http.rb 1.3.8 → 1.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5cab4dfd9757c08463389bff8595489378a59ecb3149cbdfcc465ab6a508536e
-  data.tar.gz: 5fe112a78858fc9deee9a1b8ab29cf71325a7e0801fd6b6d33e3f48835aba2dd
+  metadata.gz: 3ba4b45f56c0470076fa4e969e51f0e251f33c67a817aedc5a3e300a7d52d2a3
+  data.tar.gz: 4b882af236ee2c41c736cc4e256d1ee566a7e6cb4f81099c87f443c726a98f13
 SHA512:
-  metadata.gz: a9678a45ae024d10874c9fdd9781e785b64f2e9818c85cc991b7af6bff8f56d38d3cad1f53d606bf36ff758581a1c2106e3b38c5f88224aa6d5272833ee97482
-  data.tar.gz: 8f9c36f7f2496a752c55a3352eb867585e787d72d63e87c8a124576b849517e213bd997d92415d2819eaac3f21a47099bef2f3a2f8e85e473aea6d8a3c9ab560
+  metadata.gz: ec0592b2b3892f668d2a42a7b3d1d29ae56d4dc6743eda80ced5b8b9ea56b995a770e82b31c6dafc22c6245a4c85044f478bb64b71c5c8b930205dfedc17233f
+  data.tar.gz: 13b8ab56ab66abb3a17447b87ec82af1a509cf2a137266c728f04a8536b81db15b7f4711319f9eaae327b15d593abedd41929fff341e970263b6bf1f7eb4b71b

data/CHANGELOG

@@ -1,5 +1,18 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.9: Only a 301, 302, 303, 307, or 308 with a Location is followed.
+
+Any 3xx was taken for a redirect. A 304 Not Modified carries no Location, so URI#merge was handed nil and raised ArgumentError, as did any 3xx without one. And a 300 Multiple Choices was followed to whatever its Location named, though it is a list of choices for the caller, the Location being only the server's preference among them. These are answers rather than redirects, and are now returned as they are.
+
+1. ~ lib/HTTP/REDIRECT.rb: + HTTP::REDIRECT::CODES (301, 302, 303, 307, 308); + HTTP.redirect?, which is true of a response with one of those codes and a Location.
+2. ~ HTTP.request: follows what redirect? is true of, rather than whatever begins with a 3.
+3. ~ test/HTTP/REDIRECT_test.rb: + 300 and 304 returned as they are, as is a 302 without a Location. All three fail against 1.3.8: the 300 and the 304 were followed, and the 302 raised.
+4. ~ README.md: + which responses are followed, under Redirections.
+5. ~ HTTP::VERSION: /1.3.8/1.3.9/
+
+
 ## 20261011
 
 1.3.8: Headers are carried through a 301, 302, or 303.

data/README.md

@@ -95,6 +95,8 @@ When both are supplied, the options hash wins.
 
 ### Redirections
 
+301, 302, 303, 307, and 308 responses with a `Location` are followed. Other 3xx responses, such as 300 and 304, are returned as they are.
+
 Redirects are followed with the headers they were given, except that `Authorization` and `Cookie`, and the `username:` and `password:` options, go no further than the origin (scheme, host, and port) they were given to. Where a redirect makes the request a GET, `Content-Type` is left behind, there being no body for it to describe.
 
 ### Preventing redirections

data/lib/HTTP/REDIRECT.rb

@@ -3,9 +3,17 @@
 
 module HTTP
   module REDIRECT
+    CODES = %w{301 302 303 307 308}.freeze
     CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
   end
 
+  # A 300 or a 304 is an answer rather than somewhere else to go, and a 3xx without a
+  # Location has nowhere to send it.
+  def redirect?(response)
+    REDIRECT::CODES.include?(response.code) && !response['location'].to_s.empty?
+  end
+  module_function :redirect?
+
   def same_origin?(a, b)
     [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port]
   end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.8'
+  VERSION = '1.3.9'
 end

data/lib/HTTP/request.rb

@@ -40,7 +40,7 @@ module HTTP
         http.request(request_object)
       end
     )
-    if response.code =~ /^3/
+    if redirect?(response)
       if block_given? && no_redirect
         yield response
       elsif no_redirect

data/test/HTTP/REDIRECT_test.rb

@@ -96,4 +96,19 @@ describe "redirect behaviour" do
       assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization')}
     end
   end
+
+  describe "3xx responses which are not followed" do
+    %w{300 304}.each do |code|
+      it "return a #{code} as it is" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        _(HTTP.get(uri).code).must_equal(code)
+        assert_not_requested(:get, other_origin_uri)
+      end
+    end
+
+    it "return a redirect without a Location as it is" do
+      stub_request(:get, uri).to_return(status: 302)
+      _(HTTP.get(uri).code).must_equal('302')
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.8
+  version: 1.3.9
 platform: ruby
 authors:
 - thoran