http.rb 1.3.6 → 1.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 198e221dc9a1ced43833cfa01886896755615ccc22d9773d0798627d0af1bd45
-  data.tar.gz: 53d2e227daa4558d0f810980e2b86ec60fa17c4222c2e61e507c164097c25071
+  metadata.gz: 6d2e0827d0ee0a2f4215eabfd6cd2f952bacb1d12dc657ab1a488ef85a91a46f
+  data.tar.gz: 5d343996ad5cba48c51c9df5c7f0b31895f3a437d8be6cc15d5fdaff64075430
 SHA512:
-  metadata.gz: 2ef160053a5a5069e6be6714daf9229358ece7af8899ec0f5fcc8b98f9b5b4cb05c434d0c3a5a946f7e95a66cf55e19feb918f8096f8793b0bbc25780bd8545a
-  data.tar.gz: 0a9721b58212b93670c368496c50bc19f7ea4d53d1b860728b6a3fd5ff8b2d7f81d388cee42a6f969bd65c5ca5584d126d75e1fb5092e35372312e32593c6cd7
+  metadata.gz: 644e855a9c30b1ec23e0f2b3db27850ad9018574b37d1e25bcb63ce3aa11371d81a7a372c56cbd9c8f1a284ecf2cdaa0f7219b331da32c3d2fd3b6f4ea90df73
+  data.tar.gz: 751e3dfc085e8e9c1af0fc372bf948404fd6ac4839eb79ada5d38f390ea9a35ec6ce51381deda5ede866a10f6dafbe208a24ad23b4b15d143fad51a9d557c429

data/CHANGELOG

@@ -1,5 +1,18 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.7: The options hash is no longer altered, so no_redirect, retries, and basic authentication survive a call and a redirect.
+
+HTTP.request took no_redirect, username, password, and the retry options out of the caller's hash with delete. A hash passed twice had lost no_redirect by the second call, which then followed the redirect it was asked not to. And the redirect was made with what was left of the hash, so retries and basic authentication were lost at the first redirect, even to the same origin.
+
+1. ~ HTTP.request: works on a copy of the options hash, leaving the caller's as it was.
+2. ~ HTTP.request: a redirect is made with the options as given, less what goes no further than the origin.
+3. ~ lib/HTTP/REDIRECT.rb: + HTTP.redirect_options, which drops username and password where a redirect goes to another origin, as 1.3.6 does the credential headers.
+4. ~ test/HTTP/REDIRECT_test.rb: + the options hash left as it was, no_redirect kept for a second call, retries kept after a redirect, and basic authentication kept for the same origin and dropped for another. All but the last fail against 1.3.6, which dropped it for every origin.
+5. ~ HTTP::VERSION: /1.3.6/1.3.7/
+
+
 ## 20261011
 
 1.3.6: Authorization and Cookie headers go no further than the origin they were given to.

data/lib/HTTP/REDIRECT.rb

@@ -17,4 +17,10 @@ module HTTP
     headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
   end
   module_function :redirect_headers
+
+  def redirect_options(options, from_uri, to_uri)
+    return options if same_origin?(from_uri, to_uri)
+    options.reject{|k, v| %i{username password}.include?(k)}
+  end
+  module_function :redirect_options
 end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.6'
+  VERSION = '1.3.7'
 end

data/lib/HTTP/request.rb

@@ -16,6 +16,8 @@ module HTTP
   def request(uri, request_object, headers = {}, options = {}, &block)
     uri = uri.is_a?(URI) ? uri : URI.parse(uri)
     http = Net::HTTP.new(uri.host, uri.port)
+    given_options = options
+    options = options.dup
     no_redirect = options.delete(:no_redirect)
     username = options.delete(:username)
     password = options.delete(:password)
@@ -45,11 +47,12 @@ module HTTP
         return response
       end
       redirect_uri = uri.merge(response['location'])
+      onward_options = redirect_options(given_options, uri, redirect_uri)
       if response.code =~ /^30[78]$/
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
-        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), options, &block)
+        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), onward_options, &block)
       else
-        response = get(redirect_uri.to_s, {}, {}, options, &block)
+        response = get(redirect_uri.to_s, {}, {}, onward_options, &block)
       end
     end
     if block_given?

data/test/HTTP/REDIRECT_test.rb

@@ -37,4 +37,46 @@ describe "redirect behaviour" do
       assert_requested(:get, 'http://example.com:8080/path'){|request| !request.headers.key?('Cookie')}
     end
   end
+
+  describe "the options hash" do
+    it "is not altered by a call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).to_return(status: 200)
+      options = {no_redirect: false, username: 'alice', password: 'secret', retries: 1}
+      HTTP.get(uri, {}, {}, options)
+      _(options).must_equal({no_redirect: false, username: 'alice', password: 'secret', retries: 1})
+    end
+
+    it "keeps no_redirect for a second call" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => other_origin_uri})
+      options = {no_redirect: true}
+      HTTP.get(uri, {}, {}, options)
+      _(HTTP.get(uri, {}, {}, options).redirection?).must_equal(true)
+      assert_not_requested(:get, other_origin_uri)
+    end
+
+    it "keeps retrying after a redirect" do
+      HTTP::RETRY.stub(:sleep, nil) do
+        stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
+        stub_request(:get, same_origin_uri).to_return(status: 503).then.to_return(status: 200)
+        _(HTTP.get(uri, {}, {}, {retries: 1}).success?).must_equal(true)
+        assert_requested(:get, same_origin_uri, times: 2)
+      end
+    end
+  end
+
+  describe "basic authentication options" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 302, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(basic_auth: ['alice', 'secret']).to_return(status: 200)
+      _(HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'}).success?).must_equal(true)
+    end
+
+    it "are dropped for another origin" do
+      stub_request(:get, uri).with(basic_auth: ['alice', 'secret']).to_return(status: 307, headers: {'location' => other_origin_uri})
+      stub_request(:get, other_origin_uri).to_return(status: 200)
+      HTTP.get(uri, {}, {}, {username: 'alice', password: 'secret'})
+      assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization')}
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.6
+  version: 1.3.7
 platform: ruby
 authors:
 - thoran