mechanize 2.14.0 → 2.14.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00134b35e4583ae30a00b320468fa362e7290bced2f030a3e02544848f58cde6
-  data.tar.gz: babed05130568f0a4c306ccaa77da706334bafbd3fe898c961af5e4faaa98c03
+  metadata.gz: 88e582acc05ea06598dcdde3bd7feeaa34b865a9f14cbdb471867e011615d746
+  data.tar.gz: 0b6ef8790866784501313c7b8485bba98bda4665ae520f6cd7fef3c24e99f9a0
 SHA512:
-  metadata.gz: 26e8e71a37e1811cfd108c3947d6eaac79576128e2b684e9b1e1d32ee83270f93b4c912b5fa8a324fb643b28dc423ed88ad95bad6efc904fe3af592d9d179844
-  data.tar.gz: 20ae7f34891ff7dd2284831acad91789656c6817d70577de885744d419ac447d8fac5cb6d7f2e609624835f2b506a85cbd5ba20f6881ae6d402f6b17ae460b82
+  metadata.gz: 22c3ccf0b548e92b4ff08a9144156d301d80bbf93e64302db5d8efdbdeb3f54dd1f8ddd827cc09382064134ec3f4488ae8f63ac3ad0c75b5aa536046e62dd8ad
+  data.tar.gz: 0a810214b4812af939185ccd63a73bb4adebff45afc0d94e5f931702c928e7949a21b09655dc16e36ecfd1e8e7c3d328e7c9912291373ac4d7cfb08f84ea0c5a

data/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Mechanize CHANGELOG
 
+## 2.14.2 / 2026-10-26
+
+### Security
+
+* A malicious server can no longer make `Mechanize::FileSaver`, or `Mechanize::DirectorySaver` with `decode_filename: true`, write files outside the save directory. Only applications that register one of these as a pluggable parser are affected. [GHSA-hxgc-9476-fc65](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-hxgc-9476-fc65)
+
+### Improved
+
+* The gem no longer packages the test suite, the test certificates, or the example scripts, which makes it about a third smaller. It still packages `test/htdocs/`, which `Mechanize::TestCase` needs. (#667) @yuri-zubov
+* `Mechanize::TestCase` fake responses work with `net-http` 0.10.0 and later, which reads response lines with `Net::BufferedIO#readuntil`. Previously a chunked response body raised `NoMethodError`. The fake socket is now a `Net::BufferedIO`, like a real one, so `read_body` yields fragments of at most 16 KiB, and a body shorter than its `Content-Length` raises `EOFError` when `ignore_eof` is false.
+
+
+## 2.14.1 / 2026-08-22
+
+### Security
+
+* Strip both `Proxy-Authorization` and `Cookie2` headers on a cross-origin redirect. [GHSA-2mwr-xjcg-37j7](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7)
+* Headers set through `Mechanize#request_headers=` now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. [GHSA-2mwr-xjcg-37j7](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7)
+* A redirect is now considered cross-origin when the scheme, the host or the port changes, per [RFC 6454](https://datatracker.ietf.org/doc/html/rfc6454). Previously only a host change discarded cookies, and an `https:` to `http:` redirect to the same host carried credentials in cleartext. [GHSA-5jgv-wc2m-xv99](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99)
+* A `meta` refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through `Mechanize#request_headers=` followed it unconditionally. [GHSA-c6rp-p8xm-4q9f](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f)
+
+### Improved
+
+* A `meta` refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through `Mechanize#request_headers=`.
+* `robots.txt` is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through `Mechanize#request_headers=`. It is a request mechanize makes on its own behalf.
+
+
 ## 2.14.0 / 2025-01-05
 
 * `Mechanize` exposes a `write_timeout` attribute, which is set on the connection if it's supported (e.g., `Net::HTTP::Persistent.write_timeout`). (#586) @maurycy
@@ -1132,4 +1159,3 @@ Mechanize is now under the MIT license
 * Added a response code exception
 * Thanks to Brian Ellin (brianellin@gmail.com) for:
   Added support for CA files, and support for 301 response codes
-

data/README.md

@@ -56,6 +56,13 @@ bundle exec rake test
 See also Mechanize::TestCase to read about the built-in testing infrastructure.
 
