nonnative 3.35.0 → 3.36.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9a3ed94a590e8273136387f186364d01270536a472d476fc806b8e9d1d06c07
-  data.tar.gz: 9b1b14eb944a13c83c93bf816d4b485d0f1818080167a6f5339c7bba73d59c31
+  metadata.gz: 6969c5c21e416e67752d3421af108506fe44730230537c9b426529e28dad7934
+  data.tar.gz: 148ab5d39ef4f367501cca5786de14bc50be175616048a19a792671eee27fc1a
 SHA512:
-  metadata.gz: 370d1071e0665f5ea99a06a5dcf4fbe18224aee3d47b9f4279f3fd881c03340869fc11b1b8a58349065bae3d98ffa7be5243a34c26351366b53063676a7cb859
-  data.tar.gz: 94ad2439c76e863ee3b6a34655454e0610f3a7f8c0b5db23df9af0c0bfc54924ca63410008eccf4b261b6693f601c0495d2bc668bce5a96f9a5a319db44088da
+  metadata.gz: 85218dfe59a108dad82130912aaaa1bb0a79e60017595fd089383aafc005e4b9c9e72c74341cd38efc97ac2f31dbf460967cb2dc4eb2fcb34c565ad663b12e41
+  data.tar.gz: 8125a4ef344c00e450f8b03df400cbe2df991f8e2905420673fa2fbd09032c1623f52b540c92cf7ab08c60967b7dfb1d9239c68fcf737341e97c21e1feffa10a

data/README.md

@@ -602,11 +602,13 @@ The system allows you to define an in-process HTTP forward proxy server for exte
 The upstream scheme defaults to HTTPS on the scheme's default port; pass `scheme:`/`port:` to
 `Nonnative::HTTPProxyServer.new` to target an `http://` upstream or a non-default port. The proxy
 forwards the request path and query for `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, and
-`OPTIONS`, while removing proxy credentials plus `Host` and `Accept-Encoding` before the upstream
-request.
+`OPTIONS`, while removing proxy credentials, `Host`, `Accept-Encoding`, hop-by-hop headers, and
+headers nominated by `Connection` before the upstream request.
 
 The proxy preserves the upstream status, body, and safe end-to-end response headers such as `Content-Type`, `ETag`, and application-specific metadata. It removes hop-by-hop, connection-nominated, proxy-authentication, and framing headers; `Set-Cookie`, `Location`, and `Content-Encoding` are not forwarded.
 
+When the upstream is unavailable, disconnects unexpectedly, or times out, the proxy returns a clean gateway response (`502` or `504`) instead of exposing an internal exception page.
+
 Define your server:
 
 ```ruby

data/lib/nonnative/http_proxy_server.rb

@@ -44,13 +44,35 @@ module Nonnative
     ].freeze
 
     NON_FORWARDABLE_REQUEST_HEADERS = %w[
-      Host
-      Accept-Encoding
-      Version
-      Proxy-Authenticate
-      Proxy-Authorization
+      host
+      accept-encoding
+      version
+      proxy-authenticate
+      proxy-authorization
+      proxy-connection
+      connection
+      keep-alive
+      te
+      trailer
+      transfer-encoding
+      upgrade
+    ].freeze
+
+    GATEWAY_TIMEOUT_ERRORS = [
+      RestClient::Exceptions::Timeout
     ].freeze
 
+    GATEWAY_CONNECTION_ERRORS = [
+      RestClient::ServerBrokeConnection,
+      Errno::ECONNREFUSED,
+      Errno::EHOSTUNREACH,
+      SocketError
+    ].freeze
+
+    # Match malformed percent escapes and bytes outside RFC 3986's path-safe set. Valid `%HH`
+    # escapes remain intact; each match is percent-encoded before building the upstream URI.
+    PATH_ESCAPE_PATTERN = %r{%(?![\da-fA-F]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/%]}
+
     # Extracts request headers from the Rack environment and normalizes them to standard HTTP names.
     #
     # Certain hop-by-hop or proxy-specific headers are removed.
@@ -64,7 +86,8 @@ module Nonnative
         result[normalized_request_header_name(header)] = value
       end
 
-      headers.except(*NON_FORWARDABLE_REQUEST_HEADERS)
+      connection_headers = request_connection_headers(headers)
+      headers.reject { |header, _| non_forwardable_request_header?(header, connection_headers) }
     end
 
     # Builds the upstream URL for the given request.
@@ -75,8 +98,9 @@ module Nonnative
     def build_url(request, settings)
       uri_class = settings.scheme == 'http' ? URI::HTTP : URI::HTTPS
       query = request.query_string
+      path = escape_path(request.path_info)
 
-      uri_class.build(host: settings.host, port: settings.port, path: request.path_info, query: query.empty? ? nil : query).to_s
+      uri_class.build(host: settings.host, port: settings.port, path:, query: query.empty? ? nil : query).to_s
     end
 
     # Executes the upstream request and returns the response.
@@ -86,13 +110,20 @@ module Nonnative
     # @param headers [Hash] request headers
     # @param payload [String, nil] request payload
     # @return [RestClient::Response] response for error statuses, otherwise RestClient return value
+    # @raise [Sinatra::Halt] with a gateway status when the upstream is unavailable or times out
     def api_response(method:, url:, headers:, payload: nil)
       options = { method:, url:, headers: }
       options[:payload] = payload unless payload.nil?
 
       RestClient::Request.execute(options)
+    rescue *GATEWAY_TIMEOUT_ERRORS
+      halt 504
+    rescue *GATEWAY_CONNECTION_ERRORS
+      halt 502
     rescue RestClient::Exception => e
-      e.response
+      return e.response if e.response
+
+      halt 502
     end
 
     # Extracts the request payload for verbs that can carry a body.
@@ -149,6 +180,20 @@ module Nonnative
       header.delete_prefix('HTTP_').split('_').map(&:capitalize).join('-')
     end
 
+    def escape_path(path)
+      URI::DEFAULT_PARSER.escape(path, PATH_ESCAPE_PATTERN)
+    end
+
+    def request_connection_headers(headers)
+      headers.fetch('Connection', '').split(',').map { |header| header.strip.downcase }
+    end
+
+    def non_forwardable_request_header?(header, connection_headers)
+      normalized_header = header.downcase
+
+      NON_FORWARDABLE_REQUEST_HEADERS.include?(normalized_header) || connection_headers.include?(normalized_header)
+    end
+
     # Registered before `get` so it takes precedence over Sinatra's GET-generated HEAD route,
     # which would otherwise forward HEAD requests upstream as GET.
     head(/.*/) do

data/lib/nonnative/version.rb

@@ -4,5 +4,5 @@ module Nonnative
   # The current gem version.
   #
   # @return [String]
-  VERSION = '3.35.0'
+  VERSION = '3.36.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nonnative
 version: !ruby/object:Gem::Version
-  version: 3.35.0
+  version: 3.36.0
 platform: ruby
 authors:
 - Alejandro Falkowski