rack-proxy 1.0.2 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c85038309db55ace1d7ad2de733dc4a539859cf585c2ffb69b73c13a914f1d47
-  data.tar.gz: e0328851b0d2a9698b05f356bbb0322c6f3cf4c760b10d93a91194df0849ce44
+  metadata.gz: 12583aa295312c50b4133259be96749c8cb515eca735f3df803008970f5f941a
+  data.tar.gz: 765f25cc8fef13acb7b0276ed7d193d35c3ad91acc00074b923b2f1558e384d8
 SHA512:
-  metadata.gz: 7bba2a24c71a1521a3d9f9d42d7bffd56b8545f05a8f060fb7236c76d0d5dccba4099015eb25f69e5d98d79b937a4e6d8b26fac5e69345a814222bc65cf3f3d9
-  data.tar.gz: 34502c66d9801a04d95849773d3dc8c43aa24629db6cb780bb06834054ffc41588ddd1610ec39e33f6b7c64b163311633a47bc988b48eacd7d3e0578bda2568f
+  metadata.gz: 2f6467276179125820219ff0f553f216dced29a36d0a14e60d03ab5e86e49b06ab601f47f25bbc5aa180cb11be9358a3689137fbe7ff6c6190626d171b80ab92
+  data.tar.gz: e8f825b48982e015dedb923dc6bd21c7d7144ec991b9c8e24a65c2d9755daec0bc86df9519c045c9d8689bb0b1c4693966b609a66d6958d77edfd1b4fe016227

data/CHANGELOG.md

@@ -8,6 +8,58 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 Nothing yet.
 
+## [2.0.1] - 2026-09-16
+
+### Fixed
+
+- The bounded request body stream accepts `IO#read`'s optional `length`
+  argument. Net::HTTP instrumentation layers that read the whole request body
+  at once (WebMock's adapter, for example) raised `ArgumentError` against
+  2.0.0, failing the test suite of any app that proxies a request body. (#145)
+
+## [2.0.0] - 2026-09-05
+
+### Breaking changes
+
+- Non-streaming requests no longer automatically retry transport failures.
+  This prevents replay with consumed request input; applications that require
+  retries must implement them with a fresh body and an explicit retry policy.
+- Rack 3 response hooks receive arrays for repeated header values, including
+  `Set-Cookie`, and non-streaming statuses are integers. Update hooks that
+  assumed newline-separated headers or string statuses. Rack 2 retains its
+  newline-separated header representation.
+- Invalid or ambiguous HTTP framing is now rejected, incomplete responses fail,
+  and uploads without a known length use fresh chunked framing. Backends must
+  accept properly framed HTTP/1.1 requests and send valid, complete responses.
+
+### Security
+
+- Reframe decoded request bodies without a `CONTENT_LENGTH` using chunked
+  encoding instead of sending body bytes after `Content-Length: 0`. Bound
+  known-length input streams so excess bytes cannot become another backend
+  request; malformed lengths and prematurely ended uploads return `400`.
+- Reject ambiguous backend framing (`Transfer-Encoding` with `Content-Length`,
+  conflicting or invalid lengths, and unsupported transfer codings) with `502`.
+- Strip response headers named by the backend's `Connection` fields as well as
+  the standard hop-by-hop headers.
+- Enforce `max_response_length` before buffering each chunk in non-streaming
+  mode, including rejecting declared oversized responses before reading them.
+- Detect premature EOF in fixed-length responses: return `502` before sending
+  headers, or raise while streaming so the server aborts the incomplete transfer.
+- Disable Net::HTTP transport retries in non-streaming mode as well as streaming
+  mode, preventing replay with an already-consumed request body.
+
+### Fixed
+
+- Return integer statuses in non-streaming mode and preserve multiple response
+  header values as arrays on Rack 3 (including `Set-Cookie`). Rack 2 keeps its
+  newline-separated representation.
+- Remove entity headers forbidden by Rack on 1xx/204/304 responses. HEAD and
+  304 representation sizes no longer incorrectly trigger the response body cap.
+- Replace a remaining live-host test with a local fixture and simulate failed
+  DNS resolution without sending external DNS queries. Add offline adversarial
+  framing, size-limit, retry, and `Rack::Lint` regression checks.
+
 ## [1.0.2] - 2026-09-01
 
 Housekeeping — no library behavior changes. **No action is needed by users:**
@@ -195,7 +247,9 @@ or a compatible fix. See the README's "Upgrading" section for migration steps.
 
