addressable 2.9.0 → 2.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ffaab8b78df30a2126058a425f168d76b26bc33e60849cabc1a6beabae24464d
-  data.tar.gz: 841ab2bd18fbcf3ff746cb85ea1661e628e278e6c7bc5ad96cd480e36a54f067
+  metadata.gz: 322c647045515735a4adbd9c7681c7ab0c29b0cf1df4b9893ec5eb7a4c357bba
+  data.tar.gz: 1ddb9d2653a52dc98833f1ff28a849102619c16c752a92b8a6f3a6f1d67ab7c1
 SHA512:
-  metadata.gz: f5884313cb2c68ea73d25e8f7f0a76200030bb3fb7abad8b31532180b1ae3c1df10f8db614a273dba115c87860682d227fdf046c743370e020a577cae667d026
-  data.tar.gz: c97dd91446991ce20400e9b4c2586aefbc1dca9fd1d49efca9606fc505ff0d49807686ab1fdfd7d4dba447c9c4bf8fb6c0bbd5a1d3d69a4952207d035e912dc2
+  metadata.gz: 360a539e633029a58bad0b5173fdaee569c40f2d399dc51254f450dc4cf09f0b1805b2cad7033fd56ade0bf698376dc3be1b737ce0fa19f54a7a11ed6c3cfb0c
+  data.tar.gz: 9ee58aee4c18fb18a1516ac3bb3c85c1bc75804a8720f1719fb1fc66895b0fbaf84bd689b83ec850a52693c3976532bd94a13bdbf7f97fc5c583b2f2cb0d847d

data/CHANGELOG.md

@@ -1,5 +1,102 @@
 # Changelog
 
+## Addressable 2.9.2 <a name="v2.9.2">
+- fixes `Addressable::URI` returning stale values after a component was
+  changed: e.g. after `host=`, `#site`, `#normalized_site`,
+  `#normalized_authority` and `#normalize` could still use the old host, and
+  after `scheme=`, `#normalized_port` could keep a port that's the new
+  scheme's default (#613)
+- fixes `Addressable::URI#normalized_query` reusing the result of an earlier
+  call with different flags: e.g. after `normalized_query(:sorted)`,
+  `normalized_query` and `#normalize` gave a sorted query, and after
+  `normalized_query`, `normalized_query(:sorted)` gave an unsorted one (#608)
+- fixes `Addressable::Template#expand` and `#partial_expand` changing the
+  arrays given as values: e.g. `[1, :a]` became `["1", "a"]`; a frozen array
+  raised `FrozenError`, and an object that responds to `to_ary`
+  raised `TypeError` (#605)
+- fixes `Addressable::URI#clone` sharing component strings with the original:
+  e.g. appending to the clone's `#host` also changed the original's host, but
+  not its cached normalized values; `#dup` already made a separate copy (#617)
+- fixes the pure-Ruby `Addressable::IDNA.to_unicode` raising `ZeroDivisionError`
+  on some malformed labels, e.g. `xn--rp3=`, which also made
+  `Addressable::URI#display_uri` raise, because the Punycode decoder
+  treated punctuation as digits; such labels are now returned unchanged (#614)
+- speeds up the pure-Ruby `Addressable::IDNA.to_unicode`, which became up to
+  25 times slower in 2.9.1 on long labels with many non-ASCII characters;
+  Punycode encoding no longer takes quadratic time (#645)
+- fixes the "character class has duplicated range" warnings that 2.9.1 gave
+  when `Addressable::IDNA` was loaded with warnings enabled
+- fixes the "instance variable @validation_deferred not initialized" warning
+  that 2.9.1 gave for every new `Addressable::URI` on Ruby before 3.0 with
+  warnings enabled, and a "shadowing outer local variable" warning from
+  `Addressable::Template` on Ruby 2.4 and 2.5
+
+## Addressable 2.9.1 <a name="v2.9.1">
+- fixes denial of service in `Addressable::URI.normalize_path`, which took
+  quadratic time on paths with many dot segments; `URI#normalize`, `#join`,
+  `#==` and `#===` were affected (GHSA-qq38-m9mg-xjj5)
+- fixes `Addressable::URI.normalize_path` keeping segments that a `..` should
+  have removed after a `..` above the root, e.g.
+  `/../../public/x/../../secret` normalized to `/public/x/secret` instead of
+  `/secret` (GHSA-8gmh-2hhj-2hv9)
+- fixes `Addressable::URI.normalize_path` treating a raw line feed as a
+  segment boundary, e.g. joining `..\n/secret` onto `/public/` gave
+  `/\n/secret`
+- deprecates `Addressable::URI::RULE_2A`, `RULE_2B_2C`, `RULE_2D` and
+  `RULE_PREFIXED_PARENT`, which are no longer used; they will be removed in
+  2.10.0
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which still backtracked exponentially in 2.9.0 for exploded `/`, `.`, `;`,
+  `?` and `&` expressions (e.g. `{/path*}`) on regex engines without match
+  memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results
+  are unchanged (GHSA-j82w-28jv-3pmj)
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which backtracked polynomially or exponentially on the same regex engines
+  for expressions with several variables (e.g. `{/owner,repo,ref}`, or
+  `{+a,b,c}` with many variables), for `;` expressions, and for adjacent
+  expressions (e.g. `{+a}{+b}{+c}` or `{+a}{b}`); match results are unchanged
+  (GHSA-9f42-57jx-vpp3)
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which backtracked polynomially for expressions with several exploded
+  variables (e.g. `{+a*,b*}`), including on MRI 3.2; match results are
+  unchanged (GHSA-4w5q-wg7v-w6gp)
+- fixes `Addressable::IDNA.to_unicode` in the pure-Ruby backend decoding
+  Punycode labels that aren't valid A-labels: labels that decode to only
+  ASCII characters (e.g. `xn--google-` decoded to `google`) and labels that
+  don't convert back to themselves; such a label is now returned unchanged,
+  as with libidn, so `Addressable::URI#display_uri` no longer shows a host
+  that differs from `#normalized_host` (GHSA-9crm-g4mf-wc5j)
+- fixes `Addressable::IDNA.to_unicode` decoding Punycode labels with
+  characters that change how a host displays without being visible
+  themselves, such as bidi overrides and isolates (e.g. U+202E and U+2066),
+  zero width characters and control characters; such a label is now
+  returned unchanged, so `Addressable::URI#display_uri` no longer shows
+  them. The pure-Ruby backend also no longer decodes labels with other
+  characters that nameprep prohibits, as with libidn (GHSA-539f-xcgw-2gjg)
+- fixes `Addressable::URI#route_from` and `#route_to` raising
+  `InvalidURIError` when the route's first segment contains a colon
+  (e.g. `/a:b` from `/a`); the route is now `./a:b` ([#625])
+- fixes `Addressable::IDNA.to_unicode` raising in the pure-Ruby backend for
+  Punycode labels that are too long, overflow the decoder, or decode past
+  U+10FFFF; the label is now returned unchanged, as with libidn, so
+  `Addressable::URI#display_uri` no longer raises for such hosts ([#620])
+- fixes `Addressable::URI#display_uri` raising `InvalidURIError` for URIs
+  without a host, such as `abc` or `mailto:user@example.com`; relative URIs
+  are also no longer displayed with an empty authority (e.g. `/path/to` was
+  displayed as `///path/to`) ([#610])
+- fixes `Addressable::Template#match` and `#extract` raising
+  `Addressable::URI::InvalidURIError` for a string that isn't a valid URI;
+  they now return `nil`, as for any other URI that doesn't match ([#621])
+- fixes `Addressable::URI#origin=` raising `InvalidURIError` for an origin
+  with an empty port (e.g. `http://example.com:`), which is the same as no
+  port ([#627])
+
+[#610]: https://github.com/sporkmonger/addressable/pull/610
+[#620]: https://github.com/sporkmonger/addressable/pull/620
+[#621]: https://github.com/sporkmonger/addressable/pull/621
+[#625]: https://github.com/sporkmonger/addressable/pull/625
+[#627]: https://github.com/sporkmonger/addressable/pull/627
+
 ## Addressable 2.9.0 <a name="v2.9.0">
 - fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete
   remediation in 2.8.10)

