savon 2.17.5 → 2.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ebee0f0be688d000144d03f78f17399219a59b9acdfa83a1416c603eaec79112
-  data.tar.gz: 3a5b2385872f10d4664f2cc298569e40249fe29e689194f0862148c0a474d5b1
+  metadata.gz: b824b46b6baa9ec754839a85d8f4225b62ba562b4d060143c6b02cd41e4880f8
+  data.tar.gz: fbaf6f7ed2607e3c24d356c6ffb282f089b1426fc89b8fdcde5c01918c657e9a
 SHA512:
-  metadata.gz: 15ee4696bf210268256cd8110312f1e329524ae7c9efe6cebac86dfa35f918dfb7a7583667f7ae12e46504da7ee3de36e015d643aafc5472cfcef5eefd15bb88
-  data.tar.gz: ea85b81ec385af37c4e6e992b646c16bbfd8ff03f64cd4ce697f5dcabe6ba316c3d7829262caf73f14a30858c3c1af5fb3e73663a6b278748e8a374f8f384005
+  metadata.gz: efd307c9e7dffa95ddccedf76b3bc675f27c3974d8742722ff2ebfb50b173ca687dd83a6a91fd97f637a56e5057e928d0dfa9adbcdfb0efb6c5c639215ba620f
+  data.tar.gz: 5170029557b974cb66c5adb409d339c3a2d044ee0427aca330e275878afbfbaf59d0d4f5c51bdd63fd9a68d1c4ec8720e617ac3ce09ad64cb59645d2872a948e

data/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.18.0] - 2026-11-05
+
+### Added
+
+* **`order!: :use_schema` orders a message like the WSDL's `xs:sequence`** ([#592](https://github.com/savonrb/savon/issues/592)). Nested hashes and arrays of hashes follow, and an explicit `order!` array on a nested hash still wins, whether the schema qualifies its elements or not. A level the schema doesn't describe, or a key it doesn't list (elements inside an `xs:choice` or `xs:group` included, which Wasabi doesn't record), raises `Savon::Error` instead of guessing the order: an explicit `order!` on that level works around it.
+
+* **`mtom: true` emits outbound MTOM/XOP request framing** ([#1047](https://github.com/savonrb/savon/pull/1047)). With `attachments`, the request becomes `multipart/related` with an `application/xop+xml` SOAP root part. This is low-level framing only: callers provide the `xop:Include` XML and matching attachment Content-IDs. Savon does not rewrite normal base64 XML into XOP, generate `xop:Include` nodes, validate those references, infer MIME types from the XML, or deserialize inbound MTOM responses. An attachment hash may set `content_id:` to choose its Content-ID independently of its filename, e.g. when the filename holds characters invalid in a header or two attachments share a filename. A Content-ID that is not ASCII or holds spaces or header punctuation raises `ArgumentError` when it was chosen explicitly or the request is MTOM; for plain attachments with a default filename it warns instead. Log output keeps non-Latin text in multipart bodies even next to binary attachments, and filters and pretty-printing now apply to the XML part of a multipart request instead of stopping at its MIME headers.
+
+### Security
+
+* `Savon::Model.operations` and `.all_operations` no longer rely on a hand-maintained list of reserved names. The guard now derives its denylist from the model's own ancestor chains — every method instances respond to plus every method the class object responds to — so a WSDL operation can never shadow an existing method. This closes the `class`/`public_send` bypass (unbounded recursion via the generated `self.class.public_send(...)` bodies, hijacked reflective dispatch) and the whole class of follow-on reports (`new`, `freeze`, `send`, …) by construction instead of one advisory at a time. Re-registering an already-defined operation is still allowed; anything else that collides raises `ArgumentError`. Call such operations explicitly through `model.client.call(:operation, ...)`.
+
+### Fixed
+
+* `Builder` no longer reuses a reserved `xml`-prefixed identifier from the WSDL namespace map. When a schema's `targetNamespace` matched the WSDL root's default namespace, requests declared `xmlns:xmlns` and used elements like `<xmlns:Op>`, so the envelope was not namespace-well-formed. Such namespaces now get another prefix the WSDL declares for the same URI, or `ins0`, `ins1`, … if there is none.
+
+* Elements whose types live in another namespace now keep their own prefix instead of `tns:` ([#895](https://github.com/savonrb/savon/issues/895)). Strict services rejected those messages. The type lookup missed because message keys pass through the key converter first (`:entity_ids` becomes `entityIds` while the schema defines `EntityIds`), so every element fell back to `tns:`. The lookup now tries a case-insensitive match when an exact match misses.
+
+* A document with a WSSE signature is built three times instead of twice, which signed timestamps need ([#1079](https://github.com/savonrb/savon/pull/1079)). See [akami#25](https://github.com/savonrb/akami/pull/25).
+
+### Changed
+
+* A URL assigned directly to `client.wsdl.endpoint` is overridden by per-operation port routing once wasabi 5.2 ships ([#879](https://github.com/savonrb/savon/issues/879)). `EffectiveOptions#endpoint` now asks the WSDL document for the current operation's port endpoint first and only falls back to the document-wide address. Pass `:endpoint` explicitly instead — that is still checked first and wins.
+
+### Performance
+
+* `Builder` looks up the namespace identifier of each WSDL type path with `Hash#key` instead of a `gsub` per candidate prefix: requests built from a 110 KB WSDL allocate 21% fewer objects and 42% less memory.
+
 ## [2.17.5] - 2026-09-09
 
