http.rb 1.4.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd64e430f4c763d9a11367ecc26c6d419f9b5a0304c8084c41f995187d5b179a
-  data.tar.gz: bd8d9c977ed8e594a80c97a65d546270cf15dc482b2ee4440e5eeb739c2240b9
+  metadata.gz: 2483f99ec13020c1e1c780b84c7dcddc68437687b1176e7fb88ba228adf084af
+  data.tar.gz: 710dd8eed5142ac832553595e581bd2597174dd1131fb14a7c51d4e7f17f4992
 SHA512:
-  metadata.gz: 86146298fe511634f52a083fce07d96b3524a7faf46611cb262bf3e502c4ad413a233081091936a798649b6d9126061945ef34ef0b4a8e2c12ae8f0f2c3a87df
-  data.tar.gz: 8d6138d16b159c467dd645e675b7f0753e2693eb0a31c2cdf953731c90a0b9bde5ee3a90cee29ed7be928398a28ad27ab2bfe784cd9eafa66111c2cec4a42d98
+  metadata.gz: dbe519101ddbd07038de07ca7bbcb28bbb2b7c53d0f650df86092433271469da3491326dce2d9c3698f78cb381de5a9f48b57054b0b8b8301adc1118e2cead87
+  data.tar.gz: 87e66da4b78467b289dafc3a280a7f9592af77e39f6878128c3586a0ea7ade24e2589239e8beb35d43c8e52e31ca79626f04d1ee1f31347b55f5ddf41945145a

data/CHANGELOG

@@ -1,5 +1,33 @@
 # CHANGELOG
 
+## 20261011
+
+1.6.0: The response's uri is the URI it came from, which, where redirects were followed, is where they ended.
+
+Nothing recorded where a response had come from: the request objects are made from a path rather than a URI, so Net::HTTP left response.uri nil, and a caller whose request was redirected had no way of knowing where to. A spider resolving the links on a page against the page's address needs it, as does anything noticing that it has been sent to a login page.
+
+1. ~ lib/HTTP/REDIRECT.rb: + HTTP.response_uri, which leaves out any credentials embedded in the URI, a response being something which is passed around and printed.
+2. ~ HTTP.request: response.uri is set to response_uri of the URI requested, so that after redirects it is the last of them.
+3. ~ HTTP::TooManyRedirects: the message names the URI of the redirect not followed as well as its Location.
+4. ~ test/HTTP/REDIRECT_test.rb: + the final URI without a redirect, after one, with no_redirect, and without embedded credentials; the URI of the redirect TooManyRedirects carries. All fail against 1.5.0.
+5. ~ README.md: + the response's uri, under Redirections, and in the Limiting redirections example.
+6. ~ HTTP::VERSION: /1.5.0/1.6.0/
+
+
+## 20261011
+
+1.5.0: + max_redirects; + HTTP::TooManyRedirects.
+
+Redirects were followed without limit, each by a call nested in the last, so a redirect loop ran until SystemStackError, which against a local server came after 2,179 requests. Now no more than max_redirects are followed, 20 unless given, which is where browsers stop, and one more raises HTTP::TooManyRedirects.
+
+1. ~ lib/HTTP/REDIRECT.rb: + HTTP::REDIRECT::MAX (20); + HTTP::TooManyRedirects, whose response is the redirect which was not followed.
+2. ~ HTTP.redirect_options: + max_redirects, which the redirect is made with one fewer of.
+3. ~ HTTP.request: + max_redirects option, which defaults to HTTP::REDIRECT::MAX and is not passed through to Net::HTTP; HTTP::TooManyRedirects is raised at a redirect when none are left. max_redirects: 0 raises at the first redirect, where no_redirect: true returns it, and no_redirect wins where both are given.
+4. ~ test/HTTP/REDIRECT_test.rb: + as many redirects followed as allowed, TooManyRedirects for one more with the redirect not followed, 0 raising at the first, no_redirect winning over it, a loop stopped at the default, and the option not passed through to Net::HTTP; max_redirects among the options left as they were. All fail against 1.4.0, which passed max_redirects through to Net::HTTP, where there is no max_redirects= for it.
+5. ~ README.md: + Limiting redirections; + max_redirects among the options which aren't passed through to Net::HTTP.
+6. ~ HTTP::VERSION: /1.4.0/1.5.0/
+
+
 ## 20261011
 
 1.4.0: The method on a redirect is as RFC 9110 has it: a DELETE redirected by a 301 or 302 is now a DELETE, a PUT a PUT, and a HEAD a HEAD.

data/README.md

@@ -112,6 +112,14 @@ A body repeated keeps its `Content-Type`, form data's included. Where the method
 
 Redirects are followed with the headers they were given, except that `Authorization` and `Cookie`, and the `username:` and `password:` options, go no further than the origin (scheme, host, and port) they were given to. Where a redirect makes the request a GET, `Content-Type` is left behind, there being no body for it to describe.
 
+The response's `uri` is the URI it came from, which, where redirects were followed, is where they ended:
+
+```ruby
+response = HTTP.get('http://example.com/moved')
+response.uri
+# => #<URI::HTTP http://example.com/new_location>
+```
+
 ### Preventing redirections
 
 ```ruby
@@ -119,6 +127,23 @@ HTTP.get('http://example.com', {}, {}, {no_redirect: true})
 # => #<Net::HTTPResponse @code=3xx>
 ```
 
+### Limiting redirections
+
+Up to 20 redirects are followed by default. One more raises `HTTP::TooManyRedirects`, whose `response` is the redirect which wasn't followed:
+
+```ruby
+HTTP.get('http://example.com', {}, {}, {max_redirects: 5})
+
+begin
+  HTTP.get('http://example.com/loop')
+rescue HTTP::TooManyRedirects => e
+  e.response.uri
+  e.response['location']
+end
+```
+
+`max_redirects: 0` raises at the first redirect, whereas `no_redirect: true` returns it.
+
 ### Retries
 
 Retries are disabled by default. Enable them by passing `retries:` in the options hash.
@@ -216,12 +241,16 @@ HTTP.request_with_body(:propfind, 'http://example.com/path', xml, {'Content-Type
 Both take the same `(method, uri, args_or_data, headers, options, &block)` arguments as the named methods, with the method as the first argument, and the named methods delegate to them. For full control over the request object, drop down to `HTTP.request(uri, request_object, headers, options, &block)`.
 
 ## Allowed values for the options hash
-#### (These pass through to Net::HTTP, except for `no_redirect`, `username`, and `password`.)
+#### (These pass through to Net::HTTP, except for `no_redirect`, `max_redirects`, `username`, and `password`.)
 
 ```Ruby
 no_redirect
     # Prevents redirection if a 3xx response is encountered.
 
+max_redirects
+    # The most redirects followed before HTTP::TooManyRedirects is raised.
+    # Defaults to 20.
+
 username
     # Username for HTTP basic authentication. Takes precedence over any
     # credentials embedded in the URI.

data/lib/HTTP/REDIRECT.rb

@@ -5,6 +5,16 @@ module HTTP
   module REDIRECT
     CODES = %w{301 302 303 307 308}.freeze
     CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
+    MAX = 20
+  end
+
+  class TooManyRedirects < StandardError
+    attr_reader :response
+
+    def initialize(response)
+      @response = response
+      super("Too many redirects: #{response.code} from #{response.uri} to #{response['location']}")
+    end
   end
 
   # A 300 or a 304 is an answer rather than somewhere else to go, and a 3xx without a
@@ -52,9 +62,20 @@ module HTTP
   end
   module_function :body_headers
 
-  def redirect_options(options, from_uri, to_uri)
+  def redirect_options(options, from_uri, to_uri, max_redirects)
+    options = options.merge(max_redirects: max_redirects - 1)
     return options if same_origin?(from_uri, to_uri)
     options.reject{|k, v| %i{username password}.include?(k)}
   end
   module_function :redirect_options
+
+  # Embedded credentials are left out, a response being something which is passed
+  # around and printed.  URI#userinfo= ignores nil, whereas URI#user= takes the password
+  # with it.
+  def response_uri(uri)
+    uri = uri.dup
+    uri.user = nil if uri.user
+    uri
+  end
+  module_function :response_uri
 end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.4.0'
+  VERSION = '1.6.0'
 end

data/lib/HTTP/request.rb

@@ -19,6 +19,7 @@ module HTTP
     given_options = options
     options = options.dup
     no_redirect = options.delete(:no_redirect)
+    max_redirects = options.delete(:max_redirects) || REDIRECT::MAX
     username = options.delete(:username)
     password = options.delete(:password)
     config = retry_config(options)
@@ -40,9 +41,11 @@ module HTTP
         http.request(request_object)
       end
     )
+    response.uri = response_uri(uri)
     if !no_redirect && redirect?(response)
+      raise TooManyRedirects.new(response) if max_redirects < 1
       redirect_uri = uri.merge(response['location'])
-      onward_options = redirect_options(given_options, uri, redirect_uri)
+      onward_options = redirect_options(given_options, uri, redirect_uri, max_redirects)
       redirect_method = redirect_method(response.code, request_method)
       if redirect_method != request_method
         return request_without_body(redirect_method, redirect_uri, {}, redirect_headers(headers, uri, redirect_uri, drop_content_type: true), onward_options, &block)

data/test/HTTP/REDIRECT_test.rb

@@ -7,6 +7,29 @@ describe "redirect behaviour" do
   let(:same_origin_uri){'http://example.com/elsewhere'}
   let(:other_origin_uri){'http://redirected.com/path'}
 
+  describe "the final URI" do
+    it "is the requested URI when there is no redirect" do
+      stub_request(:get, uri).to_return(status: 200)
+      _(HTTP.get(uri).uri.to_s).must_equal(uri)
+    end
+
+    it "is the URI redirected to when a redirect is followed" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => other_origin_uri})
+      stub_request(:get, other_origin_uri).to_return(status: 200)
+      _(HTTP.get(uri).uri.to_s).must_equal(other_origin_uri)
+    end
+
+    it "is the URI which redirected when no_redirect is set" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => other_origin_uri})
+      _(HTTP.get(uri, {}, {}, {no_redirect: true}).uri.to_s).must_equal(uri)
+    end
+
+    it "carries no embedded credentials" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 200)
+      _(HTTP.get('http://alice:secret@example.com/path').uri.to_s).must_equal(uri)
+    end
+  end
+
   describe "headers" do
     %w{301 302 303 307 308}.each do |code|
       it "are carried through a #{code}" do
@@ -59,9 +82,9 @@ describe "redirect behaviour" do
     it "is not altered by a call" do
       stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
       stub_request(:get, same_origin_uri).to_return(status: 200)
-      options = {no_redirect: false, username: 'alice', password: 'secret', retries: 1}
+      options = {no_redirect: false, max_redirects: 3, username: 'alice', password: 'secret', retries: 1}
       HTTP.get(uri, {}, {}, options)
-      _(options).must_equal({no_redirect: false, username: 'alice', password: 'secret', retries: 1})
+      _(options).must_equal({no_redirect: false, max_redirects: 3, username: 'alice', password: 'secret', retries: 1})
     end
 
     it "keeps no_redirect for a second call" do
@@ -215,4 +238,43 @@ describe "redirect behaviour" do
       end
     end
   end
+
+  describe "max_redirects" do
+    before do
+      stub_request(:get, 'http://example.com/0').to_return(status: 302, headers: {'location' => '/1'})
+      stub_request(:get, 'http://example.com/1').to_return(status: 302, headers: {'location' => '/2'})
+      stub_request(:get, 'http://example.com/2').to_return(status: 200)
+    end
+
+    it "follows as many redirects as it is allowed" do
+      _(HTTP.get('http://example.com/0', {}, {}, {max_redirects: 2}).success?).must_equal(true)
+    end
+
+    it "raises TooManyRedirects, with the redirect not followed, when there are more" do
+      error = _(->{HTTP.get('http://example.com/0', {}, {}, {max_redirects: 1})}).must_raise(HTTP::TooManyRedirects)
+      _(error.response['location']).must_equal('/2')
+      _(error.response.uri.to_s).must_equal('http://example.com/1')
+      assert_not_requested(:get, 'http://example.com/2')
+    end
+
+    it "raises at the first redirect when it is 0" do
+      _(->{HTTP.get('http://example.com/0', {}, {}, {max_redirects: 0})}).must_raise(HTTP::TooManyRedirects)
+      assert_not_requested(:get, 'http://example.com/1')
+    end
+
+    it "gives way to no_redirect" do
+      _(HTTP.get('http://example.com/0', {}, {}, {max_redirects: 0, no_redirect: true}).code).must_equal('302')
+    end
+
+    it "stops a redirect loop at the default" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => uri})
+      _(->{HTTP.get(uri)}).must_raise(HTTP::TooManyRedirects)
+      assert_requested(:get, uri, times: HTTP::REDIRECT::MAX + 1)
+    end
+
+    it "is not passed through to Net::HTTP" do
+      stub_request(:get, uri).to_return(status: 200)
+      _(HTTP.get(uri, {}, {}, {max_redirects: 5}).success?).must_equal(true)
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.6.0
 platform: ruby
 authors:
 - thoran