http.rb 1.3.4 → 1.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a6fd7a7020d8a692cd3852ed9aa2820322ad24b9e61a368d9e70dd4a2a9b6682
-  data.tar.gz: 4b535cc818bef4bfd17ea1e3b2ef177706fede6a5772c48f7184d57e252314ee
+  metadata.gz: 198e221dc9a1ced43833cfa01886896755615ccc22d9773d0798627d0af1bd45
+  data.tar.gz: 53d2e227daa4558d0f810980e2b86ec60fa17c4222c2e61e507c164097c25071
 SHA512:
-  metadata.gz: a0c53543092fbf97a7fd94418b3c6360320dc4d4eb8711bc092c7a95d1801965e7c62e51b67988e6d28e637531f7bdcc74c4ed1633fabc4ae7be8bfb70b29bdf
-  data.tar.gz: becf134eada7e1ba1d3af4433c17599e2aaecce3b100b538a9818b8f0c4ea269086642f6d8b8acce59c41872898b0ee333bf37702f2841e1fb710623b8498a75
+  metadata.gz: 2ef160053a5a5069e6be6714daf9229358ece7af8899ec0f5fcc8b98f9b5b4cb05c434d0c3a5a946f7e95a66cf55e19feb918f8096f8793b0bbc25780bd8545a
+  data.tar.gz: 0a9721b58212b93670c368496c50bc19f7ea4d53d1b860728b6a3fd5ff8b2d7f81d388cee42a6f969bd65c5ca5584d126d75e1fb5092e35372312e32593c6cd7

data/CHANGELOG

@@ -1,5 +1,30 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.6: Authorization and Cookie headers go no further than the origin they were given to.
+
+A 307 or 308 was followed with every header it was given, so an Authorization or Cookie header meant for one host was sent to whichever host the Location named. A 301, 302, or 303 sent no headers on at all, so it did not leak, though only because it lost everything else too. Following curl and browsers, credentials now stay with their origin: the same scheme, host, and port.
+
+1. + lib/HTTP/REDIRECT.rb: HTTP::REDIRECT::CREDENTIAL_HEADERS (Authorization, Cookie); HTTP.same_origin?, and HTTP.redirect_headers, which drops the credential headers, whatever their case, where a redirect goes to another origin.
+2. ~ HTTP.request: a 307 or 308 is followed with redirect_headers rather than the headers as given.
+3. + test/HTTP/REDIRECT_test.rb: credentials kept for the same origin, and dropped for another host by 307 and by 308, for another scheme, and for another port, with other headers carried on. All but the first fail against 1.3.5.
+4. ~ HTTP::VERSION: /1.3.5/1.3.6/
+
+
+## 20261011
+
+1.3.5: Non-ASCII is URL-encoded in full, and without a warning.
+
+A query argument holding a multibyte character was encoded one byte per character, so only the first byte of each went out: 'Älaskår' became '%C3lask%C3r' where it should have been '%C3%84lask%C3%A5r', and a server decoding it got invalid UTF-8. The warning this was first noticed by, "historical binary regexp match /.../n against UTF-8 string", came from the same line and is only a warning, but dropping the /n alone would have left the bytes truncated, which is what kept the warning from seeming to matter.
+
+1. ~ Thoran::String::Urlencode#urlencode: /$1.size/$1.bytesize/, so that each byte of a character is encoded rather than the first only.
+2. ~ Thoran::String::Urlencode#urlencode: - /n flag. Matched against a UTF-8 string, a binary regexp warns on current Ruby, and the match is the same without it: a run of non-ASCII characters is still matched whole and then unpacked byte by byte, and a binary string is still matched byte-wise.
+3. ~ Thoran/String/Urlencode/urlencode.rb: /0.4.0/0.4.1/ in the file's own header.
+4. + test/Thoran/String/Urlencode/urlencode_test.rb: unreserved and reserved characters, a space, two and three byte characters, a binary string, the absence of a warning, and the url_encode alias. The multibyte, warning, and alias examples fail against 1.3.4.
+5. ~ HTTP::VERSION: /1.3.4/1.3.5/
+
+
 ## 20261011
 
 1.3.4: ~ LICENSE: /2026/2009-2026/

data/lib/HTTP/REDIRECT.rb

@@ -0,0 +1,20 @@
+# HTTP/REDIRECT.rb
+# HTTP::REDIRECT (redirect helpers)
+
+module HTTP
+  module REDIRECT
+    CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
+  end
+
+  def same_origin?(a, b)
+    [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port]
+  end
+  module_function :same_origin?
+
+  # Credentials are for the origin they were given to, so they go no further than it.
+  def redirect_headers(headers, from_uri, to_uri)
+    return headers if same_origin?(from_uri, to_uri)
+    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  end
+  module_function :redirect_headers
+end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.4'
+  VERSION = '1.3.6'
 end

data/lib/HTTP/request.rb

@@ -9,6 +9,7 @@ require_relative '../Net/HTTP/set_options'
 require_relative '../Net/HTTPRequest/set_headers'
 require_relative '../Net/HTTPResponse/StatusPredicates'
 require_relative '../URI/Generic/use_sslQ'
+require_relative './REDIRECT'
 require_relative './RETRY'
 
 module HTTP
@@ -46,7 +47,7 @@ module HTTP
       redirect_uri = uri.merge(response['location'])
       if response.code =~ /^30[78]$/
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
-        response = send(request_method, redirect_uri.to_s, data, headers, options, &block)
+        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), options, &block)
       else
         response = get(redirect_uri.to_s, {}, {}, options, &block)
       end

data/lib/Thoran/String/Urlencode/urlencode.rb

@@ -1,8 +1,8 @@
 # Thoran/String/Urlencode/urlencode.rb
 # Thoran::String::Urlencode#urlencode
 
-# 20260713
-# 0.4.0
+# 20261011
+# 0.4.1
 
 # Acknowledgements: I've simply ripped off and refashioned the code from the CGI module!...
 
@@ -10,14 +10,17 @@
 # -/0: More consistent naming.
 # 1. /UrlEncode/Urlencode/
 # 2. /url_encode/urlencode/
+# 0/1: Non-ASCII is encoded in full, and without a warning.
+# 3. /$1.size/$1.bytesize/: unpack('H2' * $1.size) took one byte per character, so only the first byte of a multibyte character was encoded and 'Älaskår' became '%C3lask%C3r'.
+# 4. - /n flag: a binary regexp matched against a UTF-8 string warns on current Ruby (seen on 4.0.5), and the match is the same without it.
 
 module Thoran
   module String
     module Urlencode
 
       def urlencode
-        self.gsub(/([^ a-zA-Z0-9_.-]+)/n) do
-          '%' + $1.unpack('H2' * $1.size).join('%').upcase
+        self.gsub(/([^ a-zA-Z0-9_.-]+)/) do
+          '%' + $1.unpack('H2' * $1.bytesize).join('%').upcase
         end.tr(' ', '+')
       end
       alias_method :url_encode, :urlencode

data/test/HTTP/REDIRECT_test.rb

@@ -0,0 +1,40 @@
+# test/HTTP/REDIRECT_test.rb
+
+require_relative '../helper'
+
+describe "redirect behaviour" do
+  let(:uri){'http://example.com/path'}
+  let(:same_origin_uri){'http://example.com/elsewhere'}
+  let(:other_origin_uri){'http://redirected.com/path'}
+
+  describe "credentials" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(headers: {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).to_return(status: 200)
+      _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
+    end
+
+    %w{307 308}.each do |code|
+      it "are dropped for another origin via #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).to_return(status: 200)
+        HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'cookie' => 'session=1', 'User-Agent' => 'Redback'})
+        assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization') && !request.headers.key?('Cookie') && request.headers['User-Agent'] == 'Redback'}
+      end
+    end
+
+    it "are dropped for another scheme" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'https://example.com/path'})
+      stub_request(:get, 'https://example.com/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'https://example.com/path'){|request| !request.headers.key?('Cookie')}
+    end
+
+    it "are dropped for another port" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'http://example.com:8080/path'})
+      stub_request(:get, 'http://example.com:8080/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'http://example.com:8080/path'){|request| !request.headers.key?('Cookie')}
+    end
+  end
+end

data/test/Thoran/String/Urlencode/urlencode_test.rb

@@ -0,0 +1,41 @@
+# test/Thoran/String/Urlencode/urlencode_test.rb
+
+require_relative '../../../helper'
+
+describe Thoran::String::Urlencode do
+  describe "#urlencode" do
+    it "leaves unreserved characters alone" do
+      _('aZ09_.-'.urlencode).must_equal('aZ09_.-')
+    end
+
+    it "encodes a space as a plus" do
+      _('a b'.urlencode).must_equal('a+b')
+    end
+
+    it "encodes reserved characters" do
+      _('a/b?c=d&e'.urlencode).must_equal('a%2Fb%3Fc%3Dd%26e')
+    end
+
+    it "encodes every byte of a two byte character" do
+      _('Älaskår'.urlencode).must_equal('%C3%84lask%C3%A5r')
+    end
+
+    it "encodes every byte of a three byte character" do
+      _('✓'.urlencode).must_equal('%E2%9C%93')
+    end
+
+    it "encodes a binary string byte by byte" do
+      _('Ä'.b.urlencode).must_equal('%C3%84')
+    end
+
+    it "does not warn on a UTF-8 string" do
+      _{'Älaskår'.urlencode}.must_be_silent
+    end
+  end
+
+  describe "#url_encode" do
+    it "is an alias of #urlencode" do
+      _('Ashër'.url_encode).must_equal('Ash%C3%ABr')
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.3.6
 platform: ruby
 authors:
 - thoran
@@ -95,6 +95,7 @@ files:
 - http.rb.gemspec
 - lib/HTTP.rb
 - lib/HTTP/METHODS.rb
+- lib/HTTP/REDIRECT.rb
 - lib/HTTP/RETRY.rb
 - lib/HTTP/VERSION.rb
 - lib/HTTP/request.rb
@@ -108,6 +109,7 @@ files:
 - lib/Thoran/String/Urlencode/urlencode.rb
 - lib/URI/Generic/use_sslQ.rb
 - test/HTTP/METHODS_test.rb
+- test/HTTP/REDIRECT_test.rb
 - test/HTTP/RETRY_test.rb
 - test/HTTP/VERSION_test.rb
 - test/HTTP/basic_auth_test.rb
@@ -122,6 +124,7 @@ files:
 - test/HTTP/request_without_body_test.rb
 - test/HTTP/trace_test.rb
 - test/Net/HTTPResponse/StatusPredicates_test.rb
+- test/Thoran/String/Urlencode/urlencode_test.rb
 - test/helper.rb
 homepage: https://github.com/thoran/http
 licenses: