Update Sinatra to 4.2 and Rack to 3.2

Gemfile

@@ -31,7 +31,7 @@ gem 'redis'
 gem 'rubyzip', '>= 1.3.0'
 gem 'sequel', '~> 5.99'
 gem 'sequel_pg', require: 'sequel'
-gem 'sinatra', '~> 3.2'
+gem 'sinatra', '~> 4.2'
 gem 'sinatra-contrib'
 gem 'statsd-ruby', '~> 1.5.0'
 gem 'steno'
@@ -88,6 +88,7 @@ group :test do
   gem 'rubocop-sequel', '~> 0.4.1'
   gem 'timecop'
   gem 'webmock', '> 2.3.1'
+  gem 'webrick', '~> 1.9.0'
 end
 
 group :development do

Gemfile.lock

@@ -369,17 +369,18 @@ GEM
     puma (7.1.0)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (2.2.21)
-    rack-protection (3.2.0)
+    rack (3.2.4)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
-    rack-session (1.0.2)
-      rack (< 3)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (1.0.1)
-      rack (< 3)
-      webrick
+    rackup (2.3.1)
+      rack (>= 3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -521,16 +522,18 @@ GEM
       json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.2)
-    sinatra (3.2.0)
+    sinatra (4.2.1)
+      logger (>= 1.6.0)
       mustermann (~> 3.0)
-      rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.2.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.2.1)
+      rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (3.2.0)
+    sinatra-contrib (4.2.1)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 3.2.0)
-      sinatra (= 3.2.0)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
       tilt (~> 2.0)
     solargraph (0.57.0)
       backport (~> 1.2)
@@ -673,7 +676,7 @@ DEPENDENCIES
   rubyzip (>= 1.3.0)
   sequel (~> 5.99)
   sequel_pg
-  sinatra (~> 3.2)
+  sinatra (~> 4.2)
   sinatra-contrib
   solargraph
   spork!
@@ -686,6 +689,7 @@ DEPENDENCIES
   uri (~> 1.1)
   vmstat (~> 2.3)
   webmock (> 2.3.1)
+  webrick (~> 1.9.0)
 
 BUNDLED WITH
    2.4.19

app/controllers/internal/app_crashed_controller.rb

@@ -26,7 +26,8 @@ def crashed(lrp_process_guid)
     private
 
     def crashed_request
-      payload = body.read
+      request.body.rewind
+      payload = request.body.read
       Oj.load(payload)
     rescue StandardError => e
       logger.error('diego.app_crashed.parse-error', payload: payload, error: e.to_s)

app/controllers/internal/app_readiness_changed_controller.rb

@@ -25,7 +25,8 @@ def readiness_changed(process_guid)
     private
 
     def readiness_request
-      payload = body.read
+      request.body.rewind
+      payload = request.body.read
       Oj.load(payload)
     rescue StandardError => e
       logger.error('diego.app_readiness_changed.parse-error', payload: payload, error: e.to_s)

app/controllers/internal/app_rescheduling_controller.rb

@@ -25,7 +25,8 @@ def rescheduling(process_guid)
     private
 
     def rescheduling_request
-      payload = body.read
+      request.body.rewind
+      payload = request.body.read
       Oj.load(payload)
     rescue StandardError => e
       logger.error('diego.app_rescheduling.parse-error', payload: payload, error: e.to_s)

app/controllers/internal/staging_completion_controller.rb

@@ -121,7 +121,8 @@ def prometheus_updater
     attr_reader :stagers
 
     def read_body
-      payload          = body.read
+      request.body.rewind
+      payload = request.body.read
       Oj.load(payload, symbol_keys: true)
     rescue StandardError => e
       logger.error('diego.staging.parse-error', payload: payload, error: e.to_s)

app/controllers/internal/task_completion_controller.rb

@@ -25,7 +25,8 @@ def complete_task(task_guid, task_response)
     end
 
     def read_body
-      payload = body.read
+      request.body.rewind
+      payload = request.body.read
       Oj.load(payload, symbol_keys: true)
     rescue StandardError => e
       logger.error('diego.task.parse-error', payload: payload, error: e.to_s)

lib/cloud_controller/logs/steno_io.rb

@@ -8,7 +8,24 @@ def write(str)
     @logger.log(@level, str)
   end
 
+  def puts(*args)
+    args.each { |a| write("#{a}\n") }
+    nil
+  end
+
+  def flush
+    nil
+  end
+
+  def close
+    nil
+  end
+
   def sync
     true
   end
+
+  def to_s
+    @logger.name
+  end
 end

