accept_headers 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3e0dda15c77d1bf57df59c16d27f829e3fadf8868f63717e59bd65247b0ec3f
-  data.tar.gz: 0baaeba925e9b4582f43fd3f699ae03debd44a8bb7d31b4b4501f178984ccb2e
+  metadata.gz: a7e488e8a3433dba0966e71c79d189240b68ae10eca39fa21e62e3a4924fcdb9
+  data.tar.gz: cf0955ec1218a983b6b3f79b6ee64255b79094fc6347e07798d20768a9a8ddb9
 SHA512:
-  metadata.gz: b76e1a583842a4952c99b953fa406edc682bd4f5e30eb07f383f07f42cb89b71f4d7b6e31f4010ad1f375406b82ac65b2462b2672529a689e18fd31ed562c9df
-  data.tar.gz: c4920549cbed068d58abec12c24058ea3d8cc8b6c4d6768374f698d7e4f544f4c03c4d831e67b83228b237e0136d384dc9877b9b4c772fa3ce1a48c9419299e1
+  metadata.gz: 56a57c4fc145a17435e6fcd0dfb90c074106161a6fdd7169285b6d9efec29ace5dcd9836434778a546cfe6d698148e3920603fc513b791ef78f8f4954e2dbf0d
+  data.tar.gz: 22f172cc9de919f571279e971b8f3fa740cd964323c4f09068e186a063c32ec898df1f6a5715e31039070eb94cf39e29b22686768208df2519832cdb32547431

data/CHANGELOG.md

@@ -1,4 +1,14 @@
-## 0.2.0 / Unreleased
+## 0.3.0 / October 21, 2026
+
+  * Validate every supported offer before negotiation and raise `AcceptHeaders::InvalidSupportedValue` for invalid application configuration. Supported offers must be concrete values without quality weights; request parsing remains lenient.
+  * Trim surrounding spaces and tabs from supported offers. Language offers such as `" en "` now match where 0.2.0 skipped them.
+  * Add `MediaType#content_type` to serialize response media types with their parameters and without quality weights.
+  * Preserve HTTP parameter bytes through parsing, matching, and response escaping, including ASCII-compatible multibyte headers and supported strings. A backslash byte introduces a quoted pair even within a Ruby multibyte character; this corrects 0.2.0's character-based parsing.
+  * Match identical media parameter bytes across Ruby encoding labels without transcoding. UTF-8, ASCII-8BIT, and ISO-8859-1 strings with the same bytes now match where 0.2.0 could return `nil`; different bytes remain distinct.
+  * Match `charset` parameter values with ASCII-only case folding, without the Unicode case folding used in 0.2.0.
+  * Document supported-value validation and use parameter-preserving response headers in the Rack example.
+
+## 0.2.0 / October 20, 2026
 
   * Replace Travis CI with GitHub Actions covering maintained Ruby 3.3, 3.4, and 4.0, and repair fresh test dependency setup.
   * Follow RFC 9110 negotiation rules and RFC 4647 Basic Filtering for languages.

data/README.md

@@ -4,7 +4,7 @@
 
 AcceptHeaders parses HTTP `Accept`, `Accept-Encoding`, and `Accept-Language` headers and negotiates a match against the representations your application supports. It has no runtime dependencies.
 
-This README describes version 0.2.0. See [Upgrading from 0.1.0 to 0.2.0](#upgrading-from-010-to-020) before updating an existing installation.
+This README describes version 0.3.0. See [Upgrading from 0.2.0 to 0.3.0](#upgrading-from-020-to-030) before updating. For older installations, also see [Upgrading from 0.1.0 to 0.2.0](#upgrading-from-010-to-020).
 
 Negotiation follows [RFC 9110, sections 12.4 and 12.5](https://www.rfc-editor.org/rfc/rfc9110.html#section-12.4). Language matching uses [RFC 4647 Basic Filtering](https://www.rfc-editor.org/rfc/rfc4647.html#section-3.3.1). `Accept-Charset` is not supported because it is deprecated.
 
@@ -15,7 +15,7 @@ CI covers the maintained Ruby series: 3.3, 3.4, and 4.0. Older Ruby versions rem
 Add the gem to your Gemfile and run `bundle install`:
 
 ```ruby
-gem 'accept_headers', '~> 0.2.0'
+gem 'accept_headers', '~> 0.3.0'
 ```
 
 ## Usage
@@ -59,6 +59,12 @@ match.media_range
 # => "application/json"
 match.extensions
 # => { "version" => "2" }
+match.content_type
+# => "application/json;version=2"
+
+response_headers = { 'content-type' => match.content_type }
+response_headers['content-type']
+# => "application/json;version=2"
 
 versions.negotiate('application/json')
 # => nil
@@ -66,7 +72,7 @@ versions.negotiate('application/json')
 
 `#extensions` retains its historical name and contains media parameters. Under RFC 9110, parameters after `q` are also media parameters. Negotiation preserves the selected supported representation's parameters. It does not copy unsupported parameters from the request.
 
