dalli 3.2.1 → 3.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f81141d870bf96f502734833c9e63678c4f034a2e5cdb6a28bf1fe54b5a6f8f2
-  data.tar.gz: abbb39311cd429b8546397b1c5ba0555024f104e49a6b23fd97b3386408cb5e6
+  metadata.gz: f0ef39f4ff4e9e465b2522707f3c4eea85a94373ba0d3de4b9d940830001b118
+  data.tar.gz: 35cb362ec6075818f062106769481e92c90752936ecaf9a00fae25725ee4ea94
 SHA512:
-  metadata.gz: 1a6af753aa61a1e80ed734eabb2fa70b8c14e2c1d2fd43a8f95f600732c02d2de08018cb9f41ce776d7796815f8da52fff4a95b05fccb732fe58506d6c38cb2f
-  data.tar.gz: 1724f003506854bc011c90402584a898534059b022de87385e0f8f2b24879897f23d33219f732489212aaf86b58eaa3c6d6ceb4e86c028daacd5180bc3be07ae
+  metadata.gz: 0c6b2b205551fb10fb2e49ab7c3c3eba3c552c0bc4b8132783b51f6cdc7a9ddd4c272bd24ed13f9d78e29353e3b84daec001b2691ad630bdfd517bb7af86fd54
+  data.tar.gz: 6ef9f6733d8e6d5f8a6bf8fb7d782e99c450494e03d4e5fe46037b77665682df63eaa9a3eb05007d1720b175564c8e91524c0df92d0856dc1f68066501732a06

data/{History.md → CHANGELOG.md}

@@ -4,6 +4,20 @@ Dalli Changelog
 Unreleased
 ==========
 
+3.2.3
+==========
+
+- Sanitize CAS inputs to ensure additional commands are not passed to memcached (xhzeem / petergoldstein)
+- Sanitize input to flush command to ensure additional commands are not passed to memcached (xhzeem / petergoldstein)
+- Namespaces passed as procs are now evaluated every time, as opposed to just on initialization (nrw505)
+- Fix missing require of uri in ServerConfigParser (adam12)
+- Fix link to the CHANGELOG.md file in README.md (rud)
+
+3.2.2
+==========
+
+- Ensure apps are resilient against old session ids (kbrock)
+
 3.2.1
 ==========
 
@@ -118,6 +132,9 @@ Unreleased
   * The Rack session adapter has been refactored to remove support for thread-unsafe
     configurations. You will need to include the `connection_pool` gem in
     your Gemfile to ensure session operations are thread-safe.
+  * When using namespaces, the algorithm for calculating truncated keys was
+    changed.  Non-truncated keys and truncated keys for the non-namespace
+    case were left unchanged.
 
 - Raise NetworkError when multi response gets into corrupt state (mervync, #783)
 - Validate servers argument (semaperepelitsa, petergoldstein, #776)

data/Gemfile

@@ -5,12 +5,5 @@ source 'https://rubygems.org'
 gemspec
 
 group :test do
-  gem 'minitest'
-  gem 'rake'
-  gem 'rubocop'
-  gem 'rubocop-minitest'
-  gem 'rubocop-performance'
-  gem 'rubocop-rake'
   gem 'ruby-prof', platform: :mri
-  gem 'simplecov'
 end

data/README.md

@@ -23,11 +23,11 @@ The name is a variant of Salvador Dali for his famous painting [The Persistence
 * [Announcements](https://github.com/petergoldstein/dalli/discussions/categories/announcements) - Announcements of interest to the Dalli community will be posted here.
 * [Bug Reports](https://github.com/petergoldstein/dalli/issues) - If you discover a problem with Dalli, please submit a bug report in the tracker.
 * [Forum](https://github.com/petergoldstein/dalli/discussions/categories/q-a) - If you have questions about Dalli, please post them here.
-* [Client API](https://www.rubydoc.info/github/petergoldstein/dalli/master/Dalli/Client) - Ruby documentation for the `Dalli::Client` API
+* [Client API](https://rubydoc.info/github/petergoldstein/dalli/Dalli/Client) - Ruby documentation for the `Dalli::Client` API
 
 ## Contributing
 
-If you have a fix you wish to provide, please fork the code, fix in your local project and then send a pull request on github.  Please ensure that you include a test which verifies your fix and update `History.md` with a one sentence description of your fix so you get credit as a contributor.
+If you have a fix you wish to provide, please fork the code, fix in your local project and then send a pull request on github.  Please ensure that you include a test which verifies your fix and update the [changelog](CHANGELOG.md) with a one sentence description of your fix so you get credit as a contributor.
 
