http 5.0.1 → 5.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afbab6dd50416f2205ca49ae54217bff2f35e3fcf7738a8a5288644e801b4d42
-  data.tar.gz: f4d7ee837eaeda6cd50ad6cd58dd1b7c125516a98e821d5e176a8591b2f6baff
+  metadata.gz: fe455ddc7caea6475216135d2748825078dfe40aa5d474e219e054a330d54967
+  data.tar.gz: cdc04d4ccd9e7a8d45ad5db093c63bd2172720aa0c22f6e095fe93c6892e4ea2
 SHA512:
-  metadata.gz: 94e587b821c4839152e67d31b704cc9a20ceae5e2bb168893786aeaea32edeee80967678b348f9b2051552ebe3a6e018e1b15ca67c3231bcd51553e78486cd8f
-  data.tar.gz: 1f0dc3544496196b8c1193509b0b3a7bf7152178488ebf071b692288caf44bc59e5edfe382f918b9f6cc4de1dfc43fdf2334ea16ce67787ef3a0ed03b1b5eb52
+  metadata.gz: eff3f4e56087fd798ecc435ddc662b9e3b8e248c4a39448323643238cc7f8855a98ecfbe392e26f9e77b9129f18fcab13c1a3c588c819453a2f5199a24683c28
+  data.tar.gz: fe8fbd07014f69631414e2644aa48198e34cac0d085a4bce8f056a5284088a2414557a5bb83456f953ce2fdaa6b69621746a31430446664f56eca2a2b454117c

data/.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
 
 env:
   BUNDLE_WITHOUT: "development"

data/CHANGES.md

@@ -1,7 +1,37 @@
+## 5.0.2 (2021-09-10)
+
+* [#686](https://github.com/httprb/http/pull/686)
+  Correctly reset the parser.
+  ([@bryanp])
+
+* [#684](https://github.com/httprb/http/pull/684)
+  Don't set Content-Length for GET, HEAD, DELETE, or CONNECT requests without a BODY.
+  ([@jyn514])
+
+* [#679](https://github.com/httprb/http/pull/679)
+  Use features on redirected requests.
+  ([@nomis])
+
+* [#678](https://github.com/schwern)
+  Restore `HTTP::Response` `:uri` option for backwards compatibility.
+  ([@schwern])
+
+* [#676](https://github.com/httprb/http/pull/676)
+  Update addressable because of CVE-2021-32740.
+  ([@matheussilvasantos])
+
+* [#653](https://github.com/httprb/http/pull/653)
+  Avoid force encodings on frozen strings.
+  ([@bvicenzo])
+
+* [#638](https://github.com/httprb/http/pull/638)
+  DNS failover handling.
+  ([@midnight-wonderer])  
+
 ## 5.0.1 (2021-06-26)
 
 * [#670](https://github.com/httprb/http/pull/670)
-  Revert `Response#parse` behavior introduced in #540.
+  Revert `Response#parse` behavior introduced in [#540].
   ([@DannyBen])
 
 * [#669](https://github.com/httprb/http/pull/669)
@@ -912,3 +942,9 @@ end
 [@meanphil]: https://github.com/meanphil
 [@odinhb]: https://github.com/odinhb
 [@DannyBen]: https://github.com/DannyBen
+[@jyn514]: https://github.com/jyn514
+[@bvicenzo]: https://github.com/bvicenzo
+[@nomis]: https://github.com/nomis
+[@midnight-wonderer]: https://github.com/midnight-wonderer
+[@schwern]: https://github.com/schwern
+[@matheussilvasantos]: https://github.com/matheussilvasantos

data/http.gemspec

@@ -27,10 +27,10 @@ Gem::Specification.new do |gem|
 
   gem.required_ruby_version = ">= 2.5"
 
-  gem.add_runtime_dependency "addressable",    "~> 2.3"
+  gem.add_runtime_dependency "addressable",    "~> 2.8"
   gem.add_runtime_dependency "http-cookie",    "~> 1.0"
   gem.add_runtime_dependency "http-form_data", "~> 2.2"
-  gem.add_runtime_dependency "llhttp-ffi",     "~> 0.3.0"
+  gem.add_runtime_dependency "llhttp-ffi",     "~> 0.4.0"
 
   gem.add_development_dependency "bundler", "~> 2.0"
 

data/lib/http/client.rb

@@ -32,7 +32,7 @@ module HTTP
       return res unless opts.follow
 
       Redirector.new(opts.follow).perform(req, res) do |request|
-        perform(request, opts)
+        perform(wrap_request(request, opts), opts)
       end
     end
 