 ### Security

data/README.md

@@ -66,6 +66,25 @@ See [Authentication](https://savonrb.com/version2/globals.html) on the website f
 
 Savon uses [HTTPI](https://github.com/savonrb/httpi) for HTTP by default. Since v2.17.0 you can opt-in to use Faraday by passing `transport: :faraday` which exposes the Faraday connection at `client.faraday` for you to configure. Savon is only adding some SOAP-specifics on top.
 
+### MTOM/XOP attachments
+
+To send a binary file with MTOM, pass a pre-built envelope with an `xop:Include` reference, set `mtom: true`, and give the matching attachment. The Content-ID must match the `cid:` href; set `content_id:` on the attachment when it differs from the filename:
+
+```ruby
+client.call(:upload,
+  xml: <<~XML,
+    <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
+                   xmlns:xop="http://www.w3.org/2004/08/xop/include">
+      <soap:Body>
+        <tns:upload><tns:file><xop:Include href="cid:doc1@example"/></tns:file></tns:upload>
+      </soap:Body>
+    </soap:Envelope>
+  XML
+  mtom: true,
+  attachments: [{ filename: "report.pdf", content_id: "doc1@example", content: File.binread("report.pdf") }]
+)
+```
+
 ## Ruby support
 
 Savon 2.x requires Ruby >= 3.0.0, kept as the lower bound for backward compatibility. Note that Ruby 3.0–3.3 are EOL or security-only. Ruby 3.4+ is the minimum version with active maintenance.
@@ -84,6 +103,8 @@ Callers on 2.13.0–2.15.x may see specific post-2.12.1 behaviors restored to th
 
 **WSDL imports are not followed.** Savon parses only the root WSDL document via [Wasabi](https://github.com/savonrb/wasabi). Messages, port types, and bindings defined in imported files are invisible to Savon. If you control the WSDL, merge the imported elements into the root document and pass that to Savon as a string. If you need full import support, the [WSDL](https://rubygems.org/gems/wsdl) gem is an alternative.
 
