curb 1.3.7 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12fe9b3726ab9e6bb2a7369ebae117d8a2da19db382acd1b182af4b8cd19d4cb
-  data.tar.gz: 05a07a992383c5c956d037770215bb2bb8795cc3062bad6ca2ec84c0389dd880
+  metadata.gz: 9f3088ba29db67ea56c9587898267648a704c8acbcb9e95cb58318c3464deb12
+  data.tar.gz: 40134cd41f0704c2aaa3b65ca6507987f6e8bc755c4530c9361ccd25f4831c17
 SHA512:
-  metadata.gz: 3f0016de5762e46f6b1f1ef3a588c82a41a8a3b1f8a3d3f351626279fa053539ec7d6ca35a8a9792ed5c9dd6e06c550d2b9ba7b900cffbb60af09f260e603662
-  data.tar.gz: c26cfe8e0c03bf30dda075c6abb916e4e1d66205f61ebe54d2db73c1359e3c8def512163393280874730769ffad6fc96c24aad8e5f79a5d586e1b43640ed6b9f
+  metadata.gz: 29ffbf5bb4301db5729aff433a938251622c8483a29f5fa0f5344b52573048964c9863d00d254b42d01ff172291a1b469ea10f1fa9757b58fe4743a66c7078a5
+  data.tar.gz: d2e21e48891f398af31a7b2dd8d99a2465f82bb97d9caecda8ac4cb69fb599e894c3172bc56a6106a28d7761b03743fc78ee80701b3051ac673b7b6f1ed27ea9

data/README.md

@@ -205,7 +205,7 @@ end
 `curb` is a libcurl binding and intentionally supports protocols beyond HTTP.
 Do not pass untrusted URLs to `Curl.get`, `Curl::Easy.new`, or related raw
 helpers without application-level validation. For user-supplied URLs, enable the
-process-wide safety policy before making requests:
+safety policy for the current Ractor before making requests:
 
 ```ruby
 Curl.safe! do |config|
@@ -257,6 +257,42 @@ configured. For untrusted or large responses, use `on_body`, `download`, and/or
 `max_body_bytes` is enforced for downloads as well as buffered responses and
 custom body callbacks.
 
+## Ractor support
+
+On Ruby 3.0+, curb can perform requests from multiple Ractors when it is built
+against a libcurl that reports the `CURL_VERSION_THREADSAFE` capability
+(libcurl 7.84.0 or newer). Check `Curl::RACTOR_SAFE` at runtime. Builds that do
+not meet those requirements continue to work in the main Ractor but do not
+advertise native Ractor safety.
+
+Create `Curl::Easy` and `Curl::Multi` handles inside the Ractor that uses them;
+do not operate on the same native handle concurrently from different Ractors.
+Safety configuration, `Curl::Multi.default_timeout`, `Curl::Multi.autoclose`,
+and deferred cleanup queues are isolated per Ractor. Call `Curl.safe!` in each
+Ractor that needs the safety policy:
+
+```ruby
+raise "this curb build is not Ractor-safe" unless Curl::RACTOR_SAFE
+
+workers = 4.times.map do
+  Ractor.new do
+    Curl.safe! { |config| config.protocols = [:http, :https] }
+    easy = Curl::Easy.new("https://example.com/")
+    easy.perform
+    easy.response_code
+  end
+end
+
+# Ruby 4.0 uses Ractor#value; earlier Ractor releases use Ractor#take.
+statuses = workers.map do |worker|
+  worker.respond_to?(:value) ? worker.value : worker.take
+end
+```
+
+Curb enables `CURLOPT_NOSIGNAL` on newly initialized and reset Easy handles by
+default so separate handles can be used safely from parallel Ruby execution.
+Applications can still override the option explicitly when required.
+
 ## You will need
 
 * A working Ruby installation (`2.0.0+` will work but `2.1+` preferred) (it's possible it still works with 1.8.7 but you'd have to tell me if not...)
