curb 1.4.0 → 1.5.0

data/ext/extconf.rb

@@ -699,6 +699,7 @@ have_header('ruby/thread.h') && have_func('rb_thread_call_without_gvl', 'ruby/th
 have_header('ruby/io.h')
 # Ruby 4.x exports rb_thread_fd_select without declaring it in ruby/io.h.
 have_func('rb_thread_fd_select')
+have_func('rb_io_descriptor', 'ruby/io.h')
 have_func('rb_wait_for_single_fd', 'ruby/io.h')
 have_header('ruby/fiber/scheduler.h')
 have_func('rb_fiber_scheduler_current', 'ruby/fiber/scheduler.h')

data/lib/curl/easy.rb

@@ -53,6 +53,11 @@ module Curl
 
       def flush_deferred_multi_closes(all_threads: false)
         state = deferred_multi_close_state
+        # Fast path: nothing queued, so skip the mutex and list partitioning.
+        # A close queued concurrently by another thread is picked up next time.
+        queued = state[:deferred_multi_closes]
+        return if queued.nil? || queued.empty?
+
         pending = deferred_multi_close_mutex.synchronize do
           deferred_closes = (state[:deferred_multi_closes] ||= [])
 
@@ -184,10 +189,20 @@ module Curl
       set_protocol_allowlist('CURLOPT_REDIR_PROTOCOLS_STR', 'CURLOPT_REDIR_PROTOCOLS', protocols)
     end
 
-    def safe_http!
+    def safe_http!(options = {})
+      options = Curl.__send__(:safe_http_options, options)
+      config = Curl.__send__(:ractor_local_state)[:safety_config] || Curl::SafetyConfig.new
+      limit = Curl::SafetyConfig.new
+      limit.max_body_bytes = options.fetch(:max_body_bytes, config.max_body_bytes)
+      limit.timeout = options.fetch(:timeout, config.timeout)
+      limit.max_redirects = options.fetch(:max_redirects, config.max_redirects)
       __curb_set_safety_override!(
         :protocols => [:http, :https],
-        :redirect_protocols => [:http, :https]
+        :redirect_protocols => [:http, :https],
+        :network_policy => :public,
+        :max_body_bytes => limit.max_body_bytes,
+        :timeout => limit.timeout,
+        :max_redirects => limit.max_redirects
       )
     end
 
@@ -197,7 +212,10 @@ module Curl
       @__curb_safety_override = (defined?(@__curb_safety_override) && @__curb_safety_override) ? @__curb_safety_override.dup : {}
       @__curb_safety_override[:protocols] = Array(options[:protocols]).map { |protocol| protocol.to_s.downcase.to_sym } if options.key?(:protocols)
       @__curb_safety_override[:redirect_protocols] = Array(options[:redirect_protocols]).map { |protocol| protocol.to_s.downcase.to_sym } if options.key?(:redirect_protocols)
-      @__curb_safety_override[:max_body_bytes] = options[:max_body_bytes] if options.key?(:max_body_bytes) && options[:max_body_bytes]
+      @__curb_safety_override[:max_body_bytes] = options[:max_body_bytes] if options.key?(:max_body_bytes)
+      @__curb_safety_override[:network_policy] = options[:network_policy] if options.key?(:network_policy)
+      @__curb_safety_override[:timeout] = options[:timeout] if options.key?(:timeout)
+      @__curb_safety_override[:max_redirects] = options[:max_redirects] if options.key?(:max_redirects)
       @__curb_safety_override_generation = __curb_safety_override_generation + 1
       Curl.__send__(:apply_safety!, self) if Curl.respond_to?(:apply_safety!, true)
       self
@@ -263,7 +281,9 @@ module Curl
     # the configured HTTP Verb.
     #
     def perform
-      Curl.__send__(:apply_safety!, self) if Curl.respond_to?(:apply_safety!, true)
+      # Validate eagerly so an unsafe request raises in the caller (and not in
+      # a shared scheduler driver fiber). Multi#add re-applies it as well.
+      Curl.__send__(:apply_safety!, self) if Curl.__send__(:safety_active_for?, self)
       self.class.flush_deferred_multi_closes
 
       if Curl.scheduler_active? && self.multi.nil?