data/lib/addressable/idna/native.rb

@@ -51,10 +51,20 @@ module Addressable
       end.join('.')
     end
 
+    # Characters that change how a label displays without being visible
+    # themselves: controls, format characters such as bidi overrides and
+    # isolates, and default ignorable code points. libidn rejects most of
+    # them, but not those added to Unicode after the version it checks
+    # against, such as U+2066 to U+2069. Format characters that are also
+    # default ignorable are left out of the second set, since Ruby warns about
+    # a duplicated range in a character class.
+    DISPLAY_CHANGING = /[\p{Cc}\p{Cf}[\p{Default_Ignorable_Code_Point}&&\P{Cf}]]/
+
     def self.to_unicode(value)
       value.to_s.split('.', -1).map do |segment|
         if segment.size > 0 && segment.size < 64
-          IDN::Idna.toUnicode(segment, IDN::Idna::ALLOW_UNASSIGNED)
+          decoded = IDN::Idna.toUnicode(segment, IDN::Idna::ALLOW_UNASSIGNED)
+          decoded =~ DISPLAY_CHANGING ? segment : decoded
         elsif segment.size >= 64
           segment
         else

data/lib/addressable/idna/pure.rb

@@ -55,6 +55,45 @@ module Addressable
       | \xF4[\x80-\x8F][\x80-\xBF]{2}       # plane 16
       )/mnx
 