@@ -278,6 +314,7 @@ an explicit CI target.
 
 | Gem Version | Release Date   | libcurl versions  |
 | ----------- | -------------- | ----------------- |
+| 1.4.0       | Sep 27, 2026   | 7.58 – 8.21.0     |
 | 1.3.7       | Jul 10, 2026   | 7.58 – 8.21.0     |
 | 1.3.6       | Jun 17, 2026   | 7.58 – 8.20.0     |
 | 1.3.5       | May 14, 2026   | 7.58 – 8.20.0     |

data/Rakefile

@@ -126,7 +126,18 @@ end
 
 RubyMemcheck.config(**ruby_memcheck_config)
 namespace :test do
-  RubyMemcheck::TestTask.new(valgrind: :compile) do|t|
+  # Ruby pools fiber stacks next to each other, about 1MB apart. Valgrind
+  # treats a stack-pointer jump smaller than --max-stackframe (2MB) as an
+  # ordinary call or return rather than a switch to another stack, and marks
+  # the memory in between, which can hold another fiber's stack, as
+  # inaccessible. Later reads of that fiber's stack (turning a block into a
+  # Proc, GC marking suspended fibers) are then reported as invalid. Spacing
+  # fiber stacks wider than that lets valgrind recognize every fiber switch.
+  task :valgrind_env do
+    ENV['RUBY_FIBER_MACHINE_STACK_SIZE'] ||= (4 * 1024 * 1024).to_s
+  end
+
+  RubyMemcheck::TestTask.new(valgrind: [:compile, :valgrind_env]) do|t|
     t.test_files = FileList['tests/tc_*.rb']
     t.verbose = false
   end

data/ext/curb.c

@@ -243,25 +243,38 @@ static void finalize_curb_core(VALUE data) {
 
 void Init_curb_core() {
   curl_version_info_data *ver;
-  VALUE curlver, curllongver, curlvernum;
+  VALUE curbver, curlver, curllongver, curlvernum;
+  int ractor_safe = 0;
 
   curl_global_init(CURL_GLOBAL_ALL);
   rb_set_end_proc(finalize_curb_core, Qnil);
   ver = curl_version_info(CURLVERSION_NOW);
 
+#if defined(HAVE_RB_EXT_RACTOR_SAFE) && defined(HAVE_CURL_VERSION_THREADSAFE)
+  /* Ractors execute native methods in parallel. Only opt in when both Ruby
+   * provides the safety marker and libcurl advertises thread-safe global
+   * initialization. Individual Curl handles remain Ractor-owned. */
+  if (ver && (ver->features & CURL_VERSION_THREADSAFE)) {
+    rb_ext_ractor_safe(1);
+    ractor_safe = 1;
+  }
+#endif
+
   mCurl = rb_define_module("Curl");
 
-  curlver = rb_str_new2(ver->version);
-  curllongver = rb_str_new2(curl_version());
+  curbver = rb_obj_freeze(rb_str_new2(CURB_VERSION));
+  curlver = rb_obj_freeze(rb_str_new2(ver->version));
+  curllongver = rb_obj_freeze(rb_str_new2(curl_version()));
   curlvernum = LONG2NUM(LIBCURL_VERSION_NUM);
 
-  rb_define_const(mCurl, "CURB_VERSION", rb_str_new2(CURB_VERSION));
+  rb_define_const(mCurl, "CURB_VERSION", curbver);
   rb_define_const(mCurl, "VERSION", curlver);
   rb_define_const(mCurl, "CURL_VERSION", curlver);
   rb_define_const(mCurl, "VERNUM", curlvernum);
   rb_define_const(mCurl, "CURL_VERNUM", curlvernum);
   rb_define_const(mCurl, "LONG_VERSION", curllongver);
   rb_define_const(mCurl, "CURL_LONG_VERSION", curllongver);
+  rb_define_const(mCurl, "RACTOR_SAFE", ractor_safe ? Qtrue : Qfalse);
 
   /* Passed to on_debug handler to indicate that the data is informational text. */
   rb_define_const(mCurl, "CURLINFO_TEXT", LONG2NUM(CURLINFO_TEXT));

data/ext/curb.h

@@ -28,11 +28,11 @@
 #include "curb_macros.h"
 
 // These should be managed from the Rake 'release' task.
