dalli 5.2.5 → 5.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64bd21546442078425398b10e3baa0b75000a4cc8388dcac08c834909bc29731
-  data.tar.gz: 67568b0a0d030ce81c657cb98a2957f0a6fc12d5ed98f485305e4a93573474f8
+  metadata.gz: 7f2cea6074db3fcade9ffdc5277b26cddb9752ee9a4229536e2a883755d4137e
+  data.tar.gz: 0f4294f047e670e18a2c97c0c7187e84449096a5e230faf7956547e634c996e9
 SHA512:
-  metadata.gz: b069ac0229a977d837ba26755ba279c9eda6b3295bb6c68fabc9baf07ae4c7367cc6acd6d1132f0a5e2913f4b000c8881df0094562b7dd773e34877fab8c21b3
-  data.tar.gz: 84fbaba58b48b46b7be72fbef38006259ce90268d8eb2ccfa3a1ceeee57a69e9f05472db76d2382d0a8d2e2965e63c363484f351a08bd99b9f9d65e7524d294e
+  metadata.gz: af2703898196c9ea24497f5777061d90b6797acb39faec3fc82b6206d2beb02668420d318bb519728b1f72383e66c05af465592ab0726e3703f5944b93a78c32
+  data.tar.gz: a59742b1c0c146cd2b36f0d36d55fc94c4491353d364a1c8a3f216452ba293b801d79fb7c34dc3ffa85bbe3aea0d72f82621f67dad3aada23579a5e50048e312

data/CHANGELOG.md

@@ -1,9 +1,21 @@
 Dalli Changelog
 =====================
 
-Unreleased
+5.2.7
 ==========
 
+Bug fixes:
+
+- `Rack::Session::Dalli`'s 401 for a session deleted mid-request called `Hash#slice` on the session options. A Rails session store puts an `ActionDispatch::Request::Session::Options` there, so the 401 raised `NoMethodError` instead of expiring the cookie (#1291, @seballot)
+- Since 5.2.0, on JRuby with TLS, Dalli could wait `socket_timeout` for part of a reply that had already arrived, because jruby-openssl can hold it where neither `IO.select` nor OpenSSL's `pending` reports it. A `get_multi` could take `socket_timeout` longer than it needed to. Dalli now reads on JRuby until the TLS socket would block (#1293)
+
+5.2.6
+==========
+
+Bug fixes:
+
+- Raw values in an encoding that isn't ASCII-compatible, such as UTF-16, raised `Encoding::CompatibilityError` from `set`, `add`, `replace`, `append`, `prepend` and `set_multi`, as did a single-server `set_multi` mixing non-ASCII UTF-8 values with binary ones (such as raw Strings of both kinds, or with a JSON serializer, a value containing `é` next to a compressed one). A `p_token` or `l_token` with non-ASCII characters, such as `é`, did the same for any binary value, including every Marshal-serialized one. The error also closed the connection, so in a `quiet` block, or within one server's part of a multi-server `set_multi`, writes buffered before it were silently lost. Values are now sent as their bytes, which is what memcached stores (#1269)
+
 5.2.5
 ==========
 

data/lib/dalli/protocol/meta.rb

@@ -167,7 +167,7 @@ module Dalli
                                           ttl: ttl, mode: mode, quiet: quiet,
                                           **routing_token_kwargs(options))
               end
-        write("#{req}#{value}#{TERMINATOR}")
+        write(request_with_value(req, value))
         finish_write(quiet)
       end
       # rubocop:enable Metrics/ParameterLists
@@ -188,10 +188,20 @@ module Dalli
         req = RequestFormatter.meta_set(key: key, value: value,
                                         cas: cas, ttl: ttl, mode: mode, quiet: quiet?,
                                         **routing_token_kwargs(options))
-        write("#{req}#{value}#{TERMINATOR}")
+        write(request_with_value(req, value))
         finish_write(quiet?)
       end
 
