client-api-builder 0.5.6 → 0.6.0

data/examples/lorem_ipsum_client.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class LoremIpsumClient
   include ClientApiBuilder::Router
 
@@ -12,5 +14,5 @@ class LoremIpsumClient
   header 'Accept', 'application/json'
 
   # this creates a method called create_lorem_ipsum with 2 named arguments amont and what
-  route :create_lorem_ipsum, '/feed/json', body: {amount: :amount, what: :what, start: 'yes', generate: 'Generate Lorem Ipsum'}
+  route :create_lorem_ipsum, '/feed/json', body: { amount: :amount, what: :what, start: 'yes', generate: 'Generate Lorem Ipsum' }
 end

data/lib/client-api-builder.rb

@@ -2,6 +2,7 @@
 
 module ClientApiBuilder
   class Error < StandardError; end
+
   class UnexpectedResponse < Error
     attr_reader :response
 

data/lib/client_api_builder/active_support_log_subscriber.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'active_support'
 
 # Purpose is to log all requests

data/lib/client_api_builder/active_support_notifications.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'active_support'
 
 # Purpose is to change the instrument_request to use ActiveSupport::Notifications.instrument
@@ -9,14 +10,15 @@ module ClientApiBuilder
       error = nil
       result = nil
       ActiveSupport::Notifications.instrument('client_api_builder.request', client: self) do
-        begin
-          result = yield
-        rescue Exception => e
-          error = e
-        end
+        result = yield
+      rescue StandardError => e
+        # Use StandardError instead of Exception to allow SystemExit, Interrupt, etc. to propagate
+        error = e
       end
 
-      raise(error) if error
+      # Re-raise with original backtrace preserved
+      raise(error, error.message, error.backtrace) if error
+
       result
     ensure
       @total_request_time = Time.now - start_time

data/lib/client_api_builder/nested_router.rb

@@ -17,15 +17,15 @@ module ClientApiBuilder
     end
 
     def self.get_instance_method(var)
-      "\#{root_router.#{var}\}"
+      "\#{root_router.#{var}}"
     end
 
     def base_url
       self.class.base_url || root_router.base_url
     end
 
-    def handle_response(response, options, &block)
-      root_router.handle_response(response, options, &block)
+    def handle_response(response, options, &)
+      root_router.handle_response(response, options, &)
     end
   end
 end

data/lib/client_api_builder/net_http_request.rb

@@ -1,9 +1,21 @@
 # frozen_string_literal: true
+
 require 'net/http'
+require 'openssl'
 
 module ClientApiBuilder
   module NetHTTP
     module Request
+      # Allowed file modes for stream_to_file to prevent arbitrary mode injection
+      ALLOWED_FILE_MODES = %w[w wb a ab w+ wb+ a+ ab+].freeze
+
+      # Default connection options with secure SSL settings
+      DEFAULT_SECURE_OPTIONS = {
+        verify_mode: OpenSSL::SSL::VERIFY_PEER,
+        open_timeout: 30,
+        read_timeout: 60
+      }.freeze
+
       # Copied from https://ruby-doc.org/stdlib-2.7.1/libdoc/net/http/rdoc/Net/HTTP.html
       METHOD_TO_NET_HTTP_CLASS = {
         copy: Net::HTTP::Copy,
@@ -21,13 +33,17 @@ module ClientApiBuilder
         put: Net::HTTP::Put,
         trace: Net::HTTP::Trace,
         unlock: Net::HTTP::Unlock
-      }
+      }.freeze
 
       def request(method:, uri:, body:, headers:, connection_options:)
         request = METHOD_TO_NET_HTTP_CLASS[method].new(uri.request_uri, headers)
         request.body = body if body
 
-        Net::HTTP.start(uri.hostname, uri.port, connection_options.merge(use_ssl: uri.scheme == 'https')) do |http|
+        # Merge secure defaults, then user options, ensuring SSL verification is enabled for HTTPS
+        ssl_options = uri.scheme == 'https' ? DEFAULT_SECURE_OPTIONS.merge(use_ssl: true) : {}
+        merged_options = ssl_options.merge(connection_options)
+
+        Net::HTTP.start(uri.hostname, uri.port, merged_options) do |http|
           http.request(request) do |response|
             yield response if block_given?
           end
@@ -49,9 +65,25 @@ module ClientApiBuilder
       end
 
       def stream_to_file(method:, uri:, body:, headers:, connection_options:, file:)
-        mode = connection_options.delete(:file_mode) || 'wb'
-        File.open(file, mode) do |io|
-          stream_to_io(method: method, uri: uri, body: body, headers: headers, connection_options: connection_options, io: io)
+        # Use dup to avoid mutating the original hash
+        opts = connection_options.dup
+        mode = opts.delete(:file_mode)
+
+        # Validate file mode - use whitelist approach
+        mode = if mode.nil?
+                 'wb'
+               elsif ALLOWED_FILE_MODES.include?(mode.to_s)
+                 mode.to_s
+               else
+                 raise ArgumentError, "Invalid file mode: #{mode.inspect}. Allowed modes: #{ALLOWED_FILE_MODES.join(', ')}"
+               end
+
+        # Validate file path - expand to absolute path and check for path traversal
+        expanded_path = File.expand_path(file)
+        raise ArgumentError, 'Invalid file path: potential path traversal detected' if file.to_s.include?('..') || expanded_path.include?("\0")
+
+        File.open(expanded_path, mode) do |io|
+          stream_to_io(method: method, uri: uri, body: body, headers: headers, connection_options: opts, io: io)
         end
       end
     end

data/lib/client_api_builder/query_params.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'cgi'
 
 module ClientApiBuilder
@@ -38,10 +39,10 @@ module ClientApiBuilder
           array_namespace = namespace ? "#{namespace}[#{escape(key.to_s)}][]" : "#{escape(key.to_s)}[]"
           query_params += to_query_from_array(value, array_namespace)
         when Hash
-          hash_namespace = namespace ? "#{namespace}[#{escape(key.to_s)}]" : "#{escape(key.to_s)}"
+          hash_namespace = namespace ? "#{namespace}[#{escape(key.to_s)}]" : escape(key.to_s).to_s
           query_params += to_query_from_hash(value, hash_namespace)
         else
-          query_name = namespace ? "#{namespace}[#{escape(key.to_s)}]" : "#{escape(key.to_s)}"
+          query_name = namespace ? "#{namespace}[#{escape(key.to_s)}]" : escape(key.to_s).to_s
           query_params << "#{query_name}#{name_value_separator}#{escape(value.to_s)}"
         end
       end
@@ -67,7 +68,12 @@ module ClientApiBuilder
     end
 
     def escape(str)
-      custom_escape_proc ? custom_escape_proc.call(str) : CGI.escape(str)
+      return CGI.escape(str) unless custom_escape_proc
+
+      result = custom_escape_proc.call(str)
+      raise TypeError, "custom_escape_proc must return a String, got #{result.class}" unless result.is_a?(String)
+
+      result
     end
   end
 end