 Older releases (≤ 0.7.8) predate this changelog; see the git history and tags.
 
-[Unreleased]: https://github.com/ncr/rack-proxy/compare/v1.0.2...HEAD
+[Unreleased]: https://github.com/ncr/rack-proxy/compare/v2.0.1...HEAD
+[2.0.1]: https://github.com/ncr/rack-proxy/compare/v2.0.0...v2.0.1
+[2.0.0]: https://github.com/ncr/rack-proxy/compare/v1.0.2...v2.0.0
 [1.0.2]: https://github.com/ncr/rack-proxy/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/ncr/rack-proxy/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/ncr/rack-proxy/compare/v0.8.3...v1.0.0

data/README.md

@@ -37,7 +37,7 @@ Typical uses:
 Requires Ruby >= 3.0 and Rack 2.x or 3.x. Add to your `Gemfile`:
 
 ```ruby
-gem "rack-proxy", "~> 1.0"
+gem "rack-proxy", "~> 2.0"
 ```
 
 ## Quick start
@@ -116,7 +116,7 @@ Pass options when instantiating (`Rack::Proxy.new(backend: ...)`) or mounting mi
 - `:read_timeout` — per-read timeout in seconds (default `60`).
 - `:open_timeout` — connection-open timeout in seconds.
 - `:write_timeout` — per-write timeout in seconds.
-- `:max_response_length` — cap (in bytes) on the backend response size; a larger response is refused with `502` (streaming aborts once the cap is passed).
+- `:max_response_length` — cap (in bytes) on the backend response body. Oversized declared lengths are refused before reading the body, and each chunk is checked before buffering or forwarding it. Non-streaming responses return `502` on overflow; streaming responses abort if overflow is discovered after sending the headers. HEAD/304 representation lengths do not count as body bytes.
 
 ### Request shaping
 
@@ -240,7 +240,7 @@ From [`examples/example_service_proxy.rb`](examples/example_service_proxy.rb):
 # 1. rails new test_app
 # 2. cd test_app
 # 3. install Rack-Proxy in `Gemfile`
-#    a. `gem 'rack-proxy', '~> 1.0'`
+#    a. `gem 'rack-proxy', '~> 2.0'`
 # 4. install gem: `bundle install`
 # 5. copy the class into your app and mount it from `config/initializers/proxy.rb`
 # 6. run: `SERVICE_URL=http://guides.rubyonrails.org rails server`
@@ -382,6 +382,17 @@ end
 
 ## Upgrading
 
+### 1.x → 2.0.0
+
+2.0.0 hardens HTTP framing and response limits. Ruby and Rack requirements are unchanged.
+
+- **Automatic transport retries are disabled in both modes.** Non-streaming requests previously inherited Net::HTTP's retry behavior. If your application needs retries, use an explicit policy that considers whether the operation is safe to replay and provides a fresh request body for each attempt.
+- **Response hooks follow Rack's types.** Statuses are integers in both modes. On Rack 3, repeated headers such as `Set-Cookie` are arrays of strings; update hooks that split these values on newlines. Rack 2 still uses newline-separated strings.
+- **Framing errors fail explicitly.** Malformed request lengths and incomplete uploads return `400`. Ambiguous backend framing returns `502`. A truncated backend body returns `502` before headers are sent, or raises during streaming so the server aborts the transfer. Uploads without `CONTENT_LENGTH` are forwarded with chunked encoding; backends must support HTTP/1.1 chunked requests.
+- **Response limits apply before buffering.** `max_response_length` now bounds non-streaming accumulation. HEAD and 304 representation lengths do not count toward the body cap.
+
+Update your Gemfile to `gem "rack-proxy", "~> 2.0"` and run `bundle update rack-proxy`. Existing explicit backend and TLS options continue to work.
+
 ### 0.8.x → 1.0.0
 
