curb 1.3.5 → 1.3.6

data/tests/tc_curl_easy.rb

@@ -18,6 +18,13 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     assert_equal 200, easy.code
   end
 
+  def test_perform_with_implicit_multi
+    easy = Curl::Easy.new($TEST_URL)
+
+    assert_nothing_raised { easy.perform }
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  end
+
   def test_curlopt_resolve
     require 'resolv'
     uri = URI.parse(TestServlet.url)
@@ -1629,6 +1636,36 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     easy.http_get
   end
 
+  def test_easy_reset_clears_network_policy_allowlists
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.allowed_hosts = ['127.0.0.1']
+    easy.network_policy = :public
+    easy.allowed_cidrs = ['1.1.1.0/24']
+
+    settings = easy.reset
+
+    assert settings.key?(:allowed_hosts)
+    assert settings.key?(:allowed_cidrs)
+    assert_nil easy.allowed_hosts
+    assert_nil easy.allowed_cidrs
+    assert_equal :none, easy.network_policy
+  rescue NotImplementedError
+    omit('network_policy=:public requires CURLOPT_OPENSOCKETFUNCTION support')
+  end
+
+  def test_frozen_easy_close_and_reset_skip_safety_override_cleanup
+    closed_easy = Curl::Easy.new
+    closed_easy.freeze
+
+    assert_nothing_raised { closed_easy.close }
+
+    reset_easy = Curl::Easy.new
+    reset_easy.safe_http!
+    reset_easy.freeze
+
+    assert_nothing_raised { reset_easy.reset }
+  end
+
   def test_last_result_initialization
     # Test for issue #463 - ensure last_result is properly initialized to 0
     easy = Curl::Easy.new
@@ -1780,6 +1817,35 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     end
   end
 
+  def test_close_during_http_post_argument_coercion_is_blocked
+    curl = Curl::Easy.new(TestServlet.url)
+    field = Object.new
+    field.define_singleton_method(:to_s) do
+      curl.close
+      "a=b"
+    end
+
+    error = assert_raise(RuntimeError) { curl.http_post(field) }
+    assert_match(/Cannot close an active curl handle/, error.message)
+
+    assert_nothing_raised { curl.close }
+  end
+
+  def test_close_during_url_coercion_is_blocked
+    curl = Curl::Easy.new
+    url = Object.new
+    url.define_singleton_method(:to_str) do
+      curl.close
+      TestServlet.url
+    end
+
+    curl.url = url
+    error = assert_raise(RuntimeError) { curl.perform }
+    assert_match(/Cannot close an active curl handle/, error.message)
+
+    assert_nothing_raised { curl.close }
+  end
+
   def test_close_in_on_progress_is_blocked
     curl = Curl::Easy.new(TestServlet.url)
     did_raise = false
@@ -1865,6 +1931,16 @@ class TestCurbCurlEasy < Test::Unit::TestCase
     end
   end
 
+  def test_poison
+    res_a = Curl.get("#{TestServlet.url}?a_body")
+    first_a_body = Digest::MD5.hexdigest(res_a.body)
+    res_b = Curl.get("#{TestServlet.url}?b_body")
+
+    b_body = Digest::MD5.hexdigest(res_b.body)
+    a_body = Digest::MD5.hexdigest(res_a.body)
+    assert_not_equal a_body, b_body, "we expected #{a_body} to be #{first_a_body}"
+  end
+
   include TestServerMethods 
 
   def setup

data/tests/tc_curl_maxfilesize.rb

@@ -5,8 +5,208 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
     @easy = Curl::Easy.new
   end
 
