http.rb 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd64e430f4c763d9a11367ecc26c6d419f9b5a0304c8084c41f995187d5b179a
-  data.tar.gz: bd8d9c977ed8e594a80c97a65d546270cf15dc482b2ee4440e5eeb739c2240b9
+  metadata.gz: 72cf60480847b43b60b63378d803acae19a12c127ceb9695ed8b0eca99ca57a4
+  data.tar.gz: aed0e179795a1f408823cb5cecca6bb2c877a1e4a90c3a31f21a115a5270a2e6
 SHA512:
-  metadata.gz: 86146298fe511634f52a083fce07d96b3524a7faf46611cb262bf3e502c4ad413a233081091936a798649b6d9126061945ef34ef0b4a8e2c12ae8f0f2c3a87df
-  data.tar.gz: 8d6138d16b159c467dd645e675b7f0753e2693eb0a31c2cdf953731c90a0b9bde5ee3a90cee29ed7be928398a28ad27ab2bfe784cd9eafa66111c2cec4a42d98
+  metadata.gz: b8e095a766f24d074324536e89dc07871bc8670785fe14f95470a06e64a4107e0c7c2df44f746c8dbd9c31d7b79336e8548aaf5601e4121db86f5787c1ee66bb
+  data.tar.gz: c5637e2490a1605d4112162bad17c12d70e1536af814901c1bdc2572eb730f15e54b0eb8db2db3ff6057d872b9969b7852c5767872b9108ce257a160a9ebf24f

data/CHANGELOG

@@ -1,5 +1,19 @@
 # CHANGELOG
 
+## 20261011
+
+1.5.0: + max_redirects; + HTTP::TooManyRedirects.
+
+Redirects were followed without limit, each by a call nested in the last, so a redirect loop ran until SystemStackError, which against a local server came after 2,179 requests. Now no more than max_redirects are followed, 20 unless given, which is where browsers stop, and one more raises HTTP::TooManyRedirects.
+
+1. ~ lib/HTTP/REDIRECT.rb: + HTTP::REDIRECT::MAX (20); + HTTP::TooManyRedirects, whose response is the redirect which was not followed.
+2. ~ HTTP.redirect_options: + max_redirects, which the redirect is made with one fewer of.
+3. ~ HTTP.request: + max_redirects option, which defaults to HTTP::REDIRECT::MAX and is not passed through to Net::HTTP; HTTP::TooManyRedirects is raised at a redirect when none are left. max_redirects: 0 raises at the first redirect, where no_redirect: true returns it, and no_redirect wins where both are given.
+4. ~ test/HTTP/REDIRECT_test.rb: + as many redirects followed as allowed, TooManyRedirects for one more with the redirect not followed, 0 raising at the first, no_redirect winning over it, a loop stopped at the default, and the option not passed through to Net::HTTP; max_redirects among the options left as they were. All fail against 1.4.0, which passed max_redirects through to Net::HTTP, where there is no max_redirects= for it.
+5. ~ README.md: + Limiting redirections; + max_redirects among the options which aren't passed through to Net::HTTP.
+6. ~ HTTP::VERSION: /1.4.0/1.5.0/
+
+
 ## 20261011
 
 1.4.0: The method on a redirect is as RFC 9110 has it: a DELETE redirected by a 301 or 302 is now a DELETE, a PUT a PUT, and a HEAD a HEAD.

data/README.md

@@ -119,6 +119,22 @@ HTTP.get('http://example.com', {}, {}, {no_redirect: true})
 # => #<Net::HTTPResponse @code=3xx>
 ```
 
+### Limiting redirections
+
+Up to 20 redirects are followed by default. One more raises `HTTP::TooManyRedirects`, whose `response` is the redirect which wasn't followed:
+
+```ruby
+HTTP.get('http://example.com', {}, {}, {max_redirects: 5})
+
+begin
+  HTTP.get('http://example.com/loop')
+rescue HTTP::TooManyRedirects => e
+  e.response['location']
+end
+```
+
+`max_redirects: 0` raises at the first redirect, whereas `no_redirect: true` returns it.
+
 ### Retries
 
 Retries are disabled by default. Enable them by passing `retries:` in the options hash.
@@ -216,12 +232,16 @@ HTTP.request_with_body(:propfind, 'http://example.com/path', xml, {'Content-Type
 Both take the same `(method, uri, args_or_data, headers, options, &block)` arguments as the named methods, with the method as the first argument, and the named methods delegate to them. For full control over the request object, drop down to `HTTP.request(uri, request_object, headers, options, &block)`.
 
 ## Allowed values for the options hash
-#### (These pass through to Net::HTTP, except for `no_redirect`, `username`, and `password`.)
+#### (These pass through to Net::HTTP, except for `no_redirect`, `max_redirects`, `username`, and `password`.)
 
 ```Ruby
 no_redirect
     # Prevents redirection if a 3xx response is encountered.
 
+max_redirects
+    # The most redirects followed before HTTP::TooManyRedirects is raised.
+    # Defaults to 20.
+
 username
     # Username for HTTP basic authentication. Takes precedence over any
     # credentials embedded in the URI.

data/lib/HTTP/REDIRECT.rb

@@ -5,6 +5,16 @@ module HTTP
   module REDIRECT
     CODES = %w{301 302 303 307 308}.freeze
     CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
+    MAX = 20
+  end
+
+  class TooManyRedirects < StandardError
+    attr_reader :response
+
+    def initialize(response)
+      @response = response
+      super("Too many redirects: #{response.code} to #{response['location']}")
+    end
   end
 
   # A 300 or a 304 is an answer rather than somewhere else to go, and a 3xx without a
@@ -52,7 +62,8 @@ module HTTP
   end
   module_function :body_headers
 
-  def redirect_options(options, from_uri, to_uri)
+  def redirect_options(options, from_uri, to_uri, max_redirects)
+    options = options.merge(max_redirects: max_redirects - 1)
     return options if same_origin?(from_uri, to_uri)
     options.reject{|k, v| %i{username password}.include?(k)}
   end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.4.0'
+  VERSION = '1.5.0'
 end

data/lib/HTTP/request.rb

@@ -19,6 +19,7 @@ module HTTP
     given_options = options
     options = options.dup
     no_redirect = options.delete(:no_redirect)
+    max_redirects = options.delete(:max_redirects) || REDIRECT::MAX
     username = options.delete(:username)
     password = options.delete(:password)
     config = retry_config(options)
@@ -41,8 +42,9 @@ module HTTP
       end
     )
     if !no_redirect && redirect?(response)
+      raise TooManyRedirects.new(response) if max_redirects < 1
       redirect_uri = uri.merge(response['location'])
-      onward_options = redirect_options(given_options, uri, redirect_uri)
+      onward_options = redirect_options(given_options, uri, redirect_uri, max_redirects)
       redirect_method = redirect_method(response.code, request_method)
       if redirect_method != request_method
         return request_without_body(redirect_method, redirect_uri, {}, redirect_headers(headers, uri, redirect_uri, drop_content_type: true), onward_options, &block)

data/test/HTTP/REDIRECT_test.rb

@@ -59,9 +59,9 @@ describe "redirect behaviour" do
     it "is not altered by a call" do
       stub_request(:get, uri).to_return(status: 302, headers: {'location' => same_origin_uri})
       stub_request(:get, same_origin_uri).to_return(status: 200)
-      options = {no_redirect: false, username: 'alice', password: 'secret', retries: 1}
+      options = {no_redirect: false, max_redirects: 3, username: 'alice', password: 'secret', retries: 1}
       HTTP.get(uri, {}, {}, options)
-      _(options).must_equal({no_redirect: false, username: 'alice', password: 'secret', retries: 1})
+      _(options).must_equal({no_redirect: false, max_redirects: 3, username: 'alice', password: 'secret', retries: 1})
     end
 
     it "keeps no_redirect for a second call" do
@@ -215,4 +215,42 @@ describe "redirect behaviour" do
       end
     end
   end
+
+  describe "max_redirects" do
+    before do
+      stub_request(:get, 'http://example.com/0').to_return(status: 302, headers: {'location' => '/1'})
+      stub_request(:get, 'http://example.com/1').to_return(status: 302, headers: {'location' => '/2'})
+      stub_request(:get, 'http://example.com/2').to_return(status: 200)
+    end
+
+    it "follows as many redirects as it is allowed" do
+      _(HTTP.get('http://example.com/0', {}, {}, {max_redirects: 2}).success?).must_equal(true)
+    end
+
+    it "raises TooManyRedirects, with the redirect not followed, when there are more" do
+      error = _(->{HTTP.get('http://example.com/0', {}, {}, {max_redirects: 1})}).must_raise(HTTP::TooManyRedirects)
+      _(error.response['location']).must_equal('/2')
+      assert_not_requested(:get, 'http://example.com/2')
+    end
+
+    it "raises at the first redirect when it is 0" do
+      _(->{HTTP.get('http://example.com/0', {}, {}, {max_redirects: 0})}).must_raise(HTTP::TooManyRedirects)
+      assert_not_requested(:get, 'http://example.com/1')
+    end
+
+    it "gives way to no_redirect" do
+      _(HTTP.get('http://example.com/0', {}, {}, {max_redirects: 0, no_redirect: true}).code).must_equal('302')
+    end
+
+    it "stops a redirect loop at the default" do
+      stub_request(:get, uri).to_return(status: 302, headers: {'location' => uri})
+      _(->{HTTP.get(uri)}).must_raise(HTTP::TooManyRedirects)
+      assert_requested(:get, uri, times: HTTP::REDIRECT::MAX + 1)
+    end
+
+    it "is not passed through to Net::HTTP" do
+      stub_request(:get, uri).to_return(status: 200)
+      _(HTTP.get(uri, {}, {}, {max_redirects: 5}).success?).must_equal(true)
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - thoran