curb 1.4.0 → 1.5.0

data/tests/tc_curl_security_hardening.rb

@@ -0,0 +1,386 @@
+require File.expand_path(File.join(File.dirname(__FILE__), 'helper'))
+
+# Regression coverage for request-hardening fixes: non-IP sockets and DoH
+# endpoints under network_policy = :public, file:// under :public, cookies=
+# on cross-host redirects, redirect/timeout defaults, and CR/LF injection.
+class TestCurbCurlSecurityHardening < Test::Unit::TestCase
+  include TestServerMethods
+
+  def setup
+    server_setup
+    @servers = []
+  end
+
+  def teardown
+    @servers.each(&:close)
+    Curl.__send__(:clear_safe!) if Curl.respond_to?(:clear_safe!, true)
+    super
+  end
+
+  # Starts a server on 127.0.0.1 that answers each request with the result of
+  # the block (given the request path) and records [path, request headers].
+  def scripted_server(&respond)
+    server = TCPServer.new('127.0.0.1', 0)
+    @servers << server
+    log = Queue.new
+    Thread.new do
+      loop do
+        client = begin
+          server.accept
+        rescue IOError, Errno::EBADF
+          break
+        end
+        begin
+          request = +''
+          request << client.readpartial(4096) until request.include?("\r\n\r\n")
+          path = request[/\A\S+ (\S+)/, 1]
+          log << [path, request.split("\r\n\r\n", 2).first.lines.drop(1).map(&:strip)]
+          client.write(respond.call(path))
+        rescue IOError, SystemCallError
+          nil
+        ensure
+          client.close
+        end
+      end
+    end
+    [server.addr[1], log]
+  end
+
+  def ok_response(body = 'ok')
+    "HTTP/1.1 200 OK\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}"
+  end
+
+  def redirect_response(location)
+    "HTTP/1.1 302 Found\r\nLocation: #{location}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+  end
+
+  def drain(log)
+    entries = []
+    entries << log.pop until log.empty?
+    entries
+  end
+
+  def require_public_network_policy!
+    Curl::Easy.new.network_policy = :public
+  rescue NotImplementedError
+    omit('network_policy=:public requires CURLOPT_OPENSOCKETFUNCTION support')
+  end
+
+  # --- non-IP sockets under :public ----------------------------------------
+
+  def test_unix_socket_set_after_multi_add_is_blocked_by_public_policy
+    omit('CURLOPT_UNIX_SOCKET_PATH not supported by this libcurl') unless Curl.const_defined?(:CURLOPT_UNIX_SOCKET_PATH)
+    omit('Unix domain sockets are not available on this platform') if WINDOWS || !defined?(UNIXServer)
+    require_public_network_policy!
+
+    dir = Dir.mktmpdir('curb-unix')
+    path = File.join(dir, 's.sock')
+    server = UNIXServer.new(path)
+    accepted = Queue.new
+    thread = Thread.new do
+      socket = server.accept
+      accepted << true
+      socket.readpartial(4096) rescue nil
+      socket.write(ok_response('bypass'))
+      socket.close
+    end
+
+    easy = Curl::Easy.new('http://198.51.100.1/')
+    easy.network_policy = :public
+    multi = Curl::Multi.new
+    multi.add(easy)
+    easy.setopt(Curl::CURLOPT_UNIX_SOCKET_PATH, path)
+    multi.perform
+
+    assert_not_equal 'bypass', easy.body_str
+    assert_match(/non-IP socket/, easy.unsafe_destination_error)
+    assert accepted.empty?, 'the Unix socket server must not be contacted'
+  ensure
+    multi.close if multi
+    thread.kill if thread
+    server.close if server
+    FileUtils.rm_rf(dir) if dir
+  end
+
+  # --- DoH endpoints under :public ------------------------------------------
+
+  def test_public_policy_requires_public_ip_literal_doh_endpoints
+    omit('CURLOPT_DOH_URL not supported by this libcurl') unless Curl.const_defined?(:CURLOPT_DOH_URL)