-  def test_maxfilesize
+  def teardown
+    Curl.__send__(:clear_safe!) if Curl.respond_to?(:clear_safe!, true)
+    super
+  end
+
+  def test_maxfilesize_setopt
     @easy.set(Curl::CURLOPT_MAXFILESIZE, 5000000)
+    @easy.set(Curl::CURLOPT_MAXFILESIZE_LARGE, 5000000) if Curl.const_defined?(:CURLOPT_MAXFILESIZE_LARGE)
+  end
+
+  def test_max_body_bytes_exact_limit_succeeds
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 8\r\n\r\n12345678") do |url|
+      @easy.url = url
+      @easy.max_body_bytes = 8
+      @easy.perform
+
+      assert_equal '12345678', @easy.body_str
+    end
+  end
+
+  def test_max_body_bytes_rejects_large_buffered_response
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      @easy.url = url
+      @easy.max_body_bytes = 10
+
+      assert_body_limit_error do
+        @easy.perform
+      end
+
+      assert_operator @easy.body_str.to_s.bytesize, :<=, 10
+    end
+  end
+
+  def test_safe_get_accepts_max_body_bytes_as_second_argument
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      assert_body_limit_error do
+        Curl.safe_get(url, :max_body_bytes => 10)
+      end
+    end
+  end
+
+  def test_safe_get_reapplies_max_body_bytes_after_user_block
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      assert_body_limit_error do
+        Curl.safe_get(url, {}, :max_body_bytes => 10) do |easy|
+          easy.max_body_bytes = nil
+        end
+      end
+    end
+  end
+
+  def test_safe_bang_max_body_bytes_applies_to_easy_perform
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      Curl.safe! do |config|
+        config.max_body_bytes = 10
+      end
+
+      @easy.url = url
+
+      assert_body_limit_error do
+        @easy.perform
+      end
+    end
+  end
+
+  def test_safe_bang_reapplies_max_body_bytes_after_shortcut_block
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      Curl.safe! do |config|
+        config.max_body_bytes = 10
+      end
+
+      assert_body_limit_error do
+        Curl.get(url) do |easy|
+          easy.max_body_bytes = nil
+        end
+      end
+    end
+  end
+
+  def test_safe_get_max_body_bytes_tightens_global_cap
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      Curl.safe! do |config|
+        config.max_body_bytes = 1_000
+      end
+
+      assert_body_limit_error do
+        Curl.safe_get(url, :max_body_bytes => 10)
+      end
+    end
+  end
+
+  def test_safe_bang_rejects_negative_max_body_bytes
+    assert_raise(ArgumentError) do
+      Curl.safe! do |config|
+        config.max_body_bytes = -1
+      end
+    end
   end
 
+  def test_safe_head_does_not_apply_body_cap_to_content_length
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 65536\r\n\r\n") do |url|
+      easy = Curl.safe_head(url, :max_body_bytes => 1)
+
+      assert_equal 200, easy.response_code
+      assert_equal '', easy.body_str
+    end
+  end
+
+  def test_max_body_bytes_rejects_chunked_response_without_content_length
+    chunks = ["1234", "5678", "90"]
+    response = +"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n"
+    chunks.each { |chunk| response << "#{chunk.bytesize.to_s(16)}\r\n#{chunk}\r\n" }
+    response << "0\r\n\r\n"
+
+    with_raw_http_response(response) do |url|
+      @easy.url = url
+      @easy.max_body_bytes = 8
+
+      assert_body_limit_error do
+        @easy.perform
+      end
+
+      assert_operator @easy.body_str.to_s.bytesize, :<=, 8
+    end
+  end
+
+  def test_max_body_bytes_limits_on_body_callback
+    chunks = ["1234", "5678", "90"]
+    response = +"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n"
+    chunks.each { |chunk| response << "#{chunk.bytesize.to_s(16)}\r\n#{chunk}\r\n" }
+    response << "0\r\n\r\n"
+    seen = +''
+
+    with_raw_http_response(response) do |url|
+      @easy.url = url
+      @easy.max_body_bytes = 8
+      @easy.on_body { |data| seen << data; data.bytesize }
+
+      assert_body_limit_error do
+        @easy.perform
+      end
+
+      assert_equal '12345678', seen
+      assert_nil @easy.body_str
+    end
+  end
+
+  def test_max_body_bytes_zero_clears_limit
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\n123456789012") do |url|
+      @easy.url = url
+      @easy.max_body_bytes = 1
+      @easy.max_body_bytes = 0
+      @easy.perform
+
+      assert_nil @easy.max_body_bytes
+      assert_equal '123456789012', @easy.body_str
+    end
+  end
+
+  def test_max_body_bytes_counter_resets_between_reused_transfers
+    @easy.max_body_bytes = 8
+
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 8\r\n\r\n12345678") do |url|
+      @easy.url = url
+      @easy.perform
+      assert_equal '12345678', @easy.body_str
+    end
+
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 8\r\n\r\nabcdefgh") do |url|
+      @easy.url = url
+      @easy.perform
+      assert_equal 'abcdefgh', @easy.body_str
+    end
+  end
+
+  private
+
+  def assert_body_limit_error
+    assert_raise(Curl::Err::FileSizeExceededError) do
+      yield
+    end
+  end
+
+  def with_raw_http_response(response)
+    server = TCPServer.new('127.0.0.1', 0)
+    port = server.addr[1]
+    thread = Thread.new do
+      socket = server.accept
+      begin
+        socket.readpartial(4096)
+      rescue EOFError
+      end
+      socket.write(response)
+      socket.close
+    end
+
+    yield "http://127.0.0.1:#{port}/"
+  ensure
+    server.close if server && !server.closed?
+    if thread
+      thread.join(5)
+      thread.kill if thread.alive?
+    end
+  end
 end

data/tests/tc_curl_multi.rb

@@ -189,6 +189,23 @@ class TestCurbCurlMulti < Test::Unit::TestCase
     second_multi.close if defined?(second_multi) && second_multi
   end
 