-Media type names and parameter names match without regard to case. Parameter values are case-sensitive except for `charset` values. Double-quoted values support commas, semicolons, and backslash escapes. `#to_s` quotes parameter values when needed and writes `q` last.
+Media type names and parameter names match without regard to case. Parameter values are case-sensitive except for `charset` values. Double-quoted values support commas, semicolons, and backslash escapes. `#content_type` includes these parameters without a quality weight, for use in a response's `Content-Type`. `#to_s` quotes parameter values when needed and writes `q` last.
 
 ### Encodings
 
@@ -114,11 +120,19 @@ Use `en` to match English variants. Extended wildcard ranges such as `en-*` are
 
 A `nil` header represents an absent field and allows any supported value. A present empty `Accept` or `Accept-Language` contains no acceptable entries. Empty `Accept-Encoding` allows only identity.
 
-The parsers skip malformed entries. An unterminated quoted string rejects the whole list because its comma boundaries are ambiguous. Apostrophes are token characters, not string delimiters. Headers with an invalid Ruby string encoding are read as raw HTTP bytes. Quoted non-ASCII values are preserved.
+The parsers skip malformed entries. An unterminated quoted string rejects the whole list because its comma boundaries are ambiguous. Apostrophes are token characters, not string delimiters. Headers with an invalid Ruby string encoding are read as raw HTTP bytes. Quoted non-ASCII values are preserved. For headers in ASCII-compatible Ruby encodings, media parameter parsing treats a backslash byte as a quoted-pair escape even when Ruby considers it part of a multibyte character. Headers and supported strings follow the same HTTP byte syntax, without transcoding.
 
 Invalid quality values recover to `0.001`, preserving this library's lenient parsing policy. Missing quality defaults to `1`. Valid quality syntax follows RFC 9110: values range from `0` to `1` with at most three decimal digits, including `0.`, `1.`, and `1.000`. The parameter name `q` is case-insensitive.
 
-`#to_s` produces a normalized preference header, including quality values. Use `#media_range`, `#encoding`, or `#language_tag` when you need the selected value alone. With `==`, objects compare equal only when their class, type-specific fields, and quality values agree. Sorting order does not imply equality.
+`#to_s` produces a normalized preference header, including quality values. Use `#content_type`, `#encoding`, or `#language_tag` for response headers. `#media_range` contains only the media type and subtype, without parameters. With `==`, objects compare equal only when their class, type-specific fields, and quality values agree. Sorting order does not imply equality.
+
+### Supported values
+
+Supported strings must use an ASCII-compatible Ruby encoding. Media parameter parsing, matching, and response escaping interpret them as HTTP bytes, without transcoding. A backslash byte introduces a quoted pair even when Ruby considers it part of a multibyte character. Parameter values compare byte for byte regardless of Ruby encoding labels, except that `charset` ignores ASCII letter case. UTF-8 parameter values retain their encoding; frozen offers are not modified.
+
+`#negotiate` and `#accept?` validate every supported value before matching, even when the request header is empty or an earlier offer matches. Declare concrete media types, coding tokens, or language tags. Wildcards, lists within one string, header name prefixes, quality weights such as `;q=1`, malformed syntax, and non-string values raise `AcceptHeaders::InvalidSupportedValue`, a subclass of `ArgumentError`. Invalid Ruby string encodings and prohibited control characters also raise this error. Quoted media parameter values can contain literal `q=` text.
+
+This error indicates invalid application configuration. A valid offer that the client does not accept still returns `nil` from `#negotiate` and `false` from `#accept?`. Passing `nil` or an empty array declares no offers and returns those same results; an array containing `nil` is invalid. Request header parsing remains lenient as described above.
 
