curb 1.4.0 → 1.5.0

data/tests/tc_curl_network_policy.rb

@@ -12,6 +12,110 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
     super
   end
 
+  def test_safe_bang_defaults_to_public_network_policy
+    assert_equal :public, Curl::SafetyConfig.new.network_policy
+    require_public_network_policy!
+    Curl.safe!
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { Curl.get(TestServlet.url) }
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.network_policy = :none
+    assert_raise(Curl::Err::UnsafeDestinationError) { easy.perform }
+    assert_equal :public, easy.network_policy
+  end
+
+  def test_safe_bang_default_blocks_private_and_metadata_destinations
+    require_public_network_policy!
+    Curl.safe!
+    ['10.0.0.1', '172.16.0.1', '192.168.0.1', '169.254.169.254', '[::1]'].each do |host|
+      assert_raise(Curl::Err::UnsafeDestinationError, host) do
+        Curl.get("http://#{host}/") do |easy|
+          easy.network_policy = :none
+          easy.connect_timeout_ms = 100
+          easy.timeout_ms = 200
+        end
+      end
+    end
+  end
+
+  def test_safe_bang_default_applies_to_previously_added_multi_handles
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    multi = Curl::Multi.new
+    multi.add(easy)
+    Curl.safe!
+    multi.perform
+
+    assert_equal :public, easy.network_policy
+    assert_match(/127\.0\.0\.1/, easy.unsafe_destination_error)
+  ensure
+    multi.close if multi
+  end
+
+  def test_safe_helpers_block_loopback_without_global_policy
+    require_public_network_policy!
+    [:get, :post, :put, :delete, :patch, :head, :options].each do |verb|
+      assert_raise(Curl::Err::UnsafeDestinationError, verb.to_s) do
+        Curl.public_send("safe_#{verb}", TestServlet.url) do |easy|
+          easy.network_policy = :none
+        end
+      end
+    end
+  end
+
+  def test_safe_http_reapplies_public_policy_before_perform
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    assert_same easy, easy.safe_http!
+    assert_equal :public, easy.network_policy
+    easy.network_policy = :none
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { easy.perform }
+  end
+
+  def test_safe_http_cannot_be_weakened_by_global_policy
+    require_public_network_policy!
+    Curl.safe! { |config| config.network_policy = :none }
+
+    assert_raise(Curl::Err::UnsafeDestinationError) { Curl.safe_get(TestServlet.url) }
+  end
+
+  def test_safe_helpers_block_private_and_metadata_destinations
+    require_public_network_policy!
+    ['10.0.0.1', '172.16.0.1', '192.168.0.1', '169.254.169.254', '[::1]'].each do |host|
+      assert_raise(Curl::Err::UnsafeDestinationError, host) do
+        Curl.safe_get("http://#{host}/") do |easy|
+          easy.connect_timeout_ms = 100
+          easy.timeout_ms = 200
+        end
+      end
+    end
+  end
+
+  def test_safe_http_rejects_resolve_override_without_global_policy
+    require_public_network_policy!
+    assert_raise(Curl::Err::UnsafeDestinationError) do
+      Curl.safe_get('http://example.invalid/') do |easy|
+        easy.resolve = ['example.invalid:80:127.0.0.1']
+      end
+    end
+  end
+
+  def test_safe_http_applies_to_multi
+    require_public_network_policy!
+    easy = Curl::Easy.new(TestServlet.url)
+    easy.safe_http!
+    easy.network_policy = :none
+    multi = Curl::Multi.new
+    multi.add(easy)
+    multi.perform
+
+    assert_equal :public, easy.network_policy
+    assert_match(/127\.0\.0\.1/, easy.unsafe_destination_error)
+  ensure
+    multi.close if multi
+  end
+
   def test_network_policy_defaults_to_none
     easy = Curl::Easy.new
 
@@ -95,6 +199,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
     with_host_redirect_server(allowed_host, allowed_host) do |port, hits|
       Curl.safe! do |config|
+        config.network_policy = :none # Isolate host filtering from peer filtering.
         config.allowed_hosts = [allowed_host]
       end
 