data/lib/curl/multi.rb

@@ -353,6 +353,15 @@ module Curl
       ]
     end
 
+    # True when no per-easy safety state (override or native policy) is set.
+    # Callers must separately check that no global Curl.safe! config exists.
+    def __curb_safety_unconstrained?(easy)
+      easy.instance_variable_get(:@__curb_safety_override).nil? &&
+        easy.network_policy == :none &&
+        easy.allowed_hosts.nil? &&
+        easy.allowed_cidrs.nil?
+    end
+
     def __record_native_safety_signature(easy)
       __curb_native_safety_signatures[easy.object_id] = __curb_safety_signature_for(easy)
     end
@@ -419,24 +428,33 @@ module Curl
 
     private :__idle_easy_references, :__curb_native_safety_signatures,
             :__curb_safety_signature_for, :__record_native_safety_signature,
+            :__curb_safety_unconstrained?,
             :__register_idle_easy_reference,
             :__unregister_idle_easy_reference, :__clear_idle_easy_references,
             :__new_idle_easy_references
 
     alias_method :_curb_native_perform, :perform
 
-    def perform(*args, &block)
+    def perform(&block)
+      safety_config_active = !Curl.__send__(:ractor_local_state)[:safety_config].nil?
+      signatures = __curb_native_safety_signatures
+
       requests.each_value do |easy|
-        Curl.__send__(:apply_safety!, easy) if Curl.respond_to?(:apply_safety!, true)
+        # An easy added with no safety state recorded no signature. If it is
+        # still unconstrained its signature would be unchanged, so there is
+        # nothing to apply and no need to re-run native setup.
+        next if !safety_config_active && !signatures.key?(easy.object_id) &&
+                __curb_safety_unconstrained?(easy)
+
+        Curl.__send__(:apply_safety!, easy)
         signature = __curb_safety_signature_for(easy)
-        if __curb_native_safety_signatures[easy.object_id] != signature &&
-           easy.respond_to?(:__curb_native_setup!, true)
+        if signatures[easy.object_id] != signature
           easy.__send__(:__curb_native_setup!)
-          __curb_native_safety_signatures[easy.object_id] = signature
+          signatures[easy.object_id] = signature
         end
       end
 
-      _curb_native_perform(*args, &block)
+      _curb_native_perform(&block)
     end
 
     def add(easy)
@@ -444,19 +462,23 @@ module Curl
       # Once a deferred callback exception is pending, Multi#perform is
       # draining existing transfers only and must not start replacement work.
       return self if instance_variable_defined?(:@__curb_deferred_exception)
-      Curl.__send__(:apply_safety!, easy) if Curl.respond_to?(:apply_safety!, true)
+      unconstrained = Curl.__send__(:ractor_local_state)[:safety_config].nil? &&
+                      __curb_safety_unconstrained?(easy)
+      Curl.__send__(:apply_safety!, easy) unless unconstrained
       _add(easy)
       __unregister_idle_easy_reference(easy)
       requests[easy.object_id] = easy
-      __record_native_safety_signature(easy)
+      # Unconstrained easies record no signature; #perform treats a missing
+      # signature as "added with no safety state" (see #perform).
+      __record_native_safety_signature(easy) unless unconstrained
       self
     end
 
     def remove(easy)
       return self if !requests[easy.object_id]
+      _remove(easy)
       requests.delete(easy.object_id)
       __curb_native_safety_signatures.delete(easy.object_id)
-      _remove(easy)
       self
     end
 

data/lib/curl.rb

@@ -12,9 +12,14 @@ module Curl
   # Ractors, even when the value itself would otherwise be safe. Keep curb's
   # mutable Ruby-side configuration in storage owned by the current Ractor.
   # Older Rubies retain the historical process-wide state.
+  # Ractor capabilities can't change at runtime, so probe them once instead of
+  # on every call: this lookup sits on the per-request path.
+  RACTOR_LOCAL_STORAGE = !!(defined?(Ractor) && Ractor.respond_to?(:current) &&
+                            Ractor.current.respond_to?(:[]) && Ractor.current.respond_to?(:[]=))
+  private_constant :RACTOR_LOCAL_STORAGE
+
   def self.ractor_local_state
-    if defined?(Ractor) && Ractor.respond_to?(:current) &&
-       Ractor.current.respond_to?(:[]) && Ractor.current.respond_to?(:[]=)
+    if RACTOR_LOCAL_STORAGE
       Ractor.current[:__curb_ractor_local_state] ||= {}
     else
       @legacy_local_state ||= {}
@@ -23,15 +28,20 @@ module Curl
 
   class SafetyConfig
     DEFAULT_PROTOCOLS = [:http, :https].freeze
+    DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024
+    DEFAULT_TIMEOUT = 60
+    DEFAULT_MAX_REDIRECTS = 20
 
