protocol-http1 0.40.0 → 0.40.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab25a92df4b7a3a47fedfb27a10b76ef768fa1472b4e8e2af5f954671212ee02
-  data.tar.gz: 7f2c88ff5cd039ecd982e9129ee7b10441c42c65eaabd9cd70e1379e268aee29
+  metadata.gz: f9a61dc65b4fee0a9cca3509493160ae14b9b3268ae3134fb8e39ee8afe126df
+  data.tar.gz: 3e04a81cdf3d40a6a95b2cdda1d44d32521d68885a48e35592b498ec61779551
 SHA512:
-  metadata.gz: 34d8dbeb53722ca4128e5c0ce9dc228aa231b59987feeb26bb5dde04db942e662406a2a751a637cd98629d7da46099a9b1d5731bb9d5eb19f41179ae696ae8c3
-  data.tar.gz: 0a809c874a1a6143588025865f14681d839b6394c441731092d50cafc86bdd9ed0064890d51271015adce8bb701a1836d2c306bb9cdae8900e66b3d00809c4e6
+  metadata.gz: bf4886e4fba31c3d001ee1edfbb6ca68390969153441a253e251d8f8ab116d28ff4b089adb82a6ec79a97465a0c190887d64dd025d090879f591ef8c90a73c3b
+  data.tar.gz: 37eb313331d6f6af51eab12400118662fa408200456fbaa54cd9908c63b598e95f97304f559e72c4a0459239c06938e2e5261da6ff6a39a379920f844886a3cf

data/lib/protocol/http1/body/chunked.rb

@@ -15,6 +15,9 @@ module Protocol
 			class Chunked < HTTP::Body::Readable
 				CRLF = "\r\n"
 				
+				# The maximum amount of body data returned by a single read.
+				BLOCK_SIZE = 1024 * 64
+				
 				# Initialize the chunked body.
 				#
 				# @parameter connection [Protocol::HTTP1::Connection] the connection to read the body from.
@@ -27,6 +30,7 @@ module Protocol
 					
 					@length = 0
 					@count = 0
+					@remaining = nil
 				end
 				
 				# @attribute [Integer] the number of chunks read so far.
@@ -69,15 +73,39 @@ module Protocol
 				# @returns [String | Nil] the next chunk of data, or `nil` if the body is finished.
 				# @raises [EOFError] if the connection is closed before the expected length is read.
 				def read
-					if !@finished
-						if @connection
+					while !@finished
+						unless @connection
+							raise EOFError, "Connection closed before expected length was read!"
+						end
+						
+						if @remaining
+							if @remaining > 0
+								chunk = @connection.readpartial([@remaining, BLOCK_SIZE].min)
+								@remaining -= chunk.bytesize
+								@length += chunk.bytesize
+								
+								return chunk
+							end
+							
+							terminator = @connection.read(CRLF.bytesize)
+							
+							unless terminator&.bytesize == CRLF.bytesize
+								raise EOFError, "Connection closed before expected length was read!"
+							end
+							
+							unless terminator == CRLF
+								raise BadRequest, "Invalid chunk terminator: #{terminator.inspect}"
+							end
+							
+							@remaining = nil
+							@count += 1
+						else
 							length, _extensions = @connection.read_line.split(";", 2)
 							
 							unless length =~ VALID_CHUNK_LENGTH
 								raise BadRequest, "Invalid chunk length: #{length.inspect}"
 							end
 							
-							# It is possible this line contains chunk extension, so we use `to_i` to only consider the initial integral part:
 							length = Integer(length, 16)
 							
 							if length == 0
@@ -91,27 +119,16 @@ module Protocol
 								return nil
 							end
 							