@@ -119,6 +224,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
     with_host_redirect_server(allowed_host, blocked_host) do |port, hits|
       Curl.safe! do |config|
+        config.network_policy = :none # Isolate host filtering from peer filtering.
         config.allowed_hosts = [allowed_host]
       end
 
@@ -142,6 +248,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
 
   def test_safe_bang_allowed_cidrs_requires_public_network_policy
     Curl.safe! do |config|
+      config.network_policy = :none # Isolate the host/CIDR policy from peer filtering.
       config.allowed_cidrs = ['1.1.1.0/24']
     end
 
@@ -911,43 +1018,36 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
     Curl.__send__(:clear_safe!) if Curl.respond_to?(:clear_safe!, true)
   end
 
-  def test_public_network_policy_blocks_private_peer_after_live_dns_answer_changes
-    omit('live DNS rebinding test requires CURLOPT_DOH_URL') unless Curl.const_defined?(:CURLOPT_DOH_URL)
-    omit('live DNS rebinding test requires CURLOPT_DOH_SSL_VERIFYPEER') unless Curl.const_defined?(:CURLOPT_DOH_SSL_VERIFYPEER)
-    omit('live DNS rebinding test requires CURLOPT_DOH_SSL_VERIFYHOST') unless Curl.const_defined?(:CURLOPT_DOH_SSL_VERIFYHOST)
+  # The peer address is vetted at connect time for every resolution, so a
+  # name that resolves to an allowed address once and a private one later is
+  # still blocked. (This used a loopback DoH server as the changing resolver;
+  # public policy now refuses non-public DoH endpoints, so CURLOPT_RESOLVE
+  # supplies the two answers instead.)
+  def test_public_network_policy_blocks_private_peer_after_dns_answer_changes
     require_public_network_policy!
 
-    host = 'curb-doh-rebind.invalid'
-    with_rebinding_doh_server(host, '1.1.1.1') do |doh_url, doh_state|
-      Curl.safe! do |config|
-        config.network_policy = :public
-        config.allow_doh = true
-        config.allowed_cidrs = ['8.8.8.0/24']
-      end
-
-      first = Curl::Easy.new("http://#{host}/dns-rebind-target")
-      configure_live_doh_easy(first, doh_url)
-
-      first_error = assert_raise(Curl::Err::UnsafeDestinationError) do
-        first.perform
-      end
-
-      assert_include doh_a_answers(doh_state), '1.1.1.1'
-      assert_match(/outside allowed CIDR ranges/, first_error.message)
-      assert_match(/1\.1\.1\.1/, first_error.message)
-
-      set_doh_answer(doh_state, '127.0.0.1')
-      second = Curl::Easy.new("http://#{host}/dns-rebind-target")
-      configure_live_doh_easy(second, doh_url)
+    host = 'curb-dns-rebind.invalid'
+    Curl.safe! do |config|
+      config.network_policy = :public
+      config.allow_resolve = true
+      config.allowed_cidrs = ['8.8.8.0/24']
+    end
 
-      error = assert_raise(Curl::Err::UnsafeDestinationError) do
-        second.perform
-      end
+    first = Curl::Easy.new("http://#{host}/dns-rebind-target")
+    first.resolve = ["#{host}:80:1.1.1.1"]
+    first_error = assert_raise(Curl::Err::UnsafeDestinationError) do
+      first.perform
+    end
+    assert_match(/outside allowed CIDR ranges/, first_error.message)
+    assert_match(/1\.1\.1\.1/, first_error.message)
 
-      assert_include doh_a_answers(doh_state), '127.0.0.1'
-      assert_match(/public network policy/, error.message)
-      assert_match(/127\.0\.0\.1/, error.message)
+    second = Curl::Easy.new("http://#{host}/dns-rebind-target")
+    second.resolve = ["#{host}:80:127.0.0.1"]
+    error = assert_raise(Curl::Err::UnsafeDestinationError) do
+      second.perform
     end
+    assert_match(/public network policy/, error.message)
+    assert_match(/127\.0\.0\.1/, error.message)
   ensure
     Curl.__send__(:clear_safe!) if Curl.respond_to?(:clear_safe!, true)
   end
@@ -1080,7 +1180,7 @@ class TestCurbCurlNetworkPolicy < Test::Unit::TestCase
       multi = Curl::Multi.new
 
       multi.add(easy)
-      Curl.safe!
+      Curl.safe! { |config| config.network_policy = :none }
       multi.perform
 
       assert_equal [['1']], request_headers

data/tests/tc_curl_postfield.rb

@@ -253,6 +253,143 @@ class TestCurbCurlPostfieldMultipartCoverage < Test::Unit::TestCase
     server_setup
   end
 
