rubygems-update 4.0.21 → 4.0.23

data/lib/rubygems/vendor/net-http/lib/net/http/header.rb

@@ -179,7 +179,9 @@
 # - #each_value: Passes each string field value to the block.
 #
 module Gem::Net::HTTPHeader
+  # The maximum length of HTTP header keys.
   MAX_KEY_LENGTH = 1024
+  # The maximum length of HTTP header values.
   MAX_FIELD_LENGTH = 65536
 
   def initialize_http_header(initheader) #:nodoc:
@@ -191,11 +193,9 @@ module Gem::Net::HTTPHeader
         warn "net/http: nil HTTP header: #{key}", uplevel: 3 if $VERBOSE
       else
         value = value.strip # raise error for invalid byte sequences
-        if key.to_s.bytesize > MAX_KEY_LENGTH
-          raise ArgumentError, "too long (#{key.bytesize} bytes) header: #{key[0, 30].inspect}..."
-        end
+        validate_field_name(key)
         if value.to_s.bytesize > MAX_FIELD_LENGTH
-          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize}"
+          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
         end
         if value.count("\r\n") > 0
           raise ArgumentError, "header #{key} has field value #{value.inspect}, this cannot include CR/LF"
@@ -261,20 +261,34 @@ module Gem::Net::HTTPHeader
   def add_field(key, val)
     stringified_downcased_key = key.downcase.to_s
     if @header.key?(stringified_downcased_key)
-      append_field_value(@header[stringified_downcased_key], val)
+      append_field_value(@header[stringified_downcased_key], val, key)
     else
       set_field(key, val)
     end
   end
 
+  # :stopdoc:
+  private def validate_field_name(key)
+    if key.to_s.bytesize > MAX_KEY_LENGTH
+      raise ArgumentError, "too long (#{key.to_s.bytesize} bytes) header: #{key.to_s[0, 30].inspect}..."
+    end
+    if /[\x00-\x1f\x7f:]/n.match?(key.to_s.b)
+      raise ArgumentError, "header field name cannot include control characters or colon: #{key.to_s[0, 30].inspect}"
+    end
+  end
+
   private def set_field(key, val)
+    validate_field_name(key)
     case val
     when Enumerable
       ary = []
-      append_field_value(ary, val)
+      append_field_value(ary, val, key)
       @header[key.downcase.to_s] = ary
     else
       val = val.to_s # for compatibility use to_s instead of to_str
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if val.b.count("\r\n") > 0
         raise ArgumentError, 'header field value cannot include CR/LF'
       end
@@ -282,18 +296,22 @@ module Gem::Net::HTTPHeader
     end
   end
 
-  private def append_field_value(ary, val)
+  private def append_field_value(ary, val, key)
     case val
     when Enumerable
-      val.each{|x| append_field_value(ary, x)}
+      val.each{|x| append_field_value(ary, x, key)}
     else
       val = val.to_s
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if /[\r\n]/n.match?(val.b)
         raise ArgumentError, 'header field value cannot include CR/LF'
       end
       ary.push val
     end
   end
+  # :startdoc:
 
   # Returns the array field value for the given +key+,
   # or +nil+ if there is no such field;
@@ -490,7 +508,7 @@ module Gem::Net::HTTPHeader
 
   alias canonical_each each_capitalized
 
-  def capitalize(name)
+  def capitalize(name)  # :nodoc:
     name.to_s.split('-'.freeze).map {|s| s.capitalize }.join('-'.freeze)
   end
   private :capitalize
@@ -613,11 +631,35 @@ module Gem::Net::HTTPHeader
   #   res = Gem::Net::HTTP.get_response(hostname, '/todos/1')
   #   res.content_length # => nil
   #
+  # The value must consist of digits only.
+  # Multiple <tt>'Content-Length'</tt> values are accepted
+  # only when they are all identical;
+  # otherwise Gem::Net::HTTPHeaderSyntaxError is raised.
+  # See {RFC 9110 Section 8.6}[https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6].
   def content_length
-    return nil unless key?('Content-Length')
-    len = self['Content-Length'].slice(/\d+/) or
-        raise Gem::Net::HTTPHeaderSyntaxError, 'wrong Content-Length format'
-    len.to_i
+    values = @header['content-length']
+    return nil if values.nil?
+
+    lengths = []
+    values.each do |value|
+      value = value.strip
+      if value.empty?
+        raise Gem::Net::HTTPHeaderSyntaxError,
+              "empty Content-Length value"
+      end
+      lengths.concat(value.split(/\s*,\s*/, -1))
+    end
+    if lengths.uniq.size != 1
+      raise Gem::Net::HTTPHeaderSyntaxError,
+            "Content-Length has multiple different values: " +
+            values.join(", ")
+    end
+    length = lengths.first
+    unless /\A\d+\z/.match?(length)
+      raise Gem::Net::HTTPHeaderSyntaxError,
+            "wrong Content-Length format: #{length}"
+    end
+    length.to_i
   end
 
