curb 1.4.0 → 1.4.1

data/tests/tc_curl_easy.rb

@@ -10,6 +10,122 @@ class FooBadToS
 end
 
 class TestCurbCurlEasy < Test::Unit::TestCase
+  CONNECTION_INFO_METHODS = %i[
+    last_effective_url response_code code primary_ip http_connect_code file_time
+    total_time name_lookup_time connect_time app_connect_time pre_transfer_time
+    start_transfer_time redirect_time redirect_count redirect_url downloaded_bytes
+    uploaded_bytes download_speed upload_speed header_size request_size
+    ssl_verify_result downloaded_content_length uploaded_content_length content_type
+    os_errno num_connects cookielist ftp_entry_path
+  ].freeze
+
+  def test_uninitialized_handles_reject_native_operations
+    subclass = Class.new(Curl::Easy) { def initialize; end }
+    [Curl::Easy.allocate, subclass.new].each do |easy|
+      methods = CONNECTION_INFO_METHODS + %i[reset close clone dup perform]
+      methods.each do |method|
+        next unless easy.respond_to?(method)
+        error = assert_raise(Curl::Err::FailedInitError, method.to_s) { easy.public_send(method) }
+        assert_match(/not initialized/, error.message)
+      end
+      [[:escape, "x"], [:unescape, "x"], [:setopt, Curl::CURLOPT_VERBOSE, true],
+       [:http_post, "x"], [:http_put, "x"], [:http_patch, "x"]].each do |args|
+        assert_raise(Curl::Err::FailedInitError, args.first.to_s) { easy.public_send(*args) }
+      end
+      multi = Curl::Multi.new
+      begin
+        assert_raise(Curl::Err::FailedInitError) { multi.add(easy) }
+        assert_raise(Curl::Err::FailedInitError) { multi.send(:_remove, easy) }
+      ensure
+        multi.close
+      end
+    end
+  end
+
+  def test_allocated_handle_can_be_initialized
+    easy = Curl::Easy.allocate
+    easy.send(:initialize, $TEST_URL)
+    easy.perform
+    # libcurl normalizes file:///C:/ to file://C:/ on Windows.
+    expected_url = WINDOWS ? $TEST_URL.sub(%r{\Afile:///}, "file://") : $TEST_URL
+    assert_equal expected_url, easy.last_effective_url
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  end
+
+  def test_connection_info_before_perform
+    easy = Curl::Easy.new
+    CONNECTION_INFO_METHODS.each do |method|
+      next unless easy.respond_to?(method)
+      assert_nothing_raised(method.to_s) { easy.public_send(method) }
+    end
+    assert_nil easy.last_effective_url
+    assert_nil easy.content_type
+    assert_equal 0, easy.response_code
+  end
+
+  def test_reinitialize_detaches_previous_handle
+    easy = Curl::Easy.new($TEST_URL)
+    easy.headers = { "X-Old" => "old" }
+    multi = Curl::Multi.new
+    multi.add(easy)
+    easy.send(:initialize, $TEST_URL)
+    assert_nil easy.multi
+    assert_equal({}, easy.headers)
+    multi.perform
+    easy.perform
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+    multi.add(easy)
+    multi.perform
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  ensure
+    multi.close if multi
+  end
+
+  [:initialize, :close, :reset].each do |operation|
+    define_method("test_#{operation}_removes_multi_bookkeeping_before_readd") do
+      easy = Curl::Easy.new($TEST_URL)
+      multi = Curl::Multi.new
+      multi.add(easy)
+      easy.__send__(operation)
+
+      assert_nil easy.multi
+      assert_empty multi.requests
+      assert_empty multi.__send__(:__curb_native_safety_signatures)
+
+      easy.url = $TEST_URL
+      multi.add(easy)
+      assert_equal [easy], multi.requests.values
+      multi.perform
+      assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+    ensure
+      multi.close if multi
+      easy.close if easy
+    end
+  end
+
+  def test_reinitialize_during_callback_is_blocked
+    easy = Curl::Easy.new($TEST_URL)
+    easy.on_body do |data|
+      error = assert_raise(RuntimeError) { easy.send(:initialize, $TEST_URL) }
+      assert_match(/Cannot initialize an active curl handle/, error.message)
+      data.bytesize
+    end
+    easy.perform
+    easy.send(:initialize, $TEST_URL)
+    easy.perform
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  end
+
+  def test_reinitialize_during_argument_coercion_is_blocked
+    easy = Curl::Easy.new($TEST_URL)
+    field = Object.new
+    field.define_singleton_method(:to_s) { easy.send(:initialize, $TEST_URL); "a=b" }
+    error = assert_raise(RuntimeError) { easy.http_post(field) }
+    assert_match(/Cannot initialize an active curl handle/, error.message)
+    easy.perform
+    assert_match(/^# DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  end
+
   def test_global_reset
     Curl.get($TEST_URL)
     # in a Timeout block you should reset the thread current handle 

