wreq 1.2.5 → 1.2.7

data/test/cookie_test.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require "test_helper"
+require "bigdecimal"
+require "open3"
+require "rbconfig"
 
 class CookieTest < Minitest::Test
   def setup
@@ -41,6 +44,14 @@ class CookieTest < Minitest::Test
     assert_equal true, (c.secure || c.secure?)
   end
 
+  def test_add_rejects_invalid_cookie_type
+    error = assert_raises(TypeError) do
+      @jar.add(Object.new, @base_url)
+    end
+
+    assert_equal "cookie must be a Wreq::Cookie or String", error.message
+  end
+
   def test_add_multiple_and_remove
     @jar.add("a=1; Path=/", @base_url)
     @jar.add("b=2; Path=/", @base_url)
@@ -84,7 +95,9 @@ class CookieTest < Minitest::Test
     @jar.add("exp=1; Expires=#{t.gmtime.strftime("%a, %d %b %Y %H:%M:%S GMT")}; Path=/", @base_url)
     c2 = @jar.get_all.find { |c| c.name == "exp" }
     assert c2
-    # expires returns Float (unix seconds) or nil
+    # expires_at returns Time. expires remains available for numeric callers.
+    assert_kind_of Time, c2.expires_at
+    assert_predicate c2.expires_at, :utc?
     if (e = c2.expires)
       assert_kind_of Float, e
       assert_operator e, :>, Time.now.to_f - 1_000_000 # sanity bound
@@ -104,15 +117,18 @@ class CookieTest < Minitest::Test
     assert_nil c.domain
     assert_nil c.max_age
     assert_nil c.expires
+    assert_nil c.expires_at
 
     assert_equal false, (c.http_only || c.http_only?)
     assert_equal false, (c.secure || c.secure?)
     assert_equal false, c.same_site_lax?
     assert_equal false, c.same_site_strict?
+    assert_nil c.same_site
+    assert_equal "sid=abc", c.to_s
   end
 
   def test_cookie_new_full_attributes
-    exp = Time.now.to_f + 7200.0
+    exp = Time.utc(2030, 1, 1, 0, 0, Rational(123_456_789, 1_000_000_000))
     c = Wreq::Cookie.new("sess", "v",
       domain: "example.com",
       path: "/",
@@ -130,16 +146,199 @@ class CookieTest < Minitest::Test
     # Max-Age returns seconds as Integer
     assert_equal 3600, c.max_age
 
-    # Expires returns Float seconds-since-epoch (with small tolerance)
-    assert c.expires
-    assert_kind_of Float, c.expires
-    assert_in_delta exp, c.expires, 2.0
+    assert_equal exp, c.expires_at
+    assert_predicate c.expires_at, :utc?
+    assert_in_delta exp.to_f, c.expires, 1e-6
 
     assert_equal true, (c.http_only || c.http_only?)
     assert_equal true, (c.secure || c.secure?)
-    # constructor currently sets SameSite to none
     assert_equal true, c.same_site_lax?
     assert_equal false, c.same_site_strict?
+    assert_equal Wreq::SameSite::Lax, c.same_site
+  end
+
+  def test_same_site_reader_distinguishes_none_from_unset
+    cookie = Wreq::Cookie.new("same-site", "value", same_site: Wreq::SameSite::None)
+
+    assert_equal Wreq::SameSite::None, cookie.same_site
+    refute cookie.same_site_lax?
+    refute cookie.same_site_strict?
+  end
+
+  def test_cookie_new_uses_shared_keyword_validation
+    cookie = Wreq::Cookie.new("sid", "abc", **{"path" => "/"})
+    assert_equal "/", cookie.path
+
+    secret = "must-not-appear"
+    unknown_error = assert_raises(ArgumentError) do
+      Wreq::Cookie.new("sid", "abc", domian: secret)
+    end
+    assert_includes unknown_error.message, ":domian"
+    refute_includes unknown_error.message, secret
+
+    duplicate_options = {path: "/one"}
+    duplicate_options["path"] = "/two"
+    duplicate_error = assert_raises(ArgumentError) do
+      Wreq::Cookie.new("sid", "abc", **duplicate_options)
+    end
+    assert_includes duplicate_error.message, "duplicate option: :path"
+  end
+
+  def test_expires_accepts_past_time
+    expiration = Time.at(Rational(-5, 4)).utc
+    cookie = Wreq::Cookie.new("past", "value", expires: expiration)
+
+    assert_equal expiration, cookie.expires_at
+    assert_in_delta(-1.25, cookie.expires, 1e-9)
+  end
+
+  def test_expires_accepts_integer_and_fractional_timestamps
+    [
+      1_893_456_000,
+      1_893_456_000.125,
+      Rational(-5, 4),
+      BigDecimal("1893456000.125")
+    ].each do |timestamp|
+      cookie = Wreq::Cookie.new("timestamp", "value", expires: timestamp)
+
+      assert_kind_of Time, cookie.expires_at
+      assert_predicate cookie.expires_at, :utc?
+      assert_in_delta timestamp.to_f, cookie.expires_at.to_f, 1e-6
+      assert_in_delta timestamp.to_f, cookie.expires, 1e-6
+    end
+  end
+
+  def test_expires_normalizes_time_to_utc_without_losing_precision
+    expiration = Time.new(
+      2030,
+      1,
+      1,
+      12,
+      34,
+      Rational(123_456_789, 1_000_000_000),
+      "+09:00"
+    )
+    actual = Wreq::Cookie.new("offset", "value", expires: expiration).expires_at
+
+    assert_predicate actual, :utc?
+    assert_equal expiration.to_r, actual.to_r
+  end
+
+  def test_expires_rejects_non_finite_timestamps
+    [Float::NAN, Float::INFINITY, -Float::INFINITY].each do |timestamp|
+      error = assert_raises(ArgumentError) do
+        Wreq::Cookie.new("invalid", "value", expires: timestamp)
+      end
+
+      assert_match(/expires.*finite/, error.message)
+    end
+  end
+
+  def test_expires_rejects_unrepresentable_times
+    expirations = [
+      -(2**63),
+      2**63 - 1,
+      -Float::MAX,
+      Float::MAX,
+      Time.utc(10_000, 1, 1)
+    ]
+
+    expirations.each do |expiration|
+      error = assert_raises(RangeError) do
+        Wreq::Cookie.new("invalid", "value", expires: expiration)
+      end
+
+      assert_match(/expires.*supported range/, error.message)
+    end
+  end
+
+  def test_max_age_accepts_signed_boundaries_without_wrapping
+    [-(2**63), -1, 0, 2**63 - 1].each do |max_age|
+      cookie = Wreq::Cookie.new("max-age", "value", max_age: max_age)
+
+      assert_equal max_age, cookie.max_age
+    end
+
+    [-(2**63) - 1, 2**63].each do |max_age|
+      assert_raises(RangeError) do
+        Wreq::Cookie.new("max-age", "value", max_age: max_age)
+      end
+    end
+  end
+
+  def test_non_positive_max_age_removes_cookie_from_jar
+    [-1, 0].each do |max_age|
+      jar = Wreq::Jar.new
+      jar.add("session=old; Path=/", @base_url)
+      deletion = Wreq::Cookie.new("session", "gone", path: "/", max_age: max_age)
+
+      jar.add(deletion, @base_url)
+
+      assert_equal max_age, deletion.max_age
+      assert_empty jar.get_all
+    end
+  end
+
+  def test_past_expiration_removes_cookie_from_jar
+    @jar.add("session=old; Path=/", @base_url)
+    deletion = Wreq::Cookie.new(
+      "session",
+      "gone",
+      path: "/",
+      expires: Time.at(-1).utc
+    )
+
+    @jar.add(deletion, @base_url)
+
+    assert_empty @jar.get_all
+  end
+
+  def test_expiration_regressions_exit_subprocess_normally
+    lib_dir = File.expand_path("../lib", __dir__)
+    script = <<~RUBY
+      require "wreq"
+
+      past = Wreq::Cookie.new("past", "value", expires: -1.0)
+      abort "past timestamp was not retained" unless past.expires_at == Time.at(-1).utc
+
+      [Float::NAN, Float::INFINITY, -Float::INFINITY].each do |timestamp|
+        begin
+          Wreq::Cookie.new("invalid", "value", expires: timestamp)
+        rescue ArgumentError
+          next
+        end
+
+        abort "non-finite timestamp did not raise ArgumentError"
+      end
+
+      [Float::MAX, -Float::MAX].each do |timestamp|
+        begin
+          Wreq::Cookie.new("invalid", "value", expires: timestamp)
+        rescue RangeError
+          next
+        end
+
+        abort "unrepresentable finite timestamp did not raise RangeError"
+      end
+
+      [-(2**63) - 1, 2**63].each do |max_age|
+        begin
+          Wreq::Cookie.new("invalid", "value", max_age: max_age)
+        rescue RangeError
+          next
+        end
+
+        abort "out-of-range Max-Age did not raise RangeError"
+      end
+
+      puts "ok"
+    RUBY
+
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, "-I", lib_dir, "-e", script)
+
+    assert status.success?, "subprocess failed with #{status.inspect}: #{stderr}"
+    assert_equal "ok\n", stdout
+    refute_match(/panicked|fatal|access violation|cannot convert float seconds to Duration/i, stderr)
   end
 