+    require_public_network_policy!
+
+    blocked = %w[
+      https://localhost/dns-query https://dns.example/dns-query
+      https://127.0.0.1/dns-query https://127.1/dns-query https://2130706433/dns-query
+      https://[::1]/dns-query https://[::ffff:127.0.0.1]/dns-query https://10.0.0.1/dns-query
+    ]
+    blocked.each do |doh_url|
+      easy = Curl::Easy.new('http://198.51.100.1/')
+      easy.network_policy = :public
+      easy.doh_url = doh_url
+      assert_raise(Curl::Err::UnsafeDestinationError, doh_url) { easy.__send__(:__curb_native_setup!) }
+    end
+
+    %w[https://1.1.1.1/dns-query https://[2606:4700:4700::1111]/dns-query].each do |doh_url|
+      easy = Curl::Easy.new('http://198.51.100.1/')
+      easy.network_policy = :public
+      easy.doh_url = doh_url
+      assert_nothing_raised(doh_url) { easy.__send__(:__curb_native_setup!) }
+    end
+  end
+
+  def test_safe_mode_allow_doh_still_rejects_local_doh_endpoint
+    omit('CURLOPT_DOH_URL not supported by this libcurl') unless Curl.const_defined?(:CURLOPT_DOH_URL)
+    require_public_network_policy!
+    port, log = scripted_server { |_| ok_response }
+
+    Curl.safe! { |config| config.allow_doh = true }
+    easy = Curl::Easy.new('http://example.com/')
+    easy.doh_url = "https://localhost:#{port}/dns-query"
+
+    error = assert_raise(Curl::Err::UnsafeDestinationError) { easy.perform }
+    assert_match(/DoH URL must use a public IP address/, error.message)
+    assert_empty drain(log)
+  end
+
+  def test_public_policy_doh_check_does_not_apply_without_policy
+    omit('CURLOPT_DOH_URL not supported by this libcurl') unless Curl.const_defined?(:CURLOPT_DOH_URL)
+    easy = Curl::Easy.new('http://198.51.100.1/')
+    easy.doh_url = 'https://localhost/dns-query'
+    assert_nothing_raised { easy.__send__(:__curb_native_setup!) }
+  end
+
+  # --- file:// under :public ------------------------------------------------
+
+  def test_public_policy_rejects_file_urls_without_protocol_allowlist
+    require_public_network_policy!
+    ['file:///etc/hosts', 'FILE:///etc/hosts', 'file:/etc/hosts', "file://#{File.expand_path(__FILE__)}"].each do |url|
+      easy = Curl::Easy.new(url)
+      easy.network_policy = :public
+      error = assert_raise(Curl::Err::UnsafeDestinationError, url) { easy.perform }
+      assert_match(/file:\/\/ URLs are not allowed/, error.message)
+    end
+  end
+
+  def test_public_policy_respects_explicit_file_protocol_allowlist
+    require_public_network_policy!
+    easy = Curl::Easy.new("file://#{File.expand_path(__FILE__)}")
+    easy.network_policy = :public
+    easy.allowed_protocols = [:file]
+    easy.perform
+    assert_match(/Regression coverage for request-hardening/, easy.body_str)
+  end
+
+  def test_file_urls_still_work_without_public_policy
+    easy = Curl::Easy.new($TEST_URL)
+    easy.perform
+    assert_match(/DO NOT REMOVE THIS COMMENT/, easy.body_str)
+  end
+
+  # --- cookies= on redirects ------------------------------------------------
+
+  def test_cookies_are_not_forwarded_to_a_different_host_on_redirect
+    other_port, other_log = scripted_server { |_| ok_response }
+    port, log = scripted_server { |_| redirect_response("http://127.0.0.1:#{other_port}/landing") }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/start")
+    easy.follow_location = true
+    easy.cookies = 'session=secret'
+    easy.perform
+
+    assert_equal 200, easy.response_code
+    first = drain(log)
+    second = drain(other_log)
+    assert_include first.first.last, 'Cookie: session=secret'
+    assert_equal 1, second.length
+    assert_empty second.first.last.grep(/\Acookie:/i), 'cookies= must not reach a different host'