 1.0.0 is a breaking release; the full list is in [CHANGELOG.md](CHANGELOG.md). The changes most likely to need action:

data/SECURITY.md

@@ -7,13 +7,14 @@ threat model below alongside the "Security considerations" section of the README
 
 ## Supported versions
 
-Security fixes are released for the latest major series. The last `0.x` series
-receives fixes for critical issues only, for a transition period — please
-upgrade to `1.x`.
+Security fixes are released for the latest major series. Older supported
+series receive critical fixes only during their transition period — please
+upgrade to `2.x`.
 
 | Version | Supported |
 | ------- | --------- |
-| 1.0.x   | ✅        |
+| 2.0.x   | ✅        |
+| 1.0.x   | critical fixes only |
 | 0.8.x   | critical fixes only |
 | < 0.8   | ❌        |
 

data/lib/rack/http_streaming_response.rb

@@ -135,7 +135,16 @@ module Rack
         @fiber = Fiber.new do
           session.request(request) do |res|
             Fiber.yield res
-            res.read_body { |chunk| Fiber.yield chunk }
+            bytes = 0
+            res.read_body do |chunk|
+              bytes += chunk.bytesize
+              Fiber.yield chunk
+            end
+            # Net::HTTP tolerates premature EOF for Content-Length bodies on
+            # supported Ruby versions. A proxy must signal an incomplete body.
+            if request.response_body_permitted? && res.class.body_permitted? && res.content_length && bytes != res.content_length
+              raise EOFError, "backend response is shorter than Content-Length"
+            end
           end
           :done
         end

data/lib/rack/proxy/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class Proxy
-    VERSION = "1.0.2"
+    VERSION = "2.0.1"
   end
 end

data/lib/rack/proxy.rb

@@ -37,6 +37,45 @@ module Rack
       Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError
     ].freeze
 
+    class InvalidRequest < StandardError; end
+
+    # Net::HTTP copies a body stream until EOF, even when Content-Length is
+    # smaller. Bound the input so extra bytes cannot become a second request.
+    class RequestBodyStream
+      def initialize(input, length)
+        @input, @remaining = input, length
+      end
+
+      def read(length = nil, buffer = nil)
+        return read_remaining(buffer) if length.nil?
+
+        if @remaining.zero?
+          buffer&.clear
+          return nil
+        end
+
+        data = @input.read([length, @remaining].min, buffer)
+        raise InvalidRequest, "request body is shorter than Content-Length" if data.nil? || data.empty?
+
+        @remaining -= data.bytesize
+        data
+      end
+
+      private
+
+      # IO#read without a length returns everything up to EOF ("" once there).
+      # Net::HTTP never calls it that way, but instrumentation layers wrapping
+      # Net::HTTP#request (WebMock's adapter, for one) do.
+      def read_remaining(buffer)
+        data = +"".b
+        while (chunk = read(16_384))
+          data << chunk
+        end
+        buffer ? buffer.replace(data) : data
+      end
+    end
+    private_constant :InvalidRequest, :RequestBodyStream
+
     class << self
       def extract_http_request_headers(env)
         headers = env.reject do |k, v|
@@ -63,7 +102,18 @@ module Rack
 
       def normalize_headers(headers)
         mapped = headers.map do |k, v|
-          [titleize(k), v.is_a?(Array) ? v.join("\n") : v]
+          value = if v.is_a?(Array)
+            if v.length == 1
+              v.first
+            elsif Rack.const_defined?(:Headers, false)
+              v
+            else
+              v.join("\n")
+            end
+          else
+            v
+          end
+          [titleize(k), value]
         end
         build_header_hash mapped.to_h
       end
@@ -115,8 +165,8 @@ module Rack
       @open_timeout = opts[:open_timeout]
       @write_timeout = opts[:write_timeout]
       # Optional cap (in bytes) on the backend response size, to bound memory
-      # against a hostile/huge backend. Enforced incrementally while streaming and
-      # via the declared Content-Length / buffered size otherwise. Default: no cap.
+      # against a hostile/huge backend. Checked before buffering each chunk in
+      # either mode, as well as against declared lengths. Default: no cap.
       @max_response_length = opts[:max_response_length]
       # :ssl_version pins an exact protocol and is deprecated (it forbids TLS 1.3);
       # prefer :min_version / :max_version, which map to Net::HTTP#min_version=/#max_version=.
@@ -223,12 +273,22 @@ module Rack
         # its own content-encoding.
         target_request.instance_variable_set(:@decode_content, false) if target_request.instance_variable_defined?(:@decode_content)
 