-    attr_reader :max_body_bytes, :network_policy
+    attr_reader :max_body_bytes, :network_policy, :timeout, :max_redirects
     attr_accessor :allow_proxies, :allow_resolve, :allow_connect_to, :allow_doh, :allow_unix_socket
 
     def initialize
       @protocols = DEFAULT_PROTOCOLS
       @redirect_protocols = nil
-      @max_body_bytes = nil
-      @network_policy = nil
+      @max_body_bytes = DEFAULT_MAX_BODY_BYTES
+      @timeout = DEFAULT_TIMEOUT
+      @max_redirects = DEFAULT_MAX_REDIRECTS
+      @network_policy = :public
       @allowed_hosts = nil
       @allowed_proxy_hosts = nil
       @allowed_cidrs = nil
@@ -82,6 +92,32 @@ module Curl
       @max_body_bytes = bytes.zero? ? nil : bytes
     end
 
+    # Seconds; applied to handles with no timeout of their own. nil disables.
+    def timeout=(seconds)
+      if seconds.nil?
+        @timeout = nil
+        return
+      end
+
+      seconds = Float(seconds)
+      raise ArgumentError, "timeout must be greater than zero" unless seconds > 0
+
+      @timeout = seconds
+    end
+
+    # Applied to handles whose max_redirects is unset or unlimited. nil disables.
+    def max_redirects=(count)
+      if count.nil?
+        @max_redirects = nil
+        return
+      end
+
+      count = Integer(count)
+      raise ArgumentError, "max_redirects must be greater than or equal to zero" if count < 0
+
+      @max_redirects = count
+    end
+
     def network_policy=(policy)
       @network_policy = normalize_network_policy(policy)
     end
@@ -217,16 +253,35 @@ module Curl
     apply_allowed_hosts!(easy, config.allowed_hosts) if config&.allowed_hosts
     apply_allowed_cidrs!(easy, config) if config&.allowed_cidrs
 
-    if config&.network_policy
-      easy.network_policy = config.network_policy
-      apply_public_network_policy_controls!(easy, config) if config.network_policy == :public
+    network_policy = config&.network_policy
+    network_policy = :public if override && override[:network_policy] == :public
+    if network_policy
+      easy.network_policy = network_policy
+      apply_public_network_policy_controls!(easy, config || SafetyConfig.new) if network_policy == :public
     end
 
     apply_max_body_bytes!(easy, config.max_body_bytes) if config&.max_body_bytes
     apply_max_body_bytes!(easy, override[:max_body_bytes]) if override && override.key?(:max_body_bytes)
+    apply_default_timeout!(easy, override && override.key?(:timeout) ? override[:timeout] : config&.timeout)
+    apply_default_max_redirects!(easy, override && override.key?(:max_redirects) ? override[:max_redirects] : config&.max_redirects)
     easy
   end
 
+  # Only fills in a limit the handle has not chosen itself.
+  def self.apply_default_timeout!(easy, seconds)
+    return unless seconds
+    return unless easy.timeout_ms.to_i.zero?
+
+    easy.timeout = seconds
+  end
+
+  def self.apply_default_max_redirects!(easy, count)
+    return unless count
+
+    current = easy.max_redirects
+    easy.max_redirects = count if current.nil? || current < 0
+  end
+
   def self.clear_safe!
     ractor_local_state[:safety_config] = nil
     bump_safety_generation!
@@ -247,9 +302,7 @@ module Curl
   end
 
   def self.safety_override_for(easy)
-    if easy.respond_to?(:__curb_safety_override, true)
-      easy.__send__(:__curb_safety_override)
-    end
+    easy.instance_variable_get(:@__curb_safety_override)
   end
 
   def self.safety_generation
@@ -414,6 +467,7 @@ module Curl
                        :safety_generation, :bump_safety_generation!,
                        :safety_protocol_intersection,
                        :apply_max_body_bytes!, :apply_public_network_policy_controls!,
+                       :apply_default_timeout!, :apply_default_max_redirects!,
                        :apply_allowed_hosts!, :apply_allowed_cidrs!,
                        :apply_allowed_proxy!, :normalize_proxy_host,
                        :reject_resolve_override!, :reject_connect_to_override!,
@@ -421,6 +475,12 @@ module Curl
                        :reject_unix_socket_override!,
                        :disable_proxy!
 