 
+### Security and Vulnerability Reporting
+
+Please report vulnerabilities at https://github.com/sparklemotion/mechanize/security
+
+See [SECURITY.md](SECURITY.md) for full information and description of our security policy.
+
+
 ## Authors
 
 * Eric Hodel

data/SECURITY.md

@@ -0,0 +1,11 @@
+# Security and Vulnerability Reporting
+
+The Mechanize Core Contributors take security very seriously and investigate all reported vulnerabilities.
+
+If you would like to report a vulnerability or have a security concern regarding Mechanize or how Mechanize is using any of its underlying platform-specific libraries, please [report it via Github](https://github.com/sparklemotion/mechanize/security).
+
+Your report should be acknowledged within a week, and you'll receive a more detailed response within two weeks indicating next steps in handling your report.
+
+If you have not received a reply to your submission within a week, contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>).
+
+If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.

data/lib/mechanize/directory_saver.rb

@@ -64,8 +64,9 @@ class Mechanize::DirectorySaver < Mechanize::Download
 
     super
 
-    @filename = CGI.unescape(@filename) if self.class.decode_filename?
+    @filename = CGI.unescape(@filename).tr('/\\', '_') if self.class.decode_filename?
     path = File.join directory, @filename
+    ensure_within directory, path
 
     if self.class.overwrite?
       save! path

data/lib/mechanize/file_saver.rb

@@ -25,6 +25,8 @@ class Mechanize::FileSaver < Mechanize::Download
 
     super
 
+    ensure_within Dir.pwd, @uri.host
+    ensure_within @uri.host, @filename
     save @filename
   end
 

data/lib/mechanize/http/agent.rb

@@ -9,10 +9,14 @@ require 'webrobots'
 
 class Mechanize::HTTP::Agent
 
-  CREDENTIAL_HEADERS = ['Authorization']
-  COOKIE_HEADERS = ['Cookie']
+  CREDENTIAL_HEADERS = ['Authorization', 'Proxy-Authorization']
+  COOKIE_HEADERS = ['Cookie', 'Cookie2']
   POST_HEADERS = ['Content-Length', 'Content-MD5', 'Content-Type']
 
+  # Symbols accepted as header names in the per-request headers hash, and the
+  # header each one names.
+  SYMBOL_HEADERS = { :etag => 'ETag', :if_modified_since => 'If-Modified-Since' }.freeze
+
   # :section: Headers
 
   # Disables If-Modified-Since conditional requests (enabled by default)
@@ -21,7 +25,9 @@ class Mechanize::HTTP::Agent
   # Is gzip compression of requests enabled?
   attr_accessor :gzip_enabled
 
-  # A hash of request headers to be used for every request
+  # A hash of request headers to be used for every request.  Headers named in
+  # CREDENTIAL_HEADERS or COOKIE_HEADERS are withheld from a request that
+  # follows a redirect across an origin; see #crosses_origin?.
   attr_accessor :request_headers
 
   # The User-Agent header to send
@@ -240,9 +246,20 @@ class Mechanize::HTTP::Agent
   #
   # +redirects+ tracks the number of redirects experienced when retrieving the
   # page.  If it is over the redirection_limit an error will be raised.
+  #
+  # +apply_request_headers+ merges #request_headers into +headers+.  It is true
+  # for a request the caller initiated and false for one continuing an
+  # operation already under way, such as following a redirect, where +headers+
+  # already carries the merged set minus anything withheld along the way.
 
