spinel-spinner 0.1.0.pre.1

data/lib/spinner/request_parser.rb

@@ -0,0 +1,183 @@
+module Spinner
+  class RequestError < StandardError
+    attr_reader :status
+
+    def initialize(status, message)
+      super(message)
+      @status = status
+    end
+  end
+
+  # Incremental framing stays separate from socket reads and application code.
+  class RequestParser
+    MAX_BODY_BYTES = 1048576
+    SUPPORTED_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+
+    attr_reader :method, :path, :query, :headers, :remainder, :content_length, :protocol
+
+    def initialize(max_header_bytes = 32768, server_port = "4000", scheme = "http", max_body_bytes = MAX_BODY_BYTES)
+      @max_body_bytes = max_body_bytes
+      @max_header_bytes = max_header_bytes
+      @buffer = "".b
+      @complete = false
+      @method = ""
+      @path = ""
+      @query = ""
+      @headers = {}
+      @remainder = "".b
+      @content_length = 0
+      @chunked = false
+      @expect_continue = false
+      @server_name = ""
+      @server_port = server_port
+      @scheme = scheme
+      @protocol = ""
+      @http_headers = {}
+    end
+
+    def complete?
+      @complete
+    end
+
+    def chunked?
+      @chunked
+    end
+
+    def expect_continue?
+      @expect_continue
+    end
+
+    def keep_alive?
+      tokens = @headers.fetch("connection", "").downcase.split(",").map(&:strip)
+      return false if tokens.include?("close")
+      @protocol == "HTTP/1.1" || tokens.include?("keep-alive")
+    end
+
+    def feed(bytes)
+      raise RequestError.new(400, "request already complete") if @complete
+      @buffer += bytes
+      boundary = @buffer.index("\r\n\r\n")
+      if boundary.nil?
+        raise RequestError.new(431, "headers too large") if @buffer.bytesize > @max_header_bytes
+        return false
+      end
+      size = boundary + 4
+      raise RequestError.new(431, "headers too large") if size > @max_header_bytes
+      head = @buffer.byteslice(0, boundary)
+      @remainder = @buffer.byteslice(size, @buffer.bytesize - size)
+      parse(head)
+      @buffer = "".b
+      @complete = true
+      true
+    end
+
+    def environment(body = "".b)
+      raise RequestError.new(400, "incomplete headers") unless @complete
+      env = {"REQUEST_METHOD" => @method, "SCRIPT_NAME" => "", "PATH_INFO" => @path,
+             "QUERY_STRING" => @query, "SERVER_NAME" => @server_name,
+             "SERVER_PORT" => @server_port, "SERVER_PROTOCOL" => @protocol,
+             "rack.url_scheme" => @scheme, "rack.input" => (body.is_a?(Input) ? body : Input.new(body))}
+      env["CONTENT_LENGTH"] = @headers["content-length"] if @headers.key?("content-length")
+      env["CONTENT_TYPE"] = @headers["content-type"] if @headers.key?("content-type")
+      @http_headers.each { |key, value| env[key] = value }
+      env
+    end
+
+    def parse(head)
+      lines = head.split("\r\n")
+      request = lines.shift.to_s
+      unless request.match?(/\A[!#$%&'*+.^_`|~0-9A-Za-z-]+ [^\x00-\x20\x7f-\xff]+ HTTP\/1\.[01]\z/n)
+        raise RequestError.new(400, "invalid request line")
+      end
+      parts = request.split(" ")
+      @method = parts[0]
+      @protocol = parts[2]
+      target = parts[1]
+      raise RequestError.new(400, "invalid request target") if target.include?("#")
+      @target_authority = nil
+      @target_scheme = nil
+      if target.start_with?("http://") || target.start_with?("https://")
+        match = target.match(/\A(https?):\/\/([^\/\?]+)(.*)\z/)
+        raise RequestError.new(400, "invalid absolute target") if match.nil?
+        @target_scheme = match[1]
+        @target_authority = match[2]
+        HostAuthority.new(@target_authority)
+        target = match[3]
+        target = "/" + target if target.empty? || target.start_with?("?")
