faraday 2.14.4 → 2.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfb9bdb4e8b26d58a269ecb088231f9b6b3fa41dcba2e45030e148e3fed39c85
-  data.tar.gz: f14d4a3d9fde7a433af42981764ef381347fbbe96414fe0f576a5d9e7d32c12e
+  metadata.gz: a700341d7d0844ede1248c479375ec0b3cb7fd51526c7c4abbaf9ce3db6c8a44
+  data.tar.gz: 76de6bace7c8995002b54ce7f19610a311418ef253c19a2fb354dee8ea986866
 SHA512:
-  metadata.gz: 3f757a719af96c446b1c90a02ed43a190b551c489c72c4f158f041c8afdcec9385903e28f057929c217cdd29ed2a396316ffc650c66352be26503edd2a70eefa
-  data.tar.gz: b34d0e1b1816abc2ae2987088abc08153acc0786582e742fe384418e8b8fc3ae4f5ee14b3e768d1f06ba8b1b44b4a10effd61858297db08e47775cf712e7f190
+  metadata.gz: 5bc51dff2b4420115e15f36532fa2f9c2a31aa60d28d9acd864dcd4a50185e28fe5ac4dbeab648915d6a605e3606d06e207c083b3387a3253040bc9c108d6264
+  data.tar.gz: 82893f3f9d2152459d2a7b9b271601926e723a0723b7c3d20dc615795ce3d210473f2b6f359ec68fb4cd0f0a590ecae3121c325a257040c33701094cf56966fb

data/Rakefile

@@ -1,12 +1,18 @@
 # frozen_string_literal: true
 
-require 'rspec/core/rake_task'
 require 'bundler'
 
 Bundler::GemHelper.install_tasks
 
-RSpec::Core::RakeTask.new(:spec) do |task|
-  task.ruby_opts = %w[-W]
-end
+# The publish workflow sets FARADAY_RELEASE because its bundle (release/Gemfile) doesn't include RSpec.
+unless ENV['FARADAY_RELEASE']
+  require 'rspec/core/rake_task'
+
+  RSpec::Core::RakeTask.new(:spec) do |task|
+    task.ruby_opts = %w[-W]
+    # Integration specs need service containers, see .github/workflows/integration-tests.yml
+    task.exclude_pattern = 'spec/integration/**/*_spec.rb'
+  end
 
-task default: :spec
+  task default: :spec
+end

data/lib/faraday/connection.rb

@@ -210,7 +210,7 @@ module Faraday
     #
     # @overload options(url, params = nil, headers = nil)
     #   Makes an OPTIONS HTTP request to the given URL.
-    #   @param url [String, URI, nil] String base URL to sue as a prefix for all requests.
+    #   @param url [String, URI, nil] String base URL to use as a prefix for all requests.
     #   @param params [Hash, nil] Hash of URI query unencoded key/value pairs.
     #   @param headers [Hash, nil] unencoded HTTP header key/value pairs.
     #
@@ -300,7 +300,10 @@ module Faraday
       end
     end
 
-    # Determine if this Faraday::Connection can make parallel requests.
+    # Determine if this Faraday::Connection is currently making parallel
+    # requests, i.e. if it is called inside an {#in_parallel} block.
+    # Use {#support_parallel?} to check if the adapter can make parallel
+    # requests at all.
     #
     # @return [Boolean]
     def in_parallel?
@@ -315,13 +318,13 @@ module Faraday
     # @yield a block to execute multiple requests.
     # @return [void]
     def in_parallel(manager = nil, &block)
-      @parallel_manager = manager || default_parallel_manager do
-        warn 'Warning: `in_parallel` called but no parallel-capable adapter ' \
-             'on Faraday stack'
-        warn caller[2, 10].join("\n")
+      previous_manager = @parallel_manager
+      @parallel_manager = manager || previous_manager || default_parallel_manager do
+        warn('Warning: `in_parallel` called but no parallel-capable adapter ' \
+             'on Faraday stack', caller[2, 10].join("\n"))
         nil
       end
-      return yield unless @parallel_manager
+      return yield unless @parallel_manager && !@parallel_manager.equal?(previous_manager)
 
       if @parallel_manager.respond_to?(:execute)
         # Execute is the new method that is responsible for executing the block.
@@ -332,7 +335,7 @@ module Faraday
         @parallel_manager.run
       end
     ensure
-      @parallel_manager = nil
+      @parallel_manager = previous_manager
     end
 
     # Sets the Hash proxy options.
@@ -362,7 +365,7 @@ module Faraday
     #
     #   conn.get("nigiri?page=2") # accesses https://httpbingo.org/api/nigiri
     def url_prefix=(url, encoder = nil)
-      uri = @url_prefix = Utils.URI(url)
+      uri = @url_prefix = Utils.URI(url.to_s)
       self.path_prefix = uri.path
 
       params.merge_query(uri.query, encoder)
@@ -445,7 +448,7 @@ module Faraday
         req.options.proxy = proxy_for_request(url)
         req.url(url)                if url
         req.headers.update(headers) if headers
-        req.body = body             if body
+        req.body = body             unless body.nil?
         yield(req) if block_given?
       end
 
@@ -496,8 +499,6 @@ module Faraday
 
     # Creates a duplicate of this Faraday::Connection.
     #
-    # @api private
-    #
     # @return [Faraday::Connection]
     def dup
       self.class.new(build_exclusive_url,
@@ -505,7 +506,7 @@ module Faraday
                      params: params.dup,
                      builder: builder.dup,
                      ssl: ssl.dup,
-                     request: options.dup)
+                     request: options.dup).tap { |copy| copy.proxy = proxy if @manual_proxy }
     end
 
     # Yields username and password extracted from a URI if they both exist.
@@ -519,7 +520,7 @@ module Faraday
     def with_uri_credentials(uri)
       return unless uri.user && uri.password
 
-      yield(Utils.unescape(uri.user), Utils.unescape(uri.password))
+      yield(URI::DEFAULT_PARSER.unescape(uri.user), URI::DEFAULT_PARSER.unescape(uri.password))
     end
 
     def proxy_from_env(url)
@@ -532,7 +533,7 @@ module Faraday
         uri = if uri.host.nil?
                 find_default_proxy
               else
-                URI.parse("#{uri.scheme}://#{uri.host}").find_proxy
+                URI.parse(uri.to_s).find_proxy
               end
       when URI
         uri = url.find_proxy
@@ -560,7 +561,13 @@ module Faraday
       end
     end
 
-    def support_parallel?(adapter)
+    # Determine if an adapter can make parallel requests.
+    #
+    # @param adapter [Class, nil] the adapter class to check. Defaults to the
+    #                adapter of this Faraday::Connection.
+    #
+    # @return [Boolean]
+    def support_parallel?(adapter = @builder.adapter&.klass)
       adapter.respond_to?(:supports_parallel?) && adapter&.supports_parallel?
     end
   end

data/lib/faraday/encoders/nested_params_encoder.rb

@@ -162,7 +162,7 @@ module Faraday
       end
 
       if depth.positive? && !hash.empty? && hash.keys.all? { |k| k =~ /^\d+$/ }
-        hash.sort.map(&:last)
+        hash.sort_by { |key, _| key.to_i }.map(&:last)
       else
         hash
       end

data/lib/faraday/error.rb

@@ -70,7 +70,7 @@ module Faraday
     # to `super`. See NilStatusError.
     def exc_msg_and_response!(exc, response = nil)
       if @response.nil? && @wrapped_exception.nil?
-        @wrapped_exception, msg, @response = exc_msg_and_response(exc, response)
+        @wrapped_exception, msg, @response = exc_msg_and_response(exc, omit_request_data(response))
         return msg
       end
 
@@ -85,7 +85,14 @@ module Faraday
       when Hash
         [nil, build_error_message_from_hash(exc), exc]
       when Faraday::Env
-        [nil, build_error_message_from_env(exc), exc]
+        sanitized = omit_request_data(exc)
+        message =
+          if sanitized.equal?(exc)
+            build_error_message_from_env(exc)
+          else
+            build_error_message_from_hash(sanitized)
+          end
+        [nil, message, sanitized]
       else
         [nil, exc.to_s, response]
       end
@@ -93,6 +100,26 @@ module Faraday
 
     private
 
+    # When the RaiseError middleware opted this request out of request data
+    # (`include_request: false`), it marks the Env. Replace env-carrying
+    # responses (the Response object raised by the Json middleware, or an Env
+    # passed directly) with a request-less hash so that errors raised by other
+    # middlewares (e.g. ParsingError) cannot expose request headers and body.
+    # The body reads the explicit `response_body` member because `Env#body`
+    # aliases to the request body while the status is nil.
+    def omit_request_data(response)
+      env =
+        case response
+        when Faraday::Response
+          response.env if response.finished?
+        when Faraday::Env
+          response
+        end
+      return response unless env.is_a?(Faraday::Env) && env[:include_request] == false
+
+      { status: env.status, headers: env.response_headers, body: env.response_body }
+    end
+
     def build_error_message_from_hash(hash)
       # Be defensive with external Hash objects - they might be missing keys
       status = hash.fetch(:status, nil)

data/lib/faraday/logging/formatter.rb

@@ -41,7 +41,7 @@ module Faraday
       def exception(exc)
         return unless log_errors?
 
-        public_send(log_level) { "error: #{exc.full_message}" }
+        public_send(log_level) { "error: #{apply_filters(exc.full_message)}" }
 
         log_headers('error', exc.response_headers) if exc.respond_to?(:response_headers) && log_headers?(:error)
         return unless exc.respond_to?(:response_body) && exc.response_body && log_body?(:error)

data/lib/faraday/options/proxy_options.rb

@@ -42,7 +42,7 @@ module Faraday
       super
     end
 
-    memoized(:user) { uri&.user && Utils.unescape(uri.user) }
-    memoized(:password) { uri&.password && Utils.unescape(uri.password) }
+    memoized(:user) { uri&.user && URI::DEFAULT_PARSER.unescape(uri.user) }
+    memoized(:password) { uri&.password && URI::DEFAULT_PARSER.unescape(uri.password) }
   end
 end

data/lib/faraday/options.rb

@@ -74,7 +74,7 @@ module Faraday
 
     # Public
     def fetch(key, *args)
-      unless symbolized_key_set.include?(key.to_sym)
+      unless members.include?(key.to_sym) && !send(key).nil?
         key_setter = "#{key}="
         if !args.empty?
           send(key_setter, args.first)
@@ -186,14 +186,15 @@ module Faraday
     def [](key)
       key = key.to_sym
       if (method = self.class.memoized_attributes[key])
-        super || (self[key] = instance_eval(&method))
+        value = super
+        value.nil? ? (self[key] = instance_eval(&method)) : value
       else
         super
       end
     end
 
     def symbolized_key_set
-      @symbolized_key_set ||= Set.new(keys.map(&:to_sym))
+      Set.new(keys.map(&:to_sym))
     end
 
     def self.inherited(subclass)

data/lib/faraday/rack_builder.rb

@@ -73,6 +73,9 @@ module Faraday
       super
       @adapter = original.adapter
       @handlers = original.handlers.dup
+      # @app is memoized on the first request. Drop it so the duplicate
+      # rebuilds from the copied handlers and middleware added after dup runs.
+      @app = nil
     end
 
     def build
@@ -115,6 +118,7 @@ module Faraday
     def adapter(klass = NO_ARGUMENT, *args, **kwargs, &block)
       return @adapter if klass == NO_ARGUMENT || klass.nil?
 
+      raise_if_locked
       klass = Faraday::Adapter.lookup_middleware(klass) if klass.is_a?(Symbol)
       @adapter = self.class::Handler.new(klass, *args, **kwargs, &block)
     end
@@ -230,10 +234,6 @@ module Faraday
       raise MISSING_ADAPTER_ERROR unless @adapter
     end
 
-    def adapter_set?
-      !@adapter.nil?
-    end
-
     def use_symbol(mod, key, ...)
       use(mod.lookup_middleware(key), ...)
     end

data/lib/faraday/response/raise_error.rb

@@ -20,7 +20,13 @@ module Faraday
       }.freeze
       # rubocop:enable Naming/ConstantName
 
-      DEFAULT_OPTIONS = { include_request: true, allowed_statuses: [] }.freeze
+      DEFAULT_OPTIONS = { include_request: true, allowed_statuses: [].freeze }.freeze
+
+      def on_request(env)
+        # Announce the opt-out on the shared Env so that errors raised by other
+        # middlewares (e.g. ParsingError from the Json middleware) honor it too.
+        env[:include_request] = false unless options[:include_request]
+      end
 
       def on_complete(env)
         return if Array(options[:allowed_statuses]).include?(env[:status])

data/lib/faraday/response.rb

@@ -54,7 +54,9 @@ module Faraday
       raise 'response already finished' if finished?
 
       @env = env.is_a?(Env) ? env : Env.from(env)
-      @on_complete_callbacks.each { |callback| callback.call(@env) }
+      callbacks = @on_complete_callbacks
+      @on_complete_callbacks = []
+      callbacks.each { |callback| callback.call(@env) }
       self
     end
 
@@ -76,7 +78,8 @@ module Faraday
     end
 
     def marshal_load(env)
-      @env = Env.from(env)
+      @env = Env.from(env) if env
+      @on_complete_callbacks = []
     end
 
     # Expand the env with more properties, without overriding existing ones.

data/lib/faraday/utils/headers.rb

@@ -38,13 +38,11 @@ module Faraday
 
       # symbol -> string mapper + cache
       KeyMap = Hash.new do |map, key|
-        value = if key.respond_to?(:to_str)
-                  key
-                else
-                  key.to_s.split('_') # user_agent: %w(user agent)
-                     .each(&:capitalize!) # => %w(User Agent)
-                     .join('-') # => "User-Agent"
-                end
+        next key if key.respond_to?(:to_str)
+
+        value = key.to_s.split('_') # user_agent: %w(user agent)
+                   .each(&:capitalize!) # => %w(User Agent)
+                   .join('-') # => "User-Agent"
         keymap_mutex.synchronize { map[key] = value }
       end
       KeyMap[:etag] = 'ETag'
@@ -62,6 +60,8 @@ module Faraday
         super
       end
 
+      alias store []=
+
       def fetch(key, ...)
         key = KeyMap[key]
         key = @names.fetch(key.downcase, key)
@@ -77,6 +77,28 @@ module Faraday
         super
       end
 
+      def clear
+        @names.clear
+        super
+      end
+
+      def shift = rebuilding_names { super }
+      def compact! = rebuilding_names { super }
+      def rehash = rebuilding_names { super }
+
+      # Without a block these return an enumerator that calls back into the
+      # method once iterated, so the index only needs rebuilding in that call.
+      def delete_if = block_given? ? rebuilding_names { super } : super
+      def keep_if = block_given? ? rebuilding_names { super } : super
+      def reject! = block_given? ? rebuilding_names { super } : super
+      def select! = block_given? ? rebuilding_names { super } : super
+      alias filter! select!
+
+      # A mapping hash is a valid alternative to a block.
+      def transform_keys!(*args, &block)
+        args.empty? && !block ? super : rebuilding_names { super }
+      end
+
       def dig(key, *rest)
         key = KeyMap[key]
         key = @names.fetch(key.downcase, key)
@@ -136,6 +158,18 @@ module Faraday
 
       private
 
+      # Runs the block, then rebuilds the name index even if the block raised
+      # or exited early, as the underlying Hash may already be partially mutated.
+      def rebuilding_names
+        yield
+      ensure
+        rebuild_names
+      end
+
+      def rebuild_names
+        @names = each_key.to_h { |key| [KeyMap[key].downcase, key] }
+      end
+
       # Join multiple values with a comma.
       def add_parsed(key, value)
         if key?(key)

data/lib/faraday/utils.rb

@@ -27,10 +27,22 @@ module Faraday
 
     ESCAPE_RE = /[^a-zA-Z0-9 .~_-]/
 
+    # CGI.escape works on raw bytes: it matches ESCAPE_RE only where no multibyte character
+    # hides an ASCII byte (Shift_JIS 'ア' is "\x83A"), unlike ESCAPE_RE it doesn't raise on
+    # invalid bytes, and it returns String subclasses (SafeBuffer) as is when nothing is escaped.
+    CGI_ESCAPE_ENCODINGS = [Encoding::UTF_8, Encoding::US_ASCII, Encoding::BINARY].freeze
+    private_constant :CGI_ESCAPE_ENCODINGS
+
     def escape(str)
-      str.to_s.gsub(ESCAPE_RE) do |match|
-        "%#{match.unpack('H2' * match.bytesize).join('%').upcase}"
-      end.gsub(' ', default_space_encoding)
+      str = str.to_s
+      if str.instance_of?(String) && CGI_ESCAPE_ENCODINGS.include?(str.encoding) && str.valid_encoding?
+        escaped = CGI.escape(str)
+        default_space_encoding == '+' ? escaped : escaped.gsub('+', default_space_encoding)
+      else
+        str.gsub(ESCAPE_RE) do |match|
+          "%#{match.unpack('H2' * match.bytesize).join('%').upcase}"
+        end.gsub(' ', default_space_encoding)
+      end
     end
 
     def unescape(str)

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '2.14.4'
+  VERSION = '2.15.1'
 end

data/spec/external_adapters/faraday_specs_setup.rb

@@ -3,6 +3,8 @@
 require 'webmock/rspec'
 WebMock.disable_net_connect!(allow_localhost: true)
 
+# The gem ships only `spec/external_adapters` and `spec/support` (see `spec.files` in
+# faraday.gemspec). Requiring a file from anywhere else means updating the gemspec too.
 require_relative '../support/helper_methods'
 require_relative '../support/disabling_stub'
 require_relative '../support/streaming_response_checker'

data/spec/support/integration/test_pki.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Faraday
+  module IntegrationHelpers
+    # Throwaway certificate authority used by the SSL and proxy integration
+    # specs. Everything is generated in memory, so no certificate files need to
+    # be committed or generated by the CI workflow.
+    class TestPKI
+      Credentials = Struct.new(:cert, :key)
+
+      attr_reader :ca_cert, :ca_key
+
+      def initialize
+        @ca_key = OpenSSL::PKey::RSA.new(2048)
+        @ca_cert = build_certificate('Faraday Test CA', ca_key, ca_key, nil) do |cert, factory|
+          [
+            factory.create_extension('basicConstraints', 'CA:TRUE', true),
+            factory.create_extension('keyUsage', 'keyCertSign,cRLSign', true),
+            factory.create_extension('subjectKeyIdentifier', 'hash', false)
+          ].each { |ext| cert.add_extension(ext) }
+        end
+      end
+
+      # Issues a certificate signed by this CA.
+      #
+      # @param common_name [String] certificate subject CN
+      # @param dns_names [Array<String>] DNS subjectAltNames
+      # @param ip_addresses [Array<String>] IP subjectAltNames
+      # @return [Credentials]
+      def issue(common_name, dns_names: [], ip_addresses: [])
+        key = OpenSSL::PKey::RSA.new(2048)
+        sans = dns_names.map { |name| "DNS:#{name}" } + ip_addresses.map { |ip| "IP:#{ip}" }
+
+        cert = build_certificate(common_name, key, ca_key, ca_cert) do |built, factory|
+          built.add_extension(factory.create_extension('basicConstraints', 'CA:FALSE', true))
+          built.add_extension(factory.create_extension('subjectAltName', sans.join(','), false)) if sans.any?
+        end
+
+        Credentials.new(cert, key)
+      end
+
+      # Writes the CA certificate to disk, as expected by the `ca_file` option.
+      def write_ca_file(path)
+        File.write(path, ca_cert.to_pem)
+        path
+      end
+
+      # @return [OpenSSL::X509::Store] a store that only trusts this CA
+      def cert_store
+        OpenSSL::X509::Store.new.tap { |store| store.add_cert(ca_cert) }
+      end
+
+      private
+
+      def build_certificate(common_name, key, signing_key, issuer_cert)
+        cert = OpenSSL::X509::Certificate.new
+        cert.version = 2
+        cert.serial = rand(1..(2**32))
+        cert.subject = OpenSSL::X509::Name.parse("/CN=#{common_name}")
+        cert.issuer = issuer_cert ? issuer_cert.subject : cert.subject
+        cert.public_key = key.public_key
+        cert.not_before = Time.now - 60
+        cert.not_after = Time.now + 3600
+
+        factory = OpenSSL::X509::ExtensionFactory.new
+        factory.subject_certificate = cert
+        factory.issuer_certificate = issuer_cert || cert
+        yield cert, factory
+
+        cert.sign(signing_key, OpenSSL::Digest.new('SHA256'))
+        cert
+      end
+    end
+  end
+end

data/spec/support/integration/tls_server.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'openssl'
+require 'socket'
+
+module Faraday
+  module IntegrationHelpers
+    # Minimal HTTPS server running in a background thread, used to exercise
+    # SSLOptions and ProxyOptions against real TLS handshakes.
+    #
+    # Every request is answered with a JSON document describing what the server
+    # saw, e.g. `{"path":"/","client_cert_subject":null,"remote_ip":"127.0.0.1"}`.
+    class TLSServer
+      attr_reader :port
+
+      # @param credentials [TestPKI::Credentials] server certificate and key
+      # @param client_ca [TestPKI, nil] when given, clients must present a
+      #   certificate signed by this CA (mutual TLS)
+      # @param host [String] address to listen on; '0.0.0.0' makes the server
+      #   reachable from service containers, such as the proxies
+      def initialize(credentials, client_ca: nil, host: '127.0.0.1')
+        @tcp_server = TCPServer.new(host, 0)
+        @port = @tcp_server.addr[1]
+        @ssl_server = OpenSSL::SSL::SSLServer.new(@tcp_server, ssl_context(credentials, client_ca))
+        @ssl_server.start_immediately = false
+        @threads = []
+      end
+
+      def self.start(...)
+        new(...).start
+      end
+
+      def start
+        @acceptor = Thread.new do
+          loop do
+            socket = @ssl_server.accept
+            @threads << Thread.new { handle(socket) }
+          end
+        rescue IOError, Errno::EBADF
+          nil # server stopped
+        end
+        self
+      end
+
+      def stop
+        @ssl_server.close
+        @acceptor&.join(1)
+        @threads.each { |thread| thread.join(1) }
+      end
+
+      def url(host = 'localhost')
+        "https://#{host}:#{port}"
+      end
+
+      private
+
+      def ssl_context(credentials, client_ca)
+        OpenSSL::SSL::SSLContext.new.tap do |ctx|
+          ctx.cert = credentials.cert
+          ctx.key = credentials.key
+          if client_ca
+            ctx.cert_store = client_ca.cert_store
+            ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+          end
+        end
+      end
+
+      def handle(socket)
+        socket.accept
+        request_line = socket.gets
+        while (line = socket.gets)
+          break if line.strip.empty?
+        end
+        respond(socket, request_line.to_s.split[1])
+      rescue OpenSSL::SSL::SSLError, SystemCallError, IOError
+        nil # the client rejected the handshake or went away
+      ensure
+        socket.close unless socket.closed?
+      end
+
+      def respond(socket, path)
+        body = JSON.generate(path: path, client_cert_subject: socket.peer_cert&.subject&.to_s,
+                             remote_ip: socket.io.remote_address.ip_address)
+        socket.write("HTTP/1.1 200 OK\r\n" \
+                     "Content-Type: application/json\r\n" \
+                     "Content-Length: #{body.bytesize}\r\n" \
+                     "Connection: close\r\n\r\n#{body}")
+      end
+    end
+  end
+end