+    # Characters that nameprep doesn't allow in a label (Section 5 of
+    # RFC 3491), or that it maps to nothing, so they can't be in a label that
+    # toASCII produces. Some code points are in more than one table; they're
+    # listed only under the first, since Ruby warns about a duplicated range
+    # in a character class.
+    NAMEPREP_PROHIBITED = Regexp.new("[" + [
+      # Table C.1.2, non-ASCII space characters
+      "\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000",
+      # Table C.2.2, non-ASCII control characters
+      "\u0080-\u009F\u06DD\u070F\u180E\u200C\u200D\u2028\u2029" +
+        "\u2060-\u2063\u206A-\u206F\uFEFF\uFFF9-\uFFFC\u{1D173}-\u{1D17A}",
+      # Table C.3, private use
+      "\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}",
+      # Table C.4, non-character code points
+      "\uFDD0-\uFDEF" + (0..16).map do |plane|
+        [plane * 0x10000 + 0xFFFE, 0x2D, plane * 0x10000 + 0xFFFF].pack("U*")
+      end.join,
+      # Table C.6, inappropriate for plain text (U+FFF9 to U+FFFC are in C.2.2)
+      "\uFFFD",
+      # Table C.7, inappropriate for canonical representation
+      "\u2FF0-\u2FFB",
+      # Table C.8, change display properties or are deprecated (U+206A to
+      # U+206F are in C.2.2)
+      "\u0340\u0341\u200E\u200F\u202A-\u202E",
+      # Table C.9, tagging characters
+      "\u{E0001}\u{E0020}-\u{E007F}",
+      # Table B.1, commonly mapped to nothing (U+200B is in C.1.2, and U+200C,
+      # U+200D, U+2060 and U+FEFF are in C.2.2)
+      "\u00AD\u034F\u1806\u180B-\u180D\uFE00-\uFE0F"
+    ].join + "]")
+
+    # Characters that change how a label displays without being visible
+    # themselves: controls, format characters such as bidi overrides and
+    # isolates, and default ignorable code points, including those added to
+    # Unicode after the version nameprep is based on. Format characters that
+    # are also default ignorable are left out of the second set, since Ruby
+    # warns about a duplicated range in a character class.
+    DISPLAY_CHANGING = /[\p{Cc}\p{Cf}[\p{Default_Ignorable_Code_Point}&&\P{Cf}]]/
+
     # :startdoc:
 
     # Converts from a Unicode internationalized domain name to an ASCII
@@ -91,8 +130,22 @@ module Addressable
       parts.map! do |part|
         if part =~ /^#{ACE_PREFIX}(.+)/
           begin
-            punycode_decode(part[/^#{ACE_PREFIX}(.+)/, 1])
-          rescue Addressable::IDNA::PunycodeBadInput
+            decoded = punycode_decode(part[/^#{ACE_PREFIX}(.+)/, 1])
+            # A label that doesn't convert back to itself isn't a valid
+            # A-label (Section 4.2 of RFC 3490, steps 6 and 7). That includes
+            # a label that decodes to only ASCII characters. A label with a
+            # character that would change how it displays is returned
+            # unchanged too.
+            if to_ascii(decoded).downcase != part.downcase ||
+                decoded =~ NAMEPREP_PROHIBITED || decoded =~ DISPLAY_CHANGING
+              part
+            else
+              decoded
+            end
+          rescue Addressable::IDNA::PunycodeBadInput,
+                 Addressable::IDNA::PunycodeBigOutput,
+                 Addressable::IDNA::PunycodeOverflow,
+                 RangeError, ArgumentError
             # toUnicode is explicitly defined as never-fails by the spec
             part
           end
@@ -4418,50 +4471,50 @@ module Addressable
     def self.punycode_encode(unicode)
       unicode = unicode.to_s unless unicode.is_a?(String)
       input = unicode.unpack("U*")
-      output = [0] * (ACE_MAX_LENGTH + 1)
-      input_length = input.size
-      output_length = [ACE_MAX_LENGTH]
+      output = []
+      max_out = ACE_MAX_LENGTH
 
-      # Initialize the state
-      n = PUNYCODE_INITIAL_N
-      delta = out = 0
-      max_out = output_length[0]
-      bias = PUNYCODE_INITIAL_BIAS
+      # The positions of each non-basic code point, and a Fenwick tree of
+      # the positions of the code points handled so far, so that counting
+      # the handled code points before a position doesn't take a pass over
+      # the input.
+      positions = {}
+      handled = Array.new(input.size + 1, 0)
 
       # Handle the basic code points:
-      input_length.times do |j|
-        if punycode_basic?(input[j])
-          if max_out - out < 2
+      input.each_with_index do |codepoint, j|
+        if punycode_basic?(codepoint)
+          if max_out - output.size < 2
             raise PunycodeBigOutput,
               "Output would exceed the space provided."
           end
-          output[out] = input[j]
-          out += 1
+          output << codepoint
+          handled[j + 1] = 1
+        else
+          (positions[codepoint] ||= []) << j
         end
       end
+      (1..input.size).each do |i|
+        parent = i + (i & -i)
+        handled[parent] += handled[i] if parent <= input.size
+      end
 
-      h = b = out
+      h = b = output.size
 
       # h is the number of code points that have been handled, b is the
-      # number of basic code points, and out is the number of characters
-      # that have been output.
+      # number of basic code points, and output.size is the number of
+      # characters that have been output.
 
-      if b > 0
-        output[out] = PUNYCODE_DELIMITER
-        out += 1
-      end
+      output << PUNYCODE_DELIMITER if b > 0
 
-      # Main encoding loop:
+      # Main encoding loop: handle each non-basic code point in ascending
+      # order.
 