   def fetch uri, method = :get, headers = {}, params = [],
-            referer = current_page, redirects = 0
+            referer = current_page, redirects = 0, apply_request_headers = true
+
+    # Fold the agent defaults into the caller's headers once, at the start of
+    # the operation, so that from here on a single hash carries every header
+    # and #response_redirect can drop a credential from it for good.  Requests
+    # continuing an operation pass false and supply the hash they were given.
+    headers = merge_request_headers headers if apply_request_headers
 
     referer_uri = referer ? referer.uri : nil
     uri         = resolve uri, referer
@@ -313,7 +330,7 @@ class Mechanize::HTTP::Agent
 
     response_cookies response, uri, page
 
-    meta = response_follow_meta_refresh response, uri, page, redirects
+    meta = response_follow_meta_refresh response, uri, page, redirects, headers
     return meta if meta
 
     if robots && page.is_a?(Mechanize::Page)
@@ -585,23 +602,58 @@ class Mechanize::HTTP::Agent
     end
   end
 
-  def request_add_headers request, headers = {}
-    @request_headers.each do |k,v|
-      request[k] = v
+  # The agent defaults, with +headers+ applied on top.  A header in +headers+
+  # replaces an agent default naming the same header, whatever the spelling,
+  # because header names are case-insensitive and the agent's keys may be
+  # symbols.
+  def merge_request_headers headers
+    merged = {}
+
+    @request_headers.each { |field, value| merged[field.to_s] = value }
+
+    headers.each do |field, value|
+      name = canonical_header_name field
+      merged.delete_if { |existing, _| canonical_header_name(existing) == name }
+      merged[field] = value
     end
 
+    merged
+  end
+
+  def canonical_header_name field
+    (SYMBOL_HEADERS[field] || field).to_s.downcase
+  end
+
+  def request_add_headers request, headers = {}
     headers.each do |field, value|
-      case field
-      when :etag              then request["ETag"] = value
-      when :if_modified_since then request["If-Modified-Since"] = value
-      when Symbol then
-        raise ArgumentError, "unknown header symbol #{field}"
+      if Symbol === field then
+        name = SYMBOL_HEADERS[field] or
+          raise ArgumentError, "unknown header symbol #{field}"
+        request[name] = value
       else
         request[field] = value
       end
     end
   end
 
+  # Does moving from +from_uri+ to +to_uri+ cross an origin?  An origin is the
+  # scheme, host and port together; see RFC 6454.
+  def crosses_origin? from_uri, to_uri
+    to_uri.scheme != from_uri.scheme ||
+      to_uri.host != from_uri.host ||
+      to_uri.port != from_uri.port
+  end
+
+  # Should the header named +name+ be withheld from a request issued after a
+  # redirect that crossed an origin?
+  def drop_after_redirect? name, crossed_origin
+    crossed_origin && match_header?(name, CREDENTIAL_HEADERS + COOKIE_HEADERS)
+  end
+
+  def match_header? name, candidates
+    candidates.any? { |candidate| name.to_s.casecmp?(candidate) }
+  end
+
   def request_auth request, uri
     base_uri = uri + '/'
     base_uri.user     &&= nil
@@ -874,7 +926,7 @@ class Mechanize::HTTP::Agent
       raise Mechanize::UnauthorizedError.new(page, challenges, message)
     end
 
-    fetch uri, request.method.downcase.to_sym, headers, params, referer
+    fetch uri, request.method.downcase.to_sym, headers, params, referer, 0, false
   end
 
   def response_content_encoding response, body_io
@@ -951,7 +1003,7 @@ class Mechanize::HTTP::Agent
     end
   end
 
-  def response_follow_meta_refresh response, uri, page, redirects
+  def response_follow_meta_refresh response, uri, page, redirects, headers = {}
     delay, new_url = get_meta_refresh(response, uri, page)
     return nil unless delay
     new_url = new_url ? secure_resolve!(new_url, page) : uri
@@ -961,8 +1013,16 @@ class Mechanize::HTTP::Agent
 
     sleep delay
     @history.push(page, page.uri)
-    fetch new_url, :get, {}, [],
-          Mechanize::Page.new, redirects + 1
+
+    headers = headers.dup
+
+    # The refresh is fetched with GET, so the original request's entity headers
+    # must not describe it.
+    POST_HEADERS.each { |key| headers.delete_if { |h, _| h.to_s.casecmp?(key) } }
+    headers.delete_if { |h, _| drop_after_redirect? h, crosses_origin?(uri, new_url) }
+
+    fetch new_url, :get, headers, [],
+          Mechanize::Page.new, redirects + 1, false
   end
 
   def response_log response
@@ -1065,18 +1125,12 @@ class Mechanize::HTTP::Agent
       headers.delete_if { |h| h.casecmp?(key) }
     end
 
-    # Make sure we clear credential headers if being redirected to another site
-    if new_uri.host == page.uri.host
-      if new_uri.port != page.uri.port
-        # https://datatracker.ietf.org/doc/html/rfc6265#section-8.5
-        # cookies are OK to be shared across ports on the same host
-        CREDENTIAL_HEADERS.each { |ch| headers.delete_if { |h| h.casecmp?(ch) } }
-      end
-    else
-      (COOKIE_HEADERS + CREDENTIAL_HEADERS).each { |ch| headers.delete_if { |h| h.casecmp?(ch) } }
-    end
+    # Sensitive headers must not follow a redirect across an origin.
+    crossed_origin = crosses_origin? page.uri, new_uri
+
+    headers.delete_if { |h, _| drop_after_redirect? h, crossed_origin }
 
-    fetch new_uri, redirect_method, headers, [], referer, redirects + 1
+    fetch new_uri, redirect_method, headers, [], referer, redirects + 1, false
   end
 
   # :section: Robots
@@ -1087,7 +1141,7 @@ class Mechanize::HTTP::Agent
     robots_mutex.synchronize do
       Thread.current[RobotsKey] = true
       begin
-        fetch(uri).body
+        fetch(uri, :get, {}, [], current_page, 0, false).body
       rescue Mechanize::ResponseCodeError => e
         case e.response_code
         when /\A4\d\d\z/

data/lib/mechanize/parser.rb

@@ -108,10 +108,10 @@ module Mechanize::Parser
     handled = false
 
     if @uri then
-      uri = @uri
-      uri += 'index.html' if uri.path.end_with? '/'
+      uri_path = remove_dot_segments @uri.path
+      uri_path += 'index.html' if uri_path.end_with? '/'
 
-      path     = uri.path.split(/\//)
+      path     = uri_path.split(/\//)
       filename = path.pop || 'index.html'
     else
       path     = []
@@ -163,6 +163,36 @@ module Mechanize::Parser
     @response
   end
 
+  ##
+  # Resolves "." and ".." segments in the absolute +path+ as RFC 3986 section
+  # 5.2.4 does, without reparsing it as a URI.
+
+  def remove_dot_segments path
+    segments = path.split '/', -1
+
+    resolved = segments.each_with_object [] do |segment, result|
+      case segment
+      when '.'  then next
+      when '..' then result.pop unless result == ['']
+      else           result << segment
+      end
+    end
+
+    resolved << '' if ['.', '..'].include? segments.last
+    resolved.join '/'
+  end
+
+  ##
+  # Raises Mechanize::Error unless +path+ is inside +directory+.
+
+  def ensure_within directory, path
+    directory = File.join File.expand_path(directory), ''
+
+    return if File.expand_path(path).start_with? directory
+
+    raise Mechanize::Error, "refusing to save #{path} outside #{directory}"
+  end
+
   ##
   # Finds a free filename based on +filename+, but is not race-free
 

data/lib/mechanize/test_case.rb

@@ -262,15 +262,8 @@ class Net::HTTP # :nodoc:
     response['Content-Type'] ||= 'text/html'
     response['Content-Length'] = res['Content-Length'] || res.body.length.to_s
 
-    io = StringIO.new(res.body)
-    response.instance_variable_set :@socket, io
-    def io.read clen, dest = nil, _ = nil
-      if dest then
-        dest << super(clen)
-      else
-        super clen
-      end
-    end
+    socket = Net::BufferedIO.new(StringIO.new(res.body))
+    response.instance_variable_set :@socket, socket
 
     body_exist = req.response_body_permitted? &&
       response_klass.body_permitted?

data/lib/mechanize/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 class Mechanize
-  VERSION = "2.14.0"
+  VERSION = "2.14.2"
 end

data/lib/mechanize.rb

@@ -1011,7 +1011,16 @@ Use of #auth and #basic_auth are deprecated due to a security vulnerability.
   end
 