+  end
+
+  def test_cookies_are_kept_on_same_host_redirect
+    port, log = scripted_server { |path| path == '/start' ? redirect_response('/landing') : ok_response }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/start")
+    easy.follow_location = true
+    easy.cookies = 'session=secret'
+    easy.perform
+
+    requests = drain(log)
+    assert_equal ['/start', '/landing'], requests.map(&:first)
+    requests.each { |(_, headers)| assert_equal ['Cookie: session=secret'], headers.grep(/\Acookie:/i) }
+  end
+
+  def test_explicit_cookie_header_still_wins_over_cookies
+    port, log = scripted_server { |_| ok_response }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/")
+    easy.headers['Cookie'] = 'explicit=1'
+    easy.cookies = 'session=secret'
+    easy.perform
+
+    assert_equal ['Cookie: explicit=1'], drain(log).first.last.grep(/\Acookie:/i)
+  end
+
+  def test_cookies_cleared_after_being_set_are_not_sent
+    port, log = scripted_server { |_| ok_response }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/")
+    easy.cookies = 'session=secret'
+    easy.perform
+    easy.cookies = nil
+    easy.perform
+
+    first, second = drain(log)
+    assert_equal ['Cookie: session=secret'], first.last.grep(/\Acookie:/i)
+    assert_empty second.last.grep(/\Acookie:/i)
+  end
+
+  def test_cookies_merge_with_cookie_engine_on_one_line
+    port, log = scripted_server do |path|
+      if path == '/start'
+        "HTTP/1.1 302 Found\r\nLocation: /landing\r\nSet-Cookie: fromserver=1\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+      else
+        ok_response
+      end
+    end
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/start")
+    easy.follow_location = true
+    easy.enable_cookies = true
+    easy.cookies = 'session=secret'
+    easy.perform
+
+    landing = drain(log).last.last.grep(/\Acookie:/i)
+    assert_equal 1, landing.length, 'the cookie engine and cookies= must share one Cookie line'
+    assert_match(/fromserver=1/, landing.first)
+    assert_match(/session=secret/, landing.first)
+  end
+
+  # --- redirect and timeout defaults ----------------------------------------
+
+  def test_unset_max_redirects_caps_redirect_loops_at_thirty
+    port, log = scripted_server { |path| redirect_response("/r#{path[/\d+/].to_i + 1}") }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/r0")
+    easy.follow_location = true
+    assert_nil easy.max_redirects
+    assert_raise(Curl::Err::TooManyRedirectsError) { easy.perform }
+    assert_equal 31, drain(log).length
+  end
+
+  def test_explicit_unlimited_and_explicit_max_redirects_are_honored
+    port, log = scripted_server { |path| (n = path[/\d+/].to_i) < 40 ? redirect_response("/r#{n + 1}") : ok_response }
+
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/r0")
+    easy.follow_location = true
+    easy.max_redirects = -1
+    easy.perform
+    assert_equal 200, easy.response_code
+    assert_equal 41, drain(log).length
+
+    easy.max_redirects = 2
+    assert_raise(Curl::Err::TooManyRedirectsError) { easy.perform }
+    assert_equal 3, drain(log).length
+  end
+
+  def test_safe_mode_applies_default_timeout_and_redirect_cap
+    config = Curl::SafetyConfig.new
+    assert_equal 60, config.timeout
+    assert_equal 20, config.max_redirects
+
+    Curl.safe!
+    easy = Curl::Easy.new('http://198.51.100.1/')
+    Curl.__send__(:apply_safety!, easy)
+    assert_equal 60.0, easy.timeout
+    assert_equal 20, easy.max_redirects
+
+    unlimited = Curl::Easy.new('http://198.51.100.1/')
+    unlimited.max_redirects = -1
+    Curl.__send__(:apply_safety!, unlimited)