-      while h < input_length
-        # All non-basic code points < n have been
-        # handled already.  Find the next larger one:
-
-        m = PUNYCODE_MAXINT
-        input_length.times do |j|
-          m = input[j] if (n...m) === input[j]
-        end
+      n = PUNYCODE_INITIAL_N
+      delta = 0
+      bias = PUNYCODE_INITIAL_BIAS
 
+      positions.keys.sort.each do |m|
         # Increase delta enough to advance the decoder's
         # <n,i> state to <m,0>, but guard against overflow:
 
@@ -4471,47 +4524,56 @@ module Addressable
         delta += (m - n) * (h + 1)
         n = m
 
-        input_length.times do |j|
-          # Punycode does not need to check whether input[j] is basic:
-          if input[j] < n
-            delta += 1
-            if delta == 0
-              raise PunycodeOverflow,
-                "Input needs wider integers to process."
-            end
+        # Each occurrence of n adds the handled code points since the last
+        # one, which RFC 3492 counts as code points less than n.
+        handled_before_pass = h
+        counted = 0
+        positions[n].each do |position|
+          before = 0
+          i = position
+          while i > 0
+            before += handled[i]
+            i -= i & -i
           end
+          delta += before - counted
+          counted = before
 
-          if input[j] == n
-            # Represent delta as a generalized variable-length integer:
+          # Represent delta as a generalized variable-length integer:
 
-            q = delta; k = PUNYCODE_BASE
-            while true
-              if out >= max_out
-                raise PunycodeBigOutput,
-                  "Output would exceed the space provided."
-              end
-              t = (
-                if k <= bias
-                  PUNYCODE_TMIN
-                elsif k >= bias + PUNYCODE_TMAX
-                  PUNYCODE_TMAX
-                else
-                  k - bias
-                end
-              )
-              break if q < t
-              output[out] =
-                punycode_encode_digit(t + (q - t) % (PUNYCODE_BASE - t))
-              out += 1
-              q = (q - t) / (PUNYCODE_BASE - t)
-              k += PUNYCODE_BASE
+          q = delta; k = PUNYCODE_BASE
+          while true
+            if output.size >= max_out
+              raise PunycodeBigOutput,
+                "Output would exceed the space provided."
             end
+            t = (
+              if k <= bias
+                PUNYCODE_TMIN
+              elsif k >= bias + PUNYCODE_TMAX
+                PUNYCODE_TMAX
+              else
+                k - bias
+              end
+            )
+            break if q < t
+            output <<
+              punycode_encode_digit(t + (q - t) % (PUNYCODE_BASE - t))
+            q = (q - t) / (PUNYCODE_BASE - t)
+            k += PUNYCODE_BASE
+          end
+
+          output << punycode_encode_digit(q)
+          bias = punycode_adapt(delta, h + 1, h == b)
+          delta = 0
+          h += 1
+        end
+        delta += handled_before_pass - counted
 
-            output[out] = punycode_encode_digit(q)
-            out += 1
-            bias = punycode_adapt(delta, h + 1, h == b)
-            delta = 0
-            h += 1
+        positions[n].each do |position|
+          i = position + 1
+          while i <= input.size
+            handled[i] += 1
+            i += i & -i
           end
         end
 
@@ -4519,20 +4581,7 @@ module Addressable
         n += 1
       end
 
-      output_length[0] = out
-
-      outlen = out
-      outlen.times do |j|
-        c = output[j]
-        unless c >= 0 && c <= 127
-          raise StandardError, "Invalid output char."
-        end
-        unless PUNYCODE_PRINT_ASCII[c]
-          raise PunycodeBadInput, "Input is invalid."
-        end
-      end
-
-      output[0..outlen].map { |x| x.chr }.join("").sub(/\0+\z/, "")
+      output.pack("C*").force_encoding(Encoding::US_ASCII)
     end
     private_class_method :punycode_encode
 
@@ -4677,11 +4726,11 @@ module Addressable
     # (for use in representing integers) in the range 0 to
     # base - 1, or PUNYCODE_BASE if codepoint does not represent a value.
     def self.punycode_decode_digit(codepoint)
-      if codepoint - 48 < 10
+      if codepoint >= 48 && codepoint <= 57
         codepoint - 22
-      elsif codepoint - 65 < 26
+      elsif codepoint >= 65 && codepoint <= 90
         codepoint - 65
-      elsif codepoint - 97 < 26
+      elsif codepoint >= 97 && codepoint <= 122
         codepoint - 97
       else
         PUNYCODE_BASE

data/lib/addressable/template.rb

@@ -413,15 +413,25 @@ module Addressable
     #   match.captures
     #   #=> ["a", ["b", "c"]]
     def match(uri, processor=nil)
-      uri = Addressable::URI.parse(uri) unless uri.is_a?(Addressable::URI)
+      unless uri.is_a?(Addressable::URI)
+        begin
+          uri = Addressable::URI.parse(uri)
+        rescue Addressable::URI::InvalidURIError
+          # Per the documented contract, match returns nil for any input
+          # that doesn't match the template - including a string that
+          # isn't even a valid URI.
+          return nil
+        end
+      end
       mapping = {}
 
       # First, we need to process the pattern, and extract the values.
       expansions, expansion_regexp =
         parse_template_pattern(pattern, processor)
 