@@ -52,9 +52,7 @@ module HTTP
         :body           => body
       )
 
-      opts.features.inject(req) do |request, (_name, feature)|
-        feature.wrap_request(request)
-      end
+      wrap_request(req, opts)
     end
 
     # @!method persistent?
@@ -104,6 +102,12 @@ module HTTP
 
     private
 
+    def wrap_request(req, opts)
+      opts.features.inject(req) do |request, (_name, feature)|
+        feature.wrap_request(request)
+      end
+    end
+
     def build_response(req, options)
       Response.new(
         :status        => @connection.status_code,

data/lib/http/features/auto_inflate.rb

@@ -21,8 +21,6 @@ module HTTP
           :request       => response.request
         }
 
-        options[:uri] = response.uri if response.uri
-
         Response.new(options)
       end
 

data/lib/http/request/writer.rb

@@ -47,7 +47,11 @@ module HTTP
       # Adds the headers to the header array for the given request body we are working
       # with
       def add_body_type_headers
-        return if @headers[Headers::CONTENT_LENGTH] || chunked?
+        return if @headers[Headers::CONTENT_LENGTH] || chunked? || (
+          @body.source.nil? && %w[GET HEAD DELETE CONNECT].any? do |method|
+            @request_header[0].start_with?("#{method} ")
+          end
+        )
 
         @request_header << "#{Headers::CONTENT_LENGTH}: #{@body.size}"
       end

data/lib/http/response/body.rb

@@ -27,7 +27,9 @@ module HTTP
       # (see HTTP::Client#readpartial)
       def readpartial(*args)
         stream!
-        @stream.readpartial(*args)&.force_encoding(@encoding)
+        chunk = @stream.readpartial(*args)
+
+        String.new(chunk, :encoding => @encoding) if chunk
       end
 
       # Iterate over the body, allowing it to be enumerable
@@ -45,11 +47,11 @@ module HTTP
 
         begin
           @streaming  = false
-          @contents   = String.new("").force_encoding(@encoding)
+          @contents   = String.new("", :encoding => @encoding)
 
           while (chunk = @stream.readpartial)
-            @contents << chunk.force_encoding(@encoding)
-            chunk.clear # deallocate string
+            @contents << String.new(chunk, :encoding => @encoding)
+            chunk = nil # deallocate string
           end
         rescue
           @contents = nil

data/lib/http/response/parser.rb

@@ -15,7 +15,7 @@ module HTTP
       end
 
       def reset
-        @parser.finish
+        @parser.reset
         @handler.reset
         @header_finished = false
         @message_finished = false

data/lib/http/response.rb

@@ -40,10 +40,11 @@ module HTTP
     # @option opts [HTTP::Connection] :connection
     # @option opts [String] :encoding Encoding to use when reading body
     # @option opts [String] :body
-    # @option opts [HTTP::Request] request
+    # @option opts [HTTP::Request] request The request this is in response to.
+    # @option opts [String] :uri (DEPRECATED) used to populate a missing request
     def initialize(opts)
       @version       = opts.fetch(:version)
-      @request       = opts.fetch(:request)
+      @request       = init_request(opts)
       @status        = HTTP::Response::Status.new(opts.fetch(:status))
       @headers       = HTTP::Headers.coerce(opts[:headers] || {})
       @proxy_headers = HTTP::Headers.coerce(opts[:proxy_headers] || {})
@@ -164,5 +165,22 @@ module HTTP
     def inspect
       "#<#{self.class}/#{@version} #{code} #{reason} #{headers.to_h.inspect}>"
     end
+
+    private
+
+    # Initialize an HTTP::Request from options.
+    #
+    # @return [HTTP::Request]
+    def init_request(opts)
+      raise ArgumentError, ":uri is for backwards compatibilty and conflicts with :request" \
+        if opts[:request] && opts[:uri]
+
+      # For backwards compatibilty
+      if opts[:uri]
+        HTTP::Request.new(:uri => opts[:uri], :verb => :get)
+      else
+        opts.fetch(:request)
+      end
+    end
   end
 end

data/lib/http/timeout/global.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
-require "timeout"
 require "io/wait"
+require "resolv"
+require "timeout"
 
 require "http/timeout/null"
 