+**MTOM/XOP support is request framing only.** Savon can emit outbound MTOM/XOP request framing, but it does not rewrite normal base64 XML into XOP, generate `xop:Include` nodes, validate references, infer MIME types from XML, or deserialize inbound MTOM responses. Callers provide the `xop:Include` XML and matching attachment Content-IDs. `mtom: true` without `attachments` has no effect. For SOAP 1.2, the action is still sent as a `SOAPAction` header, as elsewhere in Savon, rather than as the `action=` parameter of the start-info media type.
+
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md). Everyone interacting in Savon's codebases, issue trackers, and discussion forums is expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md). MIT licensed.

data/lib/savon/builder.rb

@@ -30,6 +30,11 @@ module Savon
       2 => "http://www.w3.org/2003/05/soap-envelope"
     }.freeze
 
+    SOAP_XOP_REQUEST_TYPE = {
+      1 => "text/xml",
+      2 => "application/soap+xml"
+    }.freeze
+
     # @deprecated Use {Savon::Addressing::NAMESPACE} instead. This alias will
     #   be removed in Savon 3.0.
     WSA_NAMESPACE = Addressing::NAMESPACE
@@ -63,7 +68,7 @@ module Savon
       if @signature
         @signature.document = xml_result
 
-        2.times do
+        3.times do
           @header = nil
           @signature.document = build_xml
         end
@@ -124,7 +129,7 @@ module Savon
       @internal_namespace_count ||= 0
 
       unless (identifier = namespace_by_uri(uri))
-        wsdl_identifier = @wsdl.document? ? @wsdl.parser.namespaces.key(uri) : nil
+        wsdl_identifier = wsdl_namespace_identifier(uri)
         # The prefix may already be taken by the target namespace or a user-supplied
         # :namespaces override - fall back to ins0, ins1... rather than overwriting it.
         wsdl_identifier = nil if wsdl_identifier && namespaces.key?("xmlns:#{wsdl_identifier}")
@@ -136,6 +141,12 @@ module Savon
       [path, identifier]
     end
 
+    def wsdl_namespace_identifier(uri)
+      return unless @wsdl.document?
+
+      @wsdl.parser.namespaces.find { |key, value| value == uri && !key.downcase.start_with?("xml") }&.first
+    end
+
     def namespaces_with_globals
       namespaces.merge @globals[:namespaces]
     end
@@ -188,7 +199,7 @@ module Savon
         break if @locals[:message].nil?
 
         message_locals = @locals[:message][StringUtils.snakecase(message).to_sym]
-        message_content = Message.new(message_tag, namespace_identifier, @types, @used_namespaces, message_locals, :unqualified, @globals[:convert_request_keys_to], @globals[:unwrap]).to_s
+        message_content = Message.new(type.last, namespace_identifier, @types, @used_namespaces, message_locals, :unqualified, @globals[:convert_request_keys_to], @globals[:unwrap]).to_s
         messages += "<#{message} xsi:type=\"#{type.join(':')}\">#{message_content}</#{message}>"
       end
       messages
@@ -236,10 +247,7 @@ module Savon
     end
 
     def namespace_by_uri(uri)
-      namespaces.each do |candidate_identifier, candidate_uri|
-        return candidate_identifier.gsub(/^xmlns:/, '') if candidate_uri == uri
-      end
-      nil
+      namespaces.key(uri)&.delete_prefix("xmlns:")
     end
 
     def builder
@@ -277,15 +285,31 @@ module Savon
 
       # the mail.body.encoded algorithm reorders the parts, default order is [ "text/plain", "text/enriched", "text/html" ]
       # should redefine the sort order, because the soap request xml should be the first
-      multipart_message.body.set_sort_order ["text/xml"]
+      multipart_message.body.set_sort_order(
+        @locals[:mtom] ? ["application/xop+xml", "text/xml"] : ["text/xml"]
+      )
 
       multipart_message.body.encoded(multipart_message.content_transfer_encoding)
     end
 