-      return nil unless uri.to_str.match(expansion_regexp)
-      unparsed_values = uri.to_str.scan(expansion_regexp).flatten
+      matched = uri.to_str.match(expansion_regexp)
+      return nil unless matched
+      unparsed_values = matched.captures
 
       if uri.to_str == pattern
         return Addressable::Template::MatchData.new(uri, self, mapping)
@@ -900,7 +910,7 @@ module Addressable
     def normalize_value(value)
       # Handle unicode normalization
       if value.respond_to?(:to_ary)
-        value.to_ary.map! { |val| normalize_value(val) }
+        value = value.to_ary.map { |val| normalize_value(val) }
       elsif value.kind_of?(Hash)
         value = value.inject({}) { |acc, (k, v)|
           acc[normalize_value(k)] = normalize_value(v)
@@ -958,6 +968,77 @@ module Addressable
       end
     end
 
+    ##
+    # Describes what follows each expression in a template pattern.
+    #
+    # @param [String] escaped_pattern The escaped URI template pattern.
+    #
+    # @return [Array<Array>] For each expression, the <tt>MatchData</tt> of
+    #   the expression directly after it (or <tt>nil</tt>), and whether the
+    #   text after it could start with a comma.
+    def expression_followers(escaped_pattern)
+      expressions = escaped_pattern.to_enum(:scan, EXPRESSION).map do
+        Regexp.last_match
+      end
+      expressions.each_with_index.map do |current, index|
+        following = expressions[index + 1]
+        following = nil unless following && following.begin(0) == current.end(0)
+        # Expressions can match nothing, so look past any that can't start
+        # with a comma.
+        position = current.end(0)
+        comma = expressions[(index + 1)..-1].any? do |later|
+          break false unless later.begin(0) == position
+          position = later.end(0)
+          may_start_with_comma?(later[1], later[2])
+        end
+        [following, comma || escaped_pattern[position] == ',']
+      end
+    end
+
+    ##
+    # Whether an expression could match a string that starts with a comma.
+    #
+    # @param [String, nil] operator The expression's operator.
+    # @param [String] varlist The expression's variable list.
+    #
+    # @return [TrueClass, FalseClass]
+    def may_start_with_comma?(operator, varlist)
+      return false unless LEADERS.fetch(operator, '').empty?
+      operator == '+' || !(varlist =~ VARSPEC && $2 != '*')
+    end
+
+    ##
+    # Whether an expression, followed directly by another one, could only
+    # match characters that the other one could also match, in any amount.
+    #
+    # @param [MatchData] following The expression that follows.
+    # @param [String, nil] operator The operator of the first expression.
+    # @param [Array<String>] varspecs The varspecs of the first expression.
+    #
+    # @return [TrueClass, FalseClass]
+    def absorbed_by?(following, operator, varspecs)
+      last = following[2].split(',').last
+      case following[1]
+      when '+'
+        # An unexploded last variable matches any characters that an
+        # expression can, and can end anywhere.
+        last[VARSPEC, 2] != '*'
+      when nil
+        if last[VARSPEC, 2] == '*'
+          # Matches any unreserved characters and commas.
+          operator.nil? || operator == '.'
+        elsif following[2] == last
+          # Matches any unreserved characters.
+          operator == '.' || (operator.nil? && varspecs.size == 1 &&
+            varspecs.first[VARSPEC, 2] != '*')
+        else
+          false
+        end
+      else
+        false
+      end
+    end
+
     ##
     # Generates the <tt>Regexp</tt> that parses a template pattern.
     #
@@ -978,20 +1059,36 @@ module Addressable
       end
 
       expansions = []
+      # Processor patterns can match anything, so they get 2.9.0's choices.
+      plain_processor = !(processor && processor.respond_to?(:match))
+      followers = expression_followers(escaped_pattern)
 
       # Create a regular expression that captures the values of the
       # variables in the URI.
       regexp_string = escaped_pattern.gsub( EXPRESSION ) do |expansion|
 
+        index = expansions.size
         expansions << expansion
         _, operator, varlist = *expansion.match(EXPRESSION)
         leader = Regexp.escape(LEADERS.fetch(operator, ''))
         joiner = Regexp.escape(JOINERS.fetch(operator, ','))
         varspecs = varlist.split(',')
-        combined = varspecs.map do |varspec|
+        results = varspecs.map do |varspec|
+          name = varspec[VARSPEC, 1]
+          processor && processor.respond_to?(:match) ? processor.match(name) : nil
+        end
+        # Without processor patterns, any variable in the expression can take
+        # the characters that an earlier variable leaves, which lets the
+        # variables after the first one have fewer choices below.
+        plain = results.compact.empty?
+        explodes = varspecs.map { |varspec| varspec[VARSPEC, 2] == '*' }
+        first_explode = explodes.index(true)
+        not_after_value =
+          "(?<![#{Addressable::URI::CharacterClasses::UNRESERVED}])"
+        combined = varspecs.each_with_index.map do |varspec, position|
           _, name, modifier = *varspec.match(VARSPEC)
 