 ## Appreciation
 

data/lib/dalli/key_manager.rb

@@ -61,7 +61,7 @@ module Dalli
     def key_with_namespace(key)
       return key if namespace.nil?
 
-      "#{namespace}#{NAMESPACE_SEPARATOR}#{key}"
+      "#{evaluate_namespace}#{NAMESPACE_SEPARATOR}#{key}"
     end
 
     def key_without_namespace(key)
@@ -75,6 +75,8 @@ module Dalli
     end
 
     def namespace_regexp
+      return /\A#{Regexp.escape(evaluate_namespace)}:/ if namespace.is_a?(Proc)
+
       @namespace_regexp ||= /\A#{Regexp.escape(namespace)}:/.freeze unless namespace.nil?
     end
 
@@ -87,9 +89,15 @@ module Dalli
     def namespace_from_options
       raw_namespace = @key_options[:namespace]
       return nil unless raw_namespace
-      return raw_namespace.call.to_s if raw_namespace.is_a?(Proc)
+      return raw_namespace.to_s unless raw_namespace.is_a?(Proc)
+
+      raw_namespace
+    end
+
+    def evaluate_namespace
+      return namespace.call.to_s if namespace.is_a?(Proc)
 
-      raw_namespace.to_s
+      namespace
     end
 
     ##

data/lib/dalli/pipelined_getter.rb

@@ -167,7 +167,7 @@ module Dalli
       groups = @ring.keys_grouped_by_server(keys)
       if (unfound_keys = groups.delete(nil))
         Dalli.logger.debug do
-          "unable to get keys for #{unfound_keys.length} keys "\
+          "unable to get keys for #{unfound_keys.length} keys " \
             'because no matching server was found'
         end
       end

data/lib/dalli/protocol/base.rb

@@ -127,11 +127,11 @@ module Dalli
       end
 
       def username
-        @options[:username] || ENV['MEMCACHE_USERNAME']
+        @options[:username] || ENV.fetch('MEMCACHE_USERNAME', nil)
       end
 
       def password
-        @options[:password] || ENV['MEMCACHE_PASSWORD']
+        @options[:password] || ENV.fetch('MEMCACHE_PASSWORD', nil)
       end
 
       def require_auth?

data/lib/dalli/protocol/meta/request_formatter.rb

@@ -31,7 +31,7 @@ module Dalli
           cmd << ' c' unless %i[append prepend].include?(mode)
           cmd << ' b' if base64
           cmd << " F#{bitflags}" if bitflags
-          cmd << " C#{cas}" if cas && !cas.zero?
+          cmd << cas_string(cas)
           cmd << " T#{ttl}" if ttl
           cmd << " M#{mode_to_token(mode)}"
           cmd << ' q' if quiet
@@ -43,7 +43,7 @@ module Dalli
         def self.meta_delete(key:, cas: nil, ttl: nil, base64: false, quiet: false)
           cmd = "md #{key}"
           cmd << ' b' if base64
-          cmd << " C#{cas}" if cas && !cas.zero?
+          cmd << cas_string(cas)
           cmd << " T#{ttl}" if ttl
           cmd << ' q' if quiet
           cmd + TERMINATOR
@@ -54,8 +54,9 @@ module Dalli
           cmd << ' b' if base64
           cmd << " D#{delta}" if delta
           cmd << " J#{initial}" if initial
-          cmd << " C#{cas}" if cas && !cas.zero?
-          cmd << " N#{ttl}" if ttl
+          # Always set a TTL if an initial value is specified
+          cmd << " N#{ttl || 0}" if ttl || initial
+          cmd << cas_string(cas)
           cmd << ' q' if quiet
           cmd << " M#{incr ? 'I' : 'D'}"
           cmd + TERMINATOR
@@ -75,7 +76,7 @@ module Dalli
 