     def init_multipart_message(message_xml)
       multipart_message = Mail.new
+
+      # MTOM differs from general SOAP attachments:
+      # 1. binary encoding
+      # 2. application/xop+xml mime type
+      if @locals[:mtom]
+        type = "application/xop+xml; charset=#{@globals[:encoding]}; " \
+               "type=\"#{SOAP_XOP_REQUEST_TYPE[@globals[:soap_version]]}\""
+
+        multipart_message.transport_encoding = 'binary'
+        message_xml = message_xml.dup.force_encoding('BINARY')
+      else
+        type = 'text/xml'
+      end
+
       xml_part = Mail::Part.new do
-        content_type 'text/xml'
+        content_type type
         body message_xml
         # in Content-Type the start parameter is recommended (RFC 2387)
         content_id '<soap-request-body@soap>'
@@ -305,19 +329,43 @@ module Savon
       if @locals[:attachments].is_a? Hash
         # hash example: { 'att1' => '/path/to/att1', 'att2' => '/path/to/att2' }
         @locals[:attachments].each do |identifier, attachment|
+          explicit = attachment.is_a?(Hash) && attachment.key?(:content_id)
+          identifier = attachment[:content_id] if explicit
+          validate_content_id!(identifier, explicit: explicit)
           add_attachment_to_multipart_message(multipart_message, attachment, identifier)
         end
       elsif @locals[:attachments].is_a? Array
         # array example: [ '/path/to/att1', '/path/to/att2' ]
         # array example: [ { filename: 'att1.xml', content: '<x/>' }, { filename: 'att2.xml', content: '<y/>' } ]
         @locals[:attachments].each do |attachment|
-          add_attachment_to_multipart_message(multipart_message, attachment, attachment.is_a?(String) ? File.basename(attachment) : attachment[:filename])
+          explicit = attachment.is_a?(Hash) && attachment.key?(:content_id)
+          identifier = attachment.is_a?(String) ? File.basename(attachment) : (attachment[:content_id] || attachment[:filename])
+          validate_content_id!(identifier, explicit: explicit)
+          add_attachment_to_multipart_message(multipart_message, attachment, identifier)
         end
       end
     end
 
+    # Content-IDs are matched against xop:Include hrefs, and the mail library cuts the header at the first
+    # space, so an ID with non-ASCII characters, spaces or header punctuation silently stops matching.
+    # Fail fast when the caller chose the ID or the request is MTOM; for plain attachments, whose default
+    # filename IDs predate this check, warn instead so current users do not break.
+    def validate_content_id!(identifier, explicit:)
+      id = identifier.to_s
+      return if !id.empty? && id.ascii_only? && id !~ /[\s()<>,;:"\[\]]/
+
+      message = "Invalid Content-ID #{id.inspect}: use ASCII without spaces or ()<>,;:\"[]. " \
+                "Set content_id: on the attachment to choose a valid ID."
+      raise ArgumentError, message if explicit || @locals[:mtom]
+
+      warn "#{message} The filename is used as-is.", uplevel: 1
+    end
+
     def add_attachment_to_multipart_message(multipart_message, attachment, identifier)
-      multipart_message.add_file attachment.clone
+      # :content_id only selects the Content-ID header; the mail part itself
+      # takes its filename from :filename, so it must not reach add_file.
+      file = attachment.is_a?(Hash) ? attachment.reject { |key, _| key == :content_id } : attachment
+      multipart_message.add_file file.clone
       multipart_message.parts.last.content_id = multipart_message.parts.last.content_location = identifier.to_s
     end
   end

data/lib/savon/effective_options.rb

@@ -45,18 +45,23 @@ module Savon
 
     # Resolves the endpoint URL the request is sent to.
     #
-    # A global +:endpoint+ wins over the service address of the WSDL. The
-    # global +:host+ option replaces host and port of the WSDL address and
-    # keeps scheme, path and query. The override is applied to a copy. The
-    # WSDL document keeps its parsed address.
+    # A global +:endpoint+ wins over the service address of the WSDL. When
+    # the WSDL document exposes per-port endpoints (wasabi >= 5.2), the
+    # address of the port serving the current operation wins over the
+    # document-wide address. The global +:host+ option replaces host and
+    # port of the winning address and keeps scheme, path and query. The
+    # override is applied to a copy. The WSDL document keeps its parsed
+    # address.
     #
     # @return [URI, String, nil] the endpoint as provided by the winning source
     def endpoint
       return @globals[:endpoint] if @globals[:endpoint]
-      return @wsdl.endpoint unless @globals[:host]
+
+      url = operation_endpoint || @wsdl.endpoint
+      return url unless @globals[:host]
 
       host_url = URI.parse(@globals[:host])
-      url      = @wsdl.endpoint.dup
+      url      = url.dup
       url.host = host_url.host
       url.port = host_url.port
       url
@@ -111,6 +116,16 @@ module Savon
 
     private
 
+    # Resolves the endpoint of the port serving the current operation.
+    # Returns +nil+ when the WSDL document has no per-port endpoint API
+    # (wasabi < 5.2) or when no port serves the operation, so the caller
+    # falls back to the document-wide endpoint.
+    def operation_endpoint
+      return unless @wsdl.document? && @wsdl.respond_to?(:endpoint_for_operation)
+
+      @wsdl.endpoint_for_operation(@operation_name, soap_version: @globals[:soap_version])
+    end
+
     # Resolves an option where a local +false+ is meaningful and disables it.
     # Only a local +nil+ falls through to the global value. Contrast with
     # {#wsse_signature}, which treats any falsy local as unset.

data/lib/savon/log_message.rb

@@ -4,6 +4,8 @@ require "nokogiri"
 
 module Savon
   class LogMessage
+    MIME_HEADER_PREFIX = /\A\s*[A-Za-z0-9-]+:/
+
     def initialize(message, filters = [], pretty_print = false)
       @message      = message
       @filters      = filters
@@ -11,20 +13,67 @@ module Savon
     end
 
     def to_s
-      message_is_xml = @message =~ /^</
+      message = @message
+      begin
+        message_is_xml = xml_start(message)
+      rescue ArgumentError
+        # The message encoding holds invalid bytes (e.g. a binary multipart
+        # body mistagged as UTF-8): search the bytes instead of raising.
+        message = message.b
+        message_is_xml = xml_start(message)
+      end
       has_filters    = @filters.any?
       pretty_print   = @pretty_print
 
       return @message unless message_is_xml
       return @message unless has_filters || pretty_print
 
-      document = Nokogiri.XML(@message)
+      # The message may be multipart, cut off extra lines before open tag
+      # and stop at the next MIME boundary, so the attachments that follow the
+      # XML part do not make the document invalid.
+      xml_end = message.index(/\r?\n--/, message_is_xml) || message.length
+      document = Nokogiri.XML(message[message_is_xml...xml_end])
       document = apply_filter(document) if has_filters
       document.to_xml(nokogiri_options)
     end
 
     private
 
+    # The index of the XML document in the message. Multipart messages have MIME
+    # headers before the XML part, and these can contain '<' (Content-ID: <...>).
+    # If the first '<' is on a header line, the document starts at the first '<'
+    # after the next blank line. A '<' before any blank line that is not on a
+    # header line belongs to the document itself (e.g. a declaration-less
+    # envelope with blank lines inside it).
+    #
+    # A fixed set of searches, plus a loop that only advances forward past
+    # nested header tags, so the search stays linear in the message size.
+    # Log input is attacker-influenced on the response side, so logging must
+    # never be a slow path.
+    def xml_start(message)
+      message.index("<?xml") || first_tag(message)
+    end
+
+    def first_tag(message)
+      first = message.index("<")
+      return first unless first && mime_header_line?(message, first)
+
+      pos = first
+      loop do
+        blank_line = message.index(/\r?\n\r?\n/, pos)
+        tag = blank_line && message.index("<", blank_line)
+        return first unless tag
+        return tag unless mime_header_line?(message, tag)
+
+        pos = tag
+      end
+    end
+
+    def mime_header_line?(message, index)
+      line_start = (message.rindex("\n", index) || -1) + 1
+      message[line_start...index].match?(MIME_HEADER_PREFIX)
+    end
+
     def apply_filter(document)
       return document unless document.errors.empty?
 

data/lib/savon/message.rb

@@ -22,6 +22,9 @@ module Savon
 
       if @element_form_default == :qualified
         @message = QualifiedMessage.new(@types, @used_namespaces, @key_converter).to_hash(@message, [@message_tag.to_s])
+      elsif schema_order?(@message)
+        unqualified = QualifiedMessage.new(@types, @used_namespaces, @key_converter, qualify: false)
+        @message = unqualified.to_hash(@message, [@message_tag.to_s])
       end
 
       gyoku_options = {
@@ -33,5 +36,15 @@ module Savon
 
       Gyoku.xml(@message, gyoku_options)
     end
+
+    private
+
+    def schema_order?(value)
+      case value
+      when Hash then QualifiedMessage.order_option(value) == :use_schema || value.each_value.any? { |nested| schema_order?(nested) }
+      when Array then value.any? { |nested| schema_order?(nested) }
+      else false
+      end
+    end
   end
 end

data/lib/savon/model.rb

@@ -45,13 +45,24 @@ module Savon
     # Returns the generated Ruby method name for a SOAP operation.
     def operation_method_name(operation)
       method_name = StringUtils.snakecase(operation.to_s).to_sym
-      reserved_methods = Model.instance_methods(false) + Model.private_instance_methods(false) +
-                         %i[client global raise_initialization_error!]
+      # Re-registering an operation stays allowed; any other name must not shadow a method the model already responds to.
+      return method_name if generated_operation_names.include?(method_name)
+
+      reserved_methods = instance_methods + private_instance_methods +
+                         singleton_class.instance_methods + singleton_class.private_instance_methods
       raise ArgumentError, "SOAP operation #{operation.inspect} conflicts with reserved Savon::Model method #{method_name.inspect}" if reserved_methods.include?(method_name)
 
       method_name
     end
 
+    # Names of operations already turned into methods on this model. The builder methods
+    # (client, global, raise_initialization_error!) live in the same modules but are not
+    # operations, so they stay reserved.
+    def generated_operation_names
+      (class_operation_module.instance_methods(false) + instance_operation_module.instance_methods(false)).uniq -
+        %i[client global raise_initialization_error!]
+    end
+
     # Class methods.
     def class_operation_module
       @class_operation_module ||= Module.new do

data/lib/savon/operation.rb

@@ -30,6 +30,7 @@ module Savon
       1 => "text/xml",
       2 => "application/soap+xml"
     }.freeze
+    SOAP_REQUEST_TYPE_MTOM = "application/xop+xml"
 
     def self.create(operation_name, wsdl, globals, transport)
       if wsdl.document?
@@ -133,9 +134,16 @@ module Savon
 
       if builder.multipart
         # RFC 2387 §3 (multipart/related) - SOAP envelope is the root body part
+        content_type = ["multipart/related"]
+        if @locals[:mtom]
+          content_type << "type=\"#{SOAP_REQUEST_TYPE_MTOM}\""
+          content_type << "start-info=\"#{SOAP_REQUEST_TYPE[@globals[:soap_version]]}\""
+        else
+          content_type << "type=\"#{SOAP_REQUEST_TYPE[@globals[:soap_version]]}\""
+        end
+
         headers["Content-Type"] = [
-          "multipart/related",
-          "type=\"#{SOAP_REQUEST_TYPE[@globals[:soap_version]]}\"",
+          *content_type,
           "start=\"#{builder.multipart[:start]}\"",
           "boundary=\"#{builder.multipart[:multipart_boundary]}\""
         ].join("; ")

data/lib/savon/options.rb

@@ -499,7 +499,8 @@ module Savon
       defaults = {
         advanced_typecasting: true,
         response_parser: :nokogiri,
-        multipart: false
+        multipart: false,
+        mtom: false
       }
 
       super defaults.merge(options)
@@ -532,7 +533,10 @@ module Savon
     #
     # should pass an Array or a Hash; items should be path strings or
     #  { filename: 'file.name', content: 'content' } objects
-    # The Content-ID in multipart message sections will be the filename or the key if Hash is given
+    # The Content-ID in multipart message sections will be the filename or the key if Hash is given.
+    # An attachment hash may set content_id: to use a different Content-ID, e.g. when the
+    # filename holds characters that are invalid in a header, or when two attachments
+    # share a filename. Without content_id:, the Content-ID defaults to the filename or key.
     #
     # usage examples:
     #
@@ -562,6 +566,17 @@ module Savon
       @options[:attachments] = attachments
     end
 
