# utils.rb

Path: | lib/rack/utils.rb
Last Update: | Thu Dec 05 17:13:57 -0500 2019

### Required files

fileutils set tempfile rack/multipart time rack/backports/uri/common_18 rack/backports/uri/common_192 rack/backports/uri/common_193 uri/common

### Methods

best_q_match build_nested_query build_query byte_ranges bytesize bytesize clean_path_info delete_cookie_header! escape_html normalize_params params_hash_type? q_values rfc2109 rfc2822 secure_compare select_best_encoding set_cookie_header! status_code

### Constants

ESCAPE_HTML | = | { "&" => "&amp;", "<" => "&lt;", ">" => "&gt;", "'" => "&#x27;", '"' => "&quot;", "/" => "&#x2F;"
ESCAPE_HTML_PATTERN | = | Regexp.union(*ESCAPE_HTML.keys)
ESCAPE_HTML_PATTERN | = | /#{Regexp.union(*ESCAPE_HTML.keys)}/n |  | On 1.8, there is a kcode = ‘u’ bug that allows for XSS otherwise TODO doesn‘t apply to jruby, so a better condition above might be preferable?
HTTP_STATUS_CODES | = | { 100 => 'Continue', 101 => 'Switching Protocols', 102 => 'Processing', 200 => 'OK', 201 => 'Created', 202 => 'Accepted', 203 => 'Non-Authoritative Information', 204 => 'No Content', 205 => 'Reset Content', 206 => 'Partial Content', 207 => 'Multi-Status', 208 => 'Already Reported', 226 => 'IM Used', 300 => 'Multiple Choices', 301 => 'Moved Permanently', 302 => 'Found', 303 => 'See Other', 304 => 'Not Modified', 305 => 'Use Proxy', 307 => 'Temporary Redirect', 308 => 'Permanent Redirect', 400 => 'Bad Request', 401 => 'Unauthorized', 402 => 'Payment Required', 403 => 'Forbidden', 404 => 'Not Found', 405 => 'Method Not Allowed', 406 => 'Not Acceptable', 407 => 'Proxy Authentication Required', 408 => 'Request Timeout', 409 => 'Conflict', 410 => 'Gone', 411 => 'Length Required', 412 => 'Precondition Failed', 413 => 'Payload Too Large', 414 => 'URI Too Long', 415 => 'Unsupported Media Type', 416 => 'Range Not Satisfiable', 417 => 'Expectation Failed', 422 => 'Unprocessable Entity', 423 => 'Locked', 424 => 'Failed Dependency', 426 => 'Upgrade Required', 428 => 'Precondition Required', 429 => 'Too Many Requests', 431 => 'Request Header Fields Too Large', 500 => 'Internal Server Error', 501 => 'Not Implemented', 502 => 'Bad Gateway', 503 => 'Service Unavailable', 504 => 'Gateway Timeout', 505 => 'HTTP Version Not Supported', 506 => 'Variant Also Negotiates', 507 => 'Insufficient Storage', 508 => 'Loop Detected', 510 => 'Not Extended', 511 => 'Network Authentication Required' |  | Every standard HTTP code mapped to the appropriate message. Generated with: curl -s www.iana.org/assignments/http-status-codes/http-status-codes-1.csv | # ruby -ne ‘m = /^(\d{3}),(?!Unassigned|\(Unused\))([^,]+)/.match($_) and # puts "#{m[1]} => \x27#{m[2].strip}\x27,"’
STATUS_WITH_NO_ENTITY_BODY | = | Set.new((100..199).to_a << 204 << 205 << 304) |  | Responses with HTTP status codes that should not have an entity body
SYMBOL_TO_STATUS_CODE | = | Hash[*HTTP_STATUS_CODES.map { |code, message| [message.downcase.gsub(/\s|-|'/, '_').to_sym, code]
Multipart | = | Rack::Multipart
PATH_SEPS | = | Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)

### Public Instance methods

best_q_match(q_value_header, available_mimes)
build_nested_query(value, prefix = nil)
build_query(params)
byte_ranges(env, size)

Parses the "Range:" header, if present, into an array of Range objects. Returns nil if the header is missing or syntactically invalid. Returns an empty array if none of the ranges are satisfiable.

bytesize(string)
bytesize(string)
clean_path_info(path_info)
delete_cookie_header!(header, key, value = {})
escape_html(string)

Escape ampersands, brackets and quotes to their HTML/XML entities.

normalize_params(params, name, v = nil)

normalize_params recursively expands parameters into structural types. If the structural types represented by two different parameter names are in conflict, a ParameterTypeError is raised.

params_hash_type?(obj)
q_values(q_value_header)
rfc2109(time)

Modified version of stdlib time.rb Time#rfc2822 to use ’%d-%b-%Y’ instead of ’% %b %Y’. It assumes that the time is in GMT to comply to the RFC 2109.

NOTE: I‘m not sure the RFC says it requires GMT, but is ambiguous enough that I‘m certain someone implemented only that option. Do not use %a and %b from Time.strptime, it would use localized names for weekday and month.

rfc2822(time)
secure_compare(a, b)

Constant time string comparison.

NOTE: the values compared should be of fixed length, such as strings that have already been processed by HMAC. This should not be used on variable length plaintext strings because it could leak length info via timing attacks.

select_best_encoding(available_encodings, accept_encoding)
set_cookie_header!(header, key, value)
status_code(status)

[Validate]