` or `/foo/`.

The `&str` and `String` parameter guards were updated to reflect this
change: they now error, with a newly introduced error type `Empty` in
the `rocket::error` module, when the parameter is empty. As this was the
only built-in parameter guard that would be effected by this change (all
other guards already required nonempty parameters to succeed), the
majority of applications will see no effect as a result.

For applications wanting the previous functionality, a new
`AdHoc::uri_normalizer()` fairing was introduced.
2023-04-07 20:00:09 -07:00
Sergio Benitez
0a56312607 Implement more conservative URI normalization.
* Trailing slashes are now allowed in all normalized URI paths, except
    for route attribute URIs: `/foo/` is considered normalized.
  * Query parts of URIs may now be empty: `/foo?` and `/foo/?` are now
    considered normalized.
  * The `base` field of `Catcher` is now only accessible via a new
    getter method: `Catcher::base()`.
  * `RawStr::split()` returns a `DoubleEndedIterator`.
  * Introduced a second normalization for `Origin`, "nontrailing", and
    associated methods: `Origin::normalize_nontrailing()`, and
    `Origin::is_normalized_nontrailing()`.
  * Added `Origin::has_trailing_slash()`.
  * The `Segments<Path>` iterator will now return an empty string if
    there is a trailing slash in the referenced path.
  * `Segments::len()` is now `Segments::num()`.
  * Added `RawStr::trim()`.

Resolves #2512.
2023-04-07 19:59:57 -07:00
Sergio Benitez
a82508b403 Set 'Secure' cookie flag by default under TLS.
If TLS is enabled and active, Rocket will now set the `Secure` cookie
attribute by default.

Resolves #2425.
2023-04-05 13:15:24 -07:00
Sergio Benitez
89534129de Add 'TempFile::open()' to stream its data.
Resolves #2296.
2023-04-05 12:45:48 -07:00
Sergio Benitez
c48ce64a77 Standardize 'response::status' responders.
This commit modifies all of the non-empty responders in the
`response::status` module so that they look like `Status<R>(pub R)`.
Prior to this commit, some responders looked like this, while others
contained an `Option<R>`.

Resolves #2351.
2023-04-05 10:51:05 -07:00
Sergio Benitez
03433c10ea Allow specifying 'Status' in custom form errors.
Resolves #1694.
2023-04-05 09:56:49 -07:00
Sergio Benitez
c3520fb4a1 Pin I/O handlers. Allow 'FnOnce' in 'ws' handlers.
This modifies the 'IoHandler::io()' method so that it takes a
'Pin<Box<Self>>', allowing handlers to move internally and assume that
the data is pinned.

The change is then used in the 'ws' contrib crate to allow 'FnOnce'
handlers instead of 'FnMut'. The net effect is that streams, such as
those crated by 'Stream!', are now allowed to move internally.
2023-04-04 15:33:46 -07:00
Sergio Benitez
5e7a75e1a5 Use 'parking_lot' 'Mutex' in fairing's 'Once'. 2023-04-04 15:11:09 -07:00
Sergio Benitez
887558be60 Emit warnings when data limits are reached.
Aid in debugging incorrectly configured data limits.
2023-04-03 13:27:33 -07:00
Sergio Benitez
aa6ad7030a Allow setting mTLS certificates on local 'Client'.
This allows testing with client certificates.

Co-authored-by: Brett Buford <blbuford@gmail.com>
2023-03-31 11:13:40 -07:00
Sergio Benitez
64a7bfb37c Fix header lookups for connection upgrades. 2023-03-30 16:08:14 -07:00
Sergio Benitez
2a63b1a41f Downgrade I/O stream closing to warning.
Since active I/O streams will be closed by graceful shutdown, an error,
as was previously emitted, was necessarily alarmist. This reduces the
severity of the log message to a warning.
2023-03-30 12:46:34 -07:00
Sergio Benitez
d97c83d7e0 Finalize support for external connection upgrades. 2023-03-29 17:06:08 -07:00
Mai-Lapyst
19e7e82fd6 Initial connection upgrade API implementation. 2023-03-29 17:06:04 -07:00
Sergio Benitez
372e9671eb Clarify 'Responder' async I/O usage in docs.
Resolves #2286.
2023-03-26 19:32:49 -07:00
Sergio Benitez
a474fde85b Implement 'De(Serialize)' for 'Status'.
Resolves #2366.
2023-03-26 19:18:04 -07:00
Sergio Benitez
91f6288ea4 New version: 0.5.0-rc.3.
New contrib versions: 0.1.0-rc.3.
2023-03-23 16:56:17 -07:00
Sergio Benitez
14b8a082b4 Fix doc re-export inlines in crate root. 2023-03-23 16:33:11 -07:00
Jacob Sharf
89919aa3cb Fix several typos. 2023-03-23 16:27:08 -07:00
inyourface34456
0e6b786096 Fix typo in docs.
Fixes #2734.
2023-03-23 16:27:08 -07:00
Sergio Benitez
219a8a5468 Fix a bunch of typos. 2023-03-23 16:27:08 -07:00
badoken
569bc09a1d Support raw byte slices '&[u8]' in form fields.
Resolves #2148.
2023-03-23 15:31:24 -07:00
Unpublished
2f74380d69 Replace 'atty' with 'is-terminal'. 2023-03-23 14:57:54 -07:00
Dinu Blanovschi
b556ec1bba Impl 'Fairing' for 'Arc<dyn Fairing>'. 2023-03-23 14:57:54 -07:00
Beep LIN
78e6e55aa2 Fix typo: 'FromFrom' -> 'FromForm'. 2023-03-23 14:57:54 -07:00
Sergio Benitez
0a0f540988 Support TLS keys in SEC1 format. 2023-03-23 14:57:54 -07:00
Kian-Meng Ang
06d255b52b Fix a whole bunch of typos.
Found via `codespell -L crate,ser,fo,noo,nd,cappable,pard,te,ans`.
2023-03-23 14:57:54 -07:00
Paul Weaver
825dd04ec6 Fix doc typo: "gleaming" -> "gleaning". 2023-03-23 14:57:54 -07:00
Sergio Benitez
0ed6d82d10 Defend against configured known secret keys.
This is a two-prong effort. First, we warn on launch if a known key is
used. Second, we document using invalid keys where possible.