+    # Emit outbound MTOM/XOP request framing for attachments.
+    #
+    # This is a low-level framing option. Savon does not rewrite normal base64 XML
+    # into XOP or process inbound MTOM responses. Callers must provide XML with
+    # xop:Include href="cid:..." references and matching attachment Content-IDs.
+    # It has no effect without attachments. An attachment hash may set
+    # content_id: to choose its Content-ID independently of its filename.
+    def mtom(mtom)
+      @options[:mtom] = mtom
+    end
+
     # Value of the SOAPAction HTTP header.
     def soap_action(soap_action)
       @options[:soap_action] = soap_action

data/lib/savon/qualified_message.rb

@@ -4,50 +4,130 @@ require "gyoku"
 
 module Savon
   class QualifiedMessage
-    def initialize(types, used_namespaces, key_converter)
+    # With qualify: false, keys and values are left as they are: only
+    # order!: :use_schema applies, for schemas with unqualified elements.
+    def initialize(types, used_namespaces, key_converter, qualify: true)
       @types           = types
       @used_namespaces = used_namespaces
       @key_converter   = key_converter
+      @qualify         = qualify
+
+      # Schema tables are keyed by exact element names, but message keys pass
+      # through the key converter first (:entity_ids becomes "entityIds" while
+      # the schema says "EntityIds"). Index both tables by downcased path so a
+      # converted key can still find its schema entry. Exact matches always win.
+      @types_index           = index_by_normalized_path(types)
+      @used_namespaces_index = index_by_normalized_path(used_namespaces)
     end
 
-    def to_hash(hash, path)
+    def to_hash(hash, path, schema_order: false)
       return hash unless hash
-      return hash.map { |value| to_hash(value, path) } if hash.is_a?(Array)
-      return hash.to_s unless hash.is_a?(Hash)
+      return hash.map { |value| to_hash(value, path, schema_order: schema_order) } if hash.is_a?(Array)
+      return scalar(hash) unless hash.is_a?(Hash)
+
+      schema_order ||= self.class.order_option(hash) == :use_schema
+      tags_by_key = {}
 
-      hash.each_with_object({}) do |(key, value), newhash|
+      newhash = hash.each_with_object({}) do |(key, value), newhash|
         case key
-        when :order!
-          newhash[key] = add_namespaces_to_values(value, path)
+        when :order!, "order!"
+          newhash[key] = add_namespaces_to_values(value, path) unless value == :use_schema
         when :attributes!, :content!
           newhash[key] = to_hash(value, path)
         else
           if key.to_s =~ /!$/
             newhash[key] = value
+            tags_by_key[key] = translate_tag(key)
           else
             translated_key  = translate_tag(key)
             newkey          = add_namespaces_to_values(key, path).first
             newpath         = path + [translated_key]
-            newhash[newkey] = to_hash(value, @types[newpath] ? [@types[newpath]] : newpath)
+            type            = lookup(@types, @types_index, newpath)
+            newhash[newkey] = to_hash(value, type ? [type] : newpath, schema_order: schema_order)
+            tags_by_key[newkey] = translated_key unless key.to_s.start_with?("@")
           end
         end
         newhash
       end
+
+      newhash[:order!] = order_by_schema(tags_by_key, path) if schema_order && order_by_schema?(hash)
+      newhash
+    end
+
+    def self.order_option(hash)
+      hash.key?(:order!) ? hash[:order!] : hash["order!"]
     end
 