+  def test_easy_multi_assignment_detaches_from_old_multi
+    multi = Curl::Multi.new
+    easy = Curl::Easy.new(TestServlet.url)
+
+    multi.add(easy)
+    easy.multi = nil
+
+    assert_nil easy.multi
+    assert_equal({}, multi.requests)
+    assert_nothing_raised { easy.close }
+    assert_nothing_raised { multi.close }
+
+    multi = nil
+  ensure
+    multi.close if defined?(multi) && multi
+  end
+
   def test_close_makes_multi_unusable
     multi = Curl::Multi.new
     multi.close
@@ -752,6 +769,23 @@ class TestCurbCurlMulti < Test::Unit::TestCase
     m.close if m
   end
 
+  def test_native_safety_signatures_are_pruned_after_perform
+    m = Curl::Multi.new
+    easy = Curl::Easy.new($TEST_URL)
+
+    m.add(easy)
+    signatures = m.__send__(:__curb_native_safety_signatures)
+    assert_equal easy, m.requests[easy.object_id]
+    assert signatures.key?(easy.object_id)
+
+    m.perform
+
+    assert_equal 0, m.requests.length
+    assert_empty signatures
+  ensure
+    m.close if m
+  end
+
   def test_easy_multi_is_cleared_after_perform
     m = Curl::Multi.new
     c = Curl::Easy.new($TEST_URL)
@@ -766,6 +800,21 @@ class TestCurbCurlMulti < Test::Unit::TestCase
     m.close if m
   end
 
+  def test_frozen_idle_easy_multi_reference_is_cleared_on_close
+    multi = Curl::Multi.new
+    easy = Curl::Easy.new($TEST_URL)
+    easy.freeze
+
+    easy.multi = multi
+
+    assert_same multi, easy.multi
+    assert_nothing_raised { multi.close }
+    assert_nil easy.multi
+    multi = nil
+  ensure
+    multi.close if multi
+  end
+
   def test_easy_multi_is_available_during_completion_callbacks
     multi = Curl::Multi.new
     easy = Curl::Easy.new($TEST_URL)
@@ -991,6 +1040,193 @@ class TestCurbCurlMulti < Test::Unit::TestCase
     end
   end
 
