net-http 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b248ee1b72f192c00aeaa7667d98f0e1b7c8589ca0715e074c7134ecaf79b20
-  data.tar.gz: e275a50ec3e743c3c32a89321a31589833c943a243a24196d4a9494e299badca
+  metadata.gz: 7ef5db5bbe7d235bad14b04a257948207798e176d4f1d03029801615aa26823c
+  data.tar.gz: 1677b07e53a693f5d784a39e4d76a447868b5d435f3269561ccc772dd0345d10
 SHA512:
-  metadata.gz: d845907907e467c35bedf95eb9854fa15344f717a9a499495cdd403efdb71be40f33eaaeca01c3f949b491bd57abd03beaf1d8a75a4dd241509927596dd9d59b
-  data.tar.gz: b28a46915ac4e105b83d7de85a13707b9ed938771d41dccf7bb16019a3718b141f15974d4d413f7664fdf64c0b033566ba6666755843efe43bee1a6dfa9a581a
+  metadata.gz: fd9e8e4ec27ff431f0a36acde5d6caecdebf34c5a625a6023b02bade546e7133bb6b12b3a0594d6cb3c5824577e093ef8677a209b9b35a2ee727b5b1906bf77e
+  data.tar.gz: b04a6747ae31dedd05716b221f9c9a6e668587cd025094f91f4b7c487feb85d769d4b8ff0d22ee55a79b96755324e447094579bf2306fc3acb363bb547e38b3d

data/README.md

@@ -81,6 +81,8 @@ res = Net::HTTP.post_form(uri, 'q' => ['ruby', 'perl'], 'max' => '50')
 puts res.body
 ```
 
+See the [documentation](https://docs.ruby-lang.org/en/master/Net/HTTP.html) for more details.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/net/http/generic_request.rb

@@ -336,6 +336,9 @@ class Net::HTTPGenericRequest
     boundary = opt[:boundary]
     require 'securerandom' unless defined?(SecureRandom)
     boundary ||= SecureRandom.urlsafe_base64(40)
+    if /[\r\n]/.match?(boundary.to_s)
+      raise ArgumentError, "multipart boundary cannot include CR/LF"
+    end
     chunked_p = chunked?
 
     buf = +''
@@ -349,7 +352,10 @@ class Net::HTTPGenericRequest
       buf << "--#{boundary}\r\n"
       if filename
         filename = quote_string(filename, charset)
-        type = h[:content_type] || 'application/octet-stream'
+        type = (h[:content_type] || 'application/octet-stream').to_s
+        if /[\r\n]/.match?(type)
+          raise ArgumentError, "field content type cannot include CR/LF"
+        end
         buf << "Content-Disposition: form-data; " \
           "name=\"#{key}\"; filename=\"#{filename}\"\r\n" \
           "Content-Type: #{type}\r\n\r\n"
@@ -384,6 +390,9 @@ class Net::HTTPGenericRequest
 
   def quote_string(str, charset)
     str = str.encode(charset, fallback:->(c){'&#%d;'%c.encode("UTF-8").ord}) if charset
+    if /[\r\n]/.match?(str)
+      raise ArgumentError, "multipart field name or filename cannot include CR/LF"
+    end
     str.gsub(/[\\"]/, '\\\\\&')
   end
 

data/lib/net/http/header.rb

@@ -193,11 +193,9 @@ module Net::HTTPHeader
         warn "net/http: nil HTTP header: #{key}", uplevel: 3 if $VERBOSE
       else
         value = value.strip # raise error for invalid byte sequences
-        if key.to_s.bytesize > MAX_KEY_LENGTH
-          raise ArgumentError, "too long (#{key.bytesize} bytes) header: #{key[0, 30].inspect}..."
-        end
+        validate_field_name(key)
         if value.to_s.bytesize > MAX_FIELD_LENGTH
-          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize}"
+          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
         end
         if value.count("\r\n") > 0
           raise ArgumentError, "header #{key} has field value #{value.inspect}, this cannot include CR/LF"
@@ -263,21 +261,34 @@ module Net::HTTPHeader
   def add_field(key, val)
     stringified_downcased_key = key.downcase.to_s
     if @header.key?(stringified_downcased_key)
-      append_field_value(@header[stringified_downcased_key], val)
+      append_field_value(@header[stringified_downcased_key], val, key)
     else
       set_field(key, val)
     end
   end
 
   # :stopdoc:
+  private def validate_field_name(key)
+    if key.to_s.bytesize > MAX_KEY_LENGTH
+      raise ArgumentError, "too long (#{key.to_s.bytesize} bytes) header: #{key.to_s[0, 30].inspect}..."
+    end
+    if /[\x00-\x1f\x7f:]/n.match?(key.to_s.b)
+      raise ArgumentError, "header field name cannot include control characters or colon: #{key.to_s[0, 30].inspect}"
+    end
+  end
+
   private def set_field(key, val)
+    validate_field_name(key)
     case val
     when Enumerable
       ary = []
-      append_field_value(ary, val)
+      append_field_value(ary, val, key)
       @header[key.downcase.to_s] = ary
     else
       val = val.to_s # for compatibility use to_s instead of to_str
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if val.b.count("\r\n") > 0
         raise ArgumentError, 'header field value cannot include CR/LF'
       end
@@ -285,12 +296,15 @@ module Net::HTTPHeader
     end
   end
 
-  private def append_field_value(ary, val)
+  private def append_field_value(ary, val, key)
     case val
     when Enumerable
-      val.each{|x| append_field_value(ary, x)}
+      val.each{|x| append_field_value(ary, x, key)}
     else
       val = val.to_s
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if /[\r\n]/n.match?(val.b)
         raise ArgumentError, 'header field value cannot include CR/LF'
       end
@@ -617,11 +631,35 @@ module Net::HTTPHeader
   #   res = Net::HTTP.get_response(hostname, '/todos/1')
   #   res.content_length # => nil
   #
+  # The value must consist of digits only.
+  # Multiple <tt>'Content-Length'</tt> values are accepted
+  # only when they are all identical;
+  # otherwise Net::HTTPHeaderSyntaxError is raised.
+  # See {RFC 9110 Section 8.6}[https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6].
   def content_length
-    return nil unless key?('Content-Length')
-    len = self['Content-Length'].slice(/\d+/) or
-        raise Net::HTTPHeaderSyntaxError, 'wrong Content-Length format'
-    len.to_i
+    values = @header['content-length']
+    return nil if values.nil?
+
+    lengths = []
+    values.each do |value|
+      value = value.strip
+      if value.empty?
+        raise Net::HTTPHeaderSyntaxError,
+              "empty Content-Length value"
+      end
+      lengths.concat(value.split(/\s*,\s*/, -1))
+    end
+    if lengths.uniq.size != 1
+      raise Net::HTTPHeaderSyntaxError,
+            "Content-Length has multiple different values: " +
+            values.join(", ")
+    end
+    length = lengths.first
+    unless /\A\d+\z/.match?(length)
+      raise Net::HTTPHeaderSyntaxError,
+            "wrong Content-Length format: #{length}"
+    end
+    length.to_i
   end
 
   # Sets the value of field <tt>'Content-Length'</tt> to the given numeric;
@@ -647,7 +685,7 @@ module Net::HTTPHeader
   end
 
   # Returns +true+ if field <tt>'Transfer-Encoding'</tt>
-  # exists and has value <tt>'chunked'</tt>,
+  # exists and has <tt>'chunked'</tt> as its final transfer coding,
   # +false+ otherwise;
   # see {Transfer-Encoding response header}[https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#transfer-encoding-response-header]:
   #
@@ -655,10 +693,13 @@ module Net::HTTPHeader
   #   res['Transfer-Encoding'] # => "chunked"
   #   res.chunked?             # => true
   #
+  # <tt>'gzip, chunked'</tt> is chunked but <tt>'chunked, gzip'</tt> is not,
+  # because only the final transfer coding frames the message.
+  # See {RFC 9112 Section 6.3}[https://www.rfc-editor.org/rfc/rfc9112.html#section-6.3].
   def chunked?
     return false unless @header['transfer-encoding']
     field = self['Transfer-Encoding']
-    (/(?:\A|[^\-\w])chunked(?![\-\w])/i =~ field) ? true : false
+    (/(?:\A|[^\-\w])chunked(?![\-\w])\s*(?:,\s*)*\z/i =~ field) ? true : false
   end
 
   # Returns a Range object representing the value of field
@@ -774,7 +815,7 @@ module Net::HTTPHeader
   #
   # Net::HTTPHeader#content_type= is an alias for Net::HTTPHeader#set_content_type.
   def set_content_type(type, params = {})
-    @header['content-type'] = [type + params.map{|k,v|"; #{k}=#{v}"}.join('')]
+    set_field('Content-Type', type + params.map{|k,v|"; #{k}=#{v}"}.join(''))
   end
 
   alias content_type= set_content_type

data/lib/net/http/request.rb

@@ -61,6 +61,7 @@
 # - Net::HTTP::Options
 # - Net::HTTP::Trace
 # - Net::HTTP::Patch
+# - Net::HTTP::Query
 #
 # Subclasses for WebDAV requests:
 #

data/lib/net/http/requests.rb

@@ -19,9 +19,9 @@
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
@@ -52,9 +52,9 @@ end
 #
 # - Request body: optional.
 # - Response body: no.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
@@ -87,9 +87,9 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: no.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: no.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
@@ -123,9 +123,9 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -157,9 +157,9 @@ end
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -189,9 +189,9 @@ end
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -221,9 +221,9 @@ end
 #
 # - Request body: no.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -256,9 +256,9 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: no.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: no.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -271,6 +271,41 @@ class Net::HTTP::Patch < Net::HTTPRequest
   RESPONSE_HAS_BODY = true
 end
 
+# \Class for representing
+# {HTTP method QUERY}[https://www.rfc-editor.org/rfc/rfc10008.html]:
+#
+#   require 'net/http'
+#   uri = URI('http://example.com')
+#   hostname = uri.hostname # => "example.com"
+#   uri.path = '/posts'
+#   req = Net::HTTP::Query.new(uri) # => #<Net::HTTP::Query QUERY>
+#   req.body = '{"title": "foo","body": "bar","userId": 1}'
+#   req.content_type = 'application/json'
+#   res = Net::HTTP.start(hostname) do |http|
+#     http.request(req)
+#   end
+#
+# See {Request Headers}[rdoc-ref:Net::HTTPRequest@Request+Headers].
