faraday 1.10.4 → 2.14.1

data/spec/faraday/connection_spec.rb

@@ -1,10 +1,20 @@
 # frozen_string_literal: true
 
+class CustomEncoder
+  def encode(params)
+    params.map { |k, v| "#{k.upcase}-#{v.to_s.upcase}" }.join(',')
+  end
+
+  def decode(params)
+    params.split(',').to_h { |pair| pair.split('-') }
+  end
+end
+
 shared_examples 'initializer with url' do
   context 'with simple url' do
-    let(:address) { 'http://sushi.com' }
+    let(:address) { 'http://httpbingo.org' }
 
-    it { expect(subject.host).to eq('sushi.com') }
+    it { expect(subject.host).to eq('httpbingo.org') }
     it { expect(subject.port).to eq(80) }
     it { expect(subject.scheme).to eq('http') }
     it { expect(subject.path_prefix).to eq('/') }
@@ -12,7 +22,7 @@ shared_examples 'initializer with url' do
   end
 
   context 'with complex url' do
-    let(:address) { 'http://sushi.com:815/fish?a=1' }
+    let(:address) { 'http://httpbingo.org:815/fish?a=1' }
 
     it { expect(subject.port).to eq(815) }
     it { expect(subject.path_prefix).to eq('/fish') }
@@ -31,17 +41,17 @@ shared_examples 'default connection options' do
   after { Faraday.default_connection_options = nil }
 
   it 'works with implicit url' do
-    conn = Faraday.new 'http://sushi.com/foo'
+    conn = Faraday.new 'http://httpbingo.org/foo'
     expect(conn.options.timeout).to eq(10)
   end
 
   it 'works with option url' do
-    conn = Faraday.new url: 'http://sushi.com/foo'
+    conn = Faraday.new url: 'http://httpbingo.org/foo'
     expect(conn.options.timeout).to eq(10)
   end
 
   it 'works with instance connection options' do
-    conn = Faraday.new 'http://sushi.com/foo', request: { open_timeout: 1 }
+    conn = Faraday.new 'http://httpbingo.org/foo', request: { open_timeout: 1 }
     expect(conn.options.timeout).to eq(10)
     expect(conn.options.open_timeout).to eq(1)
   end
@@ -51,7 +61,7 @@ shared_examples 'default connection options' do
     conn.options.timeout = 1
     expect(Faraday.default_connection_options.request.timeout).to eq(10)
 
-    other = Faraday.new url: 'https://sushi.com/foo'
+    other = Faraday.new url: 'https://httpbingo.org/foo'
     other.options.timeout = 1
 
     expect(Faraday.default_connection_options.request.timeout).to eq(10)
@@ -71,14 +81,14 @@ RSpec.describe Faraday::Connection do
     subject { conn }
 
     context 'with implicit url param' do
-      # Faraday::Connection.new('http://sushi.com')
+      # Faraday::Connection.new('http://httpbingo.org')
       let(:url) { address }
 
       it_behaves_like 'initializer with url'
     end
 
     context 'with explicit url param' do
-      # Faraday::Connection.new(url: 'http://sushi.com')
+      # Faraday::Connection.new(url: 'http://httpbingo.org')
       let(:url) { { url: address } }
 
       it_behaves_like 'initializer with url'
@@ -98,11 +108,17 @@ RSpec.describe Faraday::Connection do
     end
 
     context 'with custom params and params in url' do
-      let(:url) { 'http://sushi.com/fish?a=1&b=2' }
+      let(:url) { 'http://httpbingo.org/fish?a=1&b=2' }
       let(:options) { { params: { a: 3 } } }
       it { expect(subject.params).to eq('a' => 3, 'b' => '2') }
     end
 
+    context 'with basic_auth in url' do
+      let(:url) { 'http://Aladdin:open%20sesame@httpbingo.org/fish' }
+
+      it { expect(subject.headers['Authorization']).to eq('Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==') }
+    end
+
     context 'with custom headers' do
       let(:options) { { headers: { user_agent: 'Faraday' } } }
 
@@ -115,6 +131,12 @@ RSpec.describe Faraday::Connection do
       it { expect(subject.ssl.verify?).to be_falsey }
     end
 
+    context 'with verify_hostname false' do
+      let(:options) { { ssl: { verify_hostname: false } } }
+
+      it { expect(subject.ssl.verify_hostname?).to be_falsey }
+    end
+
     context 'with empty block' do
       let(:conn) { Faraday::Connection.new {} }
 
@@ -124,8 +146,8 @@ RSpec.describe Faraday::Connection do
     context 'with block' do
       let(:conn) do
         Faraday::Connection.new(params: { 'a' => '1' }) do |faraday|
-          faraday.adapter :net_http
-          faraday.url_prefix = 'http://sushi.com/omnom'
+          faraday.adapter :test
+          faraday.url_prefix = 'http://httpbingo.org/omnom'
         end
       end
 
@@ -135,41 +157,22 @@ RSpec.describe Faraday::Connection do
   end
 
   describe '#close' do
+    before { Faraday.default_adapter = :test }
+    after { Faraday.default_adapter = nil }
+
     it 'can close underlying app' do
       expect(conn.app).to receive(:close)
       conn.close
     end
   end
 
-  describe 'basic_auth' do
-    subject { conn }
-
-    context 'calling the #basic_auth method' do
-      before { subject.basic_auth 'Aladdin', 'open sesame' }
-
-      it { expect(subject.headers['Authorization']).to eq('Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==') }
-    end
-
-    context 'adding basic auth info to url' do
-      let(:url) { 'http://Aladdin:open%20sesame@sushi.com/fish' }
-
-      it { expect(subject.headers['Authorization']).to eq('Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==') }
-    end
-  end
-
-  describe '#token_auth' do
-    before { subject.token_auth('abcdef', nonce: 'abc') }
-
-    it { expect(subject.headers['Authorization']).to eq('Token nonce="abc", token="abcdef"') }
-  end
-
   describe '#build_exclusive_url' do
     context 'with relative path' do
       subject { conn.build_exclusive_url('sake.html') }
 
       it 'uses connection host as default host' do
-        conn.host = 'sushi.com'
-        expect(subject.host).to eq('sushi.com')
+        conn.host = 'httpbingo.org'
+        expect(subject.host).to eq('httpbingo.org')
         expect(subject.scheme).to eq('http')
       end
 
@@ -206,10 +209,10 @@ RSpec.describe Faraday::Connection do
     end
 
     context 'with complete url' do
-      subject { conn.build_exclusive_url('http://sushi.com/sake.html?a=1') }
+      subject { conn.build_exclusive_url('http://httpbingo.org/sake.html?a=1') }
 
       it { expect(subject.scheme).to eq('http') }
-      it { expect(subject.host).to eq('sushi.com') }
+      it { expect(subject.host).to eq('httpbingo.org') }
       it { expect(subject.port).to eq(80) }
       it { expect(subject.path).to eq('/sake.html') }
       it { expect(subject.query).to eq('a=1') }
@@ -217,35 +220,35 @@ RSpec.describe Faraday::Connection do
 
     it 'overrides connection port for absolute url' do
       conn.port = 23
-      uri = conn.build_exclusive_url('http://sushi.com')
+      uri = conn.build_exclusive_url('http://httpbingo.org')
       expect(uri.port).to eq(80)
     end
 
     it 'does not add ending slash given nil url' do
-      conn.url_prefix = 'http://sushi.com/nigiri'
+      conn.url_prefix = 'http://httpbingo.org/nigiri'
       uri = conn.build_exclusive_url
       expect(uri.path).to eq('/nigiri')
     end
 
     it 'does not add ending slash given empty url' do
-      conn.url_prefix = 'http://sushi.com/nigiri'
+      conn.url_prefix = 'http://httpbingo.org/nigiri'
       uri = conn.build_exclusive_url('')
       expect(uri.path).to eq('/nigiri')
     end
 
     it 'does not use connection params' do
-      conn.url_prefix = 'http://sushi.com/nigiri'
+      conn.url_prefix = 'http://httpbingo.org/nigiri'
       conn.params = { a: 1 }
-      expect(conn.build_exclusive_url.to_s).to eq('http://sushi.com/nigiri')
+      expect(conn.build_exclusive_url.to_s).to eq('http://httpbingo.org/nigiri')
     end
 
     it 'allows to provide params argument' do
-      conn.url_prefix = 'http://sushi.com/nigiri'
+      conn.url_prefix = 'http://httpbingo.org/nigiri'
       conn.params = { a: 1 }
       params = Faraday::Utils::ParamsHash.new
       params[:a] = 2
       uri = conn.build_exclusive_url(nil, params)
-      expect(uri.to_s).to eq('http://sushi.com/nigiri?a=2')
+      expect(uri.to_s).to eq('http://httpbingo.org/nigiri?a=2')
     end
 
     it 'handles uri instances' do
@@ -254,34 +257,34 @@ RSpec.describe Faraday::Connection do
     end
 
     it 'always returns new URI instance' do
-      conn.url_prefix = 'http://sushi.com'
+      conn.url_prefix = 'http://httpbingo.org'
       uri1 = conn.build_exclusive_url(nil)
       uri2 = conn.build_exclusive_url(nil)
       expect(uri1).not_to equal(uri2)
     end
 
     context 'with url_prefixed connection' do
-      let(:url) { 'http://sushi.com/sushi/' }
+      let(:url) { 'http://httpbingo.org/get/' }
 
       it 'parses url and changes scheme' do
         conn.scheme = 'https'
         uri = conn.build_exclusive_url('sake.html')
-        expect(uri.to_s).to eq('https://sushi.com/sushi/sake.html')
+        expect(uri.to_s).to eq('https://httpbingo.org/get/sake.html')
       end
 
       it 'joins url to base with ending slash' do
         uri = conn.build_exclusive_url('sake.html')
-        expect(uri.to_s).to eq('http://sushi.com/sushi/sake.html')
+        expect(uri.to_s).to eq('http://httpbingo.org/get/sake.html')
       end
 
       it 'used default base with ending slash' do
         uri = conn.build_exclusive_url
-        expect(uri.to_s).to eq('http://sushi.com/sushi/')
+        expect(uri.to_s).to eq('http://httpbingo.org/get/')
       end
 
       it 'overrides base' do
         uri = conn.build_exclusive_url('/sake/')
-        expect(uri.to_s).to eq('http://sushi.com/sake/')
+        expect(uri.to_s).to eq('http://httpbingo.org/sake/')
       end
     end
 
@@ -297,35 +300,83 @@ RSpec.describe Faraday::Connection do
       it 'joins url to base when used relative path' do
         conn = Faraday.new(url: url)
         uri = conn.build_exclusive_url('service:search?limit=400')
-        expect(uri.to_s).to eq('http://service.com/service%3Asearch?limit=400')
+        expect(uri.to_s).to eq('http://service.com/service:search?limit=400')
       end
 
       it 'joins url to base when used with path prefix' do
         conn = Faraday.new(url: url)
         conn.path_prefix = '/api'
         uri = conn.build_exclusive_url('service:search?limit=400')
-        expect(uri.to_s).to eq('http://service.com/api/service%3Asearch?limit=400')
+        expect(uri.to_s).to eq('http://service.com/api/service:search?limit=400')
+      end
+    end
+
+    context 'with protocol-relative URL (GHSA-33mh-2634-fwr2)' do
+      it 'does not allow host override with //evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //evil.com:8080/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com:8080/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //user:pass@evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//user:pass@evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with ///evil.com' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('///evil.com')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'still allows single-slash absolute paths' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('/safe/path')
+        expect(uri.host).to eq('httpbingo.org')
+        expect(uri.path).to eq('/safe/path')
+      end
+    end
+
+    context 'with a custom `default_uri_parser`' do
+      let(:url) { 'http://httpbingo.org' }
+      let(:parser) { Addressable::URI }
+
+      around do |example|
+        with_default_uri_parser(parser) do
+          example.run
+        end
+      end
+
+      it 'does not raise error' do
+        expect { conn.build_exclusive_url('/nigiri') }.not_to raise_error
       end
     end
   end
 
   describe '#build_url' do
-    let(:url) { 'http://sushi.com/nigiri' }
+    let(:url) { 'http://httpbingo.org/nigiri' }
 
     it 'uses params' do
       conn.params = { a: 1, b: 1 }
-      expect(conn.build_url.to_s).to eq('http://sushi.com/nigiri?a=1&b=1')
+      expect(conn.build_url.to_s).to eq('http://httpbingo.org/nigiri?a=1&b=1')
     end
 
     it 'merges params' do
       conn.params = { a: 1, b: 1 }
       url = conn.build_url(nil, b: 2, c: 3)
-      expect(url.to_s).to eq('http://sushi.com/nigiri?a=1&b=2&c=3')
+      expect(url.to_s).to eq('http://httpbingo.org/nigiri?a=1&b=2&c=3')
     end
   end
 
   describe '#build_request' do
-    let(:url) { 'https://asushi.com/sake.html' }
+    let(:url) { 'https://ahttpbingo.org/sake.html' }
     let(:request) { conn.build_request(:get) }
 
     before do
@@ -342,7 +393,7 @@ RSpec.describe Faraday::Connection do
   describe '#to_env' do
     subject { conn.build_request(:get).to_env(conn).url }
 
-    let(:url) { 'http://sushi.com/sake.html' }
+    let(:url) { 'http://httpbingo.org/sake.html' }
     let(:options) { { params: @params } }
 
     it 'parses url params into query' do
@@ -508,7 +559,7 @@ RSpec.describe Faraday::Connection do
     it 'uses env http_proxy' do
       with_env 'http_proxy' => 'http://proxy.com' do
         conn = Faraday.new
-        expect(conn.instance_variable_get('@manual_proxy')).to be_falsey
+        expect(conn.instance_variable_get(:@manual_proxy)).to be_falsey
         expect(conn.proxy_for_request('http://google.co.uk').host).to eq('proxy.com')
       end
     end
@@ -516,7 +567,7 @@ RSpec.describe Faraday::Connection do
     it 'uses processes no_proxy before http_proxy' do
       with_env 'http_proxy' => 'http://proxy.com', 'no_proxy' => 'google.co.uk' do
         conn = Faraday.new
-        expect(conn.instance_variable_get('@manual_proxy')).to be_falsey
+        expect(conn.instance_variable_get(:@manual_proxy)).to be_falsey
         expect(conn.proxy_for_request('http://google.co.uk')).to be_nil
       end
     end
@@ -524,7 +575,7 @@ RSpec.describe Faraday::Connection do
     it 'uses env https_proxy' do
       with_env 'https_proxy' => 'https://proxy.com' do
         conn = Faraday.new
-        expect(conn.instance_variable_get('@manual_proxy')).to be_falsey
+        expect(conn.instance_variable_get(:@manual_proxy)).to be_falsey
         expect(conn.proxy_for_request('https://google.co.uk').host).to eq('proxy.com')
       end
     end
@@ -532,7 +583,7 @@ RSpec.describe Faraday::Connection do
     it 'uses processes no_proxy before https_proxy' do
       with_env 'https_proxy' => 'https://proxy.com', 'no_proxy' => 'google.co.uk' do
         conn = Faraday.new
-        expect(conn.instance_variable_get('@manual_proxy')).to be_falsey
+        expect(conn.instance_variable_get(:@manual_proxy)).to be_falsey
         expect(conn.proxy_for_request('https://google.co.uk')).to be_nil
       end
     end
@@ -542,7 +593,7 @@ RSpec.describe Faraday::Connection do
         conn = Faraday.new
         conn.proxy = 'http://proxy2.com'
 
-        expect(conn.instance_variable_get('@manual_proxy')).to be_truthy
+        expect(conn.instance_variable_get(:@manual_proxy)).to be_truthy
         expect(conn.proxy_for_request('https://google.co.uk').host).to eq('proxy2.com')
       end
     end
@@ -556,26 +607,32 @@ RSpec.describe Faraday::Connection do
     end
 
     context 'performing a request' do
-      before { stub_request(:get, 'http://example.com') }
+      let(:url) { 'http://example.com' }
+      let(:conn) do
+        Faraday.new do |f|
+          f.adapter :test do |stubs|
+            stubs.get(url) do
+              [200, {}, 'ok']
+            end
+          end
+        end
+      end
 
       it 'dynamically checks proxy' do
         with_env 'http_proxy' => 'http://proxy.com:80' do
-          conn = Faraday.new
           expect(conn.proxy.uri.host).to eq('proxy.com')
 
-          conn.get('http://example.com') do |req|
+          conn.get(url) do |req|
             expect(req.options.proxy.uri.host).to eq('proxy.com')
           end
         end
 
-        conn.get('http://example.com')
-        expect(conn.instance_variable_get('@temp_proxy')).to be_nil
+        conn.get(url)
+        expect(conn.instance_variable_get(:@temp_proxy)).to be_nil
       end
 
       it 'dynamically check no proxy' do
         with_env 'http_proxy' => 'http://proxy.com', 'no_proxy' => 'example.com' do
-          conn = Faraday.new
-
           expect(conn.proxy.uri.host).to eq('proxy.com')
 
           conn.get('http://example.com') do |req|
@@ -589,7 +646,7 @@ RSpec.describe Faraday::Connection do
   describe '#dup' do
     subject { conn.dup }
 
-    let(:url) { 'http://sushi.com/foo' }
+    let(:url) { 'http://httpbingo.org/foo' }
     let(:options) do
       {
         ssl: { verify: :none },
@@ -605,7 +662,6 @@ RSpec.describe Faraday::Connection do
 
     context 'after manual changes' do
       before do
-        subject.basic_auth('', '')
         subject.headers['content-length'] = 12
         subject.params['b'] = '2'
         subject.options[:open_timeout] = 10
@@ -640,14 +696,42 @@ RSpec.describe Faraday::Connection do
 
       it_behaves_like 'default connection options'
     end
+
+    context 'preserving a user_agent assigned via default_conncetion_options' do
+      around do |example|
+        old = Faraday.default_connection_options
+        Faraday.default_connection_options = { headers: { user_agent: 'My Agent 1.2' } }
+        example.run
+        Faraday.default_connection_options = old
+      end
+
+      context 'when url is a Hash' do
+        let(:conn) { Faraday.new(url: 'http://example.co', headers: { 'CustomHeader' => 'CustomValue' }) }
+
+        it { expect(conn.headers).to eq('CustomHeader' => 'CustomValue', 'User-Agent' => 'My Agent 1.2') }
+      end
+
+      context 'when url is a String' do
+        let(:conn) { Faraday.new('http://example.co', headers: { 'CustomHeader' => 'CustomValue' }) }
+
+        it { expect(conn.headers).to eq('CustomHeader' => 'CustomValue', 'User-Agent' => 'My Agent 1.2') }
+      end
+    end
   end
 
   describe 'request params' do
     context 'with simple url' do
       let(:url) { 'http://example.com' }
-      let!(:stubbed) { stub_request(:get, 'http://example.com?a=a&p=3') }
+      let(:stubs) { Faraday::Adapter::Test::Stubs.new }
+
+      before do
+        conn.adapter(:test, stubs)
+        stubs.get('http://example.com?a=a&p=3') do
+          [200, {}, 'ok']
+        end
+      end
 
-      after { expect(stubbed).to have_been_made.once }
+      after { stubs.verify_stubbed_calls }
 
       it 'test_overrides_request_params' do
         conn.get('?p=2&a=a', p: 3)
@@ -669,15 +753,22 @@ RSpec.describe Faraday::Connection do
     context 'with url and extra params' do
       let(:url) { 'http://example.com?a=1&b=2' }
       let(:options) { { params: { c: 3 } } }
+      let(:stubs) { Faraday::Adapter::Test::Stubs.new }
+
+      before do
+        conn.adapter(:test, stubs)
+      end
 
       it 'merges connection and request params' do
-        stubbed = stub_request(:get, 'http://example.com?a=1&b=2&c=3&limit=5&page=1')
+        expected = 'http://example.com?a=1&b=2&c=3&limit=5&page=1'
+        stubs.get(expected) { [200, {}, 'ok'] }
         conn.get('?page=1', limit: 5)
-        expect(stubbed).to have_been_made.once
+        stubs.verify_stubbed_calls
       end
 
       it 'allows to override all params' do
-        stubbed = stub_request(:get, 'http://example.com?b=b')
+        expected = 'http://example.com?b=b'
+        stubs.get(expected) { [200, {}, 'ok'] }
         conn.get('?p=1&a=a', p: 2) do |req|
           expect(req.params[:a]).to eq('a')
           expect(req.params['c']).to eq(3)
@@ -685,47 +776,61 @@ RSpec.describe Faraday::Connection do
           req.params = { b: 'b' }
           expect(req.params['b']).to eq('b')
         end
-        expect(stubbed).to have_been_made.once
+        stubs.verify_stubbed_calls
       end
 
       it 'allows to set params_encoder for single request' do
-        encoder = Object.new
-        def encoder.encode(params)
-          params.map { |k, v| "#{k.upcase}-#{v.to_s.upcase}" }.join(',')
-        end
-        stubbed = stub_request(:get, 'http://example.com/?A-1,B-2,C-3,FEELING-BLUE')
+        encoder = CustomEncoder.new
+        expected = 'http://example.com/?A-1,B-2,C-3,FEELING-BLUE'
+        stubs.get(expected) { [200, {}, 'ok'] }
 
-        conn.get('/', feeling: 'blue') do |req|
+        conn.get('/', a: 1, b: 2, c: 3, feeling: 'blue') do |req|
           req.options.params_encoder = encoder
         end
-        expect(stubbed).to have_been_made.once
+        stubs.verify_stubbed_calls
       end
     end
 
     context 'with default params encoder' do
-      let!(:stubbed) { stub_request(:get, 'http://example.com?color%5B%5D=red&color%5B%5D=blue') }
-      after { expect(stubbed).to have_been_made.once }
+      let(:stubs) { Faraday::Adapter::Test::Stubs.new }
+
+      before do
+        conn.adapter(:test, stubs)
+        stubs.get('http://example.com?color%5B%5D=blue&color%5B%5D=red') do
+          [200, {}, 'ok']
+        end
+      end
+
+      after { stubs.verify_stubbed_calls }
 
       it 'supports array params in url' do
-        conn.get('http://example.com?color[]=red&color[]=blue')
+        conn.get('http://example.com?color[]=blue&color[]=red')
       end
 
       it 'supports array params in params' do
-        conn.get('http://example.com', color: %w[red blue])
+        conn.get('http://example.com', color: %w[blue red])
       end
     end
 
     context 'with flat params encoder' do
       let(:options) { { request: { params_encoder: Faraday::FlatParamsEncoder } } }
-      let!(:stubbed) { stub_request(:get, 'http://example.com?color=blue') }
-      after { expect(stubbed).to have_been_made.once }
+      let(:stubs) { Faraday::Adapter::Test::Stubs.new }
+
+      before do
+        conn.adapter(:test, stubs)
+        stubs.get('http://example.com?color=blue&color=red') do
+          [200, {}, 'ok']
+        end
+      end
+
+      after { stubs.verify_stubbed_calls }
 
       it 'supports array params in params' do
-        conn.get('http://example.com', color: %w[red blue])
+        conn.get('http://example.com', color: %w[blue red])
       end
 
       context 'with array param in url' do
-        let(:url) { 'http://example.com?color[]=red&color[]=blue' }
+        let(:url) { 'http://example.com?color[]=blue&color[]=red' }
 
         it do
           conn.get('/')