protocol-http 0.64.0 → 0.65.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 144524e37ab8f38f1391e711994fd1880cdce76b35586a757aa5745645ec95ee
-  data.tar.gz: 47caea36c05b7ae9bfedde624a614f9cfd4cee7b2471e0f18ccfa3645ed0b8f3
+  metadata.gz: b17dbce0da66e6f9093d1e3e6a3cebbe8e666a7fd9f5e002dc41f9de427d8415
+  data.tar.gz: 07aa35d8c33d720d9f00c95228f2d2d88a755a5aad9d1f8e652967a2e88080a4
 SHA512:
-  metadata.gz: febc1afedb0368e12ec0293525e7221b8d223b9aaf9eb1e6d9987a232e05eef3492933d30ea912534bed0acf09db13e436227a049dd5db405b9f2ca6ccdff209
-  data.tar.gz: ed719d0d3d5dadb3ca0698d7fee3b56f0e80c3b6fa83e0b9f2cf05bb3dbe48587204e2ecc829b8404fe8407320fcde9f6a3aee14adf40b6dd62a2913ca60f65e
+  metadata.gz: c976e4a859e43de63ca1ee55eaced96ff4122e167a806f95a9e6b001de0fcfcece9132915e6004c14249b57b539a1f7add64411747f402bd4a9e8ecaf5120242
+  data.tar.gz: dc9422aaf8a88c83c477c8ad2e35a3e88b7de37d2b6b2d7636dec9ea6b88860c35b100214727b6baafed1175aa96e1366223e6dbe2a725adaf7600d5350d4a49

data/lib/protocol/http/header/accept.rb

@@ -15,12 +15,12 @@ module Protocol
 			class Accept < Split
 				# Regular expression used to split values on commas, with optional surrounding whitespace, taking into account quoted strings.
 				SEPARATOR = /
-					(?:            # Start non-capturing group
-						"[^"\\]*"    # Match quoted strings (no escaping of quotes within)
-						|            # OR
-						[^,"]+       # Match non-quoted strings until a comma or quote
+					(?:                       # Start non-capturing group
+						"(?:[^"\\]|\\.)*"       # Match quoted strings, including quoted pairs
+						|                       # OR
+						[^,"]+                  # Match non-quoted strings until a comma or quote
 					)+
-					(?=,|\z)       # Match until a comma or end of string
+					(?=,|\z)                  # Match until a comma or end of string
 				/x
 				
 				ParseError = Class.new(Error)
@@ -114,8 +114,24 @@ module Protocol
 						type = match[:type]
 						subtype = match[:subtype]
 						parameters = {}
+						parameters_string = match[:parameters]
+						offset = 0
 						
-						match[:parameters].scan(PARAMETER) do |key, value, quoted_value|
+						parameters_string.scan(PARAMETER) do |key, value, quoted_value|
+							parameter_match = Regexp.last_match
+							unless parameter_match.begin(0) == offset
+								raise ParseError, "Invalid media range parameters: #{parameters_string[offset..].inspect}"
+							end
+							offset = parameter_match.end(0)
+							
+							if key.casecmp?("q")
+								if quoted_value || parameters.key?("q") || !value.match?(/\A(?:#{QVALUE})\z/)
+									raise ParseError, "Invalid quality factor: #{value.inspect}"
+								end
+								
+								key = "q"
+							end
+							
 							if quoted_value
 								value = QuotedString.unquote(quoted_value)
 							end
@@ -123,6 +139,14 @@ module Protocol
 							parameters[key] = value
 						end
 						
+						unless offset == parameters_string.length
+							raise ParseError, "Invalid media range parameters: #{parameters_string[offset..].inspect}"
+						end
+						
+						if (type.include?("*") && type != "*") || (subtype.include?("*") && subtype != "*") || (type == "*" && subtype != "*")
+							raise ParseError, "Invalid wildcards in media range: #{type}/#{subtype}"
+						end
+						
 						return MediaRange.new(type, subtype, parameters)
 					else
 						raise ParseError, "Invalid media type: #{value.inspect}"

data/lib/protocol/http/header/cookie.rb

@@ -3,7 +3,6 @@
 # Released under the MIT License.
 # Copyright, 2019-2026, by Samuel Williams.
 
-require_relative "multiple"
 require_relative "../cookie"
 
 module Protocol
@@ -12,7 +11,40 @@ module Protocol
 			# The `cookie` header contains stored HTTP cookies previously sent by the server with the `set-cookie` header.
 			#
 			# It is used by clients to send key-value pairs representing stored cookies back to the server.
-			class Cookie < Multiple
+			# Multiple cookies within a single `Cookie` header are joined with `"; "` per RFC 6265.
+			class Cookie < Array
+				# Parses a raw header value.
+				#
+				# @parameter value [String] a single raw header value.
+				# @returns [Cookie] a new instance containing the parsed value.
+				def self.parse(value)
+					self.new([value])
+				end
+				
+				# Coerces a value into a parsed header object.
+				#
+				# @parameter value [String | Array] the value to coerce.
+				# @returns [Cookie] a parsed header object.
+				def self.coerce(value)
+					case value
+					when Array
+						self.new(value.map(&:to_s))
+					else
+						self.parse(value.to_s)
+					end
+				end
+				
+				# Initializes the cookie header with the given values.
+				#
+				# @parameter value [Array | Nil] an array of cookie strings, or `nil` for an empty header.
+				def initialize(value = nil)
+					super()
+					
+					if value
+						self.concat(value)
+					end
+				end
+				
 				# Parses the `cookie` header into a hash of cookie names and their corresponding cookie objects.
 				#
 				# @returns [Hash(String, HTTP::Cookie)] a hash where keys are cookie names and values are {HTTP::Cookie} objects.
@@ -24,9 +56,9 @@ module Protocol
 					cookies.map{|cookie| [cookie.name, cookie]}.to_h
 				end
 				
-				# Serializes the `cookie` header by joining individual cookie strings with semicolons.
+				# Serializes the `cookie` header by joining individual cookie strings with `"; "` per RFC 6265.
 				def to_s
-					join(";")
+					join("; ")
 				end
 				
 				# Whether this header is acceptable in HTTP trailers.
@@ -36,12 +68,9 @@ module Protocol
 					false
 				end
 			end
-			
-			# The `set-cookie` header sends cookies from the server to the user agent.
-			#
-			# It is used to store cookies on the client side, which are then sent back to the server in subsequent requests using the `cookie` header.
-			class SetCookie < Cookie
-			end
 		end
 	end
 end
+
+# Preserve the existing behavior where requiring this file also defines SetCookie.
+require_relative "set_cookie"

data/lib/protocol/http/header/set_cookie.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2019-2026, by Samuel Williams.
+
+require_relative "multiple"
+require_relative "../cookie"
+
+module Protocol
+	module HTTP
+		module Header
+			# The `set-cookie` header sends cookies from the server to the user agent.
+			#
+			# Each `Set-Cookie` header must be a separate header field — they cannot be combined.
+			# It is used to store cookies on the client side, which are then sent back to the server
+			# in subsequent requests using the `cookie` header.
+			class SetCookie < Multiple
+				# Parses the `set-cookie` headers into a hash of cookie names and their corresponding cookie objects.
+				#
+				# @returns [Hash(String, HTTP::Cookie)] a hash where keys are cookie names and values are {HTTP::Cookie} objects.
+				def to_h
+					cookies = self.collect do |string|
+						HTTP::Cookie.parse(string)
+					end
+					
+					cookies.map{|cookie| [cookie.name, cookie]}.to_h
+				end
+				
+				# Whether this header is acceptable in HTTP trailers.
+				# @returns [Boolean] `false`, as set-cookie headers are needed during initial response processing.
+				def self.trailer?
+					false
+				end
+			end
+		end
+	end
+end

data/lib/protocol/http/headers.rb

@@ -9,6 +9,7 @@ require_relative "header/split"
 require_relative "header/multiple"
 
 require_relative "header/cookie"
+require_relative "header/set_cookie"
 require_relative "header/connection"
 require_relative "header/cache_control"
 require_relative "header/etag"
@@ -300,7 +301,13 @@ module Protocol
 					@indexed[key] = value
 				end
 				
-				@fields << [key, value.to_s]
+				if value.is_a?(Multiple)
+					value.each do |v|
+						@fields << [key, v.to_s]
+					end
+				else
+					@fields << [key, value.to_s]
+				end
 			end
 			
 			# Get the value of the specified header key.

data/lib/protocol/http/version.rb

@@ -5,6 +5,6 @@
 
 module Protocol
 	module HTTP
-		VERSION = "0.64.0"
+		VERSION = "0.65.0"
 	end
 end

data/readme.md

@@ -30,6 +30,11 @@ Please see the [project documentation](https://socketry.github.io/protocol-http/
 
 Please see the [project releases](https://socketry.github.io/protocol-http/releases/index) for all releases.
 
+### v0.65.0
+
+  - Improve `Accept` header parsing for quoted pairs, malformed parameters, invalid wildcards, and invalid quality factors.
+  - Emit multiple `Set-Cookie` values as separate header fields and delimit combined `Cookie` values with a space after each semicolon.
+
 ### v0.64.0
 
   - Add `Protocol::HTTP::Request#rewind!` and `#retry!` for preparing requests to be sent again.
@@ -71,14 +76,6 @@ Please see the [project releases](https://socketry.github.io/protocol-http/relea
   - Introduce `Protocol::HTTP::InvalidTrailerError` which is raised when a trailer header is not allowed by the current policy.
   - **Breaking**: `Headers#each` now yields parsed values according to the current policy. For the previous behaviour, use `Headers#fields`.
 
-### v0.56.0
-
-  - Introduce `Header::*.parse(value)` which parses a raw header value string into a header instance.
-  - Introduce `Header::*.coerce(value)` which coerces any value (`String`, `Array`, etc.) into a header instance with normalization.
-  - `Header::*#initialize` now accepts arrays without normalization for efficiency, or strings for backward compatibility.
-  - Update `Headers#[]=` to use `coerce(value)` for smart conversion of user input.
-  - Normalization (e.g., lowercasing) is applied by `parse`, `coerce`, and `<<` methods, but not by `new` when given arrays.
-
 ## See Also
 
   - [protocol-http1](https://github.com/socketry/protocol-http1) — HTTP/1 client/server implementation using this

data/releases.md

@@ -1,5 +1,10 @@
 # Releases
 
+## v0.65.0
+
+  - Improve `Accept` header parsing for quoted pairs, malformed parameters, invalid wildcards, and invalid quality factors.
+  - Emit multiple `Set-Cookie` values as separate header fields and delimit combined `Cookie` values with a space after each semicolon.
+
 ## v0.64.0
 
   - Add `Protocol::HTTP::Request#rewind!` and `#retry!` for preparing requests to be sent again.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: protocol-http
 version: !ruby/object:Gem::Version
-  version: 0.64.0
+  version: 0.65.0
 platform: ruby
 authors:
 - Samuel Williams
@@ -98,6 +98,7 @@ files:
 - lib/protocol/http/header/multiple.rb
 - lib/protocol/http/header/priority.rb
 - lib/protocol/http/header/server_timing.rb
+- lib/protocol/http/header/set_cookie.rb
 - lib/protocol/http/header/split.rb
 - lib/protocol/http/header/te.rb
 - lib/protocol/http/header/trailer.rb