-#define CURB_VERSION   "1.3.7"
-#define CURB_VER_NUM   1037
+#define CURB_VERSION   "1.4.0"
+#define CURB_VER_NUM   1040
 #define CURB_VER_MAJ   1
-#define CURB_VER_MIN   3
-#define CURB_VER_MIC   7
+#define CURB_VER_MIN   4
+#define CURB_VER_MIC   0
 #define CURB_VER_PATCH 0
 
 

data/ext/curb_easy.c

@@ -66,6 +66,17 @@ static struct curl_slist *duplicate_curl_slist(struct curl_slist *list);
 static size_t proc_data_handler(char *stream, size_t size, size_t nmemb, VALUE proc);
 static int curb_array_includes_string(VALUE list, VALUE value);
 
+static void curb_easy_apply_thread_defaults(ruby_curl_easy *rbce) {
+#ifdef HAVE_CURLOPT_NOSIGNAL
+  CURLcode ecode = curl_easy_setopt(rbce->curl, CURLOPT_NOSIGNAL, 1L);
+  if (ecode != CURLE_OK) {
+    raise_curl_easy_error_exception(ecode);
+  }
+#else
+  (void)rbce;
+#endif
+}
+
 /* ================== CURL HANDLER FUNCS ==============*/
 
 static int curb_ipv4_is_unsafe_destination(const unsigned char *ip) {
@@ -1501,6 +1512,7 @@ static VALUE ruby_curl_easy_initialize(int argc, VALUE *argv, VALUE self) {
   ruby_curl_easy_zero(rbce);
   rbce->self = self;
 
+  curb_easy_apply_thread_defaults(rbce);
   curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, &rbce->err_buf);
 
   rb_easy_set("url", url);
@@ -1659,6 +1671,7 @@ static VALUE ruby_curl_easy_close(VALUE self) {
   ruby_curl_easy_zero(rbce);
   rbce->self = self;
 
+  curb_easy_apply_thread_defaults(rbce);
   curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, rbce->err_buf);
 
   /* give the new curl handle a reference back to the ruby object */
@@ -1703,6 +1716,7 @@ static VALUE ruby_curl_easy_reset(VALUE self) {
   ruby_curl_easy_zero(rbce);
   rbce->self = self;
 
+  curb_easy_apply_thread_defaults(rbce);
   curl_easy_setopt(rbce->curl, CURLOPT_ERRORBUFFER, &rbce->err_buf);
 
   /* reset clobbers the private setting, so reset it to self */
@@ -2552,6 +2566,41 @@ static VALUE ruby_curl_easy_proxy_type_get(VALUE self) {
   (!strncmp("anysafe",node,7)) ? CURLAUTH_ANYSAFE : \
   (!strncmp("any",node,3)) ? CURLAUTH_ANY : 0
 #endif
+/*
+ * Convert the arguments to http_auth_types= / proxy_auth_types= into a
+ * CURLAUTH bitmask. Accepts nil, an Integer mask, or one or more auth type
+ * names (symbols/strings), either as separate args or as a single Array.