+  [:http_post, :http_patch, :http_put].each do |method|
+    [:close, :reset, :initialize, :perform, :http_post, :post_body=].each do |operation|
+      [:proc, :coercion].each do |source|
+        define_method("test_#{method}_guards_#{operation}_from_#{source}") do
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+          action = lambda do |*_|
+            if operation == :post_body=
+              curl.post_body = 'replacement'
+            elsif operation == :http_post
+              curl.http_post(Curl::PostField.content('nested', 'payload'))
+            else
+              curl.__send__(operation)
+            end
+            'payload'
+          end
+          field = if source == :proc
+            Curl::PostField.content('trigger', &action)
+          else
+            value = Object.new
+            value.define_singleton_method(:to_str, &action)
+            Curl::PostField.content('trigger', value)
+          end
+
+          error = assert_raise(RuntimeError) do
+            curl.__send__(method, Curl::PostField.content('first', 'allocated'), field)
+          end
+          assert_match(/active curl handle/, error.message)
+
+          # Both partial forms and guards must unwind before reuse.
+          curl.multipart_form_post = false
+          curl.perform
+          assert_equal 'GET', curl.body_str
+          assert_nothing_raised { curl.reset }
+          assert_nothing_raised { curl.close }
+        end
+      end
+    end
+  end
+
+  [:content, :file].each do |kind|
+    [false, true].each do |dynamic|
+      define_method("test_multipart_snapshots_#{kind}_#{dynamic ? 'proc' : 'direct'}") do
+        name = +'original_name'
+        payload = +"original\0payload"
+        field = multipart_field(kind, dynamic, nil, payload)
+        field.name = name
+        later = Curl::PostField.content('later') do
+          Thread.new do
+            name.replace('changed_name' * 1000)
+            payload.replace('changed_payload' * 1000)
+            field.content = nil
+            field.name = nil
+            GC.start
+            GC.verify_compaction_references(double_heap: true, toward: :empty) if GC.respond_to?(:verify_compaction_references)
+          end.join
+          'later_value'
+        end
+        curl = Curl::Easy.new(TestServlet.url)
+        curl.multipart_form_post = true
+        curl.http_post(field, later)
+
+        assert_include curl.body_str, 'name="original_name"'
+        assert_include curl.body_str, "original\0payload"
+        assert_include curl.body_str, 'filename="remote.txt"' if kind == :file
+        assert_not_include curl.body_str, 'changed_payload'
+      end
+    end
+  end
+
+  def test_multipart_snapshots_before_later_coercions_in_same_field
+    name = +'original_name'
+    payload = +'original_payload'
+    content_type = Object.new
+    content_type.define_singleton_method(:to_str) do
+      name.replace('changed_name' * 1000)
+      payload.replace('changed_payload' * 1000)
+      'text/plain'
+    end
+    field = Curl::PostField.content(name, payload, content_type)
+    curl = Curl::Easy.new(TestServlet.url)
+    curl.multipart_form_post = true
+    curl.http_post(field)
+
+    assert_include curl.body_str, 'name="original_name"'
+    assert_include curl.body_str, 'original_payload'
+  end
+
+  # Exercise each pointer/length pair with and without a content type.
+  [:content, :file].each do |kind|
+    [false, true].each do |dynamic|
+      [nil, 'text/plain'].each do |content_type|
+        variant = "#{kind}_#{dynamic ? 'proc' : 'direct'}_#{content_type ? 'typed' : 'untyped'}"
+
+        define_method("test_multipart_coerces_#{variant}") do
+          payload = "before\0after"
+          string_like = Object.new
+          string_like.define_singleton_method(:to_str) { payload }
+          field = multipart_field(kind, dynamic, content_type, string_like)
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+
+          curl.http_post(field)
+
+          assert_include curl.body_str, payload
+          assert_equal payload, field.content unless dynamic
+        end
+
+        define_method("test_multipart_rejects_non_string_#{variant}") do
+          field = multipart_field(kind, dynamic, content_type, 5)
+          curl = Curl::Easy.new(TestServlet.url)
+          curl.multipart_form_post = true
+
+          assert_raise(TypeError) { curl.http_post(field) }
+        end
+      end
+    end
+  end
+
+  def multipart_field(kind, dynamic, content_type, value)
+    field = if dynamic
+      if kind == :file
+        Curl::PostField.file('upload', 'remote.txt') { value }
+      else
+        Curl::PostField.content('value') { value }
+      end
+    elsif kind == :file
+      upload = Curl::PostField.file('upload', 'remote.txt')
+      upload.content = value
+      upload
+    else
+      Curl::PostField.content('value', value)
+    end
+    field.content_type = content_type
+    field
+  end
+
   def test_multipart_content_variants_include_dynamic_and_typed_fields
     curl = Curl::Easy.new(TestServlet.url)
     curl.multipart_form_post = true

data/tests/tc_curl_protocols.rb

@@ -104,11 +104,10 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
     end
   end
 
-  def test_safe_get_allows_http_protocol
-    easy = Curl.safe_get(TestServlet.url)
-
-    assert_equal 200, easy.response_code
-    assert_match(/GET/, easy.body_str)
+  def test_safe_get_blocks_local_http_destination
+    assert_raise(Curl::Err::UnsafeDestinationError) do
+      Curl.safe_get(TestServlet.url)
+    end
   end
 
   def test_safe_bang_denies_file_protocol_for_easy_perform
@@ -159,8 +158,8 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
     end
   end
 
-  def test_safe_bang_allows_http_protocol
-    Curl.safe!
+  def test_safe_bang_explicit_none_allows_trusted_http_destination
+    Curl.safe! { |config| config.network_policy = :none }
     easy = Curl.get(TestServlet.url)
 
     assert_equal 200, easy.response_code
@@ -184,6 +183,7 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
     with_file_redirect_server do |url|
       easy = Curl::Easy.new(url)
       easy.follow_location = true
+      stub_public_network_policy_for_local_fixture(easy)
       easy.safe_http!
 
       assert_raises Curl::Err::UnsupportedProtocolError do
@@ -198,6 +198,7 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
 
       easy = Curl::Easy.new(url)
       easy.follow_location = true
+      stub_public_network_policy_for_local_fixture(easy)
 
       assert_raises Curl::Err::UnsupportedProtocolError do
         easy.perform
@@ -211,6 +212,7 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
       easy.follow_location = true
       easy.ssl_verify_peer = false
       easy.ssl_verify_host = false
+      stub_public_network_policy_for_local_fixture(easy)
       easy.safe_http!
 
       easy.perform
@@ -226,6 +228,7 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
       easy.follow_location = true
       easy.ssl_verify_peer = false
       easy.ssl_verify_host = false
+      stub_public_network_policy_for_local_fixture(easy)
       easy.safe_http!
 
       easy.perform
@@ -240,6 +243,7 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
       easy = Curl::Easy.new(url)
       easy.follow_location = true
       easy.max_redirects = 2
+      stub_public_network_policy_for_local_fixture(easy)
       easy.safe_http!
 
       assert_raises Curl::Err::TooManyRedirectsError do
@@ -252,6 +256,14 @@ class TestCurbCurlProtocols < Test::Unit::TestCase
 
   private
 
+  # Isolate protocol/redirect behavior using local fixtures. Destination blocking
+  # is exercised without this stub in tc_curl_network_policy.rb.
+  def stub_public_network_policy_for_local_fixture(easy)
+    def easy.network_policy=(policy)
+      raise "unexpected policy: #{policy}" unless policy == :public
+    end
+  end
+
   def with_file_redirect_server
     port_socket = TCPServer.new('127.0.0.1', 0)
     port = port_socket.addr[1]