async-http 0.104.0 → 0.105.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe8ada6c5d6f03e7523b0867a298fe517d04602231bf2d06e84e49078cbb9eca
-  data.tar.gz: ffe7b6eccb947931184ba506de0cf9515a9f03f81610fc4134618efd7322838a
+  metadata.gz: 47403cea6ef8a84389b0cbef1a81af900cc950f88657cb789bed7fa51550598b
+  data.tar.gz: 0fb0d5b68a012f6cb047d846d991a98cb8bf56cc6883d169f62d5089dfa4726e
 SHA512:
-  metadata.gz: ad0e7abf8b4b720acbe07f7adad14b816ebde19ddbdc549b791b18a09e232191780cf160274469077c64b4073c15c11897b6d8b542d674c97b076f31fc4c9b3b
-  data.tar.gz: 501720fd203bec472b0a5a01668ab3ce447b45b290ef303954c5703764b771c66256dfbbcad249b1414c982f18b20ef5d288696f9391fa92bb349d3b4be68d0b
+  metadata.gz: 317d49810ec9c0768c2ef0e12ca9881749648521e42d2fc84deff08434ec20d47b11d4a69e422a2f58e9e0de8fc061a901240c4ddb09a83909144b7a65d42c79
+  data.tar.gz: 70de4f9259a9290c00117050b068e4da34f7f91c475ca5ccdc73efb8293c1f39031ce38545677ccf21f5cb7a965987887a9e1274b36703431ff2edf068252e3e

data/lib/async/http/protocol/http1/server.rb

@@ -12,6 +12,7 @@ require_relative "finishable"
 
 require "async/promise"
 require "console/event/failure"
+require "protocol/http/body/buffered"
 
 module Async
 	module HTTP
@@ -33,12 +34,15 @@ module Async
 						@ready.resolve(nil)
 					end
 					
-					# Write a failure response with the given status code.
+					# Write a failure response with the given status code and error class name.
 					# @parameter status [Integer] The HTTP status code to send.
-					def fail_request(status)
+					# @parameter error [Exception] The error which caused the request to fail.
+					def fail_request(status, error)
+						body = ::Protocol::HTTP::Body::Buffered.wrap(error.class.name)
+						
 						@persistent = false
-						write_response(@version, status, {})
-						write_body(@version, nil)
+						write_response(@version, status, {"content-type" => "text/plain; charset=utf-8"})
+						write_body(@version, body)
 					rescue => error
 						# At this point, there is very little we can do to recover:
 						Console.debug(self, "Failed to write failure response!", error)
@@ -61,8 +65,8 @@ module Async
 						end
 						
 						return request
-					rescue ::Protocol::HTTP1::BadRequest
-						fail_request(400)
+					rescue ::Protocol::HTTP::BadRequest => error
+						fail_request(400, error)
 						# Conceivably we could retry here, but we don't really know how bad the error is, so it's better to just fail:
 						raise
 					end

data/lib/async/http/protocol/http2/request.rb

@@ -24,6 +24,29 @@ module Async
 						
 						attr :request
 						
+						# Write a failure response with the given status code and error class name.
+						# @parameter status [Integer] The HTTP status code to send.
+						# @parameter error [Exception] The error which caused the request to fail.
+						def fail_request(status, error)
+							body = error.class.name
+							headers = [
+								[STATUS, status.to_s],
+								["content-type", "text/plain; charset=utf-8"],
+							]
+							
+							if @request.head?
+								send_headers(headers, ::Protocol::HTTP2::END_STREAM)
+							else
+								send_headers(headers)
+								send_data(body, ::Protocol::HTTP2::END_STREAM)
+							end
+							
+							# The peer may still be sending a request body. The response is complete, so release the stream without reporting a protocol error.
+							send_reset_stream(::Protocol::HTTP2::Error::NO_ERROR) unless closed?
+						rescue => error
+							Console.debug(self, "Failed to write failure response!", error)
+						end
+						
 						# Process the initial headers received from the client and construct the request.
 						# @parameter headers [Array] The list of header key-value pairs.
 						# @parameter end_stream [Boolean] Whether the stream is complete after these headers.
@@ -67,11 +90,13 @@ module Async
 								end
 							end
 							
-							@request.headers = @headers
-							
 							unless @request.valid?
 								raise ::Protocol::HTTP2::HeaderError, "Request is missing required headers!"
 							else
+								# Validate structured headers before exposing the request to the application:
+								@headers.to_h
+								@request.headers = @headers
+								
 								# We only construct the input/body if data is coming.
 								unless end_stream
 									@request.body = prepare_input(@length)
@@ -82,6 +107,8 @@ module Async
 							end
 							
 							return headers
+						rescue ::Protocol::HTTP::BadRequest => error
+							fail_request(400, error)
 						end
 						
 						# Called when the stream is closed.

data/lib/async/http/server.rb

@@ -70,6 +70,8 @@ module Async
 					# If this returns nil, we assume that the connection has been hijacked.
 					self.call(request)
 				end
+			rescue ::Protocol::HTTP::BadRequest
+				# Ignore bad requests, just close the connection.
 			ensure
 				connection&.close
 			end

data/lib/async/http/version.rb

@@ -7,6 +7,6 @@
 module Async
 	# @namespace
 	module HTTP
-		VERSION = "0.104.0"
+		VERSION = "0.105.0"
 	end
 end

data/readme.md

@@ -20,6 +20,10 @@ Please see the [project documentation](https://socketry.github.io/async-http/) f
 
 Please see the [project releases](https://socketry.github.io/async-http/releases/index) for all releases.
 
+### v0.105.0
+
+  - Respond with `400 Bad Request` for any `Protocol::HTTP::BadRequest` raised while parsing HTTP/1 or HTTP/2 requests, include the exception class name without reflecting request data, and avoid reporting them as unhandled server errors.
+
 ### v0.103.0
 
   - Handle `RST_STREAM(NO_ERROR)` as an orderly HTTP/2 stream closure while still failing requests whose streams close before any response headers are received.
@@ -57,10 +61,6 @@ Please see the [project releases](https://socketry.github.io/async-http/releases
 
   - Made `metrics` and `traces` optional runtime dependencies. Applications that use the providers should depend on the corresponding gem and require the provider explicitly.
 
-### v0.95.1
-
-  - Fix handling of reset stream causing complete connection failure.
-
 ## See Also
 
   - [benchmark-http](https://github.com/socketry/benchmark-http) — A benchmarking tool to report on web server concurrency.

data/releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## v0.105.0
+
+  - Respond with `400 Bad Request` for any `Protocol::HTTP::BadRequest` raised while parsing HTTP/1 or HTTP/2 requests, include the exception class name without reflecting request data, and avoid reporting them as unhandled server errors.
+
 ## v0.103.0
 
   - Handle `RST_STREAM(NO_ERROR)` as an orderly HTTP/2 stream closure while still failing requests whose streams close before any response headers are received.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: async-http
 version: !ruby/object:Gem::Version
-  version: 0.104.0
+  version: 0.105.0
 platform: ruby
 authors:
 - Samuel Williams
@@ -125,14 +125,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.72'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.72'
 - !ruby/object:Gem::Dependency
   name: protocol-http1
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A HTTP client and server library.
 test_files: []