+    assert_equal 20, unlimited.max_redirects
+  end
+
+  def test_safe_mode_keeps_handle_limits_and_accepts_overrides
+    Curl.safe!
+    own = Curl::Easy.new('http://198.51.100.1/')
+    own.timeout = 5
+    own.max_redirects = 3
+    Curl.__send__(:apply_safety!, own)
+    assert_equal 5.0, own.timeout
+    assert_equal 3, own.max_redirects
+    Curl.__send__(:clear_safe!)
+
+    helper = Curl::Easy.new('http://198.51.100.1/')
+    helper.safe_http!(:timeout => 7, :max_redirects => 2)
+    assert_equal 7.0, helper.timeout
+    assert_equal 2, helper.max_redirects
+
+    Curl.safe! { |c| c.timeout = nil; c.max_redirects = nil }
+    disabled = Curl::Easy.new('http://198.51.100.1/')
+    Curl.__send__(:apply_safety!, disabled)
+    assert_equal 0.0, disabled.timeout
+    assert_nil disabled.max_redirects
+  end
+
+  def test_safety_config_validates_limits
+    config = Curl::SafetyConfig.new
+    assert_raise(ArgumentError) { config.timeout = 0 }
+    assert_raise(ArgumentError) { config.timeout = -1 }
+    assert_raise(ArgumentError) { config.max_redirects = -1 }
+    config.timeout = 1.5
+    config.max_redirects = 0
+    assert_equal 1.5, config.timeout
+    assert_equal 0, config.max_redirects
+  end
+
+  # --- CR/LF/NUL injection --------------------------------------------------
+
+  INJECTIONS = {
+    'header value' => ->(easy) { easy.headers['X-User'] = "alice\r\nX-Injected: yes" },
+    'header name' => ->(easy) { easy.headers["X-A\r\nX-Injected"] = 'yes' },
+    'header array entry' => ->(easy) { easy.headers = ["X-User: alice\nX-Injected: yes"] },
+    'header string' => ->(easy) { easy.headers = "X-User: alice\r\nX-Injected: yes" },
+    'header NUL' => ->(easy) { easy.headers['X-User'] = "alice\0X-Injected: yes" },
+    'useragent' => ->(easy) { easy.useragent = "ua\r\nX-Injected: yes" },
+    'cookies' => ->(easy) { easy.cookies = "a=1\r\nX-Injected: yes" },
+  }.freeze
+
+  def test_crlf_in_request_headers_is_rejected
+    port, log = scripted_server { |_| ok_response }
+    INJECTIONS.each do |name, inject|
+      easy = Curl::Easy.new("http://127.0.0.1:#{port}/")
+      inject.call(easy)
+      error = assert_raise(ArgumentError, name) { easy.perform }
+      assert_match(/must not contain CR, LF, or NUL/, error.message, name)
+    end
+    assert_empty drain(log), 'no injected request may reach the server'
+  end
+
+  def test_crlf_in_proxy_headers_is_rejected
+    omit('proxy_headers not supported') unless Curl::Easy.method_defined?(:proxy_headers=)
+    easy = Curl::Easy.new('http://198.51.100.1/')
+    easy.proxy_headers['X-Proxy'] = "a\r\nX-Injected: yes"
+    assert_raise(ArgumentError) { easy.__send__(:__curb_native_setup!) }
+  end
+
+  def test_crlf_in_request_method_and_target_is_rejected
+    easy = Curl::Easy.new(TestServlet.url)
+    assert_raise(ArgumentError) { easy.setopt(Curl::CURLOPT_CUSTOMREQUEST, "GET / HTTP/1.1\r\nX-Injected: yes\r\n\r\nGET") }
+    assert_raise(ArgumentError) { easy.http("GET\r\nX-Injected: yes") }
+    if Curl.const_defined?(:CURLOPT_REQUEST_TARGET)
+      assert_raise(ArgumentError) { easy.setopt(Curl::CURLOPT_REQUEST_TARGET, "/\r\nX-Injected: yes") }
+    end
+  end
+
+  def test_ordinary_headers_and_header_removal_still_work
+    port, log = scripted_server { |_| ok_response }
+    easy = Curl::Easy.new("http://127.0.0.1:#{port}/")
+    easy.headers['X-User'] = 'alice'
+    easy.headers['Accept'] = ''
+    easy.useragent = 'curb-test/1.0'
+    easy.perform
+
+    headers = drain(log).first.last
+    assert_include headers, 'X-User: alice'
+    assert_include headers, 'User-Agent: curb-test/1.0'
+    assert_empty headers.grep(/\AAccept:/i)
+  end
+end

data/tests/tc_curl_transfer_guard.rb

@@ -0,0 +1,112 @@
+require File.expand_path(File.join(File.dirname(__FILE__), 'helper'))
+
+class TestCurbTransferGuard < Test::Unit::TestCase
+  class InterruptedTransfer < StandardError; end
+
+  [:perform, :_socket_perform].each do |drive|
+    define_method("test_#{drive}_rejects_cross_thread_handle_access") do
+      with_waiting_transfer(drive) do |easy, multi, worker, release|
+        operations = {
+          close: -> { easy.close },
+          reset: -> { easy.reset },
+          initialize: -> { easy.__send__(:initialize) },
+          clone: -> { easy.clone },
+          dup: -> { easy.dup },
+          setopt: -> { easy.setopt(Curl::CURLOPT_CUSTOMREQUEST, 'DELETE') },
+          post_body: -> { easy.post_body = 'replacement' },
+          url: -> { easy.url = 'http://127.0.0.1/' },
+          timeout: -> { easy.timeout = 1 },
+          multi_assignment: -> { easy.multi = nil },
+          multi_remove: -> { multi.remove(easy) },
+          multi_close: -> { multi.close },
+          multi_initialize: -> { multi.__send__(:initialize) },
+          multi_add: -> { multi.add(Curl::Easy.new('http://127.0.0.1/')) },
+          multi_option: -> { multi.max_connects = 1 }
+        }
+        operations.each do |name, operation|
+          error = assert_raise(RuntimeError, name.to_s, &operation)
+          assert_match(/another thread|active Curl::Multi/, error.message, name.to_s)
+        end
+        assert_equal [easy], multi.requests.values
+
+        release << true
+        assert worker.join(5), 'perform did not finish'
+        worker.value
+        assert_equal 'ok', easy.body_str
+        assert_nothing_raised { easy.clone.close }
+        assert_nothing_raised { easy.reset }
+        assert_nothing_raised { easy.close }
+      end
+    end
+
+    define_method("test_#{drive}_releases_guard_after_interruption") do
+      with_waiting_transfer(drive) do |easy, multi, worker, release|
+        worker.raise(InterruptedTransfer, 'stop')
+        assert worker.join(5), 'interrupted perform did not finish'
+        assert_kind_of InterruptedTransfer, worker[:transfer_error]
+        assert_nothing_raised { multi.remove(easy) }
+        assert_nothing_raised { easy.reset }
+        assert_nothing_raised { easy.close }
+        release << true
+      end
+    end
+  end
+
+  def with_waiting_transfer(drive)
+    if drive == :_socket_perform && !Curl::Multi.private_method_defined?(drive)
+      omit('socket-action perform path is not available')
+    end
+    server = TCPServer.new('127.0.0.1', 0)
+    started = Queue.new
+    release = Queue.new
+    server_thread = Thread.new do
+      socket = server.accept
+      begin
+        request = +''
+        request << socket.readpartial(4096) until request.include?("\r\n\r\n")
+        started << true
+        release.pop
+        socket.write("HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok")
+      rescue Errno::EPIPE, Errno::ECONNRESET
+        # The interruption test intentionally closes the connection early.
+      ensure
+        socket.close
+      end
+    end
+    easy = Curl::Easy.new("http://127.0.0.1:#{server.addr[1]}/")
+    multi = Curl::Multi.new
+    # Exercise reuse after autoclose as well as the active-transfer checks.
+    previous_autoclose = Curl::Multi.autoclose
+    begin
+      Curl::Multi.autoclose = true
+      multi.add(Curl::Easy.new($TEST_URL))
+      multi.perform
+    ensure
+      Curl::Multi.autoclose = previous_autoclose
+    end
+    multi.add(easy)
+    worker = Thread.new do
+      Thread.current.report_on_exception = false if Thread.current.respond_to?(:report_on_exception=)
+      begin
+        multi.__send__(drive)
+      rescue InterruptedTransfer => error
+        # Keep join non-raising so the test can inspect the exception explicitly.
+        Thread.current[:transfer_error] = error
+      end
+    end
+    Timeout.timeout(5) { started.pop }
+    yield easy, multi, worker, release
+  ensure
+    release << true if release
+    if worker && worker.alive?
+      worker.kill
+      worker.join(5)
+    end
+    multi.close if multi
+    server.close if server && !server.closed?
+    if server_thread
+      server_thread.join(5)
+      server_thread.kill if server_thread.alive?
+    end
+  end
+end

data/tests/tc_fiber_scheduler.rb

@@ -83,7 +83,7 @@ class TestCurbFiberScheduler < Test::Unit::TestCase
   SERIAL_TIME_WOULD_BE_ABOUT = MIN_S * ITERS
 
   def setup
-    @port = unused_local_port
+    @port = :auto
 
     @response_proc = lambda do |res|
       res['Content-Type'] = 'text/plain'
@@ -650,6 +650,48 @@ class TestCurbFiberScheduler < Test::Unit::TestCase
     end
   end
 
+  # The scheduler driver no longer yields on every Multi#perform pass when the
+  # socket-action loop is in use; sibling fibers must still run while a large
+  # body streams in.
+  def test_sibling_fibers_run_while_easy_perform_streams_large_body
+    if skip_no_async
+      return
+    end
+
+    server = CurbTinyHTTPServer.new
+    expected = CurbTinyHTTPServer.stream_body(256, 65536)
+    ticks = 0
+    ticks_during_transfer = nil
+    body = nil
+
+    async_run do |top|
+      done = false
+      ticker = top.async do
+        until done
+          ticks += 1
+          sleep 0.001
+        end
+      end
+
+      top.async do
+        start_ticks = ticks
+        easy = Curl::Easy.new(server.url('/stream/256/65536'))
+        easy.perform
+        ticks_during_transfer = ticks - start_ticks
+        body = easy.body_str
+      ensure
+        done = true
+      end.wait
+      ticker.wait
+    end
+
+    assert_equal expected.bytesize, body.bytesize
+    assert_equal expected, body
+    assert_operator ticks_during_transfer, :>=, 2, 'sibling fiber should run while the transfer streams'
+  ensure
+    server.close if server
+  end
+
   def test_easy_perform_keeps_scheduler_timers_running_while_draining_deferred_on_complete_exception
     if skip_no_async
       return
@@ -981,12 +1023,10 @@ class TestCurbFiberScheduler < Test::Unit::TestCase
   end
 
   def with_ephemeral_http_server
-    port_socket = TCPServer.new('127.0.0.1', 0)
-    port = port_socket.addr[1]
-    port_socket.close
-
     hits = Hash.new(0)
-    server = WEBrick::HTTPServer.new(:Port => port, :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    server = WEBrick::HTTPServer.new(:Port => 0, :BindAddress => '127.0.0.1',
+                                     :Logger => WEBRICK_TEST_LOG, :AccessLog => [])
+    port = server.config[:Port]
     server.mount_proc('/fast') do |_req, res|
       hits[:fast] += 1
       res['Content-Type'] = 'text/plain'

data/tests/tc_ractor.rb

@@ -30,7 +30,10 @@ class TestCurbRactor < Test::Unit::TestCase
 
     workers = RACTOR_WORKERS.times.map do |worker_id|
       Ractor.new(url, worker_id, REQUESTS_PER_WORKER) do |target, id, request_count|
-        Curl.safe! { |config| config.protocols = [:http] }
+        Curl.safe! do |config|
+          config.protocols = [:http]
+          config.network_policy = :none # This concurrency fixture uses localhost.
+        end
         Curl::Multi.default_timeout = 25 + id
         Curl::Multi.autoclose = true
 