@@ -12,6 +13,9 @@ module HTTP
         super
 
         @timeout = @time_left = options.fetch(:global_timeout)
+        @dns_resolver = options.fetch(:dns_resolver) do
+          ::Resolv.method(:getaddresses)
+        end
       end
 
       # To future me: Don't remove this again, past you was smarter.
@@ -19,14 +23,28 @@ module HTTP
         @time_left = @timeout
       end
 
-      def connect(socket_class, host, port, nodelay = false)
+      def connect(socket_class, host_name, *args)
+        connect_operation = lambda do |host_address|
+          ::Timeout.timeout(@time_left, TimeoutError) do
+            super(socket_class, host_address, *args)
+          end
+        end
+        host_addresses = @dns_resolver.call(host_name)
+        # ensure something to iterates
+        trying_targets = host_addresses.empty? ? [host_name] : host_addresses
         reset_timer
-        ::Timeout.timeout(@time_left, TimeoutError) do
-          @socket = socket_class.open(host, port)
-          @socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1) if nodelay
+        trying_iterator = trying_targets.lazy
+        error = nil
+        begin
+          connect_operation.call(trying_iterator.next).tap do
+            log_time
+          end
+        rescue TimeoutError => e
+          error = e
+          retry
+        rescue ::StopIteration
+          raise error
         end
-
-        log_time
       end
 
       def connect_ssl

data/lib/http/timeout/per_operation.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "resolv"
 require "timeout"
 
 require "http/timeout/null"
@@ -17,14 +18,34 @@ module HTTP
         @read_timeout = options.fetch(:read_timeout, READ_TIMEOUT)
         @write_timeout = options.fetch(:write_timeout, WRITE_TIMEOUT)
         @connect_timeout = options.fetch(:connect_timeout, CONNECT_TIMEOUT)
+        @dns_resolver = options.fetch(:dns_resolver) do
+          ::Resolv.method(:getaddresses)
+        end
       end
 
-      def connect(socket_class, host, port, nodelay = false)
-        ::Timeout.timeout(@connect_timeout, TimeoutError) do
-          @socket = socket_class.open(host, port)
-          @socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1) if nodelay
+      # TODO: refactor
+      # rubocop:disable Metrics/MethodLength
+      def connect(socket_class, host_name, *args)
+        connect_operation = lambda do |host_address|
+          ::Timeout.timeout(@connect_timeout, TimeoutError) do
+            super(socket_class, host_address, *args)
+          end
+        end
+        host_addresses = @dns_resolver.call(host_name)
+        # ensure something to iterates
+        trying_targets = host_addresses.empty? ? [host_name] : host_addresses
+        trying_iterator = trying_targets.lazy
+        error = nil
+        begin
+          connect_operation.call(trying_iterator.next)
+        rescue TimeoutError => e
+          error = e
+          retry
+        rescue ::StopIteration
+          raise error
         end
       end
+      # rubocop:enable Metrics/MethodLength
 
       def connect_ssl
         rescue_readable(@connect_timeout) do

data/lib/http/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HTTP
-  VERSION = "5.0.1"
+  VERSION = "5.0.2"
 end

data/spec/lib/http/client_spec.rb

@@ -4,6 +4,7 @@
 require "support/http_handling_shared"
 require "support/dummy_server"
 require "support/ssl_helper"
+require "logger"
 
 RSpec.describe HTTP::Client do
   run_server(:dummy) { DummyServer.new }
@@ -115,6 +116,39 @@ RSpec.describe HTTP::Client do
     end
   end
 