+#
+# Properties:
+#
+# - Request body: yes.
+# - Response body: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
+#
+# Related:
+#
+# - Net::HTTP#query: sends +QUERY+ request, returns response object.
+#
+class Net::HTTP::Query < Net::HTTPRequest
+  # :stopdoc:
+  METHOD = 'QUERY'
+  REQUEST_HAS_BODY = true
+  RESPONSE_HAS_BODY = true
+end
+
 #
 # WebDAV methods --- RFC2518
 #

data/lib/net/http/response.rb

@@ -133,6 +133,13 @@
 # there is a protocol error.
 #
 class Net::HTTPResponse
+  # The maximum total size in bytes of the response header.
+  MAX_RESPONSE_HEADER_LENGTH = 1024 * 1024 # 1 MiB
+
+  # The maximum number of informational (1xx) responses accepted before the
+  # final response.
+  MAX_INFORMATIONAL_RESPONSES = 100
+
   class << self
     # true if the response has a body.
     def body_permitted?
@@ -152,11 +159,17 @@ class Net::HTTPResponse
       res
     end
 
+    def read_line(sock, limit, ignore_eof = false)   #:nodoc: internal use only
+      sock.readuntil("\n", ignore_eof, limit: limit)
+    rescue Net::ReadLimitExceeded
+      raise Net::HTTPBadResponse, 'response line too long'
+    end
+
     private
     # :stopdoc:
 
     def read_status_line(sock)
-      str = sock.readline
+      str = read_line(sock, MAX_RESPONSE_HEADER_LENGTH).chop
       m = /\AHTTP(?:\/(\d+\.\d+))?\s+(\d\d\d)(?:\s+(.*))?\z/in.match(str) or
         raise Net::HTTPBadResponse, "wrong status line: #{str.dump}"
       m.captures
@@ -170,12 +183,19 @@ class Net::HTTPResponse
 
     def each_response_header(sock)
       key = value = nil
+      remaining = MAX_RESPONSE_HEADER_LENGTH
       while true
-        line = sock.readuntil("\n", true).sub(/\s+\z/, '')
+        line = read_line(sock, MAX_RESPONSE_HEADER_LENGTH, true)
+        remaining -= line.bytesize
+        raise Net::HTTPBadResponse, 'response header too large' if remaining < 0
+        line = line.chomp
         break if line.empty?
         if line[0] == ?\s or line[0] == ?\t and value
-          value << ' ' unless value.empty?
-          value << line.strip
+          folded = line.strip
+          unless folded.empty?
+            value << ' ' unless value.empty?
+            value << folded
+          end
         else
           yield key, value if key
           key, value = line.strip.split(/\s*:\s*/, 2)
@@ -599,15 +619,20 @@ class Net::HTTPResponse
 
       @socket = inflate_body_io
 
-      clen = content_length()
-      if clen
-        @socket.read clen, dest, @ignore_eof
-        return
-      end
-      clen = range_length()
-      if clen
-        @socket.read clen, dest
-        return
+      # Transfer-Encoding overrides Content-Length, so a body that is not
+      # chunk-framed runs until the server closes the connection.
+      # See RFC 9112 Section 6.3.
+      unless @header['transfer-encoding']
+        clen = content_length()
+        if clen
+          @socket.read clen, dest, @ignore_eof
+          return
+        end
+        clen = range_length()
+        if clen
+          @socket.read clen, dest
+          return
+        end
       end
       @socket.read_all dest
     end
@@ -623,7 +648,7 @@ class Net::HTTPResponse
   def read_chunked(dest, chunk_data_io) # :nodoc:
     total = 0
     while true
-      line = @socket.readline
+      line = self.class.read_line(@socket, MAX_RESPONSE_HEADER_LENGTH).chop
       hexlen = line.slice(/[0-9a-fA-F]+/) or
           raise Net::HTTPBadResponse, "wrong chunk size line: #{line}"
       len = hexlen.hex
@@ -635,7 +660,7 @@ class Net::HTTPResponse
         @socket.read 2   # \r\n
       end
     end
-    until @socket.readline.empty?
+    until self.class.read_line(@socket, MAX_RESPONSE_HEADER_LENGTH).chop.empty?
       # none
     end
   end