data/tests/tc_curl_easy_cookielist.rb

@@ -186,13 +186,15 @@ class TestCurbCurlEasyCookielist < Test::Unit::TestCase
       cookiefile = File.join(Dir.tmpdir, 'curl_test_cookiefile')
       assert !File.exist?(cookiefile)
       begin
+        # Use host-only file cookies: libpsl builds normalize localhost domain
+        # cookies on file load, but COOKIELIST imports retain tail matching.
         cookielist = [
           # Won't be updated, added instead
-          ".localhost\tTRUE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent\t84",
-          ".localhost\tTRUE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent_file\t84",
+          "localhost\tFALSE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent\t84",
+          "localhost\tFALSE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent_file\t84",
           # Won't be updated, added instead
-          ".localhost\tTRUE\t/\tFALSE\t0\tsession\t840",
-          ".localhost\tTRUE\t/\tFALSE\t0\tsession_file\t840",
+          "localhost\tFALSE\t/\tFALSE\t0\tsession\t840",
+          "localhost\tFALSE\t/\tFALSE\t0\tsession_file\t840",
           '',
         ]
         File.write(cookiefile, cookielist.join("\n"))
@@ -204,10 +206,10 @@ class TestCurbCurlEasyCookielist < Test::Unit::TestCase
         expected_cookielist = [
           ".localhost\tTRUE\t/\tFALSE\t#{expires.to_time.to_i}\tpermanent\t42",
           ".localhost\tTRUE\t/\tFALSE\t0\tsession\t420",
-          ".localhost\tTRUE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent\t84",
-          ".localhost\tTRUE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent_file\t84",
-          ".localhost\tTRUE\t/\tFALSE\t0\tsession\t840",
-          ".localhost\tTRUE\t/\tFALSE\t0\tsession_file\t840",
+          "localhost\tFALSE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent\t84",
+          "localhost\tFALSE\t/\tFALSE\t#{expires_file.to_time.to_i}\tpermanent_file\t84",
+          "localhost\tFALSE\t/\tFALSE\t0\tsession\t840",
+          "localhost\tFALSE\t/\tFALSE\t0\tsession_file\t840",
         ]
         assert_equal expected_cookielist, easy.cookielist
         easy.perform

data/tests/tc_curl_maxfilesize.rb

@@ -10,6 +10,94 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
     super
   end
 
+  def test_safe_body_limit_defaults_and_raw_requests
+    assert_equal 10 * 1024 * 1024, Curl::SafetyConfig.new.max_body_bytes
+    assert_nil @easy.max_body_bytes
+    stub_public_network_policy_for_local_fixture(@easy)
+    @easy.safe_http!
+    assert_equal Curl::SafetyConfig::DEFAULT_MAX_BODY_BYTES, @easy.max_body_bytes
+    @easy.max_body_bytes = nil
+    Curl.__send__(:apply_safety!, @easy)
+    assert_equal Curl::SafetyConfig::DEFAULT_MAX_BODY_BYTES, @easy.max_body_bytes
+  end
+
+  [:global, :helper, :handle].each do |mode|
+    define_method("test_#{mode}_default_body_limit_rejects_oversized_response") do
+      payload = 'x' * (Curl::SafetyConfig::DEFAULT_MAX_BODY_BYTES + 1)
+      with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: #{payload.bytesize}\r\n\r\n#{payload}") do |url|
+        assert_body_limit_error do
+          if mode == :helper
+            Curl.safe_get(url) { |easy| stub_public_network_policy_for_local_fixture(easy) }
+          else
+            Curl.safe! if mode == :global
+            @easy.url = url
+            stub_public_network_policy_for_local_fixture(@easy)
+            @easy.safe_http! if mode == :handle
+            @easy.perform
+          end
+        end
+      end
+    end
+  end
+
+  def test_default_body_limit_bounds_callback_delivery_without_content_length
+    limit = Curl::SafetyConfig::DEFAULT_MAX_BODY_BYTES
+    payload = 'x' * (limit + 1)
+    received = 0
+    with_raw_http_response("HTTP/1.0 200 OK\r\n\r\n#{payload}") do |url|
+      @easy.url = url
+      stub_public_network_policy_for_local_fixture(@easy)
+      @easy.safe_http!
+      @easy.on_body { |data| received += data.bytesize; data.bytesize }
+      assert_body_limit_error { @easy.perform }
+    end
+    assert_operator received, :<=, limit
+    assert_operator received, :>, 0
+  end
+
+  def test_global_body_limit_can_be_explicitly_disabled
+    Curl.safe! { |config| config.max_body_bytes = nil }
+    stub_public_network_policy_for_local_fixture(@easy)
+    @easy.safe_http!
+    assert_nil @easy.max_body_bytes
+  end
+
+  def test_safe_helper_accepts_explicit_larger_limit_and_unlimited
+    [20 * 1024 * 1024, nil, 0].each do |limit|
+      with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok") do |url|
+        easy = Curl.safe_get(url, :max_body_bytes => limit) do |handle|
+          stub_public_network_policy_for_local_fixture(handle)
+        end
+        assert_equal(limit == 0 ? nil : limit, easy.max_body_bytes)
+        assert_equal 'ok', easy.body_str
+      end
+    end
+  end
+
+  def test_safe_helper_inherits_global_body_limit
+    Curl.safe! { |config| config.max_body_bytes = 20 * 1024 * 1024 }
+    stub_public_network_policy_for_local_fixture(@easy)
+    @easy.safe_http!
+    assert_equal 20 * 1024 * 1024, @easy.max_body_bytes
+  end
+
+  def test_safe_helper_cannot_weaken_global_body_limit
+    Curl.safe! { |config| config.max_body_bytes = 10 }
+    [100, nil, 0].each do |limit|
+      with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
+        assert_body_limit_error do
+          Curl.safe_get(url, :max_body_bytes => limit) do |handle|
+            stub_public_network_policy_for_local_fixture(handle)
+          end
+        end
+      end
+    end
+  end
+
+  def test_safe_http_rejects_negative_body_limit
+    assert_raise(ArgumentError) { @easy.safe_http!(:max_body_bytes => -1) }
+  end
+
   def test_maxfilesize_setopt
     @easy.set(Curl::CURLOPT_MAXFILESIZE, 5000000)
     @easy.set(Curl::CURLOPT_MAXFILESIZE_LARGE, 5000000) if Curl.const_defined?(:CURLOPT_MAXFILESIZE_LARGE)
@@ -41,7 +129,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
   def test_safe_get_accepts_max_body_bytes_as_second_argument
     with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
       assert_body_limit_error do
-        Curl.safe_get(url, :max_body_bytes => 10)
+        Curl.safe_get(url, :max_body_bytes => 10) { |easy| stub_public_network_policy_for_local_fixture(easy) }
       end
     end
   end
@@ -50,6 +138,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
     with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 64\r\n\r\n#{'x' * 64}") do |url|
       assert_body_limit_error do
         Curl.safe_get(url, {}, :max_body_bytes => 10) do |easy|
+          stub_public_network_policy_for_local_fixture(easy)
           easy.max_body_bytes = nil
         end
       end
@@ -63,6 +152,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
       end
 
       @easy.url = url
+      stub_public_network_policy_for_local_fixture(@easy)
 
       assert_body_limit_error do
         @easy.perform
@@ -78,6 +168,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
 
       assert_body_limit_error do
         Curl.get(url) do |easy|
+          stub_public_network_policy_for_local_fixture(easy)
           easy.max_body_bytes = nil
         end
       end
@@ -91,7 +182,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
       end
 
       assert_body_limit_error do
-        Curl.safe_get(url, :max_body_bytes => 10)
+        Curl.safe_get(url, :max_body_bytes => 10) { |easy| stub_public_network_policy_for_local_fixture(easy) }
       end
     end
   end
@@ -106,7 +197,7 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
 
   def test_safe_head_does_not_apply_body_cap_to_content_length
     with_raw_http_response("HTTP/1.1 200 OK\r\nContent-Length: 65536\r\n\r\n") do |url|
-      easy = Curl.safe_head(url, :max_body_bytes => 1)
+      easy = Curl.safe_head(url, :max_body_bytes => 1) { |handle| stub_public_network_policy_for_local_fixture(handle) }
 
       assert_equal 200, easy.response_code
       assert_equal '', easy.body_str
@@ -182,6 +273,14 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
 
   private
 
+  # Keep body-limit integration tests local; real destination enforcement is
+  # covered separately in tc_curl_network_policy.rb.
+  def stub_public_network_policy_for_local_fixture(easy)
+    def easy.network_policy=(policy)
+      raise "unexpected policy: #{policy}" unless policy == :public
+    end
+  end
+
   def assert_body_limit_error
     assert_raise(Curl::Err::FileSizeExceededError) do
       yield
@@ -197,8 +296,13 @@ class TestCurbCurlMaxFileSize < Test::Unit::TestCase
         socket.readpartial(4096)
       rescue EOFError
       end
-      socket.write(response)
-      socket.close
+      begin
+        socket.write(response)
+      rescue Errno::EPIPE, Errno::ECONNRESET
+        # Expected when the client aborts at the body limit.
+      ensure
+        socket.close
+      end
     end
 
     yield "http://127.0.0.1:#{port}/"

data/tests/tc_curl_native_coverage.rb

@@ -106,6 +106,63 @@ class TestCurbCurlNativeCoverage < Test::Unit::TestCase
     easy.close if defined?(easy) && easy
   end
 
+  [:clone, :dup].each do |copy_method|
+    [:on_body, :on_header, :on_progress, :on_debug, :on_complete].each do |callback|
+      define_method("test_#{copy_method}_during_multipart_#{callback}_detaches_form") do
+        easy = Curl::Easy.new(TestServlet.url)
+        easy.multipart_form_post = true
+        easy.verbose = true if callback == :on_debug
+        copies = []
+        easy.public_send(callback) do |*args|
+          if copies.empty?
+            # The public option can change while the native form is attached.
+            easy.multipart_form_post = false
+            copies << easy.public_send(copy_method)
+          end
+          [:on_body, :on_header].include?(callback) ? args.first.bytesize : true
+        end
+
+        easy.http_post(Curl::PostField.content('original', 'temporary-form'))
+        assert_equal 1, copies.size, "#{callback} must run during the multipart request"
+        copy = copies.first
+        copy.public_send(callback) # Remove the inherited callback.
+        copy.verbose = false
+
+        # Plain perform must not access or resend the original's freed form.
+        copy.perform
+        easy.public_send(callback)
+        easy.verbose = false
+        easy.perform
+        assert_equal easy.body_str, copy.body_str
+        assert_no_match(/temporary-form|name="original"/, copy.body_str)
+
+        copy.multipart_form_post = true
+        copy.http_post(Curl::PostField.content('replacement', 'fresh-form'))
+        assert_match(/name="replacement"/, copy.body_str)
+        assert_match(/fresh-form/, copy.body_str)
+        assert_no_match(/temporary-form/, copy.body_str)
+      ensure
+        copies&.each(&:close)
+        easy&.close
+      end
+    end
+
+    define_method("test_#{copy_method}_preserves_post_after_multipart_cleanup") do
+      easy = Curl::Easy.new(TestServlet.url)
+      easy.multipart_form_post = true
+      easy.http_post(Curl::PostField.content('original', 'temporary-form'))
+      easy.multipart_form_post = false
+      easy.post_body = 'ordinary=post'
+
+      copy = easy.public_send(copy_method)
+      copy.perform
+      assert_equal "POST\nordinary=post", copy.body_str
+    ensure
+      copy&.close
+      easy&.close
+    end
+  end
+
   def test_native_accessors_round_trip
     easy = Curl::Easy.new(TestServlet.url)
 

data/tests/tc_curl_network_policy.rb

@@ -12,6 +12,110 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
     super
   end
 