Co-authored-by: Jonas Møller <jonas@moesys.no>
2023-03-23 14:57:54 -07:00
Riley Patterson
01663ed47c Fix 'msgpack' module feature enabling docs. 2023-03-23 14:57:54 -07:00
Alexander van Ratingen
2191369b37 Fix typos in docs. 2023-03-23 14:57:54 -07:00
Sergio Benitez
1edfa15d52 Fix several broken rustdoc links. 2023-03-23 14:57:54 -07:00
Sergio Benitez
9377af5978 Make real IP header configurable via 'ip_header'.
Adds an `ip_header` configuration parameter that allows modifying the
header Rocket attempts to use to retrieve the "real IP" address of the
client via `Request` methods like `client_ip()`. Additionally allows
disabling the use of any such header.
2023-03-20 12:57:21 -07:00
Sergio Benitez
162fafa0f1 Update UI tests for nightly. 2022-11-18 19:30:35 -08:00
Sergio Benitez
7e913eb8ac Report as many form errors as possible. 2022-11-12 04:11:18 -08:00
Sergio Benitez
1ed7a6e77e Fix log indentation.
Regression introduced in 885cdfd6 resulted in items in logs messages not
being properly indented.
2022-11-08 14:55:30 -08:00
Sergio Benitez
885cdfd61c Always log launch message.
Users experience confusion when the server appears to do "nothing" when
compiled in release mode. In reality, the server has started, but it
offers no indication in that direction via log message. Often users
misconfigure the port or address, but that information isn't displayed.

This commit makes it such that only the final "Rocket has launched!"
log message is displayed, which includes the listening address, port,
and protocol.
2022-08-30 13:51:23 -07:00
Sergio Benitez
c08c39e16f Implement 'FromForm' for 'Arc<T>'. 2022-08-30 13:51:18 -07:00
Kevin Wang
f7e703bc5e Fix 'Limits' deserialization.
Fixes #2268.
2022-08-01 13:11:02 -07:00
Sergio Benitez
8e8dfc7d45 Clarify built-in request guard implementations. 2022-07-17 18:45:11 -07:00
pennae
7275df9fdf Make data guards eligible to be sentinels.
Prior to this commit, data guards were not being considered as eligible
to be sentinels. This commit resolves that.
2022-06-23 16:15:11 -07:00
Sergio Benitez
30b8a77fc9 Avoid dropping 'Error' inside '#[launch]' future.
Due to tokio-rs/tokio#4780, a panicking top-level future combined with
an uncooperative background task prevents runtime shutdown. To avoid
this in the case of `Rocket::launch()` returning an `Error`, which
panics on drop if it isn't inspected, we return the `Result` to the
caller (i.e., `main`) instead of the `block_on` future. This prevent the
panic from occuring inside of the `block_on` future and so the runtime
terminates even with uncooperative I/O.
2022-06-20 23:49:41 -07:00
Sergio Benitez
04819d8cfd Add pool retrieval to sync_db_pools.
Generates a new method on attributed types, `pool()`, which returns an
opaque reference to a type that can be used to get pooled connections.

Also adds a code-generated example to the crate docs which includes
real, proper function signatures and fully checked examples.

Resolves #1884.
Closes #1972.
2022-05-24 16:47:09 -07:00
Matthew Pomes
5cb70ec58c Salvage everything viable from bad requests.
Co-authored-by: Sergio Benitez <sb@sergio.bz>
2022-05-23 23:47:53 -07:00
Matthew Pomes
47946cc55c Add 'max_blocking' threads config value. 2022-05-23 21:55:16 -07:00
Sergio Benitez
907af10ea4 Tolerate more timing issues in SSE heartbeat test. 2022-05-23 16:36:06 -07:00
Matthew Pomes
f21da79f44 Make 'form::ErrorKind' 'From' impl const generic.
Converts an older style array impl to one that uses const generics,
allowing any array length, not just a few sizes.
2022-05-19 18:17:06 -07:00
Sergio Benitez
26b58846a7 Mark fns returning 'Rocket<Build>' 'must_use'.
Remove 'must_use' on the generic 'Rocket<P>', which was overly
conservative. This change, in effect, marks only 'Rocket<Build>'
'must_use', which is a much more precise implementation of the intended
safety guard.
2022-05-19 10:45:24 -07:00