http.rb 1.3.7 → 1.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d2e0827d0ee0a2f4215eabfd6cd2f952bacb1d12dc657ab1a488ef85a91a46f
-  data.tar.gz: 5d343996ad5cba48c51c9df5c7f0b31895f3a437d8be6cc15d5fdaff64075430
+  metadata.gz: 3ba4b45f56c0470076fa4e969e51f0e251f33c67a817aedc5a3e300a7d52d2a3
+  data.tar.gz: 4b882af236ee2c41c736cc4e256d1ee566a7e6cb4f81099c87f443c726a98f13
 SHA512:
-  metadata.gz: 644e855a9c30b1ec23e0f2b3db27850ad9018574b37d1e25bcb63ce3aa11371d81a7a372c56cbd9c8f1a284ecf2cdaa0f7219b331da32c3d2fd3b6f4ea90df73
-  data.tar.gz: 751e3dfc085e8e9c1af0fc372bf948404fd6ac4839eb79ada5d38f390ea9a35ec6ce51381deda5ede866a10f6dafbe208a24ad23b4b15d143fad51a9d557c429
+  metadata.gz: ec0592b2b3892f668d2a42a7b3d1d29ae56d4dc6743eda80ced5b8b9ea56b995a770e82b31c6dafc22c6245a4c85044f478bb64b71c5c8b930205dfedc17233f
+  data.tar.gz: 13b8ab56ab66abb3a17447b87ec82af1a509cf2a137266c728f04a8536b81db15b7f4711319f9eaae327b15d593abedd41929fff341e970263b6bf1f7eb4b71b

data/CHANGELOG

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.9: Only a 301, 302, 303, 307, or 308 with a Location is followed.
+
+Any 3xx was taken for a redirect. A 304 Not Modified carries no Location, so URI#merge was handed nil and raised ArgumentError, as did any 3xx without one. And a 300 Multiple Choices was followed to whatever its Location named, though it is a list of choices for the caller, the Location being only the server's preference among them. These are answers rather than redirects, and are now returned as they are.
+
+1. ~ lib/HTTP/REDIRECT.rb: + HTTP::REDIRECT::CODES (301, 302, 303, 307, 308); + HTTP.redirect?, which is true of a response with one of those codes and a Location.
+2. ~ HTTP.request: follows what redirect? is true of, rather than whatever begins with a 3.
+3. ~ test/HTTP/REDIRECT_test.rb: + 300 and 304 returned as they are, as is a 302 without a Location. All three fail against 1.3.8: the 300 and the 304 were followed, and the 302 raised.
+4. ~ README.md: + which responses are followed, under Redirections.
+5. ~ HTTP::VERSION: /1.3.8/1.3.9/
+
+
+## 20261011
+
+1.3.8: Headers are carried through a 301, 302, or 303.
+
+A 301, 302, or 303 was followed with no headers at all, so a User-Agent, an Accept, or a Cookie given to the request was not sent to where it was redirected, whereas a 307 or 308 sent them all. Now every redirect carries them, less the credentials which 1.3.6 keeps to their origin, and less Content-Type where the request is made a GET, there being no body for it to describe.
+
+1. ~ HTTP.redirect_headers: + drop_content_type:, which leaves Content-Type behind.
+2. ~ HTTP.request: a 301, 302, or 303 is followed with redirect_headers, dropping Content-Type, rather than with no headers.
+3. ~ test/HTTP/REDIRECT_test.rb: + headers carried through each of 301, 302, 303, 307, and 308, and Content-Type left behind when a POST becomes a GET; credentials dropped for another origin by 301, 302, and 303 as well as by 307 and 308. The 301, 302, and 303 examples fail against 1.3.7.
+4. ~ README.md: + Redirections, on what is carried through a redirect and what is not.
+5. ~ HTTP::VERSION: /1.3.7/1.3.8/
+
+
 ## 20261011
 
 1.3.7: The options hash is no longer altered, so no_redirect, retries, and basic authentication survive a call and a redirect.

data/README.md

@@ -93,6 +93,12 @@ HTTP.get('http://alice:secret@example.com')
 
 When both are supplied, the options hash wins.
 
+### Redirections
+
+301, 302, 303, 307, and 308 responses with a `Location` are followed. Other 3xx responses, such as 300 and 304, are returned as they are.
+
+Redirects are followed with the headers they were given, except that `Authorization` and `Cookie`, and the `username:` and `password:` options, go no further than the origin (scheme, host, and port) they were given to. Where a redirect makes the request a GET, `Content-Type` is left behind, there being no body for it to describe.
+
 ### Preventing redirections
 
 ```ruby

data/lib/HTTP/REDIRECT.rb

@@ -3,18 +3,29 @@
 
 module HTTP
   module REDIRECT
+    CODES = %w{301 302 303 307 308}.freeze
     CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
   end
 
+  # A 300 or a 304 is an answer rather than somewhere else to go, and a 3xx without a
+  # Location has nowhere to send it.
+  def redirect?(response)
+    REDIRECT::CODES.include?(response.code) && !response['location'].to_s.empty?
+  end
+  module_function :redirect?
+
   def same_origin?(a, b)
     [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port]
   end
   module_function :same_origin?
 
   # Credentials are for the origin they were given to, so they go no further than it.
-  def redirect_headers(headers, from_uri, to_uri)
-    return headers if same_origin?(from_uri, to_uri)
-    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  # A request made into a GET has no body for a Content-Type to describe.
+  def redirect_headers(headers, from_uri, to_uri, drop_content_type: false)
+    headers.reject do |k, v|
+      (drop_content_type && k.downcase == 'content-type') ||
+        (!same_origin?(from_uri, to_uri) && REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase))
+    end
   end
   module_function :redirect_headers
 

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.7'
+  VERSION = '1.3.9'
 end

data/lib/HTTP/request.rb

@@ -40,7 +40,7 @@ module HTTP
         http.request(request_object)
       end
     )
-    if response.code =~ /^3/
+    if redirect?(response)
       if block_given? && no_redirect
         yield response
       elsif no_redirect
@@ -52,7 +52,7 @@ module HTTP
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
         response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), onward_options, &block)
       else
-        response = get(redirect_uri.to_s, {}, {}, onward_options, &block)
+        response = get(redirect_uri.to_s, {}, redirect_headers(headers, uri, redirect_uri, drop_content_type: true), onward_options, &block)
       end
     end
     if block_given?

data/test/HTTP/REDIRECT_test.rb

@@ -7,6 +7,23 @@ describe "redirect behaviour" do
   let(:same_origin_uri){'http://example.com/elsewhere'}
   let(:other_origin_uri){'http://redirected.com/path'}
 
+  describe "headers" do
+    %w{301 302 303 307 308}.each do |code|
+      it "are carried through a #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).with(headers: {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).to_return(status: 200)
+        _(HTTP.get(uri, {}, {'User-Agent' => 'Redback', 'Accept' => 'text/html'}).success?).must_equal(true)
+      end
+    end
+
+    it "leave Content-Type behind when a POST becomes a GET" do
+      stub_request(:post, uri).to_return(status: 303, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      HTTP.post(uri, {a: 1}, {'Content-Type' => 'application/json', 'User-Agent' => 'Redback'})
+      assert_requested(:get, same_origin_uri){|request| !request.headers.key?('Content-Type') && request.headers['User-Agent'] == 'Redback'}
+    end
+  end
+
   describe "credentials" do
     it "are kept for the same origin" do
       stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
@@ -14,7 +31,7 @@ describe "redirect behaviour" do
       _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
     end
 
-    %w{307 308}.each do |code|
+    %w{301 302 303 307 308}.each do |code|
       it "are dropped for another origin via #{code}" do
         stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
         stub_request(:get, other_origin_uri).to_return(status: 200)
@@ -79,4 +96,19 @@ describe "redirect behaviour" do
       assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization')}
     end
   end
+
+  describe "3xx responses which are not followed" do
+    %w{300 304}.each do |code|
+      it "return a #{code} as it is" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        _(HTTP.get(uri).code).must_equal(code)
+        assert_not_requested(:get, other_origin_uri)
+      end
+    end
+
+    it "return a redirect without a Location as it is" do
+      stub_request(:get, uri).to_return(status: 302)
+      _(HTTP.get(uri).code).must_equal('302')
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.7
+  version: 1.3.9
 platform: ruby
 authors:
 - thoran