+  # Multi#perform under a fiber scheduler uses the socket-action loop, which
+  # waits through the scheduler, exactly when this native method exists
+  # (same build condition). Otherwise it falls back to a thread-blocking wait.
+  SCHEDULER_COOPERATIVE_PERFORM = Curl::Multi.private_method_defined?(:_socket_perform)
+  private_constant :SCHEDULER_COOPERATIVE_PERFORM
+
   def self.scheduler_active?
     Fiber.respond_to?(:scheduler) && !Fiber.scheduler.nil?
   end
@@ -600,7 +660,11 @@ module Curl
             state[:multi].perform do
               drain_scheduler_pending(state)
               release_scheduler_waiters(state)
-              scheduler_yield
+              # The socket-action loop already waits through the scheduler on
+              # every pass, so sibling fibers run without an extra yield (which
+              # cost ~4 yields per request). The fallback loop blocks the thread
+              # while waiting, so it still needs one.
+              scheduler_yield unless SCHEDULER_COOPERATIVE_PERFORM
             end
           ensure
             # Release any siblings that completed just before a deferred
@@ -653,8 +717,7 @@ module Curl
 
     http(verb, url, post_body, put_data) do |handle|
       yield handle if block
-      handle.safe_http!
-      handle.max_body_bytes = options[:max_body_bytes] if options.key?(:max_body_bytes)
+      handle.safe_http!(options)
     end
   end
 
@@ -755,7 +818,7 @@ module Curl
   end
 
   def self.safe_http_option_keys
-    [:max_body_bytes]
+    [:max_body_bytes, :timeout, :max_redirects]
   end
 
   def self.reset

data/tests/bug_curb_easy_blocks_ruby_threads.rb

@@ -4,7 +4,7 @@ class BugTestInstancePostDiffersFromClassPost < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     @response_proc = lambda do|res|
       sleep 0.5
       res.body = "hi"

data/tests/bug_follow_redirect_288.rb

@@ -4,7 +4,7 @@ class BugFollowRedirect288 < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     super
     @server.mount_proc("/redirect_to_test") do|req,res|
       res.set_redirect(WEBrick::HTTPStatus::TemporaryRedirect, "/test")

data/tests/bug_poison.rb

@@ -5,7 +5,7 @@ class BugTestPoisonResponse < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     @response_proc = lambda do|res|
       sleep 0.5
       res.body = "hi"

data/tests/bug_raise_on_callback.rb

@@ -4,7 +4,7 @@ class BugRaiseOnCallback < Test::Unit::TestCase
   include BugTestServerSetupTeardown
 
   def setup
-    @port = unused_local_port
+    @port = :auto
     super
   end
 

data/tests/helper.rb

@@ -206,16 +206,17 @@ class TestServlet < WEBrick::HTTPServlet::AbstractServlet
 end
 
 module BugTestServerSetupTeardown
-  def unused_local_port
-    socket = TCPServer.new('127.0.0.1', 0)
-    socket.addr[1]
-  ensure
-    socket.close if socket
-  end
-
   def setup
     @port ||= 9992
-    @server = WEBrick::HTTPServer.new(:Port => @port, :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    # Bind 127.0.0.1 explicitly: with no bind address, WEBrick silently keeps
+    # just the IPv6 listener if the IPv4 bind fails, leaving 127.0.0.1:@port
+    # refusing connections. :auto lets the kernel pick a free port at bind
+    # time instead of reserving one and re-binding it later, which could race
+    # with client connections reusing that ephemeral port (seen on macOS).
+    @server = WEBrick::HTTPServer.new(:Port => (@port == :auto ? 0 : @port),
+                                      :BindAddress => '127.0.0.1',
+                                      :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    @port = @server.config[:Port]
     @server.mount_proc("/test") do|req,res|
       if @response_proc
         @response_proc.call(res)