itsi 0.2.13 → 0.2.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3c1c81086711872c2ceaa5042078e05f4da5b6f4246bf6d5bc24ff607581557
-  data.tar.gz: 551e582ba837c8a4fe19a09ced2f38866493be737e6ac5188d206fad4835a510
+  metadata.gz: 239b868f5edfaff5a1c7dd9e47b9f6023f284ae7c06a43438ec127ab83b5f1c1
+  data.tar.gz: 8f0e2154a4e05281eeabb9e8eaded247be04ea17efa66e72cccbad7df356dcfb
 SHA512:
-  metadata.gz: 5e858281765fdc2c698d2af7ec7e5c05efbda0430cc49ca0319acd23bdc7f35b12d72a5496fbac6c3cbd1d594f46dfb16bf5daac2fded466be9ede98d3cecca5
-  data.tar.gz: e28a5fa4d4c3c6b2b2169005f0d686d90f2bf9c1b98f02bc7dd283189e26ad09698d519a7879280724b49e2794c994872b7c3cba5927dcdcf974d6b762f24164
+  metadata.gz: db430b1ba0736844a54eb9ebe00a2f12b51342b27544bdd58ccce2440fb5eb1e6e961cf95dc3a5665def3384ba1f8cd2cfa457f93e62d01022be3419a1f3b00c
+  data.tar.gz: e626d98db8d34bddca498e8086ff8b4dfe41091b1363f7c3f0899b061ecab0ff79b628f2393f82b54dca073c78f85801fb07af3d5c0880f334103fd3cf7a7b86

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [0.2.14] - 2025-04-30
+- Support new-line separated headers for Rack 2 backward compatibility.
+
+## [0.2.12] - 2025-04-29
+- Max Rust edition is now "2021"
+- Removed invalid rbs files causing RI doc generation failure
+- Fixed header clobbering in Rack
+- Added new `ruby_thread_request_backlog_size` option
+
 ## [0.2.3] - 2025-04-22
 
 - Public release!

data/Cargo.lock

@@ -1644,7 +1644,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-scheduler"
-version = "0.2.13"
+version = "0.2.14"
 dependencies = [
  "bytes",
  "derive_more",
@@ -1662,7 +1662,7 @@ dependencies = [
 
 [[package]]
 name = "itsi-server"
-version = "0.2.13"
+version = "0.2.14"
 dependencies = [
  "argon2",
  "async-channel",
@@ -1692,6 +1692,7 @@ dependencies = [
  "jsonwebtoken",
  "magnus",
  "md5",
+ "memchr",
  "moka",
  "nix",
  "notify",

data/crates/itsi_scheduler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-scheduler"
-version = "0.2.13"
+version = "0.2.14"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"

data/crates/itsi_server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-server"
-version = "0.2.13"
+version = "0.2.14"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"
@@ -88,3 +88,4 @@ percent-encoding = "2.3.1"
 sha-crypt = "0.5.0"
 argon2 = "0.5.3"
 core_affinity = "0.8.3"
+memchr = "2.7.4"

data/crates/itsi_server/src/ruby_types/itsi_http_response.rs

@@ -1,4 +1,4 @@
-use bytes::{Bytes, BytesMut};
+use bytes::{Buf, Bytes, BytesMut};
 use derive_more::Debug;
 use futures::stream::{unfold, StreamExt};
 use http::{
@@ -12,6 +12,7 @@ use hyper_util::rt::TokioIo;
 use itsi_error::Result;
 use itsi_tracing::error;
 use magnus::error::Result as MagnusResult;
+use memchr::{memchr, memchr_iter};
 use parking_lot::RwLock;
 use std::{
     collections::HashMap,
@@ -345,13 +346,54 @@ impl ItsiHttpResponse {
         let header_name: HeaderName = HeaderName::from_bytes(&name).map_err(|e| {
             itsi_error::ItsiError::InvalidInput(format!("Invalid header name {:?}: {:?}", name, e))
         })?;
-        let header_value = unsafe { HeaderValue::from_maybe_shared_unchecked(value) };
         if let Some(ref mut resp) = *self.data.response.write() {
-            resp.headers_mut().append(header_name, header_value);
+            let headers_mut = resp.headers_mut();
+            self.insert_header(headers_mut, &header_name, value);
         }
         Ok(())
     }
 
+    pub fn insert_header(
+        &self,
+        headers_mut: &mut HeaderMap,
+        header_name: &HeaderName,
+        value: Bytes,
+    ) {
+        static MAX_SPLIT_HEADERS: usize = 100;
+
+        let mut start = 0usize;
+        let mut emitted = 0usize;
+
+        for idx in memchr_iter(b'\n', &value).chain(std::iter::once(value.len())) {
+            if idx == start {
+                start += 1;
+                continue;
+            }
+
+            let mut part = value.slice(start..idx);
+            if part.ends_with(b"\r") {
+                part.truncate(part.len() - 1);
+            }
+            if let Some(&(b' ' | b'\t')) = part.first() {
+                part.advance(1);
+            }
+            if memchr(0, &part).is_some() || part.iter().any(|&b| b < 0x20) {
+                warn!("stripped control char from header {:?}", header_name);
+                start = idx + 1;
+                continue;
+            }
+
+            emitted += 1;
+            if emitted > MAX_SPLIT_HEADERS {
+                break;
+            }
+
+            let hv = unsafe { HeaderValue::from_maybe_shared_unchecked(part) };
+            headers_mut.append(header_name, hv);
+            start = idx + 1;
+        }
+    }
+
     pub fn add_headers(&self, headers: HashMap<Bytes, Vec<Bytes>>) -> MagnusResult<()> {
         if let Some(ref mut resp) = *self.data.response.write() {
             let headers_mut = resp.headers_mut();
@@ -363,8 +405,7 @@ impl ItsiHttpResponse {
                     ))
                 })?;
                 for value in values {
-                    let header_value = unsafe { HeaderValue::from_maybe_shared_unchecked(value) };
-                    headers_mut.append(&header_name, header_value);
+                    self.insert_header(headers_mut, &header_name, value);
                 }
             }
         }

data/gems/scheduler/Cargo.lock

@@ -213,7 +213,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-scheduler"
-version = "0.2.13"
+version = "0.2.14"
 dependencies = [
  "bytes",
  "derive_more",

data/gems/scheduler/lib/itsi/scheduler/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Scheduler
-    VERSION = "0.2.13"
+    VERSION = "0.2.14"
   end
 end

data/gems/server/Cargo.lock

@@ -1644,7 +1644,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-server"
-version = "0.2.13"
+version = "0.2.14"
 dependencies = [
  "argon2",
  "async-channel",
@@ -1674,6 +1674,7 @@ dependencies = [
  "jsonwebtoken",
  "magnus",
  "md5",
+ "memchr",
  "moka",
  "nix",
  "notify",

data/gems/server/lib/itsi/server/config/middleware/static_assets.rb

@@ -18,7 +18,8 @@ module Itsi
             serve_hidden_files: ${11|true,false|}
         SNIPPET
 
-        detail "Serves static files from a designated directory with options for auto indexing, in-memory caching, and custom header support. Supports relative path rewriting and file range requests."
+        detail "Serves static files from a designated directory with options for auto indexing, in-memory caching, "\
+          "and custom header support. Supports relative path rewriting and file range requests."
 
         ErrorResponse = TypedStruct.new do
           {
@@ -42,7 +43,7 @@ module Itsi
           {
             root_dir: (Type(String) & Required()).default("./"),
             not_found_behavior: Or(
-              Enum(["fallthrough", "index", "redirect", "internal_server_error"]),
+              Enum(%w[fallthrough index redirect internal_server_error]),
               Type(IndexResponse),
               Type(RedirectResponse),
               Type(ErrorResponse)

data/gems/server/lib/itsi/server/config/middleware/static_response.rb

@@ -2,20 +2,21 @@ module Itsi
   class Server
     module Config
       class StaticResponse < Middleware
+
         insert_text <<~SNIPPET
-        static_response \\
-          code: ${1|200,404,500|}, \\
-          headers: [${2|["Content-Type","text/plain"],["Cache-Control","max-age=60"]|}], \\
-          body: ${3|"OK".bytes, "Not Found".bytes|}
+          static_response \\
+            code: ${1|200,404,500|},
+            headers: [${2|%w[content-type text/plain],%w[cache-control max-age=60]|}],
+            body: ${3|"OK", "Not Found"|}
         SNIPPET
 
         detail "Immediately return a fixed HTTP response with code, headers, and body."
 
         schema do
           {
-            code:    (Type(Integer) & Required()),
+            code: (Type(Integer) & Required()),
             headers: Array(Array(Type(String), Type(String))).default([]),
-            body:    Type(String).default("")
+            body: Type(String).default("")
           }
         end
 

data/gems/server/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.2.13"
+    VERSION = "0.2.14"
   end
 end

data/gems/server/test/rack/test_rack_server.rb

@@ -356,7 +356,7 @@ class TestRackServer < Minitest::Test
   end
 
   def test_multi_field_headers
-    server(app_with_lint: lambda do |env|
+    server(app_with_lint: lambda do |_|
       [200, { "content-type" => "text/plain", "x-example" => ["one, two, three", "four, five"] }, ["Multiple Field Headers"]]
     end) do
       response = get_resp("/")
@@ -365,4 +365,35 @@ class TestRackServer < Minitest::Test
       assert_equal "Multiple Field Headers", response.body
     end
   end
+
+  # For backwards compatibility with Rack-2, which uses "\n" for multiple values in headers.
+  # https://github.com/rack/rack/blob/df6c47357f6c6bec2d585f45f417285d813d9b3a/lib/rack/utils.rb#L271
+  #
+  # In Rack 3, the behavior has changed to using Arrays of Strings exclusively.
+  # Note we don't use Rack lint here, because it'll complain about the invalid header value.
+  def test_multiline_headers_legacy_cookie
+    cookies = "one\r\ntwo\n three\n\tfour\nfive\n\n"
+    server(app: ->(_) { [200, { "set-cookie" => cookies }, ["OK"]] }) do
+      resp = get_resp("/")
+      assert_equal "200", resp.code
+      # folded lines should coalesce; empty lines disappear
+      assert_equal %w[one two three four five], resp.get_fields("set-cookie")
+    end
+  end
+
+  def test_control_chars_are_stripped
+    evil = "good\nbad\x01bad\ngood"
+    server(app: ->(_) { [200, { "x-evil" => evil }, ["body"]] }) do
+      resp = get_resp("/")
+      assert_equal %w[good good], resp.get_fields("x-evil")
+    end
+  end
+
+  def test_rack3_array_is_untouched
+    server(app: ->(_) { [200,
+                        { "set-cookie" => ["a=b", "c=d"] }, ["OK"] ] }) do
+      resp = get_resp("/")
+      assert_equal %w[a=b c=d], resp.get_fields("set-cookie")
+    end
+  end
 end

data/lib/itsi/version.rb

@@ -1,3 +1,3 @@
 module Itsi
-  VERSION = '0.2.13'
+  VERSION = '0.2.14'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi
 version: !ruby/object:Gem::Version
-  version: 0.2.13
+  version: 0.2.14
 platform: ruby
 authors:
 - Wouter Coppieters
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.13
+        version: 0.2.14
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.13
+        version: 0.2.14
 - !ruby/object:Gem::Dependency
   name: itsi-server
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.13
+        version: 0.2.14
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.13
+        version: 0.2.14
 description: Wrapper Gem for both the Itsi server and the Itsi Fiber scheduler
 email:
 - wc@pico.net.nz