 ## Rack middleware
 
@@ -129,14 +143,14 @@ require 'accept_headers/middleware'
 
 use AcceptHeaders::Middleware
 run lambda { |env|
-	media = env['accept_headers.media_types'].negotiate('application/json')
+	media = env['accept_headers.media_types'].negotiate('application/json;version=2')
 	encoding = env['accept_headers.encodings'].negotiate('identity')
 	language = env['accept_headers.languages'].negotiate(['en-US', 'en-GB'])
 	vary = 'Accept, Accept-Encoding, Accept-Language'
 
 	if media && encoding && language
 		headers = {
-			'content-type' => media.media_range,
+			'content-type' => media.content_type,
 			'content-language' => language.language_tag,
 			'vary' => vary
 		}
@@ -147,7 +161,16 @@ run lambda { |env|
 }
 ```
 
-This example supports an unencoded JSON body in two English locales. It chooses to honor negotiation failures with `406`. Applications can choose a different fallback policy. When request headers influence response selection, set `Vary` so caches distinguish the variants. Rack 3 response header names must be lowercase.
+This example supports version 2 of an unencoded JSON body in two English locales. It chooses to honor negotiation failures with `406`. Applications can choose a different fallback policy. When request headers influence response selection, set `Vary` so caches distinguish the variants. Rack 3 response header names must be lowercase.
+
+## Upgrading from 0.2.0 to 0.3.0
+
+Version 0.3.0 validates supported offers before negotiation and adds response serialization:
+
+- Declare concrete supported values without wildcards, header prefixes, lists within one string, or quality weights. Every invalid offer raises `AcceptHeaders::InvalidSupportedValue`, even if an earlier offer matches. Request parsing remains lenient.
+- Surrounding spaces and tabs are trimmed from supported offers. Language offers such as `" en "` now match where 0.2.0 skipped them.
+- Media parameters follow HTTP byte syntax, including quoted-pair escapes inside Ruby multibyte characters. Identical parameter bytes match across Ruby encoding labels without transcoding. `charset` case folding applies only to ASCII letters.
+- Use `MediaType#content_type` for response headers to retain parameters without a quality weight. `#to_s` still includes quality values, and `#media_range` still omits parameters.
 
 ## Upgrading from 0.1.0 to 0.2.0
 

data/lib/accept_headers/encoding/negotiator.rb

@@ -10,7 +10,7 @@ module AcceptHeaders
       HEADER_PREFIX = 'Accept-Encoding:'
 
       def negotiate(supported)
-        supported = [*supported]
+        supported = validate_supported_values(supported)
         identity = Encoding.new('identity')
         explicit_identity = list.any? { |part| part.encoding == 'identity' }
         candidates = explicit_identity ? supported : supported.reject { |support| identity.match(support) }
@@ -22,6 +22,11 @@ module AcceptHeaders
       end
 
       private
+      def valid_supported_value?(value)
+        match = ENCODING_PATTERN.match(value.b)
+        match && match[:encoding] != '*'
+      end
+
       def parse(header)
         if header && header.sub(/\A#{HEADER_PREFIX}\s*/i, '').strip.empty?
           [Encoding.new('identity')]

data/lib/accept_headers/invalid_supported_value.rb

@@ -0,0 +1,3 @@
+module AcceptHeaders
+  class InvalidSupportedValue < ArgumentError; end
+end

data/lib/accept_headers/language/negotiator.rb

@@ -21,6 +21,10 @@ module AcceptHeaders
       end
 
       private
+      def valid_supported_value?(value)
+        SUPPORTED_LANGUAGE_TAG_PATTERN.match(value.b.strip)
+      end
+
       def no_header
         [Language.new]
       end

data/lib/accept_headers/media_type/negotiator.rb

@@ -17,6 +17,20 @@ module AcceptHeaders
       end
 
       private
+      def valid_supported_value?(value)
+        media_range_string, *parameters = split_quoted(value.b, ';')
+        media_range = MEDIA_TYPE_PATTERN.match(media_range_string)
+        return false unless media_range && media_range[:subtype]
+        return false if media_range[:type] == '*' || media_range[:subtype] == '*'
+        parameters.all? do |parameter|
+          next true if parameter.strip.empty?
+          match = PARAMS_PATTERN.match(parameter)
+          match && match[:attribute].downcase != 'q'
+        end
+      rescue ParseError
+        false
+      end
+
       def no_header
         [MediaType.new]
       end
@@ -49,7 +63,7 @@ module AcceptHeaders
           raise ParseError unless param
           value = param[:value].force_encoding(part.encoding)
           if value.start_with?('"')
-            value = value[1...-1].gsub(/\\(.)/m, '\\1')
+            value = value.b[1...-1].gsub(/\\(.)/m, '\\1').force_encoding(part.encoding)
           end
           extensions[param[:attribute].downcase] = value
         end

data/lib/accept_headers/media_type.rb

@@ -63,17 +63,21 @@ module AcceptHeaders
 
     def to_s
       qvalue = (q == 0 || q == 1) ? q.to_i : q
+      content_type.concat(";q=#{qvalue}")
+    end
+
+    def content_type
       string = media_range
       if extensions.size > 0
         extensions.each do |key, value|
           value = value.to_s
-          unless /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/.match(value)
-            value = '"' + value.gsub(/["\\]/) { |character| "\\#{character}" } + '"'
+          unless /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/.match(value.b)
+            value = '"' + value.b.gsub(/["\\]/) { |character| "\\#{character}" }.force_encoding(value.encoding) + '"'
           end
           string.concat(";#{key}=#{value}")
         end
       end
-      string.concat(";q=#{qvalue}")
+      string
     end
 
     def media_range
@@ -94,6 +98,10 @@ module AcceptHeaders
 
       extensions.all? do |name, value|
         supported_value = candidate.extensions[name]
+        if value.is_a?(String) && supported_value.is_a?(String)
+          value = value.b
+          supported_value = supported_value.b
+        end
         if name == 'charset'
           supported_value && value.casecmp?(supported_value)
         else

data/lib/accept_headers/negotiatable.rb

@@ -1,3 +1,5 @@
+require "accept_headers/invalid_supported_value"
+
 module AcceptHeaders
   module Negotiatable
     class Error < StandardError; end
@@ -7,6 +9,7 @@ module AcceptHeaders
 
     Q_PATTERN = /\A[ \t]*q[ \t]*=[ \t]*(?<q>.*?)[ \t]*\z/im
     QVALUE_PATTERN = /\A(?:0(?:\.[0-9]{0,3})?|1(?:\.0{0,3})?)\z/
+    SUPPORTED_CONTROL_PATTERN = /[\x00-\x08\x0A-\x1F\x7F]/n
 
     def initialize(header)
       header = header.b if header && !header.valid_encoding?
@@ -14,8 +17,9 @@ module AcceptHeaders
     end
 
     def negotiate(supported)
-      candidates = [*supported].each_with_index.map do |support, support_index|
-        matches = list.each_with_index.select { |part, _| part.match(support) }
+      supported = validate_supported_values(supported)
+      candidates = supported.each_with_index.map do |support, support_index|
+        matches = list.each_with_index.select { |part, _| part.match(support.strip) }
         part, header_index = matches.max_by do |match, _|
           [match.specificity, match.q.zero? ? 1 : 0, match.q]
         end
@@ -37,6 +41,23 @@ module AcceptHeaders
     end
 
     private
+    def validate_supported_values(supported)
+      values = if supported.nil?
+        []
+      elsif supported.is_a?(Array)
+        supported
+      else
+        [supported]
+      end
+      values.each do |value|
+        unless value.is_a?(String) && value.valid_encoding? && value.encoding.ascii_compatible? &&
+            !SUPPORTED_CONTROL_PATTERN.match(value.b) && valid_supported_value?(value)
+          raise InvalidSupportedValue, "Invalid supported value: #{value.inspect}"
+        end
+      end
+      values
+    end
+
     def no_header
       raise NotImplementedError.new("#no_header is not implemented")
     end
@@ -68,10 +89,10 @@ module AcceptHeaders
 
     def split_quoted(value, delimiter)
       parts = []
-      part = +""
+      part = +"".b
       quoted = false
       escaped = false
-      value.each_char do |character|
+      value.b.each_char do |character|
         if escaped
           escaped = false
         elsif quoted && character == "\\"
@@ -80,13 +101,14 @@ module AcceptHeaders
           quoted = !quoted
         elsif !quoted && character == delimiter
           parts << part
-          part = +""
+          part = +"".b
           next
         end