+  describe "following redirects with logging" do
+    let(:logger) do
+      logger           = Logger.new(logdev)
+      logger.formatter = ->(severity, _, _, message) { format("** %s **\n%s\n", severity, message) }
+      logger.level     = Logger::INFO
+      logger
+    end
+
+    let(:logdev) { StringIO.new }
+
+    it "logs all requests" do
+      client = StubbedClient.new(:follow => true, :features => { :logging => { :logger => logger } }).stub(
+        "http://example.com/"  => redirect_response("/1"),
+        "http://example.com/1" => redirect_response("/2"),
+        "http://example.com/2" => redirect_response("/3"),
+        "http://example.com/3" => simple_response("OK")
+      )
+
+      expect { client.get("http://example.com/") }.not_to raise_error
+
+      expect(logdev.string).to eq <<~OUTPUT
+        ** INFO **
+        > GET http://example.com/
+        ** INFO **
+        > GET http://example.com/1
+        ** INFO **
+        > GET http://example.com/2
+        ** INFO **
+        > GET http://example.com/3
+      OUTPUT
+    end
+  end
+
   describe "parsing params" do
     let(:client) { HTTP::Client.new }
     before { allow(client).to receive :perform }

data/spec/lib/http/features/auto_inflate_spec.rb

@@ -74,7 +74,6 @@ RSpec.describe HTTP::Features::AutoInflate do
           :status     => 200,
           :headers    => {:content_encoding => "gzip"},
           :connection => connection,
-          :uri        => "https://example.com",
           :request    => HTTP::Request.new(:verb => :get, :uri => "https://example.com")
         )
       end

data/spec/lib/http/features/instrumentation_spec.rb

@@ -46,7 +46,6 @@ RSpec.describe HTTP::Features::Instrumentation do
     let(:response) do
       HTTP::Response.new(
         :version => "1.1",
-        :uri     => "https://example.com",
         :status  => 200,
         :headers => {:content_type => "application/json"},
         :body    => '{"success": true}',

data/spec/lib/http/features/logging_spec.rb

@@ -42,7 +42,6 @@ RSpec.describe HTTP::Features::Logging do
     let(:response) do
       HTTP::Response.new(
         :version => "1.1",
-        :uri     => "https://example.com",
         :status  => 200,
         :headers => {:content_type => "application/json"},
         :body    => '{"success": true}',

data/spec/lib/http/request/writer_spec.rb

@@ -47,9 +47,20 @@ RSpec.describe HTTP::Request::Writer do
       end
     end
 
-    context "when body is empty" do
+    context "when body is not set" do
       let(:body) { HTTP::Request::Body.new(nil) }
 
+      it "doesn't write anything to the socket and doesn't set Content-Length" do
+        writer.stream
+        expect(io.string).to eq [
+          "#{headerstart}\r\n\r\n"
+        ].join
+      end
+    end
+
+    context "when body is empty" do
+      let(:body) { HTTP::Request::Body.new("") }
+
       it "doesn't write anything to the socket and sets Content-Length" do
         writer.stream
         expect(io.string).to eq [

data/spec/lib/http/response/body_spec.rb

@@ -2,7 +2,7 @@
 
 RSpec.describe HTTP::Response::Body do
   let(:connection) { double(:sequence_id => 0) }
-  let(:chunks)     { [String.new("Hello, "), String.new("World!")] }
+  let(:chunks)     { ["Hello, ", "World!"] }
 
   before do
     allow(connection).to receive(:readpartial) { chunks.shift }
@@ -16,7 +16,7 @@ RSpec.describe HTTP::Response::Body do
   end
 
   context "when body empty" do
-    let(:chunks) { [String.new("")] }
+    let(:chunks) { [""] }
 
     it "returns responds to empty? with true" do
       expect(subject).to be_empty
@@ -45,12 +45,12 @@ RSpec.describe HTTP::Response::Body do
     it "returns content in specified encoding" do
       body = described_class.new(connection)
       expect(connection).to receive(:readpartial).
-        and_return(String.new("content").force_encoding(Encoding::UTF_8))
+        and_return(String.new("content", :encoding => Encoding::UTF_8))
       expect(body.readpartial.encoding).to eq Encoding::BINARY
 
