dalli 5.2.6 → 5.3.1

data/lib/dalli/servers_arg_normalizer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Dalli
   ##
   # This module contains methods for validating and normalizing the servers
@@ -26,6 +28,8 @@ module Dalli
   module ServersArgNormalizer
     ENV_VAR_NAME = 'MEMCACHE_SERVERS'
     DEFAULT_SERVERS = ['127.0.0.1:11211'].freeze
+    URI_CREDENTIAL_WARNING = 'Dalli 5.0 removed SASL authentication. ' \
+                             'Credentials in memcached:// URIs are ignored.'
 
     ##
     # Normalizes the argument into an array of servers.
@@ -34,7 +38,21 @@ module Dalli
     def self.normalize_servers(arg)
       arg = apply_defaults(arg)
       validate_type(arg)
-      Array(arg).flat_map { |s| s.split(',') }.reject(&:empty?)
+      Array(arg).flat_map { |s| s.split(',') }.reject(&:empty?).map { |s| without_credentials(s) }
+    end
+
+    # Dalli 5 doesn't use credentials in a memcached:// URI, so they are
+    # dropped here, with a warning, rather than kept in the client's server
+    # list where #inspect would show them.
+    def self.without_credentials(server)
+      return server unless server.start_with?('memcached://') && server.include?('@')
+
+      uri = URI.parse(server)
+      return server unless uri.userinfo
+
+      Dalli.logger.warn(URI_CREDENTIAL_WARNING)
+      uri.user = nil # clears the password too
+      uri.to_s
     end
 
     def self.apply_defaults(arg)

data/lib/dalli/socket.rb

@@ -110,8 +110,18 @@ module Dalli
       # OpenSSL can hold decrypted bytes that IO.select won't report as readable.
       # With OpenSSL's default (no read-ahead) a short read has already used up
       # the current record, so this is normally 0; it guards read-ahead setups.
-      def buffered_data?
-        pending.positive?
+      #
+      # jruby-openssl can take the next record off the socket during a short
+      # read and hold it where neither pending nor IO.select sees it, so on
+      # JRuby a read continues until the socket would block.
+      if RUBY_ENGINE == 'jruby'
+        def buffered_data?
+          true
+        end
+      else
+        def buffered_data?
+          pending.positive?
+        end
       end
 
       unless method_defined?(:wait_readable)
@@ -182,6 +192,9 @@ module Dalli
       end
 
       def self.init_socket_options(sock, options)
+        # CRuby sets this on every socket; TruffleRuby doesn't, so a process
+        # the app spawns would inherit the connection and hold it open
+        sock.close_on_exec = true
         configure_tcp_options(sock, options)
         configure_socket_buffers(sock, options)
         configure_timeout(sock, options)
@@ -307,6 +320,8 @@ module Dalli
         end
 
         def self.init_socket_options(sock, options)
+          # Not inherited by spawned processes; see TCP.init_socket_options
+          sock.close_on_exec = true
           # https://man7.org/linux/man-pages/man7/unix.7.html
           sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_SNDBUF, options[:sndbuf]) if options[:sndbuf]
           sock.timeout = options[:socket_timeout] if options[:socket_timeout] && sock.respond_to?(:timeout=)

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '5.2.6'
+  VERSION = '5.3.1'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.6.27'
 end

data/lib/dalli.rb

@@ -29,7 +29,19 @@ module Dalli
   class ServerError < DalliError; end
 
   # socket/server communication error that can be retried
-  class RetryableNetworkError < NetworkError; end
+  class RetryableNetworkError < NetworkError
+    def initialize(message = nil, request_sent: false)
+      super(message)
+      @request_sent = request_sent
+    end
+
+    # True when some of the failed request was handed to the socket, so
+    # memcached may have applied it even though its reply was lost. Only a
+    # request that is safe to send twice is retried then.
+    def request_sent?
+      @request_sent
+    end
+  end
 
   # a multi-get reply named a key that wasn't requested, so the rest of that
   # server's replies can't be trusted
@@ -71,6 +83,7 @@ require_relative 'dalli/compressor'
 require_relative 'dalli/cache_result'
 require_relative 'dalli/client'
 require_relative 'dalli/key_manager'
+require_relative 'dalli/key_grouping'
 require_relative 'dalli/pipelined_getter'
 require_relative 'dalli/pipelined_setter'
 require_relative 'dalli/pipelined_deleter'

data/lib/rack/session/dalli.rb

@@ -46,7 +46,10 @@ module Rack
       #
       # It is not recommended to set `:expires_in`. Instead, use `:expire_after`,
       # which will control both the expiration of the client cookie as well
-      # as the expiration of the corresponding entry in memcached.
+      # as the expiration of the corresponding entry in memcached. Without
+      # `:expire_after`, sessions are stored with no expiry: one stays in
+      # memcached until it's deleted (for example by a logout) or memcached
+      # evicts it, and a stolen session cookie keeps working until then.
       #
       # Rack::Session::Dalli also accepts a host of options that control how
       # the sessions and session cookies are managed, including the
@@ -144,6 +147,11 @@ module Rack
         sid.private_id if sid.respond_to?(:private_id)
       end
 
+      # A session that can't be decoded, for example after a change of
+      # serializer or a deploy that removed a class stored in it, is treated
+      # as missing, so the request gets a new session. Otherwise the session
+      # id couldn't be used or replaced, and the user couldn't log in until
+      # the cookie was cleared.
       def existing_session_for_sid(client, sid)
         return nil unless sid && !sid.empty?
 
@@ -151,6 +159,9 @@ module Rack
         return nil if key.nil?
 
         client.get(key)
+      rescue ::Dalli::UnmarshalError => e
+        ::Dalli.logger.warn("#{self.class} couldn't decode a stored session, so it started a new one: #{e.message}")
+        nil
       end
 
       def create_sid_with_empty_session(client)
@@ -184,9 +195,12 @@ module Rack
         end
       end
 
+      # Rails stores an ActionDispatch::Request::Session::Options in the env, not a
+      # Hash. It implements [] (and to_hash) but not Hash#slice, so slicing it
+      # raised NoMethodError instead of returning this 401.
       def missing_session_response(env)
         options = env[Rack::RACK_SESSION_OPTIONS] || @default_options
-        cookie = Rack::Utils.delete_set_cookie_header(key, options.slice(:path, :domain))
+        cookie = Rack::Utils.delete_set_cookie_header(key, { path: options[:path], domain: options[:domain] })
         [401, { 'content-type' => 'text/plain', 'set-cookie' => cookie }, ['Wrong session ID']]
       end
 
@@ -231,8 +245,6 @@ module Rack
       def with_dalli_client(result_on_error = nil, &)
         @data.with(&)
       rescue ::Dalli::DalliError, Errno::ECONNREFUSED
-        raise if $ERROR_INFO.message.include?('undefined class')
-
         if $VERBOSE
           warn "#{self} is unable to find memcached server."
           warn $ERROR_INFO.inspect

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 5.2.6
+  version: 5.3.1
 platform: ruby
 authors:
 - Peter M. Goldstein
@@ -44,6 +44,7 @@ files:
 - lib/dalli/flags.rb
 - lib/dalli/instrumentation.rb
 - lib/dalli/json_serializer.rb
+- lib/dalli/key_grouping.rb
 - lib/dalli/key_manager.rb
 - lib/dalli/options.rb
 - lib/dalli/pipelined_deleter.rb