* upstream sync

palkan · palkan · commit 1bcf657a9740 · 2026-05-20T18:27:47.000+03:00
diff --git a/lib/action_cable.rb b/lib/action_cable.rb
@@ -74,7 +74,7 @@ module ActionCable
     },
     default_mount_path: "/cable",
     protocols: ["actioncable-v1-json", "actioncable-unsupported"].freeze
-  }
+  }.freeze
 
   # Singleton instance of the server
   module_function def server
diff --git a/lib/action_cable/channel/base.rb b/lib/action_cable/channel/base.rb
@@ -135,6 +135,7 @@ def action_methods
               public_instance_methods(false) -
               # Except the internal methods
               internal_methods).uniq
+
             methods.map!(&:name)
             methods.to_set
           end
@@ -148,15 +149,15 @@ def clear_action_methods! # :doc:
             @action_methods = nil
           end
 
-          def internal_methods
-            super
-          end
-
           # Refresh the cached action_methods when a new action_method is added.
           def method_added(name) # :doc:
             super
             clear_action_methods!
           end
+
+          def internal_methods
+            super
+          end
       end
 
       def initialize(connection, identifier, params = {})
diff --git a/lib/action_cable/channel/callbacks.rb b/lib/action_cable/channel/callbacks.rb
@@ -39,7 +39,7 @@ module Callbacks
       extend  ActiveSupport::Concern
       include ActiveSupport::Callbacks
 
-      INTERNAL_METHODS = [:_run_subscribe_callbacks, :_run_unsubscribe_callbacks] # :nodoc:
+      INTERNAL_METHODS = [:_run_subscribe_callbacks, :_run_unsubscribe_callbacks].freeze # :nodoc:
 
       included do
         define_callbacks :subscribe
diff --git a/lib/action_cable/connection/base.rb b/lib/action_cable/connection/base.rb
@@ -4,6 +4,12 @@
 
 require "active_support/rescuable"
 
+begin
+  require "active_support/inspect_backport"
+rescue LoadError
+  # ActiveSupport::InspectBackport ships only in Rails 8.2+; older Rails keeps the gem's custom #inspect.
+end
+
 module ActionCable
   module Connection
     # # Action Cable Connection Base
@@ -147,11 +153,19 @@ def beat
         transmit type: ActionCable::INTERNAL[:message_types][:ping], message: Time.now.to_i
       end
 
-      def inspect # :nodoc:
-        "#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
+      if defined?(ActiveSupport::InspectBackport)
+        ActiveSupport::InspectBackport.apply(self)
+      else
+        def inspect # :nodoc:
+          "#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
+        end
       end
 
       private
+        def instance_variables_to_inspect # :nodoc:
+          [].freeze
+        end
+
         # The cookies of the request that initiated the WebSocket connection. Useful for performing authorization checks.
         def cookies # :doc:
           request.cookie_jar
diff --git a/lib/action_cable/engine.rb b/lib/action_cable/engine.rb
@@ -12,6 +12,13 @@ class Engine < Rails::Engine # :nodoc:
     config.action_cable.mount_path = ActionCable::INTERNAL[:default_mount_path]
     config.action_cable.precompile_assets = true
 
+    if respond_to?(:guard_load_hooks)
+      guard_load_hooks(
+        :action_cable_channel, :action_cable_connection,
+        :action_cable_test_case, :action_cable_connection_test_case,
+      )
+    end
+
     initializer "action_cable.deprecator", before: :load_environment_config do |app|
       app.deprecators[:action_cable] = ActionCable.deprecator
     end
@@ -83,15 +90,17 @@ class Engine < Rails::Engine # :nodoc:
           end
         end
 
+        app.reloader.before_class_unload do
+          ActionCable.server.restart
+        end
+      end
+
+      ActiveSupport.on_load(:action_cable_channel) do
         wrap = lambda do |_, inner|
           app.executor.wrap(source: "application.action_cable", &inner)
         end
         ActionCable::Channel::Base.set_callback :subscribe, :around, prepend: true, &wrap
         ActionCable::Channel::Base.set_callback :unsubscribe, :around, prepend: true, &wrap
-
-        app.reloader.before_class_unload do
-          ActionCable.server.restart
-        end
       end
     end
 
diff --git a/lib/action_cable/server/base.rb b/lib/action_cable/server/base.rb
@@ -8,9 +8,9 @@ module ActionCable
   module Server
     # A wrapper over ConcurrentRuby::ThreadPoolExecutor and Concurrent::TimerTask
     class ThreadedExecutor # :nodoc:
-      def initialize(max_size: 10)
+      def initialize(max_size: 10, name: "server")
         @executor = Concurrent::ThreadPoolExecutor.new(
-          name: "ActionCable-streamer",
+          name: "ActionCable-#{name}",
           min_threads: 1,
           max_threads: max_size,
           max_queue: 0,
@@ -121,7 +121,7 @@ def worker_pool
 
       # Executor is used by various actions within Action Cable (e.g., pub/sub operations) to run code asynchronously.
       def executor
-        @executor || @mutex.synchronize { @executor ||= ThreadedExecutor.new(max_size: config.executor_pool_size) }
+        @executor || @mutex.synchronize { @executor ||= ThreadedExecutor.new(max_size: config.executor_pool_size, name: "streamer") }
       end
 
       # Adapter used for all streams/broadcasting.
@@ -146,8 +146,9 @@ def new_tagged_logger(request = nil, &block)
       def allow_request_origin?(env)
         return true if config.disable_request_forgery_protection
 
-        proto = Rack::Request.new(env).ssl? ? "https" : "http"
-        if config.allow_same_origin_as_host && env["HTTP_ORIGIN"] == "#{proto}://#{env['HTTP_HOST']}"
+        request = ActionDispatch::Request.new(env)
+        proto = request.ssl? ? "https" : "http"
+        if config.allow_same_origin_as_host && env["HTTP_ORIGIN"] == "#{proto}://#{request.host_with_port}"
           true
         elsif Array(config.allowed_request_origins).any? { |allowed_origin|  allowed_origin === env["HTTP_ORIGIN"] }
           true
diff --git a/lib/action_cable/server/broadcasting.rb b/lib/action_cable/server/broadcasting.rb
@@ -21,12 +21,12 @@ module Server
     #     ActionCable.server.broadcast \
     #       "web_notifications_1", { title: "New things!", body: "All that's fit for print" }
     #
-    #     // Client-side JavaScript, which assumes you've already requested the right to send web notifications:
+    #     # Client-side JavaScript, which assumes you've already requested the right to send web notifications:
     #     App.cable.subscriptions.create("WebNotificationsChannel", {
     #       received: function(data) {
-    #         new Notification(data['title'], { body: data['body'] });
+    #         new Notification(data['title'], { body: data['body'] })
     #       }
-    #     });
+    #     })
     module Broadcasting
       # Broadcast a hash directly to a named `broadcasting`. This will later be JSON
       # encoded.
diff --git a/lib/action_cable/server/socket.rb b/lib/action_cable/server/socket.rb
@@ -2,6 +2,12 @@
 
 require "action_dispatch"
 
+begin
+  require "active_support/inspect_backport"
+rescue LoadError
+  # ActiveSupport::InspectBackport ships only in Rails 8.2+; older Rails keeps the gem's custom #inspect.
+end
+
 module ActionCable
   module Server
     # This class encapsulates all the low-level logic of working with the underlying WebSocket conenctions
@@ -108,11 +114,19 @@ def on_close(reason, code) # :nodoc:
         send_async :handle_close
       end
 
-      def inspect # :nodoc:
-        "#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
+      if defined?(ActiveSupport::InspectBackport)
+        ActiveSupport::InspectBackport.apply(self)
+      else
+        def inspect # :nodoc:
+          "#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
+        end
       end
 
       private
+        def instance_variables_to_inspect # :nodoc:
+          [].freeze
+        end
+
         attr_reader :websocket
         attr_reader :message_buffer
 
diff --git a/lib/action_cable/subscription_adapter/postgresql.rb b/lib/action_cable/subscription_adapter/postgresql.rb
@@ -38,7 +38,7 @@ def shutdown
       def with_subscriptions_connection(&block) # :nodoc:
         # Action Cable is taking ownership over this database connection, and will
         # perform the necessary cleanup tasks.
-        # We purposedly avoid #checkout to not end up with a pinned connection
+        # We purposely avoid #checkout to not end up with a pinned connection
         ar_conn = ActiveRecord::Base.connection_pool.new_connection
         pg_conn = ar_conn.raw_connection
 
diff --git a/test/channel/stream_test.rb b/test/channel/stream_test.rb
@@ -253,7 +253,7 @@ def channel.subscribed
       threads = []
       run_in_eventmachine do
         connection = Connection.new(server, socket)
-        server.pubsub.unsubscribe_latency = 0.1
+        connection.pubsub.unsubscribe_latency = 0.1
 
         channel = ChatChannel.new connection, "{id: 1}", id: 1
         channel.subscribe_to_channel
diff --git a/test/client_test.rb b/test/client_test.rb
@@ -79,6 +79,8 @@ def setup
   end
 
   def with_puma_server(rack_app = ActionCable.server, port = 3099)
+    original_rack_env = ENV["RACK_ENV"]
+
     opts = { min_threads: 1, max_threads: 4 }
     server = if Puma::Const::PUMA_VERSION >= "6"
       opts[:log_writer] = ::Puma::LogWriter.strings
@@ -115,6 +117,8 @@ def with_puma_server(rack_app = ActionCable.server, port = 3099)
         # Handle this as if it were the IOError: do the same as above.
         server.binder.close
       end
+
+      ENV["RACK_ENV"] = original_rack_env
     end
   end
 
diff --git a/test/connection/base_test.rb b/test/connection/base_test.rb
@@ -75,6 +75,11 @@ def disconnect
     assert_equal({ "message" => "hello" }, messages.first)
   end
 