   ##
-  # A hash of custom request headers that will be sent on every request
+  # A hash of custom request headers that will be sent on every request.
+  #
+  # Headers named in Mechanize::HTTP::Agent::CREDENTIAL_HEADERS or
+  # COOKIE_HEADERS are withheld from a request that follows a redirect to
+  # another origin, where an origin is the scheme, host and port together, and
+  # stay withheld for the rest of that operation.  A meta refresh to another
+  # origin is treated the same way.
+  #
+  # The robots.txt lookup carries none of these headers, on any origin.  It is
+  # a request mechanize makes on its own behalf.
 
   def request_headers
     @agent.request_headers
@@ -1019,7 +1028,8 @@ Use of #auth and #basic_auth are deprecated due to a security vulnerability.
 
   ##
   # Replaces the custom request headers that will be sent on every request
-  # with +request_headers+
+  # with +request_headers+.  See #request_headers for the credentials
+  # withheld after a redirect to another origin.
 
   def request_headers= request_headers
     @agent.request_headers = request_headers

data/test/htdocs/frame_test.html

@@ -18,13 +18,15 @@
   </IFRAME>
   </FRAMESET>
   <NOFRAMES>
-      <P>This frameset document contains:
-      <UL>
-         <LI><A href="/google.html">Some neat contents</A>
-         <LI><A href="/form_test.html" class="bar">Form Test</A>
-         <LI><A href="/file_upload.html">Some other neat contents</A>
-      </UL>
+    Your user agent does not support frames.
   </NOFRAMES>
+  <P>This frameset document contains:
+    <UL>
+      <LI><A href="/google.html">Some neat contents</A>
+      <LI><A href="/form_test.html" class="bar">Form Test</A>
+      <LI><A href="/file_upload.html">Some other neat contents</A>
+    </UL>
+  </P>
 </FRAMESET>
 </HTML>
 

data/test/htdocs/relative/tc_relative_links.html

@@ -2,6 +2,7 @@
   <body>
     <a href="../tc_relative_links.html">dot dot slash</a>
     <a href="../../../../../tc_relative_links.html">too many dots</a>
+    <a href="?a=b">just the query string</A>
 <FRAMESET cols="20%, 80%">
   <FRAMESET rows="100, 200, 200">
   <FRAME name="frame1" src="../tc_relative_links.html">
@@ -13,7 +14,6 @@
   [Your user agent does not support frames or is currently configured
   not to display frames. However, you may visit
   <A href="foo.html">the related document.</A>]
-  <a href="?a=b">just the query string</A>
   </IFRAME>
   </FRAMESET>
 </FRAMESET>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mechanize
 version: !ruby/object:Gem::Version
-  version: 2.14.0
+  version: 2.14.2
 platform: ruby
 authors:
 - Eric Hodel
@@ -11,7 +11,7 @@ authors:
 - Lee Jarvis
 bindir: bin
 cert_chain: []
-date: 2025-01-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -232,31 +232,18 @@ email:
 executables: []
 extensions: []
 extra_rdoc_files:
+- CHANGELOG.md
 - EXAMPLES.rdoc
 - GUIDE.rdoc
-- CHANGELOG.md
 - README.md
+- SECURITY.md
 files:
-- ".autotest"
-- ".github/dependabot.yml"
-- ".github/workflows/ci.yml"
-- ".github/workflows/upstream.yml"
-- ".gitignore"
-- ".yardopts"
 - CHANGELOG.md
 - EXAMPLES.rdoc
 - GUIDE.rdoc
-- Gemfile
 - LICENSE.txt
 - README.md
-- Rakefile
-- examples/flickr_upload.rb
-- examples/latest_user_agents.rb
-- examples/mech-dump.rb
-- examples/proxy_req.rb
-- examples/rubygems.rb
-- examples/spider.rb
-- examples/wikipedia_links_to_philosophy.rb
+- SECURITY.md
 - lib/mechanize.rb
 - lib/mechanize/chunked_termination_error.rb
 - lib/mechanize/content_type_error.rb
@@ -347,12 +334,6 @@ files:
 - lib/mechanize/util.rb
 - lib/mechanize/version.rb
 - lib/mechanize/xml_file.rb
-- mechanize.gemspec
-- test/data/htpasswd
-- test/data/server.crt
-- test/data/server.csr
-- test/data/server.key
-- test/data/server.pem
 - test/htdocs/alt_text.html
 - test/htdocs/bad_form_test.html
 - test/htdocs/button.jpg
@@ -400,54 +381,6 @@ files:
 - test/htdocs/tc_textarea.html
 - test/htdocs/test_click.html
 - test/htdocs/unusual______.html
-- test/test_mechanize.rb
-- test/test_mechanize_cookie.rb
-- test/test_mechanize_cookie_jar.rb
-- test/test_mechanize_directory_saver.rb
-- test/test_mechanize_download.rb
-- test/test_mechanize_element_not_found_error.rb
-- test/test_mechanize_file.rb
-- test/test_mechanize_file_connection.rb
-- test/test_mechanize_file_request.rb
-- test/test_mechanize_file_response.rb
-- test/test_mechanize_file_saver.rb
-- test/test_mechanize_form.rb
-- test/test_mechanize_form_check_box.rb
-- test/test_mechanize_form_encoding.rb
-- test/test_mechanize_form_field.rb
-- test/test_mechanize_form_file_upload.rb
-- test/test_mechanize_form_image_button.rb
-- test/test_mechanize_form_keygen.rb
-- test/test_mechanize_form_multi_select_list.rb
-- test/test_mechanize_form_option.rb
-- test/test_mechanize_form_radio_button.rb
-- test/test_mechanize_form_select_list.rb
-- test/test_mechanize_form_textarea.rb
-- test/test_mechanize_headers.rb
-- test/test_mechanize_history.rb
-- test/test_mechanize_http_agent.rb
-- test/test_mechanize_http_auth_challenge.rb
-- test/test_mechanize_http_auth_realm.rb
-- test/test_mechanize_http_auth_store.rb
-- test/test_mechanize_http_content_disposition_parser.rb
-- test/test_mechanize_http_www_authenticate_parser.rb
-- test/test_mechanize_image.rb
-- test/test_mechanize_link.rb
-- test/test_mechanize_page.rb
-- test/test_mechanize_page_encoding.rb
-- test/test_mechanize_page_frame.rb
-- test/test_mechanize_page_image.rb
-- test/test_mechanize_page_link.rb
-- test/test_mechanize_page_meta_refresh.rb
-- test/test_mechanize_parser.rb
-- test/test_mechanize_pluggable_parser.rb
-- test/test_mechanize_redirect_limit_reached_error.rb
-- test/test_mechanize_redirect_not_get_or_head_error.rb
-- test/test_mechanize_response_read_error.rb
-- test/test_mechanize_subclass.rb
-- test/test_mechanize_util.rb
-- test/test_mechanize_xml_file.rb
-- test/test_multi_select.rb
 homepage: https://github.com/sparklemotion/mechanize
 licenses:
 - MIT
@@ -474,107 +407,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.20
 specification_version: 4
 summary: The Mechanize library is used for automating interaction with websites
-test_files:
-- test/data/htpasswd
-- test/data/server.crt
-- test/data/server.csr
-- test/data/server.key
-- test/data/server.pem
-- test/htdocs/alt_text.html
-- test/htdocs/bad_form_test.html
-- test/htdocs/button.jpg
-- test/htdocs/canonical_uri.html
-- test/htdocs/dir with spaces/foo.html
-- test/htdocs/empty_form.html
-- test/htdocs/file_upload.html
-- test/htdocs/find_link.html
-- test/htdocs/form_multi_select.html
-- test/htdocs/form_multival.html
-- test/htdocs/form_no_action.html
-- test/htdocs/form_no_input_name.html
-- test/htdocs/form_order_test.html
-- test/htdocs/form_select.html
-- test/htdocs/form_set_fields.html
-- test/htdocs/form_test.html
-- test/htdocs/frame_referer_test.html
-- test/htdocs/frame_test.html
-- test/htdocs/google.html
-- test/htdocs/index.html
-- test/htdocs/link with space.html
-- test/htdocs/meta_cookie.html
-- test/htdocs/no_title_test.html
-- test/htdocs/noindex.html
-- test/htdocs/rails_3_encoding_hack_form_test.html
-- test/htdocs/relative/tc_relative_links.html
-- test/htdocs/robots.html
-- test/htdocs/tc_bad_charset.html
-- test/htdocs/tc_bad_links.html
-- test/htdocs/tc_base_link.html
-- test/htdocs/tc_blank_form.html
-- test/htdocs/tc_charset.html
-- test/htdocs/tc_checkboxes.html
-- test/htdocs/tc_encoded_links.html
-- test/htdocs/tc_field_precedence.html
-- test/htdocs/tc_follow_meta.html
-- test/htdocs/tc_follow_meta_loop_1.html
-- test/htdocs/tc_follow_meta_loop_2.html
-- test/htdocs/tc_form_action.html
-- test/htdocs/tc_links.html
-- test/htdocs/tc_meta_in_body.html
-- test/htdocs/tc_pretty_print.html
-- test/htdocs/tc_referer.html
-- test/htdocs/tc_relative_links.html
-- test/htdocs/tc_textarea.html
-- test/htdocs/test_click.html
-- test/htdocs/unusual______.html
-- test/test_mechanize.rb
-- test/test_mechanize_cookie.rb
-- test/test_mechanize_cookie_jar.rb
-- test/test_mechanize_directory_saver.rb
-- test/test_mechanize_download.rb
-- test/test_mechanize_element_not_found_error.rb
-- test/test_mechanize_file.rb
-- test/test_mechanize_file_connection.rb
-- test/test_mechanize_file_request.rb
-- test/test_mechanize_file_response.rb
-- test/test_mechanize_file_saver.rb
-- test/test_mechanize_form.rb
-- test/test_mechanize_form_check_box.rb
-- test/test_mechanize_form_encoding.rb
-- test/test_mechanize_form_field.rb
-- test/test_mechanize_form_file_upload.rb
-- test/test_mechanize_form_image_button.rb
-- test/test_mechanize_form_keygen.rb
-- test/test_mechanize_form_multi_select_list.rb
-- test/test_mechanize_form_option.rb
-- test/test_mechanize_form_radio_button.rb
-- test/test_mechanize_form_select_list.rb
-- test/test_mechanize_form_textarea.rb
-- test/test_mechanize_headers.rb
-- test/test_mechanize_history.rb
-- test/test_mechanize_http_agent.rb
-- test/test_mechanize_http_auth_challenge.rb
-- test/test_mechanize_http_auth_realm.rb
-- test/test_mechanize_http_auth_store.rb
-- test/test_mechanize_http_content_disposition_parser.rb
-- test/test_mechanize_http_www_authenticate_parser.rb
-- test/test_mechanize_image.rb
-- test/test_mechanize_link.rb
-- test/test_mechanize_page.rb
-- test/test_mechanize_page_encoding.rb
-- test/test_mechanize_page_frame.rb
-- test/test_mechanize_page_image.rb
-- test/test_mechanize_page_link.rb
-- test/test_mechanize_page_meta_refresh.rb
-- test/test_mechanize_parser.rb
-- test/test_mechanize_pluggable_parser.rb
-- test/test_mechanize_redirect_limit_reached_error.rb
-- test/test_mechanize_redirect_not_get_or_head_error.rb
-- test/test_mechanize_response_read_error.rb
-- test/test_mechanize_subclass.rb
-- test/test_mechanize_util.rb
-- test/test_mechanize_xml_file.rb
-- test/test_multi_select.rb
+test_files: []

data/.autotest

@@ -1,6 +0,0 @@
-require 'autotest/restart'
-
-Autotest.add_hook :initialize do |at|
-  at.testlib = 'minitest/autorun'
-end
-