-        # Setup body
+        # Rack supplies decoded input. Generate framing for this hop instead
+        # of forwarding the client's Transfer-Encoding or guessing a zero size.
         if target_request.request_body_permitted? && source_request.body
-          target_request.body_stream = source_request.body
-          target_request.content_length = source_request.content_length.to_i
+          input = source_request.body
+          input.rewind if input.respond_to?(:rewind)
+          if (length = source_request.content_length)
+            raise InvalidRequest, "invalid Content-Length" unless /\A[0-9]+\z/.match?(length)
+
+            target_request.content_length = length.to_i
+            target_request.body_stream = RequestBodyStream.new(input, length.to_i)
+          else
+            target_request.delete("Content-Length")
+            target_request["Transfer-Encoding"] = "chunked"
+            target_request.body_stream = input
+          end
           target_request.content_type = source_request.content_type if source_request.content_type
-          target_request.body_stream.rewind if target_request.body_stream.respond_to?(:rewind)
         end
 
         # Use basic auth if we have to
@@ -267,64 +327,93 @@ module Rack
             configure_backend_connection(http, use_ssl: use_ssl, read_timeout: read_timeout)
           end
           target_response.logger = @logger if @logger
+          code = target_response.code
+          headers = prepare_response_headers(target_response.headers, code, target_request)
+          if response_body_permitted?(target_request, code)
+            target_response.max_response_length = @max_response_length
+            body = target_response
+          else
+            target_response.close
+            body = []
+          end
         else
           http = Net::HTTP.new(backend.host, backend.port)
           configure_backend_connection(http, use_ssl: use_ssl, read_timeout: read_timeout)
 
-          target_response = http.start do
-            http.request(target_request)
+          http.start do
+            http.request(target_request) do |response|
+              code = response.code.to_i
+              headers = prepare_response_headers(response.to_hash, code, target_request)
+              body = []
+              if response_body_permitted?(target_request, code)
+                buffered = +"".b
+                response.read_body do |chunk|
+                  check_response_length!(buffered.bytesize + chunk.bytesize)
+                  buffered << chunk
+                end
+                if response.content_length && buffered.bytesize != response.content_length
+                  raise EOFError, "backend response is shorter than Content-Length"
+                end
+                body << buffered unless buffered.empty?
+              end
+            end
           end
         end
-
-        code = target_response.code
-        headers = self.class.normalize_headers(target_response.respond_to?(:headers) ? target_response.headers : target_response.to_hash)
-        body = target_response.body || []
-        body = [body] unless body.respond_to?(:each)
-      rescue URI::InvalidURIError
+      rescue URI::InvalidURIError, InvalidRequest
+        target_response&.close
         return [400, {}, []]
-      rescue *BACKEND_ERRORS => e
+      rescue *BACKEND_ERRORS, HttpStreamingResponse::ResponseTooLarge => e
+        target_response&.close
         @logger << "rack-proxy: backend request failed: #{e.class}: #{e.message}\n" if @logger.respond_to?(:<<)
         return [502, {}, []]
       end
 