+ */
+static long ruby_curl_easy_auth_types_to_mask(VALUE args_ary) {
+  long i, len;
+  char* node = NULL;
+  long mask = 0;
+  VALUE first;
+
+  /* easy.http_auth_types = [:basic, :digest] arrives as a single Array arg */
+  if (RARRAY_LEN(args_ary) == 1 && RB_TYPE_P(rb_ary_entry(args_ary,0), T_ARRAY)) {
+    args_ary = rb_ary_entry(args_ary,0);
+  }
+
+  len = RARRAY_LEN(args_ary);
+  first = rb_ary_entry(args_ary,0);
+
+  if (len == 1 && (first == Qnil || TYPE(first) == T_FIXNUM || TYPE(first) == T_BIGNUM)) {
+    return first == Qnil ? 0 : NUM2LONG(first);
+  }
+
+  // we could have multiple values, but they should be symbols
+  // rb_obj_as_string always yields a String, even if to_s misbehaves;
+  // RSTRING_PTR on a raw rb_funcall result would crash if #to_s returned
+  // a non-String (e.g. a Fixnum, whose VALUE isn't a real pointer).
+  for( i = 0; i < len; ++i ) {
+    VALUE node_str = rb_obj_as_string(rb_ary_entry(args_ary,i));
+    node = StringValuePtr(node_str);
+    mask |= CURL_HTTPAUTH_STR_TO_NUM(node);
+  }
+  return mask;
+}
+
 /*
  * call-seq:
  *   easy.http_auth_types = fixnum or nil             => fixnum or nil
@@ -2561,37 +2610,14 @@ static VALUE ruby_curl_easy_proxy_type_get(VALUE self) {
  * +perform+ calls. This is a bitmap made by ORing together the
  * Curl::CURLAUTH constants.
  */
-static VALUE ruby_curl_easy_http_auth_types_set(int argc, VALUE *argv, VALUE self) {//VALUE self, VALUE http_auth_types) {
+static VALUE ruby_curl_easy_http_auth_types_set(int argc, VALUE *argv, VALUE self) {
   ruby_curl_easy *rbce;
   VALUE args_ary;
-  long i, len;
-  char* node = NULL;
-  long mask = 0;
 
   rb_scan_args(argc, argv, "*", &args_ary);
   TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  len = RARRAY_LEN(args_ary);
-
-  if (len == 1 && (rb_ary_entry(args_ary,0) == Qnil || TYPE(rb_ary_entry(args_ary,0)) == T_FIXNUM ||
-        TYPE(rb_ary_entry(args_ary,0)) == T_BIGNUM)) {
-    if (rb_ary_entry(args_ary,0) == Qnil) {
-      rbce->http_auth_types = 0;
-    }
-    else {
-      rbce->http_auth_types = NUM2LONG(rb_ary_entry(args_ary,0));
-    }
-  }
-  else {
-    // we could have multiple values, but they should be symbols
-    node = RSTRING_PTR(rb_funcall(rb_ary_entry(args_ary,0),rb_intern("to_s"),0));
-    mask = CURL_HTTPAUTH_STR_TO_NUM(node);
-    for( i = 1; i < len; ++i ) {
-      node = RSTRING_PTR(rb_funcall(rb_ary_entry(args_ary,i),rb_intern("to_s"),0));
-      mask |= CURL_HTTPAUTH_STR_TO_NUM(node);
-    }
-    rbce->http_auth_types = mask;
-  }
+  rbce->http_auth_types = ruby_curl_easy_auth_types_to_mask(args_ary);
   return LONG2NUM(rbce->http_auth_types);
 }
 
@@ -2609,13 +2635,21 @@ static VALUE ruby_curl_easy_http_auth_types_get(VALUE self) {
 /*
  * call-seq:
  *   easy.proxy_auth_types = fixnum or nil            => fixnum or nil
+ *   easy.proxy_auth_types = [:basic,:digest,:digest_ie,:gssnegotiate, :ntlm, :any, :anysafe]
  *
  * Set the proxy authentication types that may be used for the following
  * +perform+ calls. This is a bitmap made by ORing together the
  * Curl::CURLAUTH constants.