   # Sets the value of field <tt>'Content-Length'</tt> to the given numeric;
@@ -643,7 +685,7 @@ module Gem::Net::HTTPHeader
   end
 
   # Returns +true+ if field <tt>'Transfer-Encoding'</tt>
-  # exists and has value <tt>'chunked'</tt>,
+  # exists and has <tt>'chunked'</tt> as its final transfer coding,
   # +false+ otherwise;
   # see {Transfer-Encoding response header}[https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#transfer-encoding-response-header]:
   #
@@ -651,10 +693,13 @@ module Gem::Net::HTTPHeader
   #   res['Transfer-Encoding'] # => "chunked"
   #   res.chunked?             # => true
   #
+  # <tt>'gzip, chunked'</tt> is chunked but <tt>'chunked, gzip'</tt> is not,
+  # because only the final transfer coding frames the message.
+  # See {RFC 9112 Section 6.3}[https://www.rfc-editor.org/rfc/rfc9112.html#section-6.3].
   def chunked?
     return false unless @header['transfer-encoding']
     field = self['Transfer-Encoding']
-    (/(?:\A|[^\-\w])chunked(?![\-\w])/i =~ field) ? true : false
+    (/(?:\A|[^\-\w])chunked(?![\-\w])\s*(?:,\s*)*\z/i =~ field) ? true : false
   end
 
   # Returns a Range object representing the value of field
@@ -770,7 +815,7 @@ module Gem::Net::HTTPHeader
   #
   # Gem::Net::HTTPHeader#content_type= is an alias for Gem::Net::HTTPHeader#set_content_type.
   def set_content_type(type, params = {})
-    @header['content-type'] = [type + params.map{|k,v|"; #{k}=#{v}"}.join('')]
+    set_field('Content-Type', type + params.map{|k,v|"; #{k}=#{v}"}.join(''))
   end
 
   alias content_type= set_content_type
@@ -957,12 +1002,12 @@ module Gem::Net::HTTPHeader
     @header['proxy-authorization'] = [basic_encode(account, password)]
   end
 
-  def basic_encode(account, password)
+  def basic_encode(account, password)   # :nodoc:
     'Basic ' + ["#{account}:#{password}"].pack('m0')
   end
   private :basic_encode
 
-# Returns whether the HTTP session is to be closed.
+  # Returns whether the HTTP session is to be closed.
   def connection_close?
     token = /(?:\A|,)\s*close\s*(?:\z|,)/i
     @header['connection']&.grep(token) {return true}
@@ -970,7 +1015,7 @@ module Gem::Net::HTTPHeader
     false
   end
 
-# Returns whether the HTTP session is to be kept alive.
+  # Returns whether the HTTP session is to be kept alive.
   def connection_keep_alive?
     token = /(?:\A|,)\s*keep-alive\s*(?:\z|,)/i
     @header['connection']&.grep(token) {return true}

data/lib/rubygems/vendor/net-http/lib/net/http/request.rb

@@ -61,6 +61,7 @@
 # - Gem::Net::HTTP::Options
 # - Gem::Net::HTTP::Trace
 # - Gem::Net::HTTP::Patch
+# - Gem::Net::HTTP::Query
 #
 # Subclasses for WebDAV requests:
 #