-      # No entity body for status codes that don't allow one (1xx, 204, 304)
-      body = [] if Rack::Utils::STATUS_WITH_NO_ENTITY_BODY[code.to_i]
-
-      # Remove hop-by-hop header fields from the response. Use #delete (not
-      # #reject!) so the returned HeaderHash's case-insensitive index stays
-      # consistent on Rack 2 for any downstream middleware.
-      headers.keys.each { |k| headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] }
-
-      return [502, {}, []] if response_too_large?(target_response, headers, body)
-
       [code, headers, body]
     end
 
     private
 
-    # Enforce :max_response_length. Returns true (→ 502) when the response is
-    # already known to be too large. For streaming, a declared oversize is
-    # rejected up-front (the connection is closed) and the incremental limit is
-    # armed on the body for chunked/unknown-length responses; for non-streaming,
-    # the body is already buffered so we check its actual size. Returns false
-    # (allow) when no cap is set.
-    def response_too_large?(target_response, headers, body)
-      return false unless @max_response_length
-
-      declared = headers["Content-Length"]
-      declared_oversize = declared && declared.to_i > @max_response_length
-
-      if target_response.respond_to?(:max_response_length=)
-        if declared_oversize
-          target_response.close
-          return true
+    def response_body_permitted?(request, code)
+      request.response_body_permitted? && !Rack::Utils::STATUS_WITH_NO_ENTITY_BODY[code] && code != 205
+    end
+
+    def check_response_length!(length)
+      if @max_response_length && length && length > @max_response_length
+        raise HttpStreamingResponse::ResponseTooLarge, "backend response exceeded max_response_length=#{@max_response_length}"
+      end
+    end
+
+    # Validate framing before dropping hop-by-hop fields or reading a body.
+    # Net::HTTP dechunks responses but otherwise preserves their headers.
+    def prepare_response_headers(raw_headers, code, request)
+      # Rack 2 HeaderHash#each joins arrays with newlines. Read values directly
+      # so repeated framing/Connection fields stay distinct during validation.
+      headers = self.class.build_header_hash(raw_headers.keys.map { |key| [key, raw_headers[key]] })
+      transfer_encoding = headers["Transfer-Encoding"]
+      content_length = headers["Content-Length"]
+      if transfer_encoding
+        if content_length || Array(transfer_encoding).join(",").strip.downcase != "chunked"
+          raise Net::HTTPBadResponse, "ambiguous or unsupported backend transfer encoding"
         end
-        target_response.max_response_length = @max_response_length
-        false
-      else
-        buffered = body.sum { |part| part.to_s.bytesize }
-        declared_oversize || buffered > @max_response_length
       end
+      if content_length
+        lengths = Array(content_length).flat_map { |value| value.split(",", -1).map(&:strip) }
+        unless lengths.all? { |value| /\A[0-9]+\z/.match?(value) } && lengths.map(&:to_i).uniq.length == 1
+          raise Net::HTTPBadResponse, "invalid backend Content-Length"
+        end
+        headers["Content-Length"] = lengths.first.to_i.to_s
+        check_response_length!(lengths.first.to_i) if response_body_permitted?(request, code)
+      end
+
+      connection_named = Array(headers["Connection"]).join(",").downcase.split(",").map(&:strip)
+      headers.keys.each do |key|
+        headers.delete(key) if HOP_BY_HOP_HEADERS[key.downcase] || connection_named.include?(key.downcase)
+      end
+      if Rack::Utils::STATUS_WITH_NO_ENTITY_BODY[code]
+        headers.delete("Content-Length")
+        headers.delete("Content-Type")
+      end
+      self.class.normalize_headers(headers)
     end
 
     # Resolve the Net::HTTP request class for an HTTP method, or nil if there is
@@ -340,6 +429,9 @@ module Rack
     # TLS option — notably the VERIFY_PEER default — can never land on only one.
     def configure_backend_connection(conn, use_ssl:, read_timeout:)
       conn.use_ssl = use_ssl
+      # Request input need not be rewindable. A transport retry could replay an
+      # operation with an empty or partial body, so neither path retries it.
+      conn.max_retries = 0
       conn.read_timeout = read_timeout
       conn.open_timeout = @open_timeout if @open_timeout
       conn.write_timeout = @write_timeout if @write_timeout

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-proxy
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 2.0.1
 platform: ruby
 authors:
 - Jacek Becela
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack