http 5.0.0.pre2 → 5.0.2

data/CHANGES.md

@@ -1,4 +1,77 @@
-## future is unwritten (master)
+## 5.0.2 (2021-09-10)
+
+* [#686](https://github.com/httprb/http/pull/686)
+  Correctly reset the parser.
+  ([@bryanp])
+
+* [#684](https://github.com/httprb/http/pull/684)
+  Don't set Content-Length for GET, HEAD, DELETE, or CONNECT requests without a BODY.
+  ([@jyn514])
+
+* [#679](https://github.com/httprb/http/pull/679)
+  Use features on redirected requests.
+  ([@nomis])
+
+* [#678](https://github.com/schwern)
+  Restore `HTTP::Response` `:uri` option for backwards compatibility.
+  ([@schwern])
+
+* [#676](https://github.com/httprb/http/pull/676)
+  Update addressable because of CVE-2021-32740.
+  ([@matheussilvasantos])
+
+* [#653](https://github.com/httprb/http/pull/653)
+  Avoid force encodings on frozen strings.
+  ([@bvicenzo])
+
+* [#638](https://github.com/httprb/http/pull/638)
+  DNS failover handling.
+  ([@midnight-wonderer])  
+
+## 5.0.1 (2021-06-26)
+
+* [#670](https://github.com/httprb/http/pull/670)
+  Revert `Response#parse` behavior introduced in [#540].
+  ([@DannyBen])
+
+* [#669](https://github.com/httprb/http/pull/669)
+  Prevent bodies from being resubmitted when following unsafe redirects.
+  ([@odinhb])
+
+* [#664](https://github.com/httprb/http/pull/664)
+  Bump llhttp-ffi to 0.3.0.
+  ([@bryanp])
+
+## 5.0.0 (2021-05-12)
+
+* [#656](https://github.com/httprb/http/pull/656)
+  Handle connection timeouts in `Features`
+  ([@semenyukdmitry])
+
+* [#651](https://github.com/httprb/http/pull/651)
+  Replace `http-parser` with `llhttp`
+  ([@bryanp])
+
+* [#647](https://github.com/httprb/http/pull/647)
+  Add support for `MKCALENDAR` HTTP verb
+  ([@meanphil])
+
+* [#632](https://github.com/httprb/http/pull/632)
+  Respect the SSL context's `verify_hostname` value
+  ([@colemannugent])
+
+* [#625](https://github.com/httprb/http/pull/625)
+  Fix inflator with empty responses
+  ([@LukaszMaslej])
+
+* [#599](https://github.com/httprb/http/pull/599)
+  Allow passing `HTTP::FormData::{Multipart,UrlEncoded}` object directly.
+  ([@ixti])
+
+* [#593](https://github.com/httprb/http/pull/593)
+  [#592](https://github.com/httprb/http/issues/592)
+  Support informational (1XX) responses.
+  ([@ixti])
 
 * [#590](https://github.com/httprb/http/pull/590)
   [#589](https://github.com/httprb/http/issues/589)
@@ -24,6 +97,12 @@
   Preserve header names casing.
   ([@joshuaflanagan])
 
+* [#540](https://github.com/httprb/http/pull/540)
+  [#538](https://github.com/httprb/http/issues/538)
+  **BREAKING CHANGE**
+  Require explicit MIME type for Response#parse
+  ([@ixti])
+
 * [#532](https://github.com/httprb/http/pull/532)
   Fix pipes support in request bodies.
   ([@ixti])
@@ -50,6 +129,27 @@
   Drop Ruby 2.3.x support.
   ([@ixti])
 
+* [3ed0c31](https://github.com/httprb/http/commit/3ed0c318eab6a8c390654cda17bf6df9e963c7d6)
+  Drop Ruby 2.4.x support.
+
+
+## 4.4.0 (2020-03-25)
+
+* Backport [#587](https://github.com/httprb/http/pull/587)
+  Fix redirections when server responds with multiple Location headers.
+  ([@ixti])
+
+* Backport [#599](https://github.com/httprb/http/pull/599)
+  Allow passing HTTP::FormData::{Multipart,UrlEncoded} object directly.
+  ([@ixti])
+
+
+## 4.3.0 (2020-01-09)
+
+* Backport [#581](https://github.com/httprb/http/pull/581)
+  Add Ruby-2.7 compatibility.
+  ([@ixti], [@janko])
+
 
 ## 4.2.0 (2019-10-22)
 
@@ -835,3 +935,16 @@ end
 [@mamoonraja]: https://github.com/mamoonraja
 [@joshuaflanagan]: https://github.com/joshuaflanagan
 [@antonvolkoff]: https://github.com/antonvolkoff
+[@LukaszMaslej]: https://github.com/LukaszMaslej
+[@colemannugent]: https://github.com/colemannugent
+[@semenyukdmitry]: https://github.com/semenyukdmitry
+[@bryanp]: https://github.com/bryanp
+[@meanphil]: https://github.com/meanphil
+[@odinhb]: https://github.com/odinhb
+[@DannyBen]: https://github.com/DannyBen
+[@jyn514]: https://github.com/jyn514
+[@bvicenzo]: https://github.com/bvicenzo
+[@nomis]: https://github.com/nomis
+[@midnight-wonderer]: https://github.com/midnight-wonderer
+[@schwern]: https://github.com/schwern
+[@matheussilvasantos]: https://github.com/matheussilvasantos

data/Gemfile

@@ -5,32 +5,39 @@ ruby RUBY_VERSION
 
 gem "rake"
 
+# Ruby 3.0 does not ship it anymore.
+# TODO: We should probably refactor specs to avoid need for it.
+gem "webrick"
+
 group :development do
   gem "guard-rspec", :require => false
   gem "nokogiri",    :require => false
   gem "pry",         :require => false
 
-  platform :ruby_20 do
-    gem "pry-debugger",       :require => false
-    gem "pry-stack_explorer", :require => false
+  # RSpec formatter
+  gem "fuubar", :require => false
+
+  platform :mri do
+    gem "pry-byebug"
   end
 end
 
 group :test do
-  gem "activemodel", :require => false # Used by certificate_authority
-  gem "certificate_authority", :require => false
+  gem "certificate_authority", "~> 1.0", :require => false
 
   gem "backports"
 
-  gem "coveralls", :require => false
-  gem "simplecov", ">= 0.9"
+  gem "rubocop"
+  gem "rubocop-performance"
+  gem "rubocop-rake"
+  gem "rubocop-rspec"
+
+  gem "simplecov",      :require => false
+  gem "simplecov-lcov", :require => false
 
-  gem "rspec", "~> 3.0"
+  gem "rspec", "~> 3.10"
   gem "rspec-its"
 
-  gem "rubocop", "= 0.68.1"
-  gem "rubocop-performance"
-
   gem "yardstick"
 end
 

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2011-2016 Tony Arcieri, Erik Michaels-Ober, Alexey V. Zapparov, Zachary Anker
+Copyright (c) 2011-2021 Tony Arcieri, Erik Michaels-Ober, Alexey V. Zapparov, Zachary Anker
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -1,9 +1,8 @@
 # ![http.rb](https://raw.github.com/httprb/http.rb/master/logo.png)
 
-[![Gem Version](https://badge.fury.io/rb/http.svg)](https://rubygems.org/gems/http)
-[![Build Status](https://secure.travis-ci.org/httprb/http.svg?branch=master)](https://travis-ci.org/httprb/http)
+[![Gem Version](https://img.shields.io/gem/v/http?logo=ruby)](https://rubygems.org/gems/http)
+[![Build Status](https://github.com/httprb/http/workflows/CI/badge.svg)](https://github.com/httprb/http/actions?query=workflow:CI)
 [![Code Climate](https://codeclimate.com/github/httprb/http.svg?branch=master)](https://codeclimate.com/github/httprb/http)
-[![Coverage Status](https://coveralls.io/repos/httprb/http/badge.svg?branch=master)](https://coveralls.io/r/httprb/http)
 [![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/httprb/http/blob/master/LICENSE.txt)
 
 [Documentation]
@@ -18,14 +17,12 @@ HTTP (The Gem! a.k.a. http.rb) is an easy-to-use client library for making reque
 from Ruby. It uses a simple method chaining system for building requests, similar to
 Python's [Requests].
 
-Under the hood, via [Ruby FFI bindings][http-parser-ffi], http.rb uses the Node.js
-[http-parser], a fast HTTP parsing native extension. This library
-isn't just yet another wrapper around Net::HTTP. It implements the HTTP protocol
-natively and outsources the parsing to native extensions.
+Under the hood, http.rb uses the [llhttp] parser, a fast HTTP parsing native extension.
+This library isn't just yet another wrapper around `Net::HTTP`. It implements the HTTP
+protocol natively and outsources the parsing to native extensions.
 
 [requests]: http://docs.python-requests.org/en/latest/
-[http-parser]: https://github.com/nodejs/http-parser
-[http-parser-ffi]: https://github.com/cotag/http-parser
+[llhttp]: https://llhttp.org/
 
 
 ## Another Ruby HTTP library? Why should I care?
@@ -115,8 +112,8 @@ for more detailed documentation and usage notes.
 
 The following API documentation is also available:
 
-* [YARD API documentation](http://www.rubydoc.info/gems/http/frames)
-* [Chainable module (all chainable methods)](http://www.rubydoc.info/gems/http/HTTP/Chainable)
+* [YARD API documentation](https://www.rubydoc.info/github/httprb/http)
+* [Chainable module (all chainable methods)](https://www.rubydoc.info/github/httprb/http/HTTP/Chainable)
 
 [documentation]: https://github.com/httprb/http/wiki
 
@@ -165,10 +162,10 @@ and call `#readpartial` on it repeatedly until it returns `nil`:
 This library aims to support and is [tested against][travis] the following Ruby
 versions:
 
-* Ruby 2.4.x
-* Ruby 2.5.x
-* Ruby 2.6.x
-* JRuby 9.2.x.x
+* Ruby 2.6
+* Ruby 2.7
+* Ruby 3.0
+* JRuby 9.2
 
 If something doesn't work on one of these versions, it's a bug.
 
@@ -198,5 +195,5 @@ dropped.
 
 ## Copyright
 
-Copyright (c) 2011-2019 Tony Arcieri, Alexey V. Zapparov, Erik Michaels-Ober, Zachary Anker.
+Copyright (c) 2011-2021 Tony Arcieri, Alexey V. Zapparov, Erik Michaels-Ober, Zachary Anker.
 See LICENSE.txt for further details.

data/Rakefile

@@ -35,7 +35,7 @@ task :generate_status_codes do
   end
 
   File.open("./lib/http/response/status/reasons.rb", "w") do |io|
-    io.puts <<-TPL.gsub(/^[ ]{6}/, "")
+    io.puts <<~TPL
       # AUTO-GENERATED FILE, DO NOT CHANGE IT MANUALLY
 
       require "delegate"
@@ -61,12 +61,4 @@ task :generate_status_codes do
   end
 end
 
-if ENV["CI"].nil?
-  task :default => %i[spec rubocop verify_measurements]
-else
-  case ENV["SUITE"]
-  when "rubocop"   then task :default => :rubocop
-  when "yardstick" then task :default => :verify_measurements
-  else                  task :default => :spec
-  end
-end
+task :default => %i[spec rubocop verify_measurements]

data/http.gemspec

@@ -25,12 +25,12 @@ Gem::Specification.new do |gem|
   gem.require_paths = ["lib"]
   gem.version       = HTTP::VERSION
 
-  gem.required_ruby_version = ">= 2.3"
+  gem.required_ruby_version = ">= 2.5"
 
-  gem.add_runtime_dependency "addressable",    "~> 2.3"
+  gem.add_runtime_dependency "addressable",    "~> 2.8"
   gem.add_runtime_dependency "http-cookie",    "~> 1.0"
   gem.add_runtime_dependency "http-form_data", "~> 2.2"
-  gem.add_runtime_dependency "http-parser",    "~> 1.2.0"
+  gem.add_runtime_dependency "llhttp-ffi",     "~> 0.4.0"
 
   gem.add_development_dependency "bundler", "~> 2.0"
 

data/lib/http/chainable.rb

@@ -9,63 +9,63 @@ module HTTP
     # Request a get sans response body
     # @param uri
     # @option options [Hash]
-    def head(uri, options = {}) # rubocop:disable Style/OptionHash
+    def head(uri, options = {})
       request :head, uri, options
     end
 
     # Get a resource
     # @param uri
     # @option options [Hash]
-    def get(uri, options = {}) # rubocop:disable Style/OptionHash
+    def get(uri, options = {})
       request :get, uri, options
     end
 
     # Post to a resource
     # @param uri
     # @option options [Hash]
-    def post(uri, options = {}) # rubocop:disable Style/OptionHash
+    def post(uri, options = {})
       request :post, uri, options
     end
 
     # Put to a resource
     # @param uri
     # @option options [Hash]
-    def put(uri, options = {}) # rubocop:disable Style/OptionHash
+    def put(uri, options = {})
       request :put, uri, options
     end
 
     # Delete a resource
     # @param uri
     # @option options [Hash]
-    def delete(uri, options = {}) # rubocop:disable Style/OptionHash
+    def delete(uri, options = {})
       request :delete, uri, options
     end
 
     # Echo the request back to the client
     # @param uri
     # @option options [Hash]
-    def trace(uri, options = {}) # rubocop:disable Style/OptionHash
+    def trace(uri, options = {})
       request :trace, uri, options
     end
 
     # Return the methods supported on the given URI
     # @param uri
     # @option options [Hash]
-    def options(uri, options = {}) # rubocop:disable Style/OptionHash
+    def options(uri, options = {})
       request :options, uri, options
     end
 
     # Convert to a transparent TCP/IP tunnel
     # @param uri
     # @option options [Hash]
-    def connect(uri, options = {}) # rubocop:disable Style/OptionHash
+    def connect(uri, options = {})
       request :connect, uri, options
     end
 
     # Apply partial modifications to a resource
     # @param uri
     # @option options [Hash]
-    def patch(uri, options = {}) # rubocop:disable Style/OptionHash
+    def patch(uri, options = {})
       request :patch, uri, options
     end
 
@@ -148,7 +148,7 @@ module HTTP
 
       yield p_client
     ensure
-      p_client.close if p_client
+      p_client&.close
     end
 
     # Make a request through an HTTP proxy
@@ -173,7 +173,7 @@ module HTTP
     # @param options
     # @return [HTTP::Client]
     # @see Redirector#initialize
-    def follow(options = {}) # rubocop:disable Style/OptionHash
+    def follow(options = {})
       branch default_options.with_follow options
     end
 
@@ -211,10 +211,11 @@ module HTTP
     # @option opts [#to_s] :user
     # @option opts [#to_s] :pass
     def basic_auth(opts)
-      user = opts.fetch :user
-      pass = opts.fetch :pass
+      user  = opts.fetch(:user)
+      pass  = opts.fetch(:pass)
+      creds = "#{user}:#{pass}"
 
-      auth("Basic " + Base64.strict_encode64("#{user}:#{pass}"))
+      auth("Basic #{Base64.strict_encode64(creds)}")
     end
 
     # Get options for HTTP

data/lib/http/client.rb

@@ -25,19 +25,19 @@ module HTTP
     end
 
     # Make an HTTP request
-    def request(verb, uri, opts = {}) # rubocop:disable Style/OptionHash
+    def request(verb, uri, opts = {})
       opts = @default_options.merge(opts)
       req = build_request(verb, uri, opts)
       res = perform(req, opts)
       return res unless opts.follow
 
       Redirector.new(opts.follow).perform(req, res) do |request|
-        perform(request, opts)
+        perform(wrap_request(request, opts), opts)
       end
     end
 
     # Prepare an HTTP request
-    def build_request(verb, uri, opts = {}) # rubocop:disable Style/OptionHash
+    def build_request(verb, uri, opts = {})
       opts    = @default_options.merge(opts)
       uri     = make_request_uri(uri, opts)
       headers = make_request_headers(opts)
@@ -52,9 +52,7 @@ module HTTP
         :body           => body
       )
 
-      opts.features.inject(req) do |request, (_name, feature)|
-        feature.wrap_request(request)
-      end
+      wrap_request(req, opts)
     end
 
     # @!method persistent?
@@ -68,9 +66,9 @@ module HTTP
 
       @state = :dirty
 
-      @connection ||= HTTP::Connection.new(req, options)
-
       begin
+        @connection ||= HTTP::Connection.new(req, options)
+
         unless @connection.failed_proxy_connect?
           @connection.send_request(req)
           @connection.read_headers!
@@ -97,13 +95,19 @@ module HTTP
     end
 
     def close
-      @connection.close if @connection
+      @connection&.close
       @connection = nil
       @state = :clean
     end
 
     private
 
+    def wrap_request(req, opts)
+      opts.features.inject(req) do |request, (_name, feature)|
+        feature.wrap_request(request)
+      end
+    end
+
     def build_response(req, options)
       Response.new(
         :status        => @connection.status_code,
@@ -120,15 +124,15 @@ module HTTP
     def verify_connection!(uri)
       if default_options.persistent? && uri.origin != default_options.persistent
         raise StateError, "Persistence is enabled for #{default_options.persistent}, but we got #{uri.origin}"
+      end
+
       # We re-create the connection object because we want to let prior requests
       # lazily load the body as long as possible, and this mimics prior functionality.
-      elsif @connection && (!@connection.keep_alive? || @connection.expired?)
-        close
+      return close if @connection && (!@connection.keep_alive? || @connection.expired?)
+
       # If we get into a bad state (eg, Timeout.timeout ensure being killed)
       # close the connection to prevent potential for mixed responses.
-      elsif @state == :dirty
-        close
-      end
+      return close if @state == :dirty
     end
 
     # Merges query params if needed
@@ -175,7 +179,7 @@ module HTTP
       when opts.body
         opts.body
       when opts.form
-        form = HTTP::FormData.create opts.form
+        form = make_form_data(opts.form)
         headers[Headers::CONTENT_TYPE] ||= form.content_type
         form
       when opts.json
@@ -184,5 +188,12 @@ module HTTP
         body
       end
     end
+
+    def make_form_data(form)
+      return form if form.is_a? HTTP::FormData::Multipart
+      return form if form.is_a? HTTP::FormData::Urlencoded
+
+      HTTP::FormData.create(form)
+    end
   end
 end