+      # Ruby refuses to join Strings whose encodings clash, such as a raw
+      # UTF-16 value, or a routing token with non-ASCII characters next to a
+      # binary value. memcached stores bytes, so join the bytes then.
+      # Joining the Strings first keeps the common case free of extra checks.
+      def request_with_value(req, value)
+        "#{req}#{value}#{TERMINATOR}"
+      rescue Encoding::CompatibilityError
+        "#{req.b}#{value.b}#{TERMINATOR}"
+      end
+
       # Delete Commands
       #
       # `options` supports the meta-delete keys :invalidate, :tombstone_ttl and

data/lib/dalli/protocol/request_formatter.rb

@@ -120,8 +120,9 @@ module Dalli
 
         def multi_meta_set(entries, ttl: nil, p_token: nil, l_token: nil)
           # Routing tokens apply to every entry in the batch, so the suffix is
-          # built once rather than per entry.
-          token_suffix = routing_tokens(p_token: p_token, l_token: l_token)
+          # built once rather than per entry. It's binary, like the buffer, so
+          # a token with non-ASCII characters doesn't turn the buffer UTF-8.
+          token_suffix = routing_tokens(p_token: p_token, l_token: l_token).b
           ttl = integer_flag(:ttl, ttl) if ttl
 
           buffer = ''.b
@@ -136,11 +137,29 @@ module Dalli
             buffer << ' b' if base64
             buffer << " F#{bitflags}" if bitflags
             buffer << " T#{ttl}" if ttl
-            buffer << ' MS q' << token_suffix << TERMINATOR << value << TERMINATOR
+            buffer << ' MS q' << token_suffix << TERMINATOR
+            append_bytes(buffer, value)
+            buffer << TERMINATOR
           end
           buffer << META_NOOP
         end
 
+        # Values are appended as bytes. One batch can hold UTF-8 and binary
+        # values, which String#<< refuses to combine, and a raw value can be in
+        # an encoding that isn't ASCII-compatible, such as UTF-16.
+        # Don't chain on the result: TruffleRuby's append_as_bytes returns its
+        # arguments rather than the buffer.
+        if String.method_defined?(:append_as_bytes)
+          def append_bytes(buffer, value)
+            buffer.append_as_bytes(value)
+          end
+        else
+          def append_bytes(buffer, value)
+            buffer << (value.encoding == Encoding::BINARY ? value : value.b)
+          end
+        end
+        private :append_bytes
+
         # Thundering herd protection flag:
         # - stale (I flag): Instead of deleting the item, mark it as stale. Other clients
         #   using N/R flags will see the X flag and know the item is being regenerated.

data/lib/dalli/socket.rb

@@ -110,8 +110,18 @@ module Dalli
       # OpenSSL can hold decrypted bytes that IO.select won't report as readable.
       # With OpenSSL's default (no read-ahead) a short read has already used up
       # the current record, so this is normally 0; it guards read-ahead setups.
-      def buffered_data?
-        pending.positive?
+      #
+      # jruby-openssl can take the next record off the socket during a short
+      # read and hold it where neither pending nor IO.select sees it, so on
+      # JRuby a read continues until the socket would block.
+      if RUBY_ENGINE == 'jruby'
+        def buffered_data?
+          true
+        end
+      else
+        def buffered_data?
+          pending.positive?
+        end
       end
 
       unless method_defined?(:wait_readable)

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '5.2.5'
+  VERSION = '5.2.7'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.6.27'
 end

data/lib/rack/session/dalli.rb

@@ -184,9 +184,12 @@ module Rack
         end
       end
 
+      # Rails stores an ActionDispatch::Request::Session::Options in the env, not a
+      # Hash. It implements [] (and to_hash) but not Hash#slice, so slicing it
+      # raised NoMethodError instead of returning this 401.
       def missing_session_response(env)
         options = env[Rack::RACK_SESSION_OPTIONS] || @default_options
-        cookie = Rack::Utils.delete_set_cookie_header(key, options.slice(:path, :domain))
+        cookie = Rack::Utils.delete_set_cookie_header(key, { path: options[:path], domain: options[:domain] })
         [401, { 'content-type' => 'text/plain', 'set-cookie' => cookie }, ['Wrong session ID']]
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 5.2.5
+  version: 5.2.7
 platform: ruby
 authors:
 - Peter M. Goldstein