data/lib/rubygems/vendor/net-http/lib/net/http/requests.rb

@@ -19,9 +19,9 @@
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
@@ -29,6 +29,7 @@
 # - Gem::Net::HTTP#get: sends +GET+ request, returns response object.
 #
 class Gem::Net::HTTP::Get < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'GET'
   REQUEST_HAS_BODY  = false
   RESPONSE_HAS_BODY = true
@@ -51,15 +52,16 @@ end
 #
 # - Request body: optional.
 # - Response body: no.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
 # - Gem::Net::HTTP#head: sends +HEAD+ request, returns response object.
 #
 class Gem::Net::HTTP::Head < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'HEAD'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = false
@@ -85,9 +87,9 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: no.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: no.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
 #
 # Related:
 #
@@ -95,6 +97,7 @@ end
 # - Gem::Net::HTTP#post: sends +POST+ request, returns response object.
 #
 class Gem::Net::HTTP::Post < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'POST'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -120,9 +123,9 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
@@ -130,6 +133,7 @@ end
 # - Gem::Net::HTTP#put: sends +PUT+ request, returns response object.
 #
 class Gem::Net::HTTP::Put < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'PUT'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -153,15 +157,16 @@ end
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
 # - Gem::Net::HTTP#delete: sends +DELETE+ request, returns response object.
 #
 class Gem::Net::HTTP::Delete < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'DELETE'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = true
@@ -184,15 +189,16 @@ end
 #
 # - Request body: optional.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
 # - Gem::Net::HTTP#options: sends +OPTIONS+ request, returns response object.
 #
 class Gem::Net::HTTP::Options < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'OPTIONS'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = true
@@ -215,15 +221,16 @@ end
 #
 # - Request body: no.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: yes.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: yes.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
 # - Gem::Net::HTTP#trace: sends +TRACE+ request, returns response object.
 #
 class Gem::Net::HTTP::Trace < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'TRACE'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = true
@@ -249,20 +256,56 @@ end
 #
 # - Request body: yes.
 # - Response body: yes.
-# - {Safe}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Safe_methods]: no.
-# - {Idempotent}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Idempotent_methods]: no.
-# - {Cacheable}[https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Cacheable_methods]: no.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: no.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: no.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: no.
 #
 # Related:
 #
 # - Gem::Net::HTTP#patch: sends +PATCH+ request, returns response object.
 #
 class Gem::Net::HTTP::Patch < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'PATCH'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
 end
 
+# \Class for representing
+# {HTTP method QUERY}[https://www.rfc-editor.org/rfc/rfc10008.html]:
+#
+#   require 'rubygems/vendor/net-http/lib/net/http'
+#   uri = Gem::URI('http://example.com')
+#   hostname = uri.hostname # => "example.com"
+#   uri.path = '/posts'
+#   req = Gem::Net::HTTP::Query.new(uri) # => #<Gem::Net::HTTP::Query QUERY>
+#   req.body = '{"title": "foo","body": "bar","userId": 1}'
+#   req.content_type = 'application/json'
+#   res = Gem::Net::HTTP.start(hostname) do |http|
+#     http.request(req)
+#   end
+#
+# See {Request Headers}[rdoc-ref:Gem::Net::HTTPRequest@Request+Headers].
+#
+# Properties:
+#
+# - Request body: yes.
+# - Response body: yes.
+# - {Safe}[https://en.wikipedia.org/wiki/HTTP#Safe_method]: yes.
+# - {Idempotent}[https://en.wikipedia.org/wiki/HTTP#Idempotent_method]: yes.
+# - {Cacheable}[https://en.wikipedia.org/wiki/HTTP#Cacheable_method]: yes.
+#
+# Related:
+#
+# - Gem::Net::HTTP#query: sends +QUERY+ request, returns response object.
+#
+class Gem::Net::HTTP::Query < Gem::Net::HTTPRequest
+  # :stopdoc:
+  METHOD = 'QUERY'
+  REQUEST_HAS_BODY = true
+  RESPONSE_HAS_BODY = true
+end
+
 #
 # WebDAV methods --- RFC2518
 #
@@ -285,6 +328,7 @@ end
 # - Gem::Net::HTTP#propfind: sends +PROPFIND+ request, returns response object.
 #
 class Gem::Net::HTTP::Propfind < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'PROPFIND'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -308,6 +352,7 @@ end
 # - Gem::Net::HTTP#proppatch: sends +PROPPATCH+ request, returns response object.
 #
 class Gem::Net::HTTP::Proppatch < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'PROPPATCH'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -331,6 +376,7 @@ end
 # - Gem::Net::HTTP#mkcol: sends +MKCOL+ request, returns response object.
 #
 class Gem::Net::HTTP::Mkcol < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'MKCOL'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -354,6 +400,7 @@ end
 # - Gem::Net::HTTP#copy: sends +COPY+ request, returns response object.
 #
 class Gem::Net::HTTP::Copy < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'COPY'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = true
@@ -377,6 +424,7 @@ end
 # - Gem::Net::HTTP#move: sends +MOVE+ request, returns response object.
 #
 class Gem::Net::HTTP::Move < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'MOVE'
   REQUEST_HAS_BODY = false
   RESPONSE_HAS_BODY = true
@@ -400,6 +448,7 @@ end
 # - Gem::Net::HTTP#lock: sends +LOCK+ request, returns response object.
 #
 class Gem::Net::HTTP::Lock < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'LOCK'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
@@ -423,8 +472,8 @@ end
 # - Gem::Net::HTTP#unlock: sends +UNLOCK+ request, returns response object.
 #
 class Gem::Net::HTTP::Unlock < Gem::Net::HTTPRequest
+  # :stopdoc:
   METHOD = 'UNLOCK'
   REQUEST_HAS_BODY = true
   RESPONSE_HAS_BODY = true
 end
-

data/lib/rubygems/vendor/net-http/lib/net/http/response.rb

@@ -133,6 +133,13 @@
 # there is a protocol error.
 #
 class Gem::Net::HTTPResponse
+  # The maximum total size in bytes of the response header.
+  MAX_RESPONSE_HEADER_LENGTH = 1024 * 1024 # 1 MiB
+
+  # The maximum number of informational (1xx) responses accepted before the
+  # final response.
+  MAX_INFORMATIONAL_RESPONSES = 100
+
   class << self
     # true if the response has a body.
     def body_permitted?
@@ -152,10 +159,17 @@ class Gem::Net::HTTPResponse
       res
     end
 
+    def read_line(sock, limit, ignore_eof = false)   #:nodoc: internal use only
+      sock.readuntil("\n", ignore_eof, limit: limit)
+    rescue Gem::Net::ReadLimitExceeded
+      raise Gem::Net::HTTPBadResponse, 'response line too long'
+    end
+
     private
+    # :stopdoc:
 
     def read_status_line(sock)
-      str = sock.readline
+      str = read_line(sock, MAX_RESPONSE_HEADER_LENGTH).chop
       m = /\AHTTP(?:\/(\d+\.\d+))?\s+(\d\d\d)(?:\s+(.*))?\z/in.match(str) or
         raise Gem::Net::HTTPBadResponse, "wrong status line: #{str.dump}"
       m.captures
@@ -169,12 +183,19 @@ class Gem::Net::HTTPResponse
 
     def each_response_header(sock)
       key = value = nil
+      remaining = MAX_RESPONSE_HEADER_LENGTH
       while true
-        line = sock.readuntil("\n", true).sub(/\s+\z/, '')
+        line = read_line(sock, MAX_RESPONSE_HEADER_LENGTH, true)
+        remaining -= line.bytesize
+        raise Gem::Net::HTTPBadResponse, 'response header too large' if remaining < 0
+        line = line.chomp
         break if line.empty?
         if line[0] == ?\s or line[0] == ?\t and value
-          value << ' ' unless value.empty?
-          value << line.strip
+          folded = line.strip
+          unless folded.empty?
+            value << ' ' unless value.empty?
+            value << folded
+          end
         else
           yield key, value if key
           key, value = line.strip.split(/\s*:\s*/, 2)
@@ -259,7 +280,7 @@ class Gem::Net::HTTPResponse
   # header.
   attr_accessor :ignore_eof
 
-  def inspect
+  def inspect   # :nodoc:
     "#<#{self.class} #{@code} #{@message} readbody=#{@read}>"
   end
 
@@ -598,15 +619,20 @@ class Gem::Net::HTTPResponse
 
       @socket = inflate_body_io
 
-      clen = content_length()
-      if clen
-        @socket.read clen, dest, @ignore_eof
-        return
-      end
-      clen = range_length()
-      if clen
-        @socket.read clen, dest
-        return
+      # Transfer-Encoding overrides Content-Length, so a body that is not
+      # chunk-framed runs until the server closes the connection.
+      # See RFC 9112 Section 6.3.
+      unless @header['transfer-encoding']
+        clen = content_length()
+        if clen
+          @socket.read clen, dest, @ignore_eof
+          return
+        end
+        clen = range_length()
+        if clen
+          @socket.read clen, dest
+          return
+        end
       end
       @socket.read_all dest
     end
@@ -622,7 +648,7 @@ class Gem::Net::HTTPResponse
   def read_chunked(dest, chunk_data_io) # :nodoc:
     total = 0
     while true
-      line = @socket.readline
+      line = self.class.read_line(@socket, MAX_RESPONSE_HEADER_LENGTH).chop
       hexlen = line.slice(/[0-9a-fA-F]+/) or
           raise Gem::Net::HTTPBadResponse, "wrong chunk size line: #{line}"
       len = hexlen.hex
@@ -634,7 +660,7 @@ class Gem::Net::HTTPResponse
         @socket.read 2   # \r\n
       end
     end
-    until @socket.readline.empty?
+    until self.class.read_line(@socket, MAX_RESPONSE_HEADER_LENGTH).chop.empty?
       # none
     end
   end