Cherry pick:

1. Minitest module fix in tests
2. standard formatting
3. Logger.broadcast fix for ActiveSupport 7.1

Changes.md

@@ -2,6 +2,12 @@
 
 [Sidekiq Changes](https://github.com/mperham/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/mperham/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/mperham/sidekiq/blob/main/Ent-Changes.md)
 
+6.5.10
+----------
+
+- Web UI DoS vector [#6045] CVE-2023-26141
+- Fix broadcast logger with Rails 7.1 [#6054]
+
 6.5.9
 ----------
 

lib/sidekiq/rails.rb

@@ -62,6 +62,16 @@ def inspect
     config.after_initialize do
       Sidekiq.configure_server do |config|
         config[:reloader] = Sidekiq::Rails::Reloader.new
+
+        # This is the integration code necessary so that if a job uses `Rails.logger.info "Hello"`,
+        # it will appear in the Sidekiq console with all of the job context.
+        unless ::Rails.logger == config.logger || ::ActiveSupport::Logger.logger_outputs_to?(::Rails.logger, $stdout)
+          if ::Rails::VERSION::STRING < "7.1"
+            ::Rails.logger.extend(::ActiveSupport::Logger.broadcast(config.logger))
+          else
+            ::Rails.logger = ::ActiveSupport::BroadcastLogger.new(::Rails.logger, config.logger)
+          end
+        end
       end
     end
   end

lib/sidekiq/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "6.5.9"
+  VERSION = "6.5.10"
 end

test/test_client.rb

@@ -440,15 +440,15 @@ class DWorker < BaseWorker
     end
 
     it "allows sidekiq_options to point to different Redi" do
-      conn = MiniTest::Mock.new
+      conn = Minitest::Mock.new
       conn.expect(:pipelined, [0, 1])
       DWorker.sidekiq_options("pool" => ConnectionPool.new(size: 1) { conn })
       DWorker.perform_async(1, 2, 3)
       conn.verify
     end
 
     it "allows #via to point to same Redi" do
-      conn = MiniTest::Mock.new
+      conn = Minitest::Mock.new
       conn.expect(:pipelined, [0, 1])
       sharded_pool = ConnectionPool.new(size: 1) { conn }
       Sidekiq::Client.via(sharded_pool) do
@@ -462,11 +462,11 @@ class DWorker < BaseWorker
     it "allows #via to point to different Redi" do
       default = Sidekiq::Client.new.redis_pool
 
-      moo = MiniTest::Mock.new
+      moo = Minitest::Mock.new
       moo.expect(:pipelined, [0, 1])
       beef = ConnectionPool.new(size: 1) { moo }
 
-      oink = MiniTest::Mock.new
+      oink = Minitest::Mock.new
       oink.expect(:pipelined, [0, 1])
       pork = ConnectionPool.new(size: 1) { oink }
 
@@ -485,7 +485,7 @@ class DWorker < BaseWorker
     end
 
     it "allows Resque helpers to point to different Redi" do
-      conn = MiniTest::Mock.new
+      conn = Minitest::Mock.new
       conn.expect(:pipelined, []) { |*args, &block| block.call(conn) }
       conn.expect(:zadd, 1, [String, Array])
       DWorker.sidekiq_options("pool" => ConnectionPool.new(size: 1) { conn })

test/test_csrf.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "./helper"
+require_relative "helper"
 require "sidekiq/web/csrf_protection"
 
 describe "Csrf" do

test/test_current_attributes.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "./helper"
+require_relative "helper"
 require "sidekiq/middleware/current_attributes"
 require "sidekiq/fetch"
 

test/test_processor.rb

@@ -156,7 +156,7 @@ def call(worker, item, queue)
     let(:raise_after_yield) { false }
     let(:skip_job) { false }
     let(:worker_args) { ["myarg"] }
-    let(:work) { MiniTest::Mock.new }
+    let(:work) { Minitest::Mock.new }
 
     before do
       work.expect(:queue_name, "queue:default")

test/test_transaction_aware_client.rb

@@ -5,7 +5,7 @@
 require "sidekiq/rails"
 require "sidekiq/transaction_aware_client"
 
-require_relative "./dummy/config/environment"
+require_relative "dummy/config/environment"
 
 class Schema < ActiveRecord::Migration["6.1"]
   def change

test/test_web.rb

@@ -293,7 +293,7 @@ def perform(a, b)
 
     get "/retries"
     assert_equal 200, last_response.status
-    refute_match(/#{params.first['args'][2]}/, last_response.body)
+    refute_match(/#{params.first["args"][2]}/, last_response.body)
   end
 
   it "can delete all retries" do
@@ -313,7 +313,7 @@ def perform(a, b)
 
     get "/queues/default"
     assert_equal 200, last_response.status
-    assert_match(/#{params.first['args'][2]}/, last_response.body)
+    assert_match(/#{params.first["args"][2]}/, last_response.body)
   end
 
   it "can kill a single retry now" do
@@ -324,7 +324,7 @@ def perform(a, b)
 
     get "/morgue"
     assert_equal 200, last_response.status
-    assert_match(/#{params.first['args'][2]}/, last_response.body)
+    assert_match(/#{params.first["args"][2]}/, last_response.body)
   end
 
   it "can display scheduled" do
@@ -370,7 +370,7 @@ def perform(a, b)
 
     get "/queues/default"
     assert_equal 200, last_response.status
-    assert_match(/#{params.first['args'][2]}/, last_response.body)
+    assert_match(/#{params.first["args"][2]}/, last_response.body)
   end
 
   it "can delete a single scheduled job" do
@@ -381,7 +381,7 @@ def perform(a, b)
 
     get "/scheduled"
     assert_equal 200, last_response.status
-    refute_match(/#{params.first['args'][2]}/, last_response.body)
+    refute_match(/#{params.first["args"][2]}/, last_response.body)
   end
 
   it "can delete scheduled" do
@@ -408,7 +408,7 @@ def perform(a, b)
       assert_equal 1, q.size
       get "/queues/default"
       assert_equal 200, last_response.status
-      assert_match(/#{params[0]['args'][2]}/, last_response.body)
+      assert_match(/#{params[0]["args"][2]}/, last_response.body)
     end
   end
 
@@ -423,7 +423,7 @@ def perform(a, b)
 
     get "/queues/default"
     assert_equal 200, last_response.status
-    assert_match(/#{msg['args'][2]}/, last_response.body)
+    assert_match(/#{msg["args"][2]}/, last_response.body)
   end
 
   it "escape job args and error messages" do
@@ -629,7 +629,7 @@ def perform(a, b)
 
       get "/queues/foo"
       assert_equal 200, last_response.status
-      assert_match(/#{params.first['args'][2]}/, last_response.body)
+      assert_match(/#{params.first["args"][2]}/, last_response.body)
     end
   end