-          result = processor && processor.respond_to?(:match) ? processor.match(name) : nil
+          result = results[position]
           if result
             "(?<#{name}>#{ result })"
           else
@@ -1005,7 +1102,9 @@ module Addressable
             when '.'
               "#{ UNRESERVED.gsub('\.', '') }*?"
             when ';'
-              "#{ UNRESERVED }*=?#{ UNRESERVED }*?"
+              # The same strings, tried in the same order, as 2.9.0's
+              # "U*=?U*?", but a name without "=" can only match one way.
+              "(?:#{UNRESERVED}*=#{UNRESERVED}*?|#{UNRESERVED}*)"
             when '?'
               "#{ UNRESERVED }*=#{ UNRESERVED }*?"
             when '&'
@@ -1014,20 +1113,117 @@ module Addressable
               "#{ UNRESERVED }*?"
             end
             if modifier == '*'
+              # The ; ? and & members match the same strings, in the same
+              # order of preference, as 2.9.0's members joined by an optional
+              # joiner, but each character can only belong to one member.
               seg = case operator
                     when '+', '#' then "#{RESERVED_NO_COMMA}*+"
+                    when ';' then "(?:#{UNRESERVED}|=)*"
+                    when '?', '&'
+                      "#{UNRESERVED}*=(?:#{UNRESERVED}*=)*#{UNRESERVED}*?"
                     else group
                     end
-              joiner_pattern = operator.nil? ? joiner : "#{joiner}?"
-              "(?<#{name}>#{seg}(?:#{joiner_pattern}#{seg})*)?"
+              # The joiner between exploded members must be mandatory. With
+              # an optional joiner, a run of members can be partitioned in
+              # exponentially many ways, which backtracks catastrophically on
+              # engines without match memoization (MRI < 3.2, JRuby,
+              # TruffleRuby).
+              value = "#{seg}(?:#{joiner}#{seg})*"
+            end
+            if plain && first_explode && position > first_explode &&
+                (operator == '+' || operator == '#' || operator == ';')
+              # Exploded values were tried longest first, so whatever this
+              # variable could match after the first exploded one, that one
+              # already tried matching itself. Only the last unexploded + or
+              # # variable can stop inside a member, where an exploded
+              # variable can't. As in 2.9.0, a variable is the last one if
+              # its varspec is the same as the last varspec.
+              if operator == ';'
+                "(?<#{name}>)"
+              elsif modifier != '*' && varspec == varspecs.last
+                "(?<#{name}>#{RESERVED_NO_COMMA}*?)?"
+              else
+                # 2.9.0 skipped the variable when it couldn't be empty.
+                "(?:(?<#{name}>)(?!#{RESERVED_NO_COMMA}))?"
+              end
+            elsif plain && modifier == '*' && explodes[(position + 1)..-1].any? &&
+                (operator.nil? || operator == '/' || operator == '.')
+              # Exploded values were tried shortest first, and a later
+              # exploded variable can match whatever this one leaves, so once
+              # a split fails, every split where this variable is longer
+              # fails too. Of the values tried, only the leading joiners are
+              # shorter than every value tried before them.
+              "(?<#{name}>(?:#{joiner})*)"
+            elsif plain && position > 0 && explodes[position - 1] &&
+                (operator == '?' || operator == '&')
+              # Whatever this variable could match after an exploded one,
+              # that one already tried matching itself, unless it couldn't:
+              # an exploded member can't be empty, so this variable may only
+              # start right after an empty one.
+              "(?<#{name}>(?<=#{leader}#{joiner}|#{joiner}#{joiner})" \
+                "#{value || group})?"
+            elsif operator == ';' && plain && position > 0
+              # Values were tried longest first, and splitting an earlier
+              # variable's run of characters with this one never gave a
+              # different result, so this one may only start after that run.
+              "(?<#{name}>(?:#{not_after_value}#{value || group})?)"
+            elsif modifier == '*'
+              "(?<#{name}>#{value})?"
             elsif varspecs.size > 1 && (operator == '+' || operator == '#') &&
                   varspec != varspecs.last
               "(?<#{name}>#{RESERVED_NO_COMMA}*+)?"
+            elsif plain && position < varspecs.size - 1 &&
+                  (operator.nil? || operator == '/' || operator == '.')
+              # Values were tried shortest first, so a run of characters
+              # without a joiner went to a later variable. The only other
+              # value that could change the result is the whole run up to the
+              # next joiner.
+              "(?<#{name}>(?:#{group}(?=#{joiner}))??)"
             else
               "(?<#{name}>#{group})?"
             end
           end
-        end.join("#{joiner}?")
+        end
+        following, comma_follows = followers[index]
+        single = varspecs.size == 1 && varspecs.first[VARSPEC, 2] != '*'
+        if plain_processor && following &&
+            absorbed_by?(following, operator, varspecs)
+          # Each expression tried its empty alternative first. When the next
+          # one follows it directly and can match anything it could, followed
+          # by anything the next one could match on its own, every other
+          # choice ends where the empty one can also end, so the empty
+          # alternative always gave the first match.
+          leader = "(?!)#{leader}"
+          combined = combined.join("#{joiner}?")
+        elsif plain_processor && single && following &&
+            following[1].nil? && following[2] =~ VARSPEC && $2 != '*' &&
+            (operator == '+' || operator == '#')
+          # Values were tried shortest first, and the next expression can
+          # match any unreserved characters, so the value only needs to end
+          # after a character that the next expression couldn't match.
+          combined = "(?<#{varspecs.first[VARSPEC, 1]}>" \
+            "#{RESERVED}*?#{not_after_value})?"
+        elsif plain && varspecs.size > 1 &&
+            (operator == '+' || operator == '#') &&
+            !comma_follows &&
+            varspecs.none? { |varspec| varspec[VARSPEC, 2] == '*' } &&
+            !varspecs[0...-1].include?(varspecs.last)
+          # 2.9.0 tried each value with the joiner after it first, then the
+          # value on its own, then skipping the variable, and every other
+          # choice gave a value to a later variable that an earlier one had
+          # already been tried with. A variable after a skipped one is
+          # skipped too. Stopping before a joiner is left out, so this is
+          # only used when no joiner can follow the expression. As in 2.9.0,
+          # a variable is the last one if its varspec is the same as the
+          # last varspec.
+          nested = varspecs[0...-1].reverse.inject("") do |inner, varspec|
+            "(?:(?<#{varspec[VARSPEC, 1]}>#{RESERVED_NO_COMMA}*+)" \
+              "#{joiner}?+#{inner}|(?=#{RESERVED_NO_COMMA}))"
+          end
+          combined = nested + combined.last
+        else
+          combined = combined.join("#{joiner}?")
+        end
         "(?:|#{leader}#{combined})"
       end
 

data/lib/addressable/uri.rb

@@ -928,6 +928,11 @@ module Addressable
 
       # Reset dependent values
       @normalized_scheme = NONE
+      @normalized_user = NONE
+      @normalized_password = NONE
+      @normalized_userinfo = NONE
+      @normalized_port = NONE
+      @normalized_path = nil
       remove_composite_values
 
       # Ensure we haven't created an invalid URI
@@ -983,6 +988,7 @@ module Addressable
       @normalized_userinfo = NONE
       @authority = nil
       @normalized_user = NONE
+      @normalized_password = NONE
       remove_composite_values
 
       # Ensure we haven't created an invalid URI
@@ -1038,6 +1044,7 @@ module Addressable
       @normalized_userinfo = NONE
       @authority = nil
       @normalized_password = NONE
+      @normalized_user = NONE
       remove_composite_values
 
       # Ensure we haven't created an invalid URI
@@ -1345,6 +1352,10 @@ module Addressable
           raise InvalidURIError, 'An origin cannot omit the host.'
         end
         new_port = new_origin[/:([^:@\[\]\/]*?)$/, 1]
+        # An empty port is the same as no port (Section 3.2.3 of RFC 3986).
+        if new_port == EMPTY_STR && new_origin =~ /\A[^:\/?#]+:\/\/[^\/?#:@\[\]]+:\z/
+          new_port = nil
+        end
       end
 
       self.scheme = new_scheme
@@ -1612,11 +1623,8 @@ module Addressable
     # @return [String] The query component, normalized.
     def normalized_query(*flags)
       return nil unless self.query
-      return @normalized_query unless @normalized_query == NONE
-      @normalized_query = begin
-        modified_query_class = Addressable::URI::CharacterClasses::QUERY.dup
-        # Make sure possible key-value pair delimiters are escaped.
-        modified_query_class.sub!("\\&", "").sub!("\\;", "")
+      return @normalized_query if flags.empty? && @normalized_query != NONE
+      normalized_query = begin
         pairs = (query || "").split("&", -1)
         pairs.delete_if(&:empty?).uniq! if flags.include?(:compacted)
         pairs.sort! if flags.include?(:sorted)
@@ -1630,8 +1638,9 @@ module Addressable
         component == "" ? nil : component
       end
       # All normalized values should be UTF-8
-      force_utf8_encoding_if_needed(@normalized_query)
-      @normalized_query
+      force_utf8_encoding_if_needed(normalized_query)
+      @normalized_query = normalized_query if flags.empty?
+      normalized_query
     end
 
     ##
@@ -2126,6 +2135,11 @@ module Addressable
       if components[:host] != nil
         components[:scheme] = normalized_self.scheme
       end
+      # A first segment containing a colon would be read as a scheme.
+      if components[:scheme].nil? && components[:path] &&
+          components[:path][/\A[^\/]*/].include?(":")
+        components[:path] = "./" + components[:path]
+      end
       return Addressable::URI.new(
         :scheme => components[:scheme],
         :user => components[:user],
@@ -2200,7 +2214,7 @@ module Addressable
     # @return [Addressable::URI] A URI suitable for display purposes.
     def display_uri
       display_uri = self.normalize
-      display_uri.host = ::Addressable::IDNA.to_unicode(display_uri.host)
+      display_uri.host = ::Addressable::IDNA.to_unicode(display_uri.host) if display_uri.host
       return display_uri
     end
 
@@ -2394,13 +2408,15 @@ module Addressable
     # @param [Proc] block
     #   A set of operations to perform on a given URI.
     def defer_validation
+      validation_was_deferred =
+        !!(defined?(@validation_deferred) && @validation_deferred)
       raise LocalJumpError, "No block given." unless block_given?
       @validation_deferred = true
       yield
-      @validation_deferred = false
-      validate
+      @validation_deferred = validation_was_deferred
+      validate unless validation_was_deferred
     ensure
-      @validation_deferred = false
+      @validation_deferred = validation_was_deferred
     end
 
     def encode_with(coder)
@@ -2426,10 +2442,14 @@ module Addressable
     SELF_REF = '.'
     PARENT = '..'
 
+    # Deprecated. No longer used by normalize_path; will be removed in 2.10.0.
     RULE_2A = /\/\.\/|\/\.$/
     RULE_2B_2C = /\/([^\/]*)\/\.\.\/|\/([^\/]*)\/\.\.$/
     RULE_2D = /^\.\.?\/?/
     RULE_PREFIXED_PARENT = /^\/\.\.?\/|^(\/\.\.?)+\/?$/
+    if respond_to?(:deprecate_constant, true)
+      deprecate_constant :RULE_2A, :RULE_2B_2C, :RULE_2D, :RULE_PREFIXED_PARENT
+    end
 
     ##
     # Resolves paths to their simplest form.
@@ -2438,37 +2458,52 @@ module Addressable
     #
     # @return [String] The normalized path.
     def self.normalize_path(path)
-      # Section 5.2.4 of RFC 3986
+      # Section 5.2.4 of RFC 3986, as a single pass over the segments so that
+      # the running time is linear in the length of the path.
 
       return if path.nil?
-      normalized_path = path.dup
-      loop do
-        mod ||= normalized_path.gsub!(RULE_2A, SLASH)
-
-        pair = normalized_path.match(RULE_2B_2C)
-        if pair
-          parent  = pair[1]
-          current = pair[2]
+      segments = path.split(SLASH, -1)
+      return path.dup if segments.empty?
+
+      # The first segment is never removed by a parent reference. For an
+      # absolute path it is the empty segment before the leading slash.
+      output = [segments.first]
+      last = segments.size - 1
+      (1..last).each do |index|
+        segment = segments[index]
+        if segment == SELF_REF
+          output << EMPTY_STR if index == last
+        elsif segment == PARENT
+          if output.size > 1
+            output.pop
+            output << EMPTY_STR if index == last
+          else
+            output << PARENT
+          end
         else
-          parent  = nil
-          current = nil
+          output << segment
         end
-
-        regexp = "/#{Regexp.escape(parent.to_s)}/\\.\\./|"
-        regexp += "(/#{Regexp.escape(current.to_s)}/\\.\\.$)"
-
-        if pair && ((parent != SELF_REF && parent != PARENT) ||
-            (current != SELF_REF && current != PARENT))
-          mod ||= normalized_path.gsub!(Regexp.new(regexp), SLASH)
+      end
+      normalized_path = output.join(SLASH)
+
+      # Non-standard, removes prefixed dotted segments from path. At this
+      # point an absolute path can only start with a single "/..", and a
+      # relative path keeps its leading dots.
+      start = 0
+      if normalized_path.start_with?(SLASH)
+        if normalized_path == "/#{PARENT}"
+          return normalized_path[0, 1]
+        elsif normalized_path.start_with?("/#{PARENT}/")
+          start = PARENT.size + 1
+        end
+      else
+        while normalized_path[start] == SELF_REF
+          start += 1
+          start += 1 if normalized_path[start] == SELF_REF
+          start += 1 if normalized_path[start] == SLASH
         end
-
-        mod ||= normalized_path.gsub!(RULE_2D, EMPTY_STR)
-        # Non-standard, removes prefixed dotted segments from path.
-        mod ||= normalized_path.gsub!(RULE_PREFIXED_PARENT, SLASH)
-        break if mod.nil?
       end
-
-      normalized_path
+      start.zero? ? normalized_path : normalized_path[start..-1]
     end
 
     ##
@@ -2552,6 +2587,9 @@ module Addressable
     def remove_composite_values
       @uri_string = nil
       @hash = nil
+      @site = nil
+      @normalized_site = nil
+      @normalized_authority = nil
     end
 
     ##
@@ -2566,11 +2604,21 @@ module Addressable
 
     private
 
+    def initialize_copy(other)
+      super
+      instance_variables.each do |ivar|
+        value = instance_variable_get(ivar)
+        instance_variable_set(ivar, value.dup) if value.kind_of?(String)
+      end
+    end
+
     ##
     # Resets instance variables
     #
     # @api private
     def reset_ivs
+      @site = nil
+      @normalized_site = nil
       @scheme = nil
       @user = nil
       @normalized_scheme = NONE

data/lib/addressable/version.rb

@@ -23,7 +23,7 @@ if !defined?(Addressable::VERSION)
     module VERSION
       MAJOR = 2
       MINOR = 9
-      TINY  = 0
+      TINY  = 2
 
       STRING = [MAJOR, MINOR, TINY].join('.')
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: addressable
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.9.2
 platform: ruby
 authors:
 - Bob Aman
@@ -53,7 +53,7 @@ homepage: https://github.com/sporkmonger/addressable
 licenses:
 - Apache-2.0
 metadata:
-  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.0
+  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.2
 rdoc_options:
 - "--main"
 - README.md
@@ -70,7 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.20
 specification_version: 4
 summary: URI Implementation
 test_files: []