+  test "inspect does not show internals" do
+    connection = open_connection
+    assert_match(/\A#<ActionCable::Connection::BaseTest::Connection:0x[0-9a-f]+>\z/, connection.inspect)
+  end
+
   private
     def open_connection
       server = TestServer.new
diff --git a/test/server/cross_site_forgery_test.rb b/test/server/cross_site_forgery_test.rb
@@ -62,29 +62,65 @@ class Connection < ActionCable::Connection::Base
     assert_origin_not_allowed "http://rails.co.uk"
   end
 
+  test "allow same origin with X-Forwarded-Host" do
+    @server.config.allow_same_origin_as_host = true
+    assert_origin_allowed "http://proxy.example.com", forwarded_host: "proxy.example.com"
+    assert_origin_not_allowed "http://hax.com", forwarded_host: "proxy.example.com"
+  end
+
+  test "X-Forwarded-Host takes precedence over HTTP_HOST for same origin check" do
+    @server.config.allowed_request_origins = []
+    @server.config.allow_same_origin_as_host = true
+    assert_origin_allowed "http://proxy.example.com", forwarded_host: "proxy.example.com"
+    assert_origin_not_allowed "http://#{HOST}", forwarded_host: "proxy.example.com"
+  end
+
+  test "X-Forwarded-Host same origin check uses last host in chain" do
+    @server.config.allowed_request_origins = []
+    @server.config.allow_same_origin_as_host = true
+    assert_origin_allowed "http://proxy2.example.com", forwarded_host: "proxy1.example.com, proxy2.example.com"
+    assert_origin_not_allowed "http://proxy1.example.com", forwarded_host: "proxy1.example.com, proxy2.example.com"
+  end
+
+  test "allow same origin with X-Forwarded-Host and non-standard port" do
+    @server.config.allow_same_origin_as_host = true
+    assert_origin_allowed "http://proxy.example.com:3000", forwarded_host: "proxy.example.com:3000"
+    assert_origin_not_allowed "http://proxy.example.com", forwarded_host: "proxy.example.com:3000"
+  end
+
+  test "allow same origin with X-Forwarded-Proto" do
+    @server.config.allowed_request_origins = []
+    @server.config.allow_same_origin_as_host = true
+    assert_origin_allowed "https://#{HOST}", forwarded_proto: "https"
+    assert_origin_not_allowed "http://#{HOST}", forwarded_proto: "https"
+  end
+
   private
-    def assert_origin_allowed(origin)
-      response = connect_with_origin origin
+    def assert_origin_allowed(origin, **options)
+      response = connect_with_origin origin, **options
       assert_equal(-1, response[0])
     end
 
-    def assert_origin_not_allowed(origin)
-      response = connect_with_origin origin
+    def assert_origin_not_allowed(origin, **options)
+      response = connect_with_origin origin, **options
       assert_equal 404, response[0]
     end
 
-    def connect_with_origin(origin)
+    def connect_with_origin(origin, **options)
       response = nil
 
       run_in_eventmachine do
-        response = ActionCable::Server::Socket.new(@server, env_for_origin(origin)).process
+        response = ActionCable::Server::Socket.new(@server, env_for_origin(origin, **options)).process
       end
 
       response
     end
 
-    def env_for_origin(origin)
-      Rack::MockRequest.env_for "/test", "HTTP_CONNECTION" => "upgrade", "HTTP_UPGRADE" => "websocket", "SERVER_NAME" => HOST,
+    def env_for_origin(origin, forwarded_host: nil, forwarded_proto: nil)
+      env = Rack::MockRequest.env_for "/test", "HTTP_CONNECTION" => "upgrade", "HTTP_UPGRADE" => "websocket", "SERVER_NAME" => HOST,
         "HTTP_HOST" => HOST, "HTTP_ORIGIN" => origin
+      env["HTTP_X_FORWARDED_HOST"] = forwarded_host if forwarded_host
+      env["HTTP_X_FORWARDED_PROTO"] = forwarded_proto if forwarded_proto
+      env
     end
 end
