faraday 2.14.2 → 2.14.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05f10cf15f3eb3f35b39edc67e14c374306d286f7b282ce86e131cab66ef9726
-  data.tar.gz: 17df5c4c9c054080f80038a1d8c6e1eaf88fd5d319c5ca1f04b10bc7bc0fe350
+  metadata.gz: ecc5e9592d7434d7e39bc5cc827be5b62af99e258582468c8b6fd78e0122bf7e
+  data.tar.gz: 4f5728ac524a3456a800c8d0159b4569173b1c841f80fae7d0d2704e261b6588
 SHA512:
-  metadata.gz: 511bc21e7d0e4c4ecf866f84b434e6f38d6c4eada9d17148f25db9c6cf3194c4fe6fe600cc1b41d288e611e8dbfcbbbb5e2d711051a4340239741bb9dae54b73
-  data.tar.gz: e527f43b558124d58d4c4826dc46d0716a6689fec48dea4daf47a3943e1cae5c3612b2e490c956811d0d2ba501290548e85f2b0879bd924fd026566a2dc6056e
+  metadata.gz: 12567175cd7d08a95ccf8203bffcb9bebf8d1b52f279ce034c3f3e17dc5efc81e08259c2992ff792560ed626dd59ae305c163cb43018860b3c0ae833c3f68855
+  data.tar.gz: bb786c688b4629c6bc43e4715715fcd42de120eee3802a3614eca60e17627ff77f40298af500a431158b1f1de8bd0d0bd58817a8793bab92e11bac9aa9b482f2

data/lib/faraday/adapter/test.rb

@@ -127,6 +127,14 @@ module Faraday
           new_stub(:options, path, headers, &block)
         end
 
+        # Removes all stubs, including the ones that have already been consumed.
+        def clear
+          @stubs_mutex.synchronize do
+            @stack.clear
+            @consumed.clear
+          end
+        end
+
         # Raises an error if any of the stubbed calls have not been made.
         def verify_stubbed_calls
           failed_stubs = []

data/lib/faraday/encoders/nested_params_encoder.rb

@@ -106,6 +106,8 @@ module Faraday
 
     def decode_pair(key, value, context)
       subkeys = key.scan(SUBKEYS_REGEX)
+      validate_params_depth!(subkeys.length)
+
       subkeys.each_with_index do |subkey, i|
         is_array = subkey =~ /[\[\]]+\Z/
         subkey = Regexp.last_match.pre_match if is_array
@@ -145,6 +147,12 @@ module Faraday
       is_array ? context << value : context[subkey] = value
     end
 
+    def validate_params_depth!(depth)
+      return unless @param_depth_limit && depth > @param_depth_limit
+
+      raise Faraday::Error, "exceeded nested parameter depth limit of #{@param_depth_limit}"
+    end
+
     # Internal: convert a nested hash with purely numeric keys into an array.
     # FIXME: this is not compatible with Rack::Utils.parse_nested_query
     # @!visibility private
@@ -167,7 +175,7 @@ module Faraday
   # for your requests.
   module NestedParamsEncoder
     class << self
-      attr_accessor :sort_params, :array_indices
+      attr_accessor :sort_params, :array_indices, :param_depth_limit
 
       extend Forwardable
 
@@ -177,6 +185,7 @@ module Faraday
     # Useful default for OAuth and caching.
     @sort_params = true
     @array_indices = false
+    @param_depth_limit = 100
 
     extend EncodeMethods
     extend DecodeMethods

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '2.14.2'
+  VERSION = '2.14.3'
 end

data/spec/faraday/adapter/test_spec.rb

@@ -439,4 +439,22 @@ RSpec.describe Faraday::Adapter::Test do
       end
     end
   end
+
+  describe '#clear' do
+    it 'removes pending stubs' do
+      stubs.clear
+      expect { connection.get('/hello') }.to raise_error(described_class::Stubs::NotFound)
+    end
+
+    it 'removes already consumed stubs' do
+      expect(connection.get('/hello').body).to eq('hello')
+      stubs.clear
+      expect { connection.get('/hello') }.to raise_error(described_class::Stubs::NotFound)
+    end
+
+    it 'leaves the stubs empty' do
+      stubs.clear
+      expect(stubs).to be_empty
+    end
+  end
 end

data/spec/faraday/connection_spec.rb

@@ -380,6 +380,18 @@ RSpec.describe Faraday::Connection do
       url = conn.build_url(nil, b: 2, c: 3)
       expect(url.to_s).to eq('http://httpbingo.org/nigiri?a=1&b=2&c=3')
     end
+
+    it 'raises a controlled error when URL query params exceed the nested depth limit' do
+      original_param_depth_limit = Faraday::NestedParamsEncoder.param_depth_limit
+      Faraday::NestedParamsEncoder.param_depth_limit = 2
+
+      expect { conn.build_url('/nigiri?a[b][c]=1') }.to raise_error(
+        Faraday::Error,
+        'exceeded nested parameter depth limit of 2'
+      )
+    ensure
+      Faraday::NestedParamsEncoder.param_depth_limit = original_param_depth_limit
+    end
   end
 
   describe '#build_request' do

data/spec/faraday/params_encoders/nested_spec.rb

@@ -5,6 +5,13 @@ require 'rack/utils'
 RSpec.describe Faraday::NestedParamsEncoder do
   it_behaves_like 'a params encoder'
 
+  around do |example|
+    original_param_depth_limit = described_class.param_depth_limit
+    example.run
+  ensure
+    described_class.param_depth_limit = original_param_depth_limit
+  end
+
   it 'decodes arrays' do
     query    = 'a[1]=one&a[2]=two&a[3]=three'
     expected = { 'a' => %w[one two three] }
@@ -53,6 +60,27 @@ RSpec.describe Faraday::NestedParamsEncoder do
     expect(subject.decode(query)).to eq(expected)
   end
 
+  it 'allows nested params within the configured depth limit' do
+    described_class.param_depth_limit = 3
+
+    expect(subject.decode('a[b][c]=1')).to eq({ 'a' => { 'b' => { 'c' => '1' } } })
+  end
+
+  it 'raises a controlled error when nested params exceed the depth limit' do
+    described_class.param_depth_limit = 2
+
+    expect { subject.decode('a[b][c]=1') }.to raise_error(
+      Faraday::Error,
+      'exceeded nested parameter depth limit of 2'
+    )
+  end
+
+  it 'allows disabling the nested params depth limit' do
+    described_class.param_depth_limit = nil
+
+    expect(subject.decode('a[b][c][d]=1')).to eq({ 'a' => { 'b' => { 'c' => { 'd' => '1' } } } })
+  end
+
   it 'decodes nested final value overrides any type' do
     query    = 'a[b][c]=1&a[b]=2'
     expected = { 'a' => { 'b' => '2' } }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: faraday
 version: !ruby/object:Gem::Version
-  version: 2.14.2
+  version: 2.14.3
 platform: ruby
 authors:
 - "@technoweenie"
@@ -144,7 +144,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://lostisland.github.io/faraday
-  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v2.14.2
+  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v2.14.3
   source_code_uri: https://github.com/lostisland/faraday
   bug_tracker_uri: https://github.com/lostisland/faraday/issues
   rubygems_mfa_required: 'true'