  */
-static VALUE ruby_curl_easy_proxy_auth_types_set(VALUE self, VALUE proxy_auth_types) {
-  CURB_IMMED_SETTER(ruby_curl_easy, proxy_auth_types, 0);
+static VALUE ruby_curl_easy_proxy_auth_types_set(int argc, VALUE *argv, VALUE self) {
+  ruby_curl_easy *rbce;
+  VALUE args_ary;
+
+  rb_scan_args(argc, argv, "*", &args_ary);
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+
+  rbce->proxy_auth_types = ruby_curl_easy_auth_types_to_mask(args_ary);
+  return LONG2NUM(rbce->proxy_auth_types);
 }
 
 /*
@@ -6067,8 +6101,9 @@ static VALUE ruby_curl_easy_escape(VALUE self, VALUE svalue) {
 
   TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
-  /* NOTE: make sure the value is a string, if not call to_s */
-  if( rb_type(str) != T_STRING ) { str = rb_funcall(str,rb_intern("to_s"),0); }
+  /* NOTE: make sure the value is a string; rb_obj_as_string always yields a
+   * String, even if the object's to_s misbehaves and returns a non-String. */
+  if( rb_type(str) != T_STRING ) { str = rb_obj_as_string(str); }
 
 #if (LIBCURL_VERSION_NUM >= 0x070f04)
   result = (char*)curl_easy_escape(rbce->curl, StringValuePtr(str), (int)RSTRING_LEN(str));
@@ -6098,6 +6133,11 @@ static VALUE ruby_curl_easy_unescape(VALUE self, VALUE str) {
 
   TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
 
+  /* Coerce as its own statement before use below - StringValuePtr and
+   * RSTRING_LEN are sibling args to the same call and C does not guarantee
+   * left-to-right evaluation order between them. */
+  StringValue(str);
+
 #if (LIBCURL_VERSION_NUM >= 0x070f04)
   result = (char*)curl_easy_unescape(rbce->curl, StringValuePtr(str), (int)RSTRING_LEN(str), &rlen);
 #else
@@ -6132,7 +6172,7 @@ void init_curb_easy() {
   idNetworkPolicyNone = rb_intern("none");
   idNetworkPolicyPublic = rb_intern("public");
 
-  rbstrAmp = rb_str_new2("&");
+  rbstrAmp = rb_obj_freeze(rb_str_new2("&"));
   rb_global_variable(&rbstrAmp);
 
   cCurlEasy = rb_define_class_under(mCurl, "Easy", rb_cObject);
@@ -6203,7 +6243,7 @@ void init_curb_easy() {
   rb_define_method(cCurlEasy, "proxy_type", ruby_curl_easy_proxy_type_get, 0);
   rb_define_method(cCurlEasy, "http_auth_types=", ruby_curl_easy_http_auth_types_set, -1);
   rb_define_method(cCurlEasy, "http_auth_types", ruby_curl_easy_http_auth_types_get, 0);
-  rb_define_method(cCurlEasy, "proxy_auth_types=", ruby_curl_easy_proxy_auth_types_set, 1);
+  rb_define_method(cCurlEasy, "proxy_auth_types=", ruby_curl_easy_proxy_auth_types_set, -1);
   rb_define_method(cCurlEasy, "proxy_auth_types", ruby_curl_easy_proxy_auth_types_get, 0);
   rb_define_method(cCurlEasy, "max_redirects=", ruby_curl_easy_max_redirects_set, 1);
   rb_define_method(cCurlEasy, "max_redirects", ruby_curl_easy_max_redirects_get, 0);

data/ext/curb_easy.h

@@ -112,6 +112,7 @@ typedef struct {
   curb_cidr_rule *network_allowed_cidr_rules;
   char **network_allowed_hosts;
 
+  /* attachment_sequence of the multi at the time this easy was last added. */
   unsigned long multi_attachment_generation;
   curl_off_t downloaded_body_bytes;
   size_t network_allowed_cidr_rule_count;