+      end
+      raise RequestError.new(405, "unsupported method") if @method == "CONNECT"
+      unless target.start_with?("/") || (target == "*" && @method == "OPTIONS")
+        raise RequestError.new(400, "unsupported request target")
+      end
+      path_and_query = target.split("?", 2)
+      @path = path_and_query[0]
+      @query = path_and_query.length == 2 ? path_and_query[1] : ""
+
+      normalized_names = {}
+      lines.each do |line|
+        pair = line.split(":", 2)
+        unless pair.length == 2 && pair[0].match?(/\A[!#$%&'*+.^_`|~0-9A-Za-z-]+\z/)
+          raise RequestError.new(400, "invalid header")
+        end
+        name = pair[0].downcase
+        value = pair[1].strip
+        if pair[1].match?(/[\x00-\x08\x0a-\x1f\x7f]/)
+          raise RequestError.new(400, "invalid or duplicate header")
+        end
+        normalized = name.upcase.tr("-", "_")
+        if normalized_names.key?(normalized) && normalized_names[normalized] != name
+          raise RequestError.new(400, "ambiguous header normalization")
+        end
+        if (normalized == "CONTENT_TYPE" && name != "content-type") ||
+           (normalized == "CONTENT_LENGTH" && name != "content-length")
+          raise RequestError.new(400, "ambiguous content header")
+        end
+        normalized_names[normalized] = name
+        if @headers.key?(name)
+          if ["host", "content-length", "transfer-encoding", "content-type", "expect", "authorization", "sec-websocket-key", "sec-websocket-version"].include?(name)
+            raise RequestError.new(400, "duplicate singleton header")
+          end
+          value = @headers[name] + (name == "cookie" ? "; " : ", ") + value
+        end
+        @headers[name] = value
+        unless name == "content-type" || name == "content-length"
+          @http_headers["HTTP_#{normalized}"] = value
+        end
+      end
+      host = @headers.fetch("host", "")
+      if host.empty? && @protocol == "HTTP/1.0"
+        @server_name = "localhost"
+      else
+        @server_name = HostAuthority.new(host).name
+      end
+      unless @target_authority.nil?
+        default_port = @target_scheme == "https" ? "443" : "80"
+        canonical_target = @target_authority.downcase.delete_suffix(":" + default_port)
+        canonical_host = host.downcase.delete_suffix(":" + default_port)
+        raise RequestError.new(400, "conflicting target authority") unless canonical_target == canonical_host
+        raise RequestError.new(400, "conflicting target scheme") unless @target_scheme == @scheme
+      end
+      if @headers.key?("transfer-encoding")
+        raise RequestError.new(400, "HTTP/1.0 transfer encoding unsupported") if @protocol != "HTTP/1.1"
+        raise RequestError.new(400, "ambiguous message framing") if @headers.key?("content-length")
+        raise RequestError.new(400, "unsupported transfer encoding") unless @headers["transfer-encoding"].downcase == "chunked"
+        @chunked = true
+      end
+      length = @headers.fetch("content-length", "0")
+      raise RequestError.new(400, "invalid Content-Length") unless length.match?(/\A[0-9]+\z/)
+      # Compare decimal strings before conversion; even enormous valid lengths
+      # must be rejected without overflowing the compiler's integer type.
+      digits = length.sub(/\A0+/, "")
+      limit = @max_body_bytes.to_s
+      if digits.length > limit.length || (digits.length == limit.length && digits > limit)
+        raise RequestError.new(413, "request body exceeds configured limit")
+      end
+      @content_length = digits.empty? ? 0 : digits.to_i
+      raise RequestError.new(405, "unsupported method") unless SUPPORTED_METHODS.include?(@method)
+      if @headers.key?("expect")
+        raise RequestError.new(417, "expectations unsupported") unless @headers["expect"].downcase == "100-continue" && @protocol == "HTTP/1.1"
+        @expect_continue = true
+      end
+    end
+  end
+end

data/lib/spinner/response_writer.rb

@@ -0,0 +1,123 @@
+module Spinner
+  class ResponseWriter
+    def upgrade_header(response)
+      status, headers, body = response
+      raise ArgumentError, "expected upgrade response" unless status == 101 && body.is_a?(Upgrade)
+      unless headers.is_a?(Hash) && headers["upgrade"].is_a?(String) && headers["upgrade"].match?(/\A[!#$%&'*+.^_`|~0-9A-Za-z-]+(?:\/[!#$%&'*+.^_`|~0-9A-Za-z-]+)?\z/)
+        raise ArgumentError, "expected upgrade protocol"
+      end
+      # Reuse header validation, replacing only server-owned connection framing.
+      head = header(200, headers, nil, false, "HTTP/1.1", false)
+      head.sub("200 OK", "101 Switching Protocols").sub("connection: close", "connection: Upgrade")
+    end
+
+    def self.reason(status)
+      reasons = {200 => "OK", 201 => "Created", 202 => "Accepted", 204 => "No Content",
+                 205 => "Reset Content", 301 => "Moved Permanently", 302 => "Found",
+                 304 => "Not Modified", 400 => "Bad Request", 404 => "Not Found",
+                 405 => "Method Not Allowed", 408 => "Request Timeout",
+                 413 => "Content Too Large", 417 => "Expectation Failed",
+                 431 => "Request Header Fields Too Large", 500 => "Internal Server Error",
+                 503 => "Service Unavailable"}
+      reasons.fetch(status, "Response")
+    end
+
+    # Validate and serialize before any bytes reach the client.