@@ -76,6 +79,54 @@ class TestCurbRactor < Test::Unit::TestCase
     Curl::Multi.autoclose = original_autoclose if defined?(original_autoclose)
   end
 
+  def test_multipart_snapshots_are_private_to_parallel_ractors
+    omit_unless_curb_ractor_safe
+    worker_count = Integer(ENV.fetch('CURB_MULTIPART_RACTORS', '4'))
+    request_count = Integer(ENV.fetch('CURB_MULTIPART_REQUESTS', '5'))
+    workers = worker_count.times.map do |worker_id|
+      Ractor.new(TestServlet.url, worker_id, request_count) do |url, id, count|
+        easy = Curl::Easy.new(url)
+        easy.multipart_form_post = true
+        count.times do |iteration|
+          name = +"field_#{id}_#{iteration}"
+          payload = "payload_#{id}_#{iteration}\0" + ('x' * 1024)
+          expected_name = name.dup
+          expected_payload = payload.dup
+          direct = Curl::PostField.content(name, payload, 'application/octet-stream')
+          file = Curl::PostField.file('upload', 'payload.bin') { payload }
+          later = Curl::PostField.content('later') do
+            name.replace('changed' * 1000)
+            payload.replace('changed' * 1000)
+            # Ruby #21537: explicit GC in a Windows Ractor can deadlock
+            # the VM barrier. Keep parallel mutation coverage on Windows;
+            # single-Ractor compaction is covered by the PostField tests.
+            if iteration % 10 == 0 && !WINDOWS
+              GC.start
+              # Ruby 3.4 can crash in method/constant lookup when another
+              # Ractor compacts the heap, even with plain TCPSocket requests
+              # and no curb loaded. Keep ordinary GC and parallel mutation
+              # here; tc_curl_postfield covers compaction without Ractors.
+              GC.compact if GC.respond_to?(:compact) && !RUBY_VERSION.start_with?('3.4.')
+            end
+            'done'
+          end
+          easy.http_post(direct, file, later)
+          body = easy.body_str
+          unless easy.response_code == 200 &&
+                 body.include?("name=\"#{expected_name}\"") &&
+                 body.include?('filename="payload.bin"') &&
+                 body.scan(expected_payload).length == 2 &&
+                 !body.include?('changed')
+            raise "Multipart snapshot changed in Ractor #{id}, request #{iteration}"
+          end
+        end
+        easy.close
+        count
+      end
+    end
+    assert_equal Array.new(worker_count, request_count), workers.map { |worker| ractor_value(worker) }
+  end
+
   private
 
   def omit_unless_curb_ractor_safe

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: curb
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Ross Bamford
 - Todd A. Fisher
 bindir: bin
 cert_chain: []
-date: 2026-09-27 00:00:00.000000000 Z
+date: 2026-11-02 00:00:00.000000000 Z
 dependencies: []
 description: Curb (probably CUrl-RuBy or something) provides Ruby-language bindings
   for the libcurl(3), a fully-featured client-side URL transfer library. cURL and
@@ -21,6 +21,7 @@ extra_rdoc_files:
 - LICENSE
 - README.md
 files:
+- ChangeLog.md
 - LICENSE
 - README.md
 - Rakefile
@@ -84,6 +85,8 @@ files:
 - tests/tc_curl_network_policy.rb
 - tests/tc_curl_postfield.rb
 - tests/tc_curl_protocols.rb
+- tests/tc_curl_security_hardening.rb
+- tests/tc_curl_transfer_guard.rb
 - tests/tc_fiber_scheduler.rb
 - tests/tc_ftp_options.rb
 - tests/tc_gc_compact.rb
@@ -157,6 +160,8 @@ test_files:
 - tests/tc_curl_network_policy.rb
 - tests/tc_curl_postfield.rb
 - tests/tc_curl_protocols.rb
+- tests/tc_curl_security_hardening.rb
+- tests/tc_curl_transfer_guard.rb
 - tests/tc_fiber_scheduler.rb
 - tests/tc_ftp_options.rb
 - tests/tc_gc_compact.rb