+  def test_safe_bang_defaults_to_public_network_policy
+    assert_equal :public, Curl::SafetyConfig.new.network_policy
+    require_public_network_policy!
+    Curl.safe!
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { Curl.get(TestServlet.url) }
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.network_policy = :none
+    assert_raise(Curl::Err::UnsafeDestinationError) { easy.perform }
+    assert_equal :public, easy.network_policy
+  end
+
+  def test_safe_bang_default_blocks_private_and_metadata_destinations
+    require_public_network_policy!
+    Curl.safe!
+    ['10.0.0.1', '172.16.0.1', '192.168.0.1', '169.254.169.254', '[::1]'].each do |host|
+      assert_raise(Curl::Err::UnsafeDestinationError, host) do
+        Curl.get("http://#{host}/") do |easy|
+          easy.network_policy = :none
+          easy.connect_timeout_ms = 100
+          easy.timeout_ms = 200
+        end
+      end
+    end
+  end
+
+  def test_safe_bang_default_applies_to_previously_added_multi_handles
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    multi = Curl::Multi.new
+    multi.add(easy)
+    Curl.safe!
+    multi.perform
+
+    assert_equal :public, easy.network_policy
+    assert_match(/127\.0\.0\.1/, easy.unsafe_destination_error)
+  ensure
+    multi.close if multi
+  end
+
+  def test_safe_helpers_block_loopback_without_global_policy
+    require_public_network_policy!
+    [:get, :post, :put, :delete, :patch, :head, :options].each do |verb|
+      assert_raise(Curl::Err::UnsafeDestinationError, verb.to_s) do
+        Curl.public_send("safe_#{verb}", TestServlet.url) do |easy|
+          easy.network_policy = :none
+        end
+      end
+    end
+  end
+
+  def test_safe_http_reapplies_public_policy_before_perform
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    assert_same easy, easy.safe_http!
+    assert_equal :public, easy.network_policy
+    easy.network_policy = :none
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { easy.perform }
+  end
+
+  def test_safe_http_cannot_be_weakened_by_global_policy
+    require_public_network_policy!
+    Curl.safe! { |config| config.network_policy = :none }
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { Curl.safe_get(TestServlet.url) }
+  end
+
+  def test_safe_helpers_block_private_and_metadata_destinations
+    require_public_network_policy!
+    ['10.0.0.1', '172.16.0.1', '192.168.0.1', '169.254.169.254', '[::1]'].each do |host|
+      assert_raise(Curl::Err::UnsafeDestinationError, host) do
+        Curl.safe_get("http://#{host}/") do |easy|
+          easy.connect_timeout_ms = 100
+          easy.timeout_ms = 200
+        end
+      end
+    end
+  end
+
+  def test_safe_http_rejects_resolve_override_without_global_policy
+    require_public_network_policy!
+    assert_raise(Curl::Err::UnsafeDestinationError) do
+      Curl.safe_get('http://example.invalid/') do |easy|
+        easy.resolve = ['example.invalid:80:127.0.0.1']
+      end
+    end
+  end
+
+  def test_safe_http_applies_to_multi
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.safe_http!
+    easy.network_policy = :none
+    multi = Curl::Multi.new
+    multi.add(easy)
+    multi.perform
+
+    assert_equal :public, easy.network_policy
+    assert_match(/127\.0\.0\.1/, easy.unsafe_destination_error)
+  ensure
+    multi.close if multi
+  end
+
   def test_network_policy_defaults_to_none
     easy = Curl::Easy.new
 
@@ -95,6 +199,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
     with_host_redirect_server(allowed_host, allowed_host) do |port, hits|
       Curl.safe! do |config|
+        config.network_policy = :none # Isolate host filtering from peer filtering.
         config.allowed_hosts = [allowed_host]
       end
 
@@ -119,6 +224,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
     with_host_redirect_server(allowed_host, blocked_host) do |port, hits|
       Curl.safe! do |config|
+        config.network_policy = :none # Isolate host filtering from peer filtering.
         config.allowed_hosts = [allowed_host]
       end
 
@@ -142,6 +248,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
   def test_safe_bang_allowed_cidrs_requires_public_network_policy
     Curl.safe! do |config|
+      config.network_policy = :none # Isolate the host/CIDR policy from peer filtering.
       config.allowed_cidrs = ['1.1.1.0/24']
     end
 
@@ -1080,7 +1187,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
       multi = Curl::Multi.new
 
       multi.add(easy)
-      Curl.safe!
+      Curl.safe! { |config| config.network_policy = :none }
       multi.perform
 
       assert_equal [['1']], request_headers

data/tests/tc_curl_postfield.rb

@@ -253,6 +253,143 @@ class TestCurbCurlPostfieldMultipartCoverage < Test::Unit::TestCase
     server_setup
   end
 