-							# Read trailing CRLF:
-							chunk = @connection.read(length + 2)
-							
-							if chunk.bytesize == length + 2
-								# ...and chomp it off:
-								chunk.chomp!(CRLF)
-								
-								@length += length
-								@count += 1
-								
-								return chunk
-							else
-								# The connection has been closed before we have read the requested length:
-								@connection.close_read
-								@connection = nil
-							end
+							@remaining = length
 						end
-						
-						# If the connection has been closed before we have read the final chunk, raise an error:
-						raise EOFError, "connection closed before expected length was read!"
 					end
+				rescue EOFError
+					if connection = @connection
+						@connection = nil
+						connection.close_read
+					end
+					
+					raise EOFError, "Connection closed before expected length was read!"
 				end
 				
 				# @returns [String] a human-readable representation of the body.

data/lib/protocol/http1/body/fixed.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Released under the MIT License.
-# Copyright, 2019-2025, by Samuel Williams.
+# Copyright, 2019-2026, by Samuel Williams.
 
 require "protocol/http/body/readable"
 
@@ -10,6 +10,9 @@ module Protocol
 		module Body
 			# Represents a fixed length body.
 			class Fixed < HTTP::Body::Readable
+				# The maximum amount of body data returned by a single read.
+				BLOCK_SIZE = 1024 * 64
+				
 				# Initialize the body with the given connection and length.
 				#
 				# @parameter connection [Protocol::HTTP1::Connection] the connection to read the body from.
@@ -55,7 +58,7 @@ module Protocol
 					if @remaining > 0
 						if @connection
 							# `readpartial` will raise `EOFError` if the connection is finished, or `IOError` if the connection is closed.
-							chunk = @connection.readpartial(@remaining)
+							chunk = @connection.readpartial([@remaining, BLOCK_SIZE].min)
 							
 							@remaining -= chunk.bytesize
 							
@@ -68,7 +71,7 @@ module Protocol
 						end
 						
 						# If the connection has been closed before we have read the expected length, raise an error:
-						raise EOFError, "connection closed before expected length was read!"
+						raise EOFError, "Connection closed before expected length was read!"
 					end
 				end
 				

data/lib/protocol/http1/version.rb

@@ -5,6 +5,6 @@
 
 module Protocol
 	module HTTP1
-		VERSION = "0.40.0"
+		VERSION = "0.40.1"
 	end
 end

data/readme.md

@@ -30,6 +30,10 @@ Please see the [project documentation](https://socketry.github.io/protocol-http1
 
 Please see the [project releases](https://socketry.github.io/protocol-http1/releases/index) for all releases.
 
+### v0.40.1
+
+  - Bound fixed-length and chunked body reads, and validate chunk terminators.
+
 ### v0.40.0
 
   - Use `Protocol::HTTP::Status` for standard HTTP status descriptions and remove the duplicate `Protocol::HTTP1::Reason` table.
@@ -68,10 +72,6 @@ Please see the [project releases](https://socketry.github.io/protocol-http1/rele
   - Fix connection state handling to allow idempotent response body closing.
   - Add `kisaten` fuzzing integration for improved security testing.
 
-### v0.34.0
-
-  - Support empty header values in HTTP parsing for better compatibility.
-
 ## Contributing
 
 We welcome contributions to this project.
@@ -82,6 +82,22 @@ We welcome contributions to this project.
 4.  Push to the branch (`git push origin my-new-feature`).
 5.  Create new Pull Request.
 
+### Running Tests
+
+To run the test suite:
+
+``` shell
+bundle exec sus
+```
+
+### Making Releases
+
+To make a new release:
+
+``` shell
+bundle exec bake gem:release:patch # or minor or major
+```
+
 ### Developer Certificate of Origin
 
 In order to protect users of this project, we require all contributors to comply with the [Developer Certificate of Origin](https://developercertificate.org/). This ensures that all contributions are properly licensed and attributed.

data/releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## v0.40.1
+
+  - Bound fixed-length and chunked body reads, and validate chunk terminators.
+
 ## v0.40.0
 
   - Use `Protocol::HTTP::Status` for standard HTTP status descriptions and remove the duplicate `Protocol::HTTP1::Reason` table.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: protocol-http1
 version: !ruby/object:Gem::Version
-  version: 0.40.0
+  version: 0.40.1
 platform: ruby
 authors:
 - Samuel Williams