+  def test_multi_download_refuses_existing_explicit_download_path
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'curb_easy.c')
+      File.write(download_path, 'sentinel')
+
+      assert_raise(Curl::DownloadTargetExistsError) do
+        Curl::Multi.download([root_uri + 'curb_easy.c'], {}, {}, [download_path])
+      end
+
+      assert_equal 'sentinel', File.read(download_path)
+    end
+  end
+
+  def test_multi_download_failed_transfer_does_not_publish_file_without_block
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'missing')
+
+      error = assert_raise(Curl::Multi::DownloadError) do
+        Curl::Multi.download(['file:///curb/missing'], {}, {}, [download_path])
+      end
+
+      assert !error.errors.empty?
+      assert !File.exist?(download_path)
+    end
+  end
+
+  def test_multi_download_failed_transfer_does_not_publish_file_or_call_block
+    called = false
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'missing')
+
+      error = assert_raise(Curl::Multi::DownloadError) do
+        Curl::Multi.download(['file:///curb/missing'], {}, {}, [download_path]) do |_curl, _path|
+          called = true
+        end
+      end
+
+      assert !error.errors.empty?
+      assert_equal false, called
+      assert !File.exist?(download_path)
+    end
+  end
+
+  def test_multi_download_failed_transfer_closes_io_destination
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'missing')
+      io = File.open(download_path, 'wb')
+
+      error = assert_raise(Curl::Multi::DownloadError) do
+        Curl::Multi.download(['file:///curb/missing'], {}, {}, [io])
+      end
+
+      assert !error.errors.any? { |e| e.is_a?(ArgumentError) }
+      assert io.closed?
+      assert_equal '', File.read(download_path)
+    end
+  end
+
+  def test_multi_download_preserves_body_limit_callback_error
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+      Dir.mktmpdir('curb-download-') do |download_dir|
+        download_path = File.join(download_dir, 'too-large')
+
+        error = assert_raise(Curl::Err::FileSizeExceededError) do
+          Curl::Multi.download([url], { :max_body_bytes => 10 }, {}, [download_path])
+        end
+
+        assert_match(/Maximum body size exceeded/, error.message)
+        assert !File.exist?(download_path)
+      end
+    end
+  end
+
+  def test_multi_download_preserves_output_write_callback_error
+    writer_error = Class.new(StandardError)
+
+    with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\ndata") do |url|
+      Dir.mktmpdir('curb-download-') do |download_dir|
+        writer = File.open(File.join(download_dir, 'writer'), 'wb')
+        writer.define_singleton_method(:write) do |_data|
+          raise writer_error, 'writer failed'
+        end
+
+        error = assert_raise(writer_error) do
+          Curl::Multi.download([url], {}, {}, [writer])
+        end
+
+        assert_equal 'writer failed', error.message
+        assert writer.closed?
+      end
+    end
+  end
+
+  def test_multi_download_safe_directory_rejects_unsafe_names
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      ['../escape.c', '.env', 'nested/file', '/tmp/escape.c', "bad\0name"].each do |name|
+        assert_raise(ArgumentError, "expected #{name.inspect} to be rejected") do
+          Curl::Multi.download([root_uri + 'curb_easy.c'], {}, {}, [name], :download_dir => download_dir)
+        end
+      end
+    end
+  end
+
+  def test_multi_download_rejects_duplicate_destinations
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      assert_raise(ArgumentError) do
+        Curl::Multi.download(
+          [root_uri + 'curb_easy.c?one=1', root_uri + 'curb_easy.c?two=2'],
+          {},
+          {},
+          nil,
+          :download_dir => download_dir
+        )
+      end
+
+      assert !File.exist?(File.join(download_dir, 'curb_easy.c'))
+      assert_equal [], Dir[File.join(download_dir, '.curb-download-*')]
+    end
+  end
+
+  def test_multi_download_safe_directory_strips_query_from_url_basename
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      Curl::Multi.download([root_uri + 'curb_easy.c?cache=1'], {}, {}, nil, :download_dir => download_dir)
+
+      download_path = File.join(download_dir, 'curb_easy.c')
+      assert File.exist?(download_path)
+      assert !File.exist?(File.join(download_dir, 'curb_easy.c?cache=1'))
+      assert_equal File.read(File.join(File.dirname(__FILE__), '..','ext','curb_easy.c')), File.read(download_path)
+    end
+  end
+
+  def test_multi_download_hash_url_config_uses_hash_url
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'curb_easy.c')
+
+      Curl::Multi.download([{ :url => root_uri + 'curb_easy.c', :method => :get }], {}, {}, [download_path]) do |curl, path|
+        assert_equal 200, curl.response_code
+        assert_equal download_path, path
+      end
+
+      assert_equal File.read(File.join(File.dirname(__FILE__), '..','ext','curb_easy.c')), File.read(download_path)
+    end
+  end
+
+  def test_multi_download_duplicate_urls_use_distinct_explicit_paths
+    url = "file://#{File.expand_path(File.join(File.dirname(__FILE__), '..','ext','curb_easy.c'))}"
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      paths = [
+        File.join(download_dir, 'a.c'),
+        File.join(download_dir, 'b.c')
+      ]
+      completed_paths = []
+
+      Curl::Multi.download([url, url], {}, {}, paths) do |_curl, path|
+        completed_paths << path
+      end
+
+      assert_equal paths.sort, completed_paths.sort
+      assert_equal File.read(paths[0]), File.read(paths[1])
+    end
+  end
+
+  def test_multi_download_accepts_indexed_hash_download_paths
+    root_uri = 'http://127.0.0.1:9129/ext/'
+
+    Dir.mktmpdir('curb-download-') do |download_dir|
+      download_path = File.join(download_dir, 'curb_easy.c')
+
+      Curl::Multi.download([root_uri + 'curb_easy.c'], {}, {}, {0 => download_path})
+
+      assert File.exist?(download_path)
+      assert_equal File.read(File.join(File.dirname(__FILE__), '..','ext','curb_easy.c')), File.read(download_path)
+    end
+  end
+
   def test_multi_easy_post_01
     urls = [
       { :url => TestServlet.url + '?q=1', :post_fields => {'field1' => 'value1', 'k' => 'j'}},
@@ -1279,6 +1515,28 @@ class TestCurbCurlMulti < Test::Unit::TestCase
     server_thread.kill if defined?(server_thread) && server_thread&.alive?
   end
 
+  def with_raw_http_response(response)
+    server = TCPServer.new('127.0.0.1', 0)
+    port = server.addr[1]
+    thread = Thread.new do
+      socket = server.accept
+      begin
+        socket.readpartial(4096)
+      rescue EOFError
+      end
+      socket.write(response)
+      socket.close
+    end
+
+    yield "http://127.0.0.1:#{port}/"
+  ensure
+    server.close if defined?(server) && server && !server.closed?
+    if defined?(thread) && thread
+      thread.join(5)
+      thread.kill if thread.alive?
+    end
+  end
+
   include TestServerMethods
 
   def setup