     private
 
+    # An explicit order! wins, and a hash with content! is a single element.
+    def order_by_schema?(hash)
+      [nil, :use_schema].include?(self.class.order_option(hash)) && !hash.key?(:content!)
+    end
+
+    def scalar(value)
+      @qualify ? value.to_s : value
+    end
+
     def translate_tag(key)
       Gyoku.xml_tag(key, key_converter: @key_converter).to_s
     end
 
     def add_namespaces_to_values(values, path)
+      return Array(values) unless @qualify
+
       Array(values).collect do |value|
         translated_value = translate_tag(value)
         namespace_path   = path + [translated_value]
-        namespace        = @used_namespaces[namespace_path] || ''
+        namespace        = lookup(@used_namespaces, @used_namespaces_index, namespace_path) || ''
         namespace.empty? ? value : "#{namespace}:#{translated_value}"
       end
     end
+
+    # Wasabi doesn't record elements inside an xs:choice or xs:group, so they
+    # are unknown keys too: raise rather than guess where they go.
+    def order_by_schema(tags_by_key, path)
+      children = schema_children(path)
+      if children.empty? && tags_by_key.any?
+        raise Error, "order!: :use_schema found no schema sequence for #{path.join('/')}: " \
+                     "give this level its own order! array"
+      end
+
+      position_by_tag = children.each_with_index.to_h
+      unknown_tags = tags_by_key.values.reject { |tag| position_by_tag.key?(tag.downcase) }
+      if unknown_tags.any?
+        raise Error, "order!: :use_schema found no schema element for #{unknown_tags.join(', ')} in #{path.join('/')}: " \
+                     "give this level its own order! array"
+      end
+
+      tags_by_key.keys.sort_by { |key| position_by_tag.fetch(tags_by_key[key].downcase) }
+    end
+
+    def schema_children(path)
+      parent = normalize_path(path)
+      (@schema_children ||= {})[parent] ||= @used_namespaces_index.keys.filter_map { |child|
+        child.last if child.length == parent.length + 1 && child.first(parent.length) == parent
+      }
+    end
+
+    # Finds the schema entry for a message path. Converted message keys rarely
+    # match schema element names exactly ("entityIds" vs "EntityIds"), so fall
+    # back to a case-insensitive match when the exact lookup misses.
+    def lookup(table, index, path)
+      return table[path] if table.key?(path)
+
+      original = index[normalize_path(path)]
+      original && table[original]
+    end
+
+    def normalize_path(path)
+      path.map { |segment| segment.to_s.downcase }
+    end
+
+    def index_by_normalized_path(table)
+      table.each_with_object({}) do |(path, _), memo|
+        memo[normalize_path(path)] ||= path
+      end
+    end
   end
 end

data/lib/savon/transport/logging.rb

@@ -53,7 +53,14 @@ module Savon
       end
 
       def body_to_log(body)
-        LogMessage.new(body, @globals[:filters], @globals[:pretty_print_xml]).to_s
+        message = LogMessage.new(body, @globals[:filters], @globals[:pretty_print_xml]).to_s
+
+        # A multipart body is tagged binary only so its parts can be concatenated: the text parts are already in the
+        # log encoding. Transcoding from ASCII-8BIT would replace every non-ASCII byte, the text included, so relabel
+        # the bytes and replace only those that are invalid in the log encoding (the binary attachments).
+        return message.dup.force_encoding(@globals[:encoding]).scrub if message.encoding == Encoding::BINARY
+
+        message.encode(@globals[:encoding], invalid: :replace, undef: :replace)
       end
     end
   end

data/lib/savon/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Savon
-  VERSION = '2.17.5'
+  VERSION = '2.18.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: savon
 version: !ruby/object:Gem::Version
-  version: 2.17.5
+  version: 2.18.0
 platform: ruby
 authors:
 - Daniel Harrington
@@ -245,6 +245,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.9'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 description: Heavy metal SOAP client
 email: me@rubiii.com
 executables: []