itsi-server 0.2.13 → 0.2.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a511f7da334b54141cfacb97b1dc47f21c88dc2f3942843a39bb113f254c970b
-  data.tar.gz: d6d0fab60a963cceffabaf545bb31d5b0400dcd966ae33ff280288da9dfb380c
+  metadata.gz: a2fec88d9b1fec3458e5d890cbd2b517c6c58cff123a2d28b26a00571edc456f
+  data.tar.gz: c460f900b09ba2602b8a0a9211d330e953fb8490497b24ae5390de9652780f42
 SHA512:
-  metadata.gz: 180375c8dbd4841da13bca51a86d3f28e131cc8e0209935a64d3e8e474bd388b43b4582bc5abf44eea309fe93cd924795509af1122e46cd455081f9c50b03433
-  data.tar.gz: c9e41ad7eeffc356b9522585ed1709d670419f573e0d1384704365e5ea48d28e5f2c7cd470cae9c4f438f787bc3619f865f19b8b1318da70504c5fa55d8e18ec
+  metadata.gz: 34402433ec5e6d9f755a2ac41e5fb7b17d6be27d9d6a30d23fefdf595c5d9619b05ad3a00751f72923db579685daf537e336db83d772f6307a6f5046de056cd0
+  data.tar.gz: 46e05ae1dd1c4c0b9219fee35783a55294edf6d344afe938f041779ba8ab2ab98625418b3d631b6c1d1cde9ff9d346f6e215bbe15032756caabef25e279dc386

data/Cargo.lock

@@ -1644,7 +1644,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-server"
-version = "0.2.13"
+version = "0.2.14"
 dependencies = [
  "argon2",
  "async-channel",
@@ -1674,6 +1674,7 @@ dependencies = [
  "jsonwebtoken",
  "magnus",
  "md5",
+ "memchr",
  "moka",
  "nix",
  "notify",

data/ext/itsi_scheduler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-scheduler"
-version = "0.2.13"
+version = "0.2.14"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"

data/ext/itsi_server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-server"
-version = "0.2.13"
+version = "0.2.14"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"
@@ -88,3 +88,4 @@ percent-encoding = "2.3.1"
 sha-crypt = "0.5.0"
 argon2 = "0.5.3"
 core_affinity = "0.8.3"
+memchr = "2.7.4"

data/ext/itsi_server/src/ruby_types/itsi_http_response.rs

@@ -1,4 +1,4 @@
-use bytes::{Bytes, BytesMut};
+use bytes::{Buf, Bytes, BytesMut};
 use derive_more::Debug;
 use futures::stream::{unfold, StreamExt};
 use http::{
@@ -12,6 +12,7 @@ use hyper_util::rt::TokioIo;
 use itsi_error::Result;
 use itsi_tracing::error;
 use magnus::error::Result as MagnusResult;
+use memchr::{memchr, memchr_iter};
 use parking_lot::RwLock;
 use std::{
     collections::HashMap,
@@ -345,13 +346,54 @@ impl ItsiHttpResponse {
         let header_name: HeaderName = HeaderName::from_bytes(&name).map_err(|e| {
             itsi_error::ItsiError::InvalidInput(format!("Invalid header name {:?}: {:?}", name, e))
         })?;
-        let header_value = unsafe { HeaderValue::from_maybe_shared_unchecked(value) };
         if let Some(ref mut resp) = *self.data.response.write() {
-            resp.headers_mut().append(header_name, header_value);
+            let headers_mut = resp.headers_mut();
+            self.insert_header(headers_mut, &header_name, value);
         }
         Ok(())
     }
 
+    pub fn insert_header(
+        &self,
+        headers_mut: &mut HeaderMap,
+        header_name: &HeaderName,
+        value: Bytes,
+    ) {
+        static MAX_SPLIT_HEADERS: usize = 100;
+
+        let mut start = 0usize;
+        let mut emitted = 0usize;
+
+        for idx in memchr_iter(b'\n', &value).chain(std::iter::once(value.len())) {
+            if idx == start {
+                start += 1;
+                continue;
+            }
+
+            let mut part = value.slice(start..idx);
+            if part.ends_with(b"\r") {
+                part.truncate(part.len() - 1);
+            }
+            if let Some(&(b' ' | b'\t')) = part.first() {
+                part.advance(1);
+            }
+            if memchr(0, &part).is_some() || part.iter().any(|&b| b < 0x20) {
+                warn!("stripped control char from header {:?}", header_name);
+                start = idx + 1;
+                continue;
+            }
+
+            emitted += 1;
+            if emitted > MAX_SPLIT_HEADERS {
+                break;
+            }
+
+            let hv = unsafe { HeaderValue::from_maybe_shared_unchecked(part) };
+            headers_mut.append(header_name, hv);
+            start = idx + 1;
+        }
+    }
+
     pub fn add_headers(&self, headers: HashMap<Bytes, Vec<Bytes>>) -> MagnusResult<()> {
         if let Some(ref mut resp) = *self.data.response.write() {
             let headers_mut = resp.headers_mut();
@@ -363,8 +405,7 @@ impl ItsiHttpResponse {
                     ))
                 })?;
                 for value in values {
-                    let header_value = unsafe { HeaderValue::from_maybe_shared_unchecked(value) };
-                    headers_mut.append(&header_name, header_value);
+                    self.insert_header(headers_mut, &header_name, value);
                 }
             }
         }

data/lib/itsi/server/config/middleware/static_assets.rb

@@ -18,7 +18,8 @@ module Itsi
             serve_hidden_files: ${11|true,false|}
         SNIPPET
 
-        detail "Serves static files from a designated directory with options for auto indexing, in-memory caching, and custom header support. Supports relative path rewriting and file range requests."
+        detail "Serves static files from a designated directory with options for auto indexing, in-memory caching, "\
+          "and custom header support. Supports relative path rewriting and file range requests."
 
         ErrorResponse = TypedStruct.new do
           {
@@ -42,7 +43,7 @@ module Itsi
           {
             root_dir: (Type(String) & Required()).default("./"),
             not_found_behavior: Or(
-              Enum(["fallthrough", "index", "redirect", "internal_server_error"]),
+              Enum(%w[fallthrough index redirect internal_server_error]),
               Type(IndexResponse),
               Type(RedirectResponse),
               Type(ErrorResponse)

data/lib/itsi/server/config/middleware/static_response.rb

@@ -2,20 +2,21 @@ module Itsi
   class Server
     module Config
       class StaticResponse < Middleware
+
         insert_text <<~SNIPPET
-        static_response \\
-          code: ${1|200,404,500|}, \\
-          headers: [${2|["Content-Type","text/plain"],["Cache-Control","max-age=60"]|}], \\
-          body: ${3|"OK".bytes, "Not Found".bytes|}
+          static_response \\
+            code: ${1|200,404,500|},
+            headers: [${2|%w[content-type text/plain],%w[cache-control max-age=60]|}],
+            body: ${3|"OK", "Not Found"|}
         SNIPPET
 
         detail "Immediately return a fixed HTTP response with code, headers, and body."
 
         schema do
           {
-            code:    (Type(Integer) & Required()),
+            code: (Type(Integer) & Required()),
             headers: Array(Array(Type(String), Type(String))).default([]),
-            body:    Type(String).default("")
+            body: Type(String).default("")
           }
         end
 

data/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.2.13"
+    VERSION = "0.2.14"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi-server
 version: !ruby/object:Gem::Version
-  version: 0.2.13
+  version: 0.2.14
 platform: ruby
 authors:
 - Wouter Coppieters