       body = described_class.new(connection, :encoding => Encoding::UTF_8)
       expect(connection).to receive(:readpartial).
-        and_return(String.new("content").force_encoding(Encoding::BINARY))
+        and_return(String.new("content", :encoding => Encoding::BINARY))
       expect(body.readpartial.encoding).to eq Encoding::UTF_8
     end
   end
@@ -59,7 +59,7 @@ RSpec.describe HTTP::Response::Body do
     let(:chunks) do
       body = Zlib::Deflate.deflate("Hi, HTTP here ☺")
       len  = body.length
-      [String.new(body[0, len / 2]), String.new(body[(len / 2)..-1])]
+      [body[0, len / 2], body[(len / 2)..-1]]
     end
     subject(:body) do
       inflater = HTTP::Response::Inflater.new(connection)

data/spec/lib/http/response/parser_spec.rb

@@ -46,9 +46,9 @@ RSpec.describe HTTP::Response::Parser do
   context "when got 100 Continue response" do
     let :raw_response do
       "HTTP/1.1 100 Continue\r\n\r\n" \
-      "HTTP/1.1 200 OK\r\n" \
-      "Content-Length: 12\r\n\r\n" \
-      "Hello World!"
+        "HTTP/1.1 200 OK\r\n" \
+        "Content-Length: 12\r\n\r\n" \
+        "Hello World!"
     end
 
     context "when response is feeded in one part" do

data/spec/lib/http/response_spec.rb

@@ -4,6 +4,7 @@ RSpec.describe HTTP::Response do
   let(:body)          { "Hello world!" }
   let(:uri)           { "http://example.com/" }
   let(:headers)       { {} }
+  let(:request)       { HTTP::Request.new(:verb => :get, :uri => uri) }
 
   subject(:response) do
     HTTP::Response.new(
@@ -11,8 +12,7 @@ RSpec.describe HTTP::Response do
       :version => "1.1",
       :headers => headers,
       :body    => body,
-      :uri     => uri,
-      :request => HTTP::Request.new(:verb => :get, :uri => "http://example.com")
+      :request => request
     )
   end
 
@@ -167,7 +167,7 @@ RSpec.describe HTTP::Response do
         :version    => "1.1",
         :status     => 200,
         :connection => connection,
-        :request    => HTTP::Request.new(:verb => :get, :uri => "http://example.com")
+        :request    => request
       )
     end
 
@@ -184,4 +184,43 @@ RSpec.describe HTTP::Response do
     end
     it { is_expected.not_to be_chunked }
   end
+
+  describe "backwards compatibilty with :uri" do
+    context "with no :verb" do
+      subject(:response) do
+        HTTP::Response.new(
+          :status  => 200,
+          :version => "1.1",
+          :headers => headers,
+          :body    => body,
+          :uri     => uri
+        )
+      end
+
+      it "defaults the uri to :uri" do
+        expect(response.request.uri.to_s).to eq uri
+      end
+
+      it "defaults to the verb to :get" do
+        expect(response.request.verb).to eq :get
+      end
+    end
+
+    context "with both a :request and :uri" do
+      subject(:response) do
+        HTTP::Response.new(
+          :status  => 200,
+          :version => "1.1",
+          :headers => headers,
+          :body    => body,
+          :uri     => uri,
+          :request => request
+        )
+      end
+
+      it "raises ArgumentError" do
+        expect { response }.to raise_error(ArgumentError)
+      end
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http
 version: !ruby/object:Gem::Version
-  version: 5.0.1
+  version: 5.0.2
 platform: ruby
 authors:
 - Tony Arcieri
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-26 00:00:00.000000000 Z
+date: 2021-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -19,14 +19,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '2.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '2.8'
 - !ruby/object:Gem::Dependency
   name: http-cookie
   requirement: !ruby/object:Gem::Requirement
@@ -61,14 +61,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -191,7 +191,7 @@ metadata:
   source_code_uri: https://github.com/httprb/http
   wiki_uri: https://github.com/httprb/http/wiki
   bug_tracker_uri: https://github.com/httprb/http/issues
-  changelog_uri: https://github.com/httprb/http/blob/v5.0.1/CHANGES.md
+  changelog_uri: https://github.com/httprb/http/blob/v5.0.2/CHANGES.md
 post_install_message:
 rdoc_options: []
 require_paths: