Add Rack::Lint to ActionableExceptions tests

actionpack/lib/action_dispatch/http/response.rb

@@ -38,10 +38,14 @@ class Response
       # For `Rack::Headers` (Rack 3+):
       require "rack/headers"
       Headers = ::Rack::Headers
+
+      LOCATION = "location"
     rescue LoadError
       # For `Rack::Utils::HeaderHash`:
       require "rack/utils"
       Headers = ::Rack::Utils::HeaderHash
+
+      LOCATION = "Location"
     end
 
     # To be deprecated:
@@ -81,7 +85,6 @@ def each(&block)
 
     CONTENT_TYPE = "Content-Type"
     SET_COOKIE   = "Set-Cookie"
-    LOCATION     = "Location"
     NO_CONTENT_CODES = [100, 101, 102, 103, 204, 205, 304]
 
     cattr_accessor :default_charset, default: "utf-8"

actionpack/lib/action_dispatch/middleware/actionable_exceptions.rb

@@ -32,13 +32,13 @@ def redirect_to(location)
         if uri.relative? || uri.scheme == "http" || uri.scheme == "https"
           body = ""
         else
-          return [400, { "Content-Type" => "text/plain; charset=utf-8" }, ["Invalid redirection URI"]]
+          return [400, { Rack::CONTENT_TYPE => "text/plain; charset=utf-8" }, ["Invalid redirection URI"]]
         end
 
         [302, {
-          "Content-Type" => "text/html; charset=#{Response.default_charset}",
-          "Content-Length" => body.bytesize.to_s,
-          "Location" => location,
+          Rack::CONTENT_TYPE => "text/html; charset=#{Response.default_charset}",
+          Rack::CONTENT_LENGTH => body.bytesize.to_s,
+          ActionDispatch::Response::LOCATION => location,
         }, [body]]
       end
   end

actionpack/test/dispatch/actionable_exceptions_test.rb

@@ -20,7 +20,11 @@ class ActionError < StandardError
   Noop = -> env { [200, {}, [""]] }
 
   setup do
-    @app = ActionDispatch::ActionableExceptions.new(Noop)
+    @app = Rack::Lint.new(
+      ActionDispatch::ActionableExceptions.new(
+        Rack::Lint.new(Noop),
+      ),
+    )
 
     Actions.clear
   end
@@ -77,4 +81,14 @@ class ActionError < StandardError
       }, headers: { "action_dispatch.show_detailed_exceptions" => true }
     end
   end
+
+  test "catches invalid redirections" do
+    post ActionDispatch::ActionableExceptions.endpoint, params: {
+      error: ActionError.name,
+      action: "Successful action",
+      location: "wss://example.com",
+    }, headers: { "action_dispatch.show_detailed_exceptions" => true }
+
+    assert_equal 400, response.status
+  end
 end