mechanize 2.7.6 → 2.8.2

data/test/test_mechanize_file_response.rb

@@ -1,6 +1,10 @@
 require 'mechanize/test_case'
 
 class TestMechanizeFileResponse < Mechanize::TestCase
+  def test_file_path
+    res = Mechanize::FileResponse.new("/path/to/foo.html")
+    assert_equal("/path/to/foo.html", res.file_path)
+  end
 
   def test_content_type
     Tempfile.open %w[pi .nothtml] do |tempfile|
@@ -19,5 +23,25 @@ class TestMechanizeFileResponse < Mechanize::TestCase
     end
   end
 
-end
+  def test_read_body
+    Tempfile.open %w[pi .html] do |tempfile|
+      tempfile.write("asdfasdfasdf")
+      tempfile.close
 
+      res = Mechanize::FileResponse.new(tempfile.path)
+      res.read_body do |input|
+        assert_equal("asdfasdfasdf", input)
+      end
+    end
+  end
+
+  def test_read_body_does_not_allow_command_injection
+    skip if windows?
+    in_tmpdir do
+      FileUtils.touch('| ruby -rfileutils -e \'FileUtils.touch("vul.txt")\'')
+      res = Mechanize::FileResponse.new('| ruby -rfileutils -e \'FileUtils.touch("vul.txt")\'')
+      res.read_body { |_| }
+      refute_operator(File, :exist?, "vul.txt")
+    end
+  end
+end

data/test/test_mechanize_form.rb

@@ -65,6 +65,18 @@ class TestMechanizeForm < Mechanize::TestCase
     assert query.all? { |x| x[1] == '' }
   end
 
+  def test_build_query_blank_input_name
+    html = Nokogiri::HTML <<-HTML
+<form>
+  <input type="text" name="" value="foo" />
+</form>
+    HTML
+
+    form = Mechanize::Form.new html.at('form'), @mech, @page
+
+    assert_equal [], form.build_query
+  end
+
   def test_build_query_radio_button_duplicate
     html = Nokogiri::HTML <<-HTML
 <form>

data/test/test_mechanize_form_keygen.rb

@@ -22,6 +22,7 @@ class TestMechanizeFormKeygen < Mechanize::TestCase
   end
 
   def test_spki_signature
+    skip("JRuby PKI doesn't handle this for reasons I've been unable to understand") if RUBY_ENGINE=~/jruby/
     spki = OpenSSL::Netscape::SPKI.new @keygen.value
     assert_equal @keygen.challenge, spki.challenge
     assert_equal @keygen.key.public_key.to_pem, spki.public_key.to_pem

data/test/test_mechanize_http_agent.rb

@@ -16,11 +16,7 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     @res.instance_variable_set :@code, 200
     @res.instance_variable_set :@header, {}
 
-    @headers = if RUBY_VERSION >= '2.0.0' then
-                 %w[accept accept-encoding user-agent]
-               else
-                 %w[accept user-agent]
-               end
+    @headers = %w[accept accept-encoding user-agent]
   end
 
   def auth_realm uri, scheme, type
@@ -205,7 +201,7 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
 
     page = @agent.fetch uri
 
-    assert_equal File.read(foo), page.body
+    assert_equal File.read(foo), page.body.gsub(/\r\n/, "\n")
     assert_kind_of Mechanize::Page, page
   end
 
@@ -935,7 +931,7 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     body_io = StringIO.new \
       "\037\213\b\0002\002\225M\000\003+H,*\001"
 
-    return if jruby_zlib?
+    skip if jruby_zlib?
 
     e = assert_raises Mechanize::Error do
       @agent.response_content_encoding @res, body_io
@@ -1508,7 +1504,8 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     headers = {
       'Range' => 'bytes=0-9999',
       'Content-Type' => 'application/x-www-form-urlencoded',
-      'Content-Length' => '9999',
+      'CONTENT-LENGTH' => '9999',
+      'content-md5' => '14758f1afd44c09b7992073ccf00b43d',
     }
 
     page = fake_page
@@ -1520,6 +1517,7 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     assert_match 'range|bytes=0-9999', page.body
     refute_match 'content-type|application/x-www-form-urlencoded', page.body
     refute_match 'content-length|9999', page.body
+    refute_match 'content-md5|14758f1afd44c09b7992073ccf00b43d', page.body
   end
 
   def test_response_redirect_malformed
@@ -1555,6 +1553,48 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     end
   end
 
+  def test_response_redirect_to_cross_site_with_credential
+    @agent.redirect_ok = true
+
+    headers = {
+      'Range' => 'bytes=0-9999',
+      'AUTHORIZATION' => 'Basic xxx',
+      'cookie' => 'name=value',
+    }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => 'http://trap/http_headers' }, :get,
+                                    page, 0, headers)
+
+    refute_includes(headers.keys, "AUTHORIZATION")
+    refute_includes(headers.keys, "cookie")
+
+    assert_match 'range|bytes=0-9999', page.body
+    refute_match("authorization|Basic xxx", page.body)
+    refute_match("cookie|name=value", page.body)
+  end
+
+  def test_response_redirect_to_same_site_with_credential
+    @agent.redirect_ok = true
+
+    headers = {
+      'Range' => 'bytes=0-9999',
+      'AUTHORIZATION' => 'Basic xxx',
+      'cookie' => 'name=value',
+    }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => '/http_headers' }, :get,
+                                    page, 0, headers)
+
+    assert_includes(headers.keys, "AUTHORIZATION")
+    assert_includes(headers.keys, "cookie")
+
+    assert_match 'range|bytes=0-9999', page.body
+    assert_match("authorization|Basic xxx", page.body)
+    assert_match("cookie|name=value", page.body)
+  end
+
   def test_response_redirect_not_ok
     @agent.redirect_ok = false
 
@@ -1590,6 +1630,11 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
   end
 
   def test_retry_change_request_equals
+    unless Gem::Requirement.new("< 4.0.0").satisfied_by?(Gem::Version.new(Net::HTTP::Persistent::VERSION))
+      # see https://github.com/drbrain/net-http-persistent/pull/100
+      skip("net-http-persistent 4.0.0 and later does not support retry_change_requests")
+    end
+
     refute @agent.http.retry_change_requests
 
     @agent.retry_change_requests = true

data/test/test_mechanize_http_content_disposition_parser.rb

@@ -30,6 +30,33 @@ class TestMechanizeHttpContentDispositionParser < Mechanize::TestCase
     assert_equal expected,     content_disposition.parameters
   end
 
+  def test_parse_date_iso8601_fallback
+    now = Time.at Time.now.to_i
+
+    content_disposition = @parser.parse \
+      'attachment;' \
+      'filename=value;' \
+      "creation-date=\"#{now.iso8601}\";" \
+      "modification-date=\"#{(now + 1).iso8601}\""
+
+    assert_equal 'attachment', content_disposition.type
+    assert_equal 'value',      content_disposition.filename
+    assert_equal now,          content_disposition.creation_date
+    assert_equal((now + 1),    content_disposition.modification_date)
+  end
+
+  def test_parse_date_invalid
+    now = Time.at Time.now.to_i
+
+    content_disposition = @parser.parse \
+      'attachment;' \
+      'filename=value;' \
+      "creation-date=\"#{now.to_s}\";" \
+      "modification-date=\"#{(now + 1).to_s}\""
+
+    assert_nil content_disposition
+  end
+
   def test_parse_header
     content_disposition = @parser.parse \
       'content-disposition: attachment;filename=value', true

data/test/test_mechanize_link.rb

@@ -135,6 +135,30 @@ class TestMechanizeLink < Mechanize::TestCase
     assert_equal 'http://foo.bar/%20baz', link.uri.to_s
   end
 
+  def test_uri_weird_with_fragment
+    doc = Nokogiri::HTML::Document.new
+
+    node = Nokogiri::XML::Node.new('foo', doc)
+    node['href'] = 'http://foo.bar/ baz#уважение'
+
+    link = Mechanize::Page::Link.new(node, nil, nil)
+
+    assert_equal '%D1%83%D0%B2%D0%B0%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5', link.uri.fragment
+  end
+
+  def test_bad_uri_raise_compatible_exception
+    doc = Nokogiri::HTML::Document.new
+
+    node = Nokogiri::XML::Node.new('foo', doc)
+    node['href'] = 'http://http:foo.bar/ baz'
+
+    link = Mechanize::Page::Link.new(node, nil, nil)
+
+    assert_raises URI::InvalidURIError do
+      link.uri
+    end
+  end
+
   def test_resolving_full_uri
     page = @mech.get("http://localhost/frame_test.html")
     link = page.link_with(:text => "Form Test")

data/test/test_mechanize_page_encoding.rb

@@ -183,5 +183,32 @@ class TestMechanizePageEncoding < Mechanize::TestCase
     assert_equal Encoding::UTF_8, result.text.encoding
   end
 
-end
+  def test_parser_error_message_containing_encoding_errors
+    skip if RUBY_ENGINE == 'jruby' # this is a libxml2-specific condition
+
+    # https://github.com/sparklemotion/mechanize/issues/553
+    body = <<~EOF
+      <html>
+      <body>
+      <!--
+      ## メモ
+      処理の一般化, 二重ループ, 多重ループ
+      wzxhzdk:25
+      -->
+    EOF
+    page = util_page body
+
+    # this should not raise an "invalid byte sequence in UTF-8" error while processing parsing errors
+    page.search("body")
 
+    # let's assert on the setup: a libxml2-returned parsing error itself contains an invalid character
+    # note that this problem only appears in libxml <= 2.9.10
+    error = page.parser.errors.find { |e| e.message.include?("Comment not terminated") }
+    if error
+      exception = assert_raises(ArgumentError) do
+        error.message =~ /any regex just to trigger encoding error/
+      end
+      assert_includes(exception.message, "invalid byte sequence in UTF-8")
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mechanize
 version: !ruby/object:Gem::Version
-  version: 2.7.6
+  version: 2.8.2
 platform: ruby
 authors:
 - Eric Hodel
@@ -12,200 +12,240 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-02 00:00:00.000000000 Z
+date: 2021-08-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: net-http-digest_auth
+  name: addressable
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.1
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '2.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.1
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '2.8'
 - !ruby/object:Gem::Dependency
-  name: mime-types
+  name: domain_name
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.17.2
+        version: 0.5.20190701
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.17.2
+        version: 0.5.20190701
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
 - !ruby/object:Gem::Dependency
-  name: net-http-persistent
+  name: http-cookie
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.2
+        version: 1.0.3
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.2
+        version: 1.0.3
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: http-cookie
+  name: mime-types
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
-  name: nokogiri
+  name: net-http-digest_auth
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.4.1
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.4.1
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
-  name: ntlm-http
+  name: net-http-persistent
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
-    - - "~>"
+        version: 2.5.2
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: 5.0.dev
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
-    - - "~>"
+        version: 2.5.2
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: 5.0.dev
 - !ruby/object:Gem::Dependency
-  name: webrobots
+  name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '0.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.0.9
+        version: 1.11.2
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.11'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '0.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.0.9
+        version: 1.11.2
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.11'
 - !ruby/object:Gem::Dependency
-  name: domain_name
+  name: rubyntlm
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: 0.6.3
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: '0.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: 0.6.3
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: '0.6'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+- !ruby/object:Gem::Dependency
+  name: webrobots
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.2
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.14'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.14'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '6.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '6.3'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '1.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '1.12'
 description: |-
   The Mechanize library is used for automating interaction with websites.
   Mechanize automatically stores and sends cookies, follows redirects,
@@ -214,7 +254,7 @@ description: |-
   a history.
 email:
 - drbrain@segment7.net
-- aaronp@rubyforge.org
+- aaron.patterson@gmail.com
 - mike.dalessio@gmail.com
 - knu@idaemons.org
 - ljjarvis@gmail.com
@@ -222,20 +262,21 @@ executables: []
 extensions: []
 extra_rdoc_files:
 - EXAMPLES.rdoc
-- CHANGELOG.rdoc
 - GUIDE.rdoc
-- LICENSE.rdoc
-- README.rdoc
+- CHANGELOG.md
+- README.md
 files:
 - ".autotest"
+- ".github/dependabot.yml"
+- ".github/workflows/ci-test.yml"
 - ".gitignore"
-- ".travis.yml"
-- CHANGELOG.rdoc
+- ".yardopts"
+- CHANGELOG.md
 - EXAMPLES.rdoc
 - GUIDE.rdoc
 - Gemfile
-- LICENSE.rdoc
-- README.rdoc
+- LICENSE.txt
+- README.md
 - Rakefile
 - examples/flickr_upload.rb
 - examples/mech-dump.rb
@@ -434,29 +475,34 @@ files:
 - test/test_mechanize_util.rb
 - test/test_mechanize_xml_file.rb
 - test/test_multi_select.rb
-homepage: http://docs.seattlerb.org/mechanize/
+homepage: https://github.com/sparklemotion/mechanize
 licenses:
 - MIT
-metadata: {}
+metadata:
+  yard.run: yard
+  bug_tracker_uri: https://github.com/sparklemotion/mechanize/issues
+  changelog_uri: https://github.com/sparklemotion/mechanize/blob/main/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/mechanize
+  homepage_uri: https://github.com/sparklemotion/mechanize
+  source_code_uri: https://github.com/sparklemotion/mechanize
 post_install_message: 
 rdoc_options:
 - "--main"
-- README.rdoc
+- README.md
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.9.2
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14.1
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: The Mechanize library is used for automating interaction with websites