         part << character
       end
       raise ParseError if quoted || escaped
       parts << part
+      parts.map { |segment| segment.force_encoding(value.encoding) }
     end
 
     def parse_q(header)

data/lib/accept_headers/version.rb

@@ -1,3 +1,3 @@
 module AcceptHeaders
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/spec/encoding/negotiator_spec.rb

@@ -139,7 +139,7 @@ describe AcceptHeaders::Encoding::Negotiator do
     it "requires supported names to be complete HTTP tokens" do
       negotiator = subject.new('*')
       ['gzip\\bad', 'gzip{bad}', "gzip\nidentity", 'gzip,br'].each do |coding|
-        negotiator.negotiate(coding).must_be_nil
+        assert_raises(AcceptHeaders::InvalidSupportedValue) { negotiator.negotiate(coding) }
       end
     end
   end

data/spec/language/negotiator_spec.rb

@@ -95,9 +95,10 @@ describe AcceptHeaders::Language::Negotiator do
     end
 
     it "requires concrete supported language tags" do
-      ['*', 'en-*', 'en_US', 'en;q=1', nil].each do |support|
-        subject.new('*').accept?(support).must_equal false
+      ['*', 'en-*', 'en_US', 'en;q=1'].each do |support|
+        assert_raises(AcceptHeaders::InvalidSupportedValue) { subject.new('*').accept?(support) }
       end
+      subject.new('*').accept?(nil).must_equal false
     end
 
     it "returns nil when no supported language matches" do

data/spec/malformed_spec.rb

@@ -53,6 +53,63 @@ class MalformedHeaderSpec < Minitest::Test
     assert_equal item.to_h, AcceptHeaders::MediaType::Negotiator.new(item.to_s).list.first.to_h
   end
 
+  def test_multibyte_headers_decode_quoted_pairs_as_http_bytes
+    {
+      [0x95, 0x5c, 0x5c] => [0x95, 0x5c],
+      [0x95, 0x5c, 0x5c, 0x61] => [0x95, 0x5c, 0x61],
+      [0x95, 0x5c, 0x61] => [0x95, 0x61],
+      [0x95, 0x5c, 0x22, 0x61] => [0x95, 0x22, 0x61]
+    }.each do |bytes, expected|
+      wire = 'text/plain;note="'.b + bytes.pack('C*') + '";q=0.8,application/json;q=0.5'
+      header = wire.dup.force_encoding('Shift_JIS').freeze
+      assert header.valid_encoding?
+      binary = AcceptHeaders::MediaType::Negotiator.new(wire)
+      tagged = AcceptHeaders::MediaType::Negotiator.new(header)
+
+      assert_equal binary.list.map(&:media_range), tagged.list.map(&:media_range)
+      assert_equal binary.list.first.extensions['note'].bytes, tagged.list.first.extensions['note'].bytes
+      assert_equal expected, tagged.list.first.extensions['note'].bytes
+      assert_equal [0.8, 0.5], tagged.list.map(&:q)
+      [wire.split(';q=').first, 'text/plain;note="other"', 'application/json'].each do |offer|
+        assert_equal binary.accept?(offer), tagged.accept?(offer)
+        assert_equal [binary.negotiate(offer)&.content_type&.bytes], [tagged.negotiate(offer)&.content_type&.bytes]
+      end
+      assert_equal wire.bytes, header.bytes
+      assert_equal Encoding::Shift_JIS, header.encoding
+    end
+  end
+
+  def test_multibyte_headers_reject_unterminated_http_quoted_pairs
+    ['"', '",application/json'].each do |suffix|
+      wire = 'text/plain;note="'.b + [0x95, 0x5c].pack('C*') + suffix
+      header = wire.dup.force_encoding('Shift_JIS').freeze
+      assert header.valid_encoding?
+
+      [wire, header].each do |input|
+        matcher = AcceptHeaders::MediaType::Negotiator.new(input)
+        assert_empty matcher.list
+        refute matcher.accept?('application/json')
+        assert_nil matcher.negotiate('text/plain')
+      end
+      assert_equal wire.bytes, header.bytes
+    end
+  end
+
+  def test_utf8_header_quoted_pairs_preserve_values_and_encoding
+    header = 'text/plain;note="日本語; café\\"x\\\\y";q=0.8'.freeze
+    tagged = AcceptHeaders::MediaType::Negotiator.new(header)
+    binary = AcceptHeaders::MediaType::Negotiator.new(header.b)
+    item = tagged.list.first
+
+    assert_equal '日本語; café"x\\y', item.extensions['note']
+    assert_equal Encoding::UTF_8, item.extensions['note'].encoding
+    assert_equal 0.8, item.q
+    assert_equal binary.list.first.extensions['note'].bytes, item.extensions['note'].bytes
+    assert_equal item.to_h, AcceptHeaders::MediaType::Negotiator.new(item.to_s).list.first.to_h
+    assert_equal item.content_type, tagged.negotiate(item.content_type).content_type
+    assert_equal Encoding::UTF_8, header.encoding
+  end
+
   def test_invalid_media_ranges_do_not_match_partial_lines_or_non_token_characters
     ['*/json', 'text/html/extra', 'text/ht{ml}', 'text/ht\\ml', "text/html\nnonsense", 'text /html'].each do |range|
       assert_empty AcceptHeaders::MediaType::Negotiator.new(range).list, range

data/spec/media_type_spec.rb

@@ -104,6 +104,84 @@ describe AcceptHeaders::MediaType do
     subject.new('text', 'html', extensions: { 'level' => '1' }).media_range.must_equal "text/html"
   end
 
+  describe "#content_type" do
+    it "outputs type, subtype, and parameters without the quality weight" do
+      media_type = subject.new('text', 'html', q: 0.9, extensions: { 'level' => '1' })
+
+      media_type.content_type.must_equal 'text/html;level=1'
+      media_type.to_s.must_equal 'text/html;level=1;q=0.9'
+      media_type.media_range.must_equal 'text/html'
+    end
+
+    it "does not add a quality parameter when there are no media parameters" do
+      subject.new('application', 'json').content_type.must_equal 'application/json'
+    end
+
+    it "uses the same parameter quoting as the Accept representation" do
+      {
+        'a,b' => '"a,b"',
+        'a;b' => '"a;b"',
+        'a"b' => '"a\\"b"',
+        'a\\b' => '"a\\\\b"',
+        '' => '""',
+        "caf\u00e9" => "\"caf\u00e9\"",
+        "\x80\xFF".b => "\"\x80\xFF\"".b
+      }.each do |parameter, encoded|
+        media_type = subject.new('text', 'plain', extensions: { 'note' => parameter })
+
+        media_type.content_type.must_equal "text/plain;note=#{encoded}"
+        media_type.to_s.must_equal "text/plain;note=#{encoded};q=1"
+      end
+    end
+
+    it "does not mutate the media type or parameter values" do
+      parameter = 'a,b;c"d\\e'.freeze
+      extensions = { 'note' => parameter }.freeze
+      media_type = subject.new('text', 'plain', q: 0.8, extensions: extensions)
+      original = media_type.to_h
+      result = media_type.content_type
+      result.replace('application/json')
+
+      media_type.to_h.must_equal original
+      media_type.extensions.must_equal extensions
+      media_type.content_type.must_equal 'text/plain;note="a,b;c\\"d\\\\e"'
+      media_type.to_s.must_equal 'text/plain;note="a,b;c\\"d\\\\e";q=0.8'
+    end
+  end
+
+  describe "#match" do
+    it "preserves raw comparison for hand-built non-String parameter values" do
+      [2, :public, nil].each do |value|
+        range = subject.new('application', 'json', extensions: { 'version' => value })
+        excluded = subject.new('application', 'json', q: 0, extensions: { 'version' => value })
+
+        ['application/json;version=2', 'application/json;version=public'].each do |candidate|
+          range.match(candidate).must_equal false
+          range.accept?(candidate).must_equal false
+          excluded.reject?(candidate).must_equal false
+        end
+
+        expected = value.nil?
+        range.match('application/json').must_equal expected
+        range.accept?('application/json').must_equal expected
+        excluded.reject?('application/json').must_equal expected
+      end
+    end
+
+    it "folds only ASCII case in charset values" do
+      { 'UTF-8' => 'utf-8', 'É' => 'é', 'K' => 'k' }.each do |value, candidate|
+        range = subject.new('text', 'plain', extensions: { 'charset' => value })
+        excluded = subject.new('text', 'plain', q: 0, extensions: { 'charset' => value })
+        header = "text/plain;charset=\"#{candidate}\""
+        expected = value == 'UTF-8'
+
+        range.match(header).must_equal expected
+        range.accept?(header).must_equal expected
+        excluded.reject?(header).must_equal expected
+      end
+    end
+  end
+
   describe "#accept?" do
     it "matches type and subtype without case sensitivity" do
       subject.new('text', 'html').accept?('TEXT/HTML').must_equal true

data/spec/readme_spec.rb

@@ -36,7 +36,7 @@ class ReadmeSpec < Minitest::Test
 
     response = request.get('/', 'HTTP_ACCEPT' => 'application/json', 'HTTP_ACCEPT_LANGUAGE' => 'en-GB')
     assert_equal 200, response.status
-    assert_equal 'application/json', response['content-type']
+    assert_equal 'application/json;version=2', response['content-type']
     assert_equal 'en-gb', response['content-language']
     assert_equal '{"message":"Hello"}', response.body
     assert_nil response['content-encoding']
@@ -44,6 +44,7 @@ class ReadmeSpec < Minitest::Test
 
     [
       { 'HTTP_ACCEPT' => 'application/xml' },
+      { 'HTTP_ACCEPT' => 'application/json;version=1' },
       { 'HTTP_ACCEPT_ENCODING' => 'identity;q=0' },
       { 'HTTP_ACCEPT_LANGUAGE' => 'fr' }
     ].each do |headers|

data/spec/supported_values_spec.rb

@@ -0,0 +1,158 @@
+require_relative "spec_helper"
+require "open3"
+require "rbconfig"
+
+describe "supported representation validation" do
+  [
+    [AcceptHeaders::MediaType::Negotiator, 'text/plain', '*/*', 'Accept: text/plain'],
+    [AcceptHeaders::Encoding::Negotiator, 'gzip', '*', 'Accept-Encoding: gzip'],
+    [AcceptHeaders::Language::Negotiator, 'en-US', '*', 'Accept-Language: en-US']
+  ].each do |negotiator_class, valid, wildcard, prefixed|
+    describe negotiator_class.name do
+      it "rejects invalid offers before considering any header or other offer" do
+        invalid = [nil, false, 42, Object.new, '', ' ', wildcard, prefixed,
+                   "#{valid},#{valid}", "#{valid};q=1", "#{valid};Q=1",
+                   "#{valid};q=0.5", "#{valid};q=0", "#{valid}\r\n",
+                   "#{valid}\0", "#{valid}\x7f", "#{valid}\v",
+                   "\xff".b.force_encoding('UTF-8'), valid.encode('UTF-16LE')]
+        [nil, '', "#{wildcard};q=0", wildcard].each do |header|
+          negotiator = negotiator_class.new(header)
+          invalid.each do |value|
+            [:negotiate, :accept?].each do |method|
+              assert_raises(AcceptHeaders::InvalidSupportedValue, "#{method}: #{value.inspect}") do
+                negotiator.public_send(method, [valid, value])
+              end
+            end
+          end
+        end
+      end
+
+      it "raises ArgumentError for an invalid standalone offer" do
+        [false, {}, Object.new].each do |offer|
+          assert_raises(AcceptHeaders::InvalidSupportedValue) do
+            negotiator_class.new(wildcard).negotiate(offer)
+          end
+        end
+      end
+
+      it "retains nil and empty arrays as no offers" do
+        [nil, []].each do |supported|
+          negotiator = negotiator_class.new(nil)
+          assert_nil negotiator.negotiate(supported)
+          assert_equal false, negotiator.accept?(supported)
+        end
+      end
+
+      it "rejects objects that convert themselves to offer arrays" do
+        supported = Object.new
+        supported.define_singleton_method(:to_a) { [valid] }
+        assert_raises(AcceptHeaders::InvalidSupportedValue) do
+          negotiator_class.new(nil).negotiate(supported)
+        end
+      end
+
+      it "accepts case and optional whitespace without mutating frozen offers" do
+        offer = " \t#{valid.upcase}\t ".freeze
+        negotiator = negotiator_class.new(wildcard)
+        assert_equal true, negotiator.accept?(offer)
+        assert_equal " \t#{valid.upcase}\t ", offer
+      end
+    end
+  end
+
+  describe "media type syntax" do
+    let(:negotiator) { AcceptHeaders::MediaType::Negotiator.new('*/*') }
+
+    it "rejects incomplete types and malformed parameters throughout the offer" do
+      ['text', 'text/*', '*/plain', 'text/plain/', 'text /plain',
+       'text/plain;note', 'text/plain;note=', 'text/plain;=value',
+       'text/plain;note=two words', 'text/plain;note="unclosed',
+       'text/plain;note="closed"junk', 'text/plain;note="trailing' + "\\",
+       'text/plain;note="valid";broken', 'text/plain; Q = "1"',
+       'text/plain;note="a,b" , application/json', 'text/plain,garbage',
+       "text/plain;note=\"line\nbreak\"", "text/plain;note=\"escaped\\\nbreak\""].each do |offer|
+        assert_raises(AcceptHeaders::InvalidSupportedValue, offer) { negotiator.negotiate(offer) }
+      end
+    end
+
+    it "preserves quoted delimiters, escapes, quality text, and non-ASCII values" do
+      offer = 'Text/Plain;note="a,b;c\\"d\\\\e;q=1";label="café"'.freeze
+      result = negotiator.negotiate(offer)
+      assert_equal 'text/plain', result.media_range
+      assert_equal({'note' => 'a,b;c"d\\e;q=1', 'label' => "caf\u00e9"}, result.extensions)
+    end
+
+    it "preserves quoted obs-text bytes" do
+      offer = "text/plain;note=\"\x80\xff\"".b.freeze
+      result = negotiator.negotiate(offer)
+      assert_equal "\x80\xff".b, result.extensions['note']
+    end
+
+    it "uses HTTP bytes for multibyte offers, quoted pairs, and response escaping" do
+      {
+        [0x95, 0x5c, 0x5c] => [0x95, 0x5c],
+        [0x95, 0x5c, 0x5c, 0x61] => [0x95, 0x5c, 0x61],
+        [0x95, 0x5c, 0x61] => [0x95, 0x61]
+      }.each do |bytes, expected|
+        wire = 'text/plain;note="'.b + bytes.pack('C*') + '"'
+        offer = wire.dup.force_encoding('Shift_JIS').freeze
+        original = offer.dup
+        [nil, '*/*', wire, offer].each do |header|
+          matcher = AcceptHeaders::MediaType::Negotiator.new(header)
+          assert matcher.accept?(offer)
+          result = matcher.negotiate(offer)
+          assert_equal expected, result.extensions['note'].bytes
+          binary_result = negotiator.negotiate(wire)
+          assert_equal binary_result.content_type.bytes, result.content_type.bytes
+          assert_equal binary_result.to_s.bytes, result.to_s.bytes
+          [result.content_type, result.to_s].each do |serialized|
+            reparsed = AcceptHeaders::MediaType::Negotiator.new(serialized.b).list.first
+            assert_equal expected, reparsed.extensions['note'].bytes
+          end
+        end
+        assert_equal original, offer
+        assert_equal original.encoding, offer.encoding
+      end
+    end
+
+    it "compares parameter bytes across encodings without transcoding or Unicode case folding" do
+      offer = 'text/plain;note="café";charset="K"'.freeze
+      labelled_offer = offer.dup.force_encoding('ISO-8859-1').freeze
+      [offer, offer.b, labelled_offer].each do |header|
+        matcher = AcceptHeaders::MediaType::Negotiator.new(header)
+        [offer, offer.b, labelled_offer].each do |supported|
+          result = matcher.negotiate(supported)
+          assert_equal offer.bytes, result.content_type.bytes
+        end
+        refute matcher.accept?('text/plain;note="café";charset=k')
+        refute matcher.accept?(offer.encode('Windows-1252', undef: :replace))
+      end
+      result = negotiator.negotiate(offer)
+      assert_equal Encoding::UTF_8, result.extensions['note'].encoding
+      assert_equal Encoding::UTF_8, result.content_type.encoding
+
+      utf8_offer = 'text/plain;note="café"'.freeze
+      latin1_offer = utf8_offer.encode('ISO-8859-1').freeze
+      [utf8_offer, latin1_offer].each do |header|
+        matcher = AcceptHeaders::MediaType::Negotiator.new(header)
+        other_offer = header.equal?(utf8_offer) ? latin1_offer : utf8_offer
+        assert_nil matcher.negotiate(other_offer)
+        refute matcher.accept?(other_offer)
+      end
+    end
+
+    it "accepts empty parameter segments and empty quoted values" do
+      result = negotiator.negotiate('text/plain; ; note="";;')
+      assert_equal({'note' => ''}, result.extensions)
+    end
+  end
+
+  it "exposes the shared exception through each direct negotiator require" do
+    %w[media_type encoding language].each do |kind|
+      script = "require 'accept_headers/#{kind}/negotiator'; " \
+        "abort unless AcceptHeaders::InvalidSupportedValue < ArgumentError"
+      output, status = Open3.capture2e(RbConfig.ruby, '-Ilib', '-e', script)
+      assert status.success?, output
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: accept_headers
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Jack Chu
@@ -87,6 +87,7 @@ files:
 - lib/accept_headers/acceptable.rb
 - lib/accept_headers/encoding.rb
 - lib/accept_headers/encoding/negotiator.rb
+- lib/accept_headers/invalid_supported_value.rb
 - lib/accept_headers/language.rb
 - lib/accept_headers/language/negotiator.rb
 - lib/accept_headers/media_type.rb
@@ -115,6 +116,7 @@ files:
 - spec/support/media_types/multipart.csv
 - spec/support/media_types/text.csv
 - spec/support/media_types/video.csv
+- spec/supported_values_spec.rb
 homepage: ''
 licenses:
 - MIT
@@ -159,3 +161,4 @@ test_files:
 - spec/support/media_types/multipart.csv
 - spec/support/media_types/text.csv
 - spec/support/media_types/video.csv
+- spec/supported_values_spec.rb