+    def prepare(response, keep_alive = false, protocol = "HTTP/1.1", head_request = false)
+      unless response.is_a?(Array) && response.length == 3
+        raise ArgumentError, "expected [status, headers, body]"
+      end
+      status, headers, body = response
+      unless status.is_a?(Integer) && status >= 200 && status <= 599
+        raise ArgumentError, "expected a final HTTP status"
+      end
+      raise ArgumentError, "expected header hash" unless headers.is_a?(Hash)
+      raise ArgumentError, "expected body array" unless body.is_a?(Array)
+      length = 0
+      body.each do |chunk|
+        raise ArgumentError, "expected string body chunks" unless chunk.is_a?(String)
+        length += chunk.bytesize
+      end
+      if [204, 205, 304].include?(status) && length != 0
+        raise ArgumentError, "status requires an empty body"
+      end
+      head = header(status, headers, length, keep_alive, protocol, false)
+      chunks = [head]
+      body.each { |chunk| chunks << chunk } unless head_request
+      chunks
+    end
+
+    def prepare_stream(response, keep_alive = false, protocol = "HTTP/1.1")
+      unless response.is_a?(Array) && response.length == 3
+        raise ArgumentError, "expected [status, headers, body]"
+      end
+      status, headers, body = response
+      raise ArgumentError, "expected enumerable body" unless body.respond_to?(:each)
+      raise ArgumentError, "bodyless status cannot stream" if [204, 205, 304].include?(status)
+      chunked = protocol == "HTTP/1.1"
+      [header(status, headers, nil, keep_alive && chunked, protocol, chunked), chunked]
+    end
+
+    def header(status, headers, length, keep_alive, protocol, chunked)
+      unless status.is_a?(Integer) && status >= 200 && status <= 599
+        raise ArgumentError, "expected a final HTTP status"
+      end
+      raise ArgumentError, "expected header hash" unless headers.is_a?(Hash)
+      head = "#{protocol} #{status} #{ResponseWriter.reason(status)}\r\n"
+      headers.each do |name, value|
+        unless name.is_a?(String) && name.match?(/\A[!#$%&'*+.^_`|~0-9a-z-]+\z/)
+          raise ArgumentError, "expected lowercase header names"
+        end
+        values = value.is_a?(Array) ? value : [value]
+        values.each do |field|
+          raise ArgumentError, "invalid header value" unless field.is_a?(String) && !field.match?(/[\x00-\x08\x0a-\x1f\x7f]/)
+        end
+        raise ArgumentError, "transfer encoding unsupported" if name == "transfer-encoding"
+        next if name == "content-length" || name == "connection"
+        values.each { |field| head += "#{name}: #{field}\r\n" }
+      end
+      head += "transfer-encoding: chunked\r\n" if chunked
+      head += "content-length: #{length}\r\n" if !length.nil? && status != 204 && status != 304
+      head += "allow: #{RequestParser::SUPPORTED_METHODS.join(', ')}\r\n" if status == 405 && !headers.key?("allow")
+      head += "connection: #{keep_alive ? 'keep-alive' : 'close'}\r\n\r\n"
+      head
+    end
+
+    def write_stream(transport, response, deadline, head, chunked, head_request = false, idle_timeout = 30.0, client = nil)
+      body = response[2]
+      begin
+        write(transport, [head], deadline)
+        unless head_request
+          body.each do |part|
+            raise ArgumentError, "expected string body chunks" unless part.is_a?(String)
+            active_deadline = client.nil? ? deadline : client.stream_deadline
+            raise IOError, "stream idle timeout" if Transport.now >= active_deadline
+            next if part.empty?
+            deadline = Transport.now + idle_timeout
+            client.stream_deadline = deadline unless client.nil?
+            if chunked
+              write(transport, ["#{part.bytesize.to_s(16)}\r\n", part, "\r\n"], deadline)
+            else
+              write(transport, [part], deadline)
+            end
+          end
+          write(transport, ["0\r\n\r\n"], deadline) if chunked
+        end
+      ensure
+        body.close if body.respond_to?(:close)
+      end
+    end
+
+    def write(transport, chunks, deadline)
+      chunks.each do |chunk|
+        offset = 0
+        while offset < chunk.bytesize
+          remaining = chunk.byteslice(offset, chunk.bytesize - offset)
+          count = transport.write_some(remaining, deadline)
+          raise IOError, "invalid write progress" if count <= 0 || count > remaining.bytesize
+          offset += count
+        end
+      end
+    end
+  end
+end