+  [:http_post, :http_patch, :http_put].each do |method|
+    [:close, :reset, :initialize, :perform, :http_post, :post_body=].each do |operation|
+      [:proc, :coercion].each do |source|
+        define_method("test_#{method}_guards_#{operation}_from_#{source}") do
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+          action = lambda do |*_|
+            if operation == :post_body=
+              curl.post_body = 'replacement'
+            elsif operation == :http_post
+              curl.http_post(Curl::PostField.content('nested', 'payload'))
+            else
+              curl.__send__(operation)
+            end
+            'payload'
+          end
+          field = if source == :proc
+            Curl::PostField.content('trigger', &action)
+          else
+            value = Object.new
+            value.define_singleton_method(:to_str, &action)
+            Curl::PostField.content('trigger', value)
+          end
+
+          error = assert_raise(RuntimeError) do
+            curl.__send__(method, Curl::PostField.content('first', 'allocated'), field)
+          end
+          assert_match(/active curl handle/, error.message)
+
+          # Both partial forms and guards must unwind before reuse.
+          curl.multipart_form_post = false
+          curl.perform
+          assert_equal 'GET', curl.body_str
+          assert_nothing_raised { curl.reset }
+          assert_nothing_raised { curl.close }
+        end
+      end
+    end
+  end
+
+  [:content, :file].each do |kind|
+    [false, true].each do |dynamic|
+      define_method("test_multipart_snapshots_#{kind}_#{dynamic ? 'proc' : 'direct'}") do
+        name = +'original_name'
+        payload = +"original\0payload"
+        field = multipart_field(kind, dynamic, nil, payload)
+        field.name = name
+        later = Curl::PostField.content('later') do
+          Thread.new do
+            name.replace('changed_name' * 1000)
+            payload.replace('changed_payload' * 1000)
+            field.content = nil
+            field.name = nil
+            GC.start
+            GC.verify_compaction_references(double_heap: true, toward: :empty) if GC.respond_to?(:verify_compaction_references)
+          end.join
+          'later_value'
+        end
+        curl = Curl::Easy.new(TestServlet.url)
+        curl.multipart_form_post = true
+        curl.http_post(field, later)
+
+        assert_include curl.body_str, 'name="original_name"'
+        assert_include curl.body_str, "original\0payload"
+        assert_include curl.body_str, 'filename="remote.txt"' if kind == :file
+        assert_not_include curl.body_str, 'changed_payload'
+      end
+    end
+  end
+
+  def test_multipart_snapshots_before_later_coercions_in_same_field
+    name = +'original_name'
+    payload = +'original_payload'
+    content_type = Object.new
+    content_type.define_singleton_method(:to_str) do
+      name.replace('changed_name' * 1000)
+      payload.replace('changed_payload' * 1000)
+      'text/plain'
+    end
+    field = Curl::PostField.content(name, payload, content_type)
+    curl = Curl::Easy.new(TestServlet.url)
+    curl.multipart_form_post = true
+    curl.http_post(field)
+
+    assert_include curl.body_str, 'name="original_name"'
+    assert_include curl.body_str, 'original_payload'
+  end
+
+  # Exercise each pointer/length pair with and without a content type.
+  [:content, :file].each do |kind|
+    [false, true].each do |dynamic|
+      [nil, 'text/plain'].each do |content_type|
+        variant = "#{kind}_#{dynamic ? 'proc' : 'direct'}_#{content_type ? 'typed' : 'untyped'}"
+
+        define_method("test_multipart_coerces_#{variant}") do
+          payload = "before\0after"
+          string_like = Object.new
+          string_like.define_singleton_method(:to_str) { payload }
+          field = multipart_field(kind, dynamic, content_type, string_like)
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+
+          curl.http_post(field)
+
+          assert_include curl.body_str, payload
+          assert_equal payload, field.content unless dynamic
+        end
+
+        define_method("test_multipart_rejects_non_string_#{variant}") do
+          field = multipart_field(kind, dynamic, content_type, 5)
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+
+          assert_raise(TypeError) { curl.http_post(field) }
+        end
+      end
+    end
+  end
+
+  def multipart_field(kind, dynamic, content_type, value)
+    field = if dynamic
+      if kind == :file
+        Curl::PostField.file('upload', 'remote.txt') { value }
+      else
+        Curl::PostField.content('value') { value }
+      end
+    elsif kind == :file
+      upload = Curl::PostField.file('upload', 'remote.txt')
+      upload.content = value
+      upload
+    else
+      Curl::PostField.content('value', value)
+    end
+    field.content_type = content_type
+    field
+  end
+
   def test_multipart_content_variants_include_dynamic_and_typed_fields
     curl = Curl::Easy.new(TestServlet.url)
     curl.multipart_form_post = true