lib/sinatra/vcap.rb

@@ -70,6 +70,7 @@ def vcap_configure(opts={})
         set(:show_exceptions, false)
         set(:raise_errors, false)
         set(:dump_errors, false)
+        set(:host_authorization, permitted_hosts: [])
       end
 
       configure :development do

spec/request/packages_spec.rb

@@ -1194,7 +1194,7 @@
 
       expect(last_response.status).to eq(202)
       expect(last_response.body).to eq('')
-      expect(last_response.header['Location']).to match(%r{jobs/[a-fA-F0-9-]+})
+      expect(last_response.headers['Location']).to match(%r{jobs/[a-fA-F0-9-]+})
       execute_all_jobs(expected_successes: 2, expected_failures: 0)
       get "/v3/packages/#{guid}", {}, user_header
       expect(last_response.status).to eq(404)

spec/support/rspec_api_documentation_patch.rb

@@ -0,0 +1,14 @@
+# Monkey patch to provide a robust read_request_body helper compatible with Rack 3
+# See:
+# https://github.com/zipmark/rspec_api_documentation/pull/550
+# https://github.com/zipmark/rspec_api_documentation/issues/548
+
+module RspecApiDocumentation
+  class ClientBase
+    def read_request_body
+      input = last_request.env['rack.input'] || StringIO.new
+      input.rewind
+      input.read
+    end
+  end
+end

spec/unit/controllers/internal/download_droplets_controller_spec.rb

@@ -64,7 +64,7 @@ def upload_droplet
           get "/internal/v2/droplets/#{process.guid}/#{process.droplet_checksum}/download"
 
           expect(last_response).to be_redirect
-          expect(last_response.header['Location']).to eq(expected_redirect)
+          expect(last_response.headers['Location']).to eq(expected_redirect)
         end
       end
 
@@ -250,7 +250,7 @@ def upload_droplet(target_droplet=droplet)
           get "/internal/v4/droplets/#{process.guid}/#{process.droplet_checksum}/download"
 
           expect(last_response).to be_redirect
-          expect(last_response.header['Location']).to eq('http://example.com/somewhere/else')
+          expect(last_response.headers['Location']).to eq('http://example.com/somewhere/else')
         end
 
         context 'when using with a revision' do
@@ -271,7 +271,7 @@ def upload_droplet(target_droplet=droplet)
             get "/internal/v4/droplets/#{process.guid}/#{new_droplet.checksum}/download"
 
             expect(last_response).to be_redirect
-            expect(last_response.header['Location']).to eq('http://example.com/correct/droplet')
+            expect(last_response.headers['Location']).to eq('http://example.com/correct/droplet')
           end
         end
       end

spec/unit/controllers/runtime/apps_controller_spec.rb

@@ -1818,7 +1818,7 @@ def delete_app
       it 'lets the user download the droplet' do
         get "/v2/apps/#{process.app.guid}/droplet/download", Oj.dump({})
         expect(last_response).to be_redirect
-        expect(last_response.header['Location']).to eq('http://example.com/somewhere/else')
+        expect(last_response.headers['Location']).to eq('http://example.com/somewhere/else')
       end
 
       it 'returns an error for non-existent apps' do

spec/unit/controllers/runtime/buildpack_bits_controller_spec.rb

@@ -316,7 +316,7 @@ module VCAP::CloudController
           authorize(staging_user, staging_password)
           get "/v2/buildpacks/#{test_buildpack.guid}/download"
           expect(last_response.status).to eq(302)
-          expect(last_response.header['Location']).to match(/cc-buildpacks/)
+          expect(last_response.headers['Location']).to match(/cc-buildpacks/)
         end
 
         it 'returns 404 for missing bits' do

spec/unit/controllers/v3/app_features_controller_spec.rb

@@ -148,7 +148,7 @@
         patch :update, params: { app_guid: app_model.guid, name: 'ssh' }, as: :json
       end.not_to(change { app_model.reload.values })
 
-      expect(response).to have_http_status(:unprocessable_entity)
+      expect(response).to have_http_status(:unprocessable_content)
       expect(response).to have_error_message('Enabled must be a boolean')
     end
   end

spec/unit/controllers/v3/application_controller_spec.rb

@@ -362,7 +362,7 @@ def warnings_incorrect_type
       routes.draw { get 'multiple_warnings' => 'anonymous#multiple_warnings' }
       get :multiple_warnings
       expect(response).to have_http_status(:ok)
-      warnings = response.headers['X-Cf-Warnings'].split(',').map { |w| CGI.unescape(w) }
+      warnings = response.headers['X-Cf-Warnings'].map { |w| CGI.unescape(w) }
       expect(warnings).to eq([
         'warning,a',
         'wa,rning b',