http.rb 1.3.5 → 1.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b19f251bfdf7beb262c7f6fe8c00950fb580937b1679cef33059346e4695d8a4
-  data.tar.gz: 6dd0dfa38e25d6805552778398c36df2bf8e42d6f507f23fe8bde2aeb229945c
+  metadata.gz: 6d2e0827d0ee0a2f4215eabfd6cd2f952bacb1d12dc657ab1a488ef85a91a46f
+  data.tar.gz: 5d343996ad5cba48c51c9df5c7f0b31895f3a437d8be6cc15d5fdaff64075430
 SHA512:
-  metadata.gz: 923a61906a76fd676e1f47808ccc3d295cc9d7c6b5b977d5ec1ff9a496daf8488dfd5f49f1169b650343d66aba9d9994cc166d9caf9d2a64a9e6440c5ac3fb64
-  data.tar.gz: 672784fee166a077e19e8b79866c24b84793c9aa82c7e4bbe217cbca60565fa0ad241c3d739bb3808108a4caa9ac2f036428943c7d1337327f35b8083ddc737b
+  metadata.gz: 644e855a9c30b1ec23e0f2b3db27850ad9018574b37d1e25bcb63ce3aa11371d81a7a372c56cbd9c8f1a284ecf2cdaa0f7219b331da32c3d2fd3b6f4ea90df73
+  data.tar.gz: 751e3dfc085e8e9c1af0fc372bf948404fd6ac4839eb79ada5d38f390ea9a35ec6ce51381deda5ede866a10f6dafbe208a24ad23b4b15d143fad51a9d557c429

data/CHANGELOG

@@ -1,5 +1,30 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.7: The options hash is no longer altered, so no_redirect, retries, and basic authentication survive a call and a redirect.
+
+HTTP.request took no_redirect, username, password, and the retry options out of the caller's hash with delete. A hash passed twice had lost no_redirect by the second call, which then followed the redirect it was asked not to. And the redirect was made with what was left of the hash, so retries and basic authentication were lost at the first redirect, even to the same origin.
+
+1. ~ HTTP.request: works on a copy of the options hash, leaving the caller's as it was.
+2. ~ HTTP.request: a redirect is made with the options as given, less what goes no further than the origin.
+3. ~ lib/HTTP/REDIRECT.rb: + HTTP.redirect_options, which drops username and password where a redirect goes to another origin, as 1.3.6 does the credential headers.
+4. ~ test/HTTP/REDIRECT_test.rb: + the options hash left as it was, no_redirect kept for a second call, retries kept after a redirect, and basic authentication kept for the same origin and dropped for another. All but the last fail against 1.3.6, which dropped it for every origin.
+5. ~ HTTP::VERSION: /1.3.6/1.3.7/
+
+
+## 20261011
+
+1.3.6: Authorization and Cookie headers go no further than the origin they were given to.
+
+A 307 or 308 was followed with every header it was given, so an Authorization or Cookie header meant for one host was sent to whichever host the Location named. A 301, 302, or 303 sent no headers on at all, so it did not leak, though only because it lost everything else too. Following curl and browsers, credentials now stay with their origin: the same scheme, host, and port.
+
+1. + lib/HTTP/REDIRECT.rb: HTTP::REDIRECT::CREDENTIAL_HEADERS (Authorization, Cookie); HTTP.same_origin?, and HTTP.redirect_headers, which drops the credential headers, whatever their case, where a redirect goes to another origin.
+2. ~ HTTP.request: a 307 or 308 is followed with redirect_headers rather than the headers as given.
+3. + test/HTTP/REDIRECT_test.rb: credentials kept for the same origin, and dropped for another host by 307 and by 308, for another scheme, and for another port, with other headers carried on. All but the first fail against 1.3.5.
+4. ~ HTTP::VERSION: /1.3.5/1.3.6/
+
+
 ## 20261011
 
 1.3.5: Non-ASCII is URL-encoded in full, and without a warning.

data/lib/HTTP/REDIRECT.rb

@@ -0,0 +1,26 @@
+# HTTP/REDIRECT.rb
+# HTTP::REDIRECT (redirect helpers)
+
+module HTTP
+  module REDIRECT
+    CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
+  end
+
+  def same_origin?(a, b)
+    [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port]
+  end
+  module_function :same_origin?
+
+  # Credentials are for the origin they were given to, so they go no further than it.
+  def redirect_headers(headers, from_uri, to_uri)
+    return headers if same_origin?(from_uri, to_uri)
+    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  end
+  module_function :redirect_headers
+
+  def redirect_options(options, from_uri, to_uri)
+    return options if same_origin?(from_uri, to_uri)
+    options.reject{|k, v| %i{username password}.include?(k)}
+  end
+  module_function :redirect_options
+end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.5'
+  VERSION = '1.3.7'
 end

data/lib/HTTP/request.rb

@@ -9,12 +9,15 @@ require_relative '../Net/HTTP/set_options'
 require_relative '../Net/HTTPRequest/set_headers'
 require_relative '../Net/HTTPResponse/StatusPredicates'
 require_relative '../URI/Generic/use_sslQ'
+require_relative './REDIRECT'
 require_relative './RETRY'
 
 module HTTP
   def request(uri, request_object, headers = {}, options = {}, &block)
     uri = uri.is_a?(URI) ? uri : URI.parse(uri)
     http = Net::HTTP.new(uri.host, uri.port)
+    given_options = options
+    options = options.dup
     no_redirect = options.delete(:no_redirect)
     username = options.delete(:username)
     password = options.delete(:password)
@@ -44,11 +47,12 @@ module HTTP
         return response
       end
       redirect_uri = uri.merge(response['location'])
+      onward_options = redirect_options(given_options, uri, redirect_uri)
       if response.code =~ /^30[78]$/
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
-        response = send(request_method, redirect_uri.to_s, data, headers, options, &block)
+        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), onward_options, &block)
       else
-        response = get(redirect_uri.to_s, {}, {}, options, &block)
+        response = get(redirect_uri.to_s, {}, {}, onward_options, &block)
       end
     end
     if block_given?

data/test/HTTP/REDIRECT_test.rb

@@ -0,0 +1,82 @@
+# test/HTTP/REDIRECT_test.rb
+
+require_relative '../helper'
+
+describe "redirect behaviour" do
+  let(:uri){'http://example.com/path'}
+  let(:same_origin_uri){'http://example.com/elsewhere'}
+  let(:other_origin_uri){'http://redirected.com/path'}
+
+  describe "credentials" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(headers: {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).to_return(status: 200)
+      _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
+    end
+
+    %w{307 308}.each do |code|
+      it "are dropped for another origin via #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).to_return(status: 200)
+        HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'cookie' => 'session=1', 'User-Agent' => 'Redback'})
+        assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization') && !request.headers.key?('Cookie') && request.headers['User-Agent'] == 'Redback'}
+      end
+    end
+
+    it "are dropped for another scheme" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'https://example.com/path'})
+      stub_request(:get, 'https://example.com/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'https://example.com/path'){|request| !request.headers.key?('Cookie')}
+    end
+
+    it "are dropped for another port" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'http://example.com:8080/path'})
+      stub_request(:get, 'http://example.com:8080/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'http://example.com:8080/path'){|request| !request.headers.key?('Cookie')}
+    end
+  end
+
+  describe "the options hash" do
+    it "is not altered by a call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      options = {no_redirect: false, username: 'alice', password: 'secret', retries: 1}
+      HTTP.get(uri, {}, {}, options)
+      _(options).must_equal({no_redirect: false, username: 'alice', password: 'secret', retries: 1})
+    end
+
+    it "keeps no_redirect for a second call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => other_origin_uri})
+      options = {no_redirect: true}
+      HTTP.get(uri, {}, {}, options)
+      _(HTTP.get(uri, {}, {}, options).redirection?).must_equal(true)
+      assert_not_requested(:get, other_origin_uri)
+    end
+
+    it "keeps retrying after a redirect" do
+      HTTP::RETRY.stub(:sleep, nil) do
+        stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+        stub_request(:get, same_origin_uri).to_return(status: 503).then.to_return(status: 200)
+        _(HTTP.get(uri, {}, {}, {retries: 1}).success?).must_equal(true)
+        assert_requested(:get, same_origin_uri, times: 2)
+      end
+    end
+  end
+
+  describe "basic authentication options" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(basic_auth: ['alice', 'secret']).to_return(status: 200)
+      _(HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'}).success?).must_equal(true)
+    end
+
+    it "are dropped for another origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 307, headers: {'location' => other_origin_uri})
+      stub_request(:get, other_origin_uri).to_return(status: 200)
+      HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'})
+      assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization')}
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.5
+  version: 1.3.7
 platform: ruby
 authors:
 - thoran
@@ -95,6 +95,7 @@ files:
 - http.rb.gemspec
 - lib/HTTP.rb
 - lib/HTTP/METHODS.rb
+- lib/HTTP/REDIRECT.rb
 - lib/HTTP/RETRY.rb
 - lib/HTTP/VERSION.rb
 - lib/HTTP/request.rb
@@ -108,6 +109,7 @@ files:
 - lib/Thoran/String/Urlencode/urlencode.rb
 - lib/URI/Generic/use_sslQ.rb
 - test/HTTP/METHODS_test.rb
+- test/HTTP/REDIRECT_test.rb
 - test/HTTP/RETRY_test.rb
 - test/HTTP/VERSION_test.rb
 - test/HTTP/basic_auth_test.rb