         def self.flush(delay: nil, quiet: false)
           cmd = +'flush_all'
-          cmd << " #{delay}" if delay
+          cmd << " #{parse_to_64_bit_int(delay, 0)}" if delay
           cmd << ' noreply' if quiet
           cmd + TERMINATOR
         end
@@ -102,6 +103,18 @@ module Dalli
           end
         end
         # rubocop:enable Metrics/MethodLength
+
+        def self.cas_string(cas)
+          cas = parse_to_64_bit_int(cas, nil)
+          cas.nil? || cas.zero? ? '' : " C#{cas}"
+        end
+
+        def self.parse_to_64_bit_int(val, default)
+          val.nil? ? nil : Integer(val)
+        rescue ArgumentError
+          # Sanitize to default if it isn't parsable as an integer
+          default
+        end
       end
     end
   end

data/lib/dalli/protocol/meta.rb

@@ -44,6 +44,7 @@ module Dalli
       end
 
       def touch(key, ttl)
+        ttl = TtlSanitizer.sanitize(ttl)
         encoded_key, base64 = KeyRegularizer.encode(key)
         req = RequestFormatter.meta_get(key: encoded_key, ttl: ttl, value: false, base64: base64)
         write(req)

data/lib/dalli/protocol/server_config_parser.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Dalli
   module Protocol
     ##

data/lib/dalli/servers_arg_normalizer.rb

@@ -40,7 +40,7 @@ module Dalli
     def self.apply_defaults(arg)
       return arg unless arg.nil?
 
-      ENV[ENV_VAR_NAME] || DEFAULT_SERVERS
+      ENV.fetch(ENV_VAR_NAME, nil) || DEFAULT_SERVERS
     end
 
     def self.validate_type(arg)

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '3.2.1'
+  VERSION = '3.2.3'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.4'
 end

data/lib/rack/session/dalli.rb

@@ -82,6 +82,9 @@ module Rack
       def write_session(_req, sid, session, options)
         return false unless sid
 
+        key = memcached_key_from_sid(sid)
+        return false unless key
+
         with_dalli_client(false) do |dc|
           dc.set(memcached_key_from_sid(sid), session, ttl(options[:expire_after]))
           sid
@@ -90,7 +93,8 @@ module Rack
 
       def delete_session(_req, sid, options)
         with_dalli_client do |dc|
-          dc.delete(memcached_key_from_sid(sid))
+          key = memcached_key_from_sid(sid)
+          dc.delete(key) if key
           generate_sid_with(dc) unless options[:drop]
         end
       end
@@ -98,20 +102,24 @@ module Rack
       private
 
       def memcached_key_from_sid(sid)
-        sid.private_id
+        sid.private_id if sid.respond_to?(:private_id)
       end
 
       def existing_session_for_sid(client, sid)
         return nil unless sid && !sid.empty?
 
-        client.get(memcached_key_from_sid(sid))
+        key = memcached_key_from_sid(sid)
+        return nil if key.nil?
+
+        client.get(key)
       end
 
       def create_sid_with_empty_session(client)
         loop do
           sid = generate_sid_with(client)
+          key = memcached_key_from_sid(sid)
 
-          break sid if client.add(memcached_key_from_sid(sid), {}, @default_ttl)
+          break sid if key && client.add(key, {}, @default_ttl)
         end
       end
 
@@ -119,7 +127,8 @@ module Rack
         loop do
           raw_sid = generate_sid
           sid = raw_sid.is_a?(String) ? Rack::Session::SessionId.new(raw_sid) : raw_sid
-          break sid unless client.get(memcached_key_from_sid(sid))
+          key = memcached_key_from_sid(sid)
+          break sid unless key && client.get(key)
         end
       end
 
@@ -161,7 +170,7 @@ module Rack
       def ensure_connection_pool_added!
         require 'connection_pool'
       rescue LoadError => e
-        warn "You don't have connection_pool installed in your application. "\
+        warn "You don't have connection_pool installed in your application. " \
              'Please add it to your Gemfile and run bundle install'
         raise e
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 3.2.1
+  version: 3.2.3
 platform: ruby
 authors:
 - Peter M. Goldstein
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-14 00:00:00.000000000 Z
+date: 2022-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: connection_pool
@@ -25,6 +25,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -45,6 +59,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.2.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
@@ -101,6 +129,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: High performance memcached client for Ruby
 email:
 - peter.m.goldstein@gmail.com
@@ -109,8 +151,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - Gemfile
-- History.md
 - LICENSE
 - README.md
 - lib/dalli.rb
@@ -164,7 +206,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.24
 signing_key:
 specification_version: 4
 summary: High performance memcached client for Ruby