   def test_same_site_flags_from_parsed_header
@@ -148,10 +347,12 @@ class CookieTest < Minitest::Test
     @jar.add("s2=1; Path=/; SameSite=Lax", @base_url)
 
     cookies = @jar.get_all
-    h = cookies.to_h { |ck| [ck.name, [ck.same_site_strict?, ck.same_site_lax?]] }
+    h = cookies.to_h do |cookie|
+      [cookie.name, [cookie.same_site, cookie.same_site_strict?, cookie.same_site_lax?]]
+    end
 
-    assert_equal [true, false], h["s1"]
-    assert_equal [false, true], h["s2"]
+    assert_equal [Wreq::SameSite::Strict, true, false], h["s1"]
+    assert_equal [Wreq::SameSite::Lax, false, true], h["s2"]
   end
 
   def test_request_uncompressed_cookies

data/test/json_precision_test.rb

@@ -0,0 +1,209 @@
+require "test_helper"
+require "json"
+require "socket"
+
+class JsonPrecisionTest < Minitest::Test
+  INTEGER_BOUNDARIES = [
+    (2**53) - 1,
+    2**53,
+    (2**63) - 1,
+    2**63,
+    (2**64) - 1,
+    -((2**53) - 1),
+    -(2**53),
+    -((2**63) - 1),
+    -(2**63),
+    -(2**63) - 1,
+    -((2**64) - 1),
+    -(2**64),
+    2**100,
+    -(2**100),
+    2**256,
+    -(2**256)
+  ].freeze
+
+  def test_response_json_matches_json_parse_for_large_integers
+    payload = precision_payload
+
+    with_json_server(response_body: JSON.generate(payload)) do |url, _requests|
+      response = Wreq.get(url)
+      expected = JSON.parse(response.bytes)
+      actual = response.json
+
+      assert_equal payload, expected
+      assert_equal expected, actual
+      assert actual.fetch("integers").all? { |value| value.instance_of?(Integer) }
+      assert_instance_of Float, actual.fetch("fraction")
+      assert_instance_of Float, actual.fetch("exponent")
+    end
+  end
+
+  def test_request_json_preserves_large_integers_and_nested_values
+    payload = precision_payload
+
+    with_json_server do |url, requests|
+      response = Wreq.post(url, json: payload)
+      request = requests.pop
+
+      assert_equal "application/json", request.fetch(:headers).fetch("content-type")
+      assert_equal JSON.generate(payload), request.fetch(:body)
+      assert_equal payload, response.json
+    end
+  end
+
+  def test_request_json_nil_is_serialized_as_null
+    with_json_server do |url, requests|
+      response = Wreq.post(url, json: nil)
+      request = requests.pop
+
+      assert_equal "null", request.fetch(:body)
+      assert_nil response.json
+    end
+  end
+
+  def test_request_json_accepts_symbols_and_preserves_object_order
+    payload = {second: 2**100, first: :value}
+
+    with_json_server do |url, requests|
+      response = Wreq.post(url, json: payload)
+      request = requests.pop
+      actual = response.json
+
+      assert_equal JSON.generate(payload), request.fetch(:body)
+      assert_equal ["second", "first"], actual.keys
+      assert_equal({"second" => 2**100, "first" => "value"}, actual)
+    end
+  end
+
+  def test_request_json_enforces_documented_nesting_limit
+    accepted = 0
+    100.times { accepted = [accepted] }
+
+    with_json_server do |url, requests|
+      Wreq.post(url, json: accepted)
+
+      assert_equal JSON.generate(accepted), requests.pop.fetch(:body)
+    end
+
+    error = assert_raises(Wreq::BuilderError) do
+      Wreq.post("http://127.0.0.1:1/", json: [accepted])
+    end
+    assert_match(/nesting exceeds 100 levels/, error.message)
+  end
+
+  def test_unsupported_request_json_raises_before_socket_io
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+
+    error = assert_raises(Wreq::BuilderError) do
+      Wreq.post("http://127.0.0.1:#{port}/", json: {"value" => Float::NAN})
+    end
+
+    cyclic = []
+    cyclic << cyclic
+    nesting_error = assert_raises(Wreq::BuilderError) do
+      Wreq.post("http://127.0.0.1:#{port}/", json: cyclic)
+    end
+
+    cyclic_hash = {}
+    cyclic_hash["self"] = cyclic_hash
+    hash_nesting_error = assert_raises(Wreq::BuilderError) do
+      Wreq.post("http://127.0.0.1:#{port}/", json: cyclic_hash)
+    end
+
+    key_error = assert_raises(Wreq::BuilderError) do
+      Wreq.post("http://127.0.0.1:#{port}/", json: {1 => "value"})
+    end
+
+    assert_match(/non-finite/, error.message)
+    assert_match(/nesting/, nesting_error.message)
+    assert_match(/nesting/, hash_nesting_error.message)
+    assert_match(/keys/, key_error.message)
+    assert_equal :wait_readable, server.accept_nonblock(exception: false)
+  ensure
+    server&.close unless server&.closed?
+  end
+
+  def test_invalid_response_json_raises_decoding_error
+    with_json_server(response_body: '{"id":') do |url, _requests|
+      response = Wreq.get(url)
+
+      assert_raises(Wreq::DecodingError) { response.json }
+    end
+  end
+
+  def test_fractional_and_large_exponent_numbers_match_json_parse
+    source = '{"fraction":0.12345678901234567890123456789,"exponent":1e400}'
+
+    with_json_server(response_body: source) do |url, _requests|
+      response = Wreq.get(url)
+      expected = JSON.parse(response.bytes)
+      actual = response.json
+
+      assert_equal expected, actual
+      assert_instance_of Float, actual.fetch("fraction")
+      assert_equal Float::INFINITY, actual.fetch("exponent")
+    end
+  end
+
+  private
+
+  def precision_payload
+    {
+      "integers" => INTEGER_BOUNDARIES,
+      "nested" => {
+        "array" => [2**100, {"negative" => -(2**100)}],
+        "object" => {"unsigned_64_max" => (2**64) - 1}
+      },
+      "shapes" => ["text", true, false, nil],
+      "fraction" => 1.25,
+      "exponent" => 1.0e40
+    }
+  end
+
+  def with_json_server(response_body: nil)
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+    requests = Queue.new
+    thread = Thread.new do
+      socket = server.accept
+      begin
+        request_line = socket.gets
+        headers = read_headers(socket)
+        content_length = headers.fetch("content-length", "0").to_i
+        body = content_length.zero? ? "" : socket.read(content_length)
+        requests << {request_line: request_line, headers: headers, body: body}
+
+        response = response_body.nil? ? body : response_body
+        socket.write "HTTP/1.1 200 OK\r\n"
+        socket.write "Content-Type: application/json\r\n"
+        socket.write "Content-Length: #{response.bytesize}\r\n"
+        socket.write "Connection: close\r\n\r\n"
+        socket.write response
+      ensure
+        socket.close unless socket.closed?
+      end
+    rescue IOError, SystemCallError
+      nil
+    ensure
+      server.close unless server.closed?
+    end
+    thread.report_on_exception = false
+
+    yield "http://127.0.0.1:#{port}/", requests
+  ensure
+    server&.close unless server&.closed?
+    thread&.join(5)
+  end
+
+  def read_headers(socket)
+    headers = {}
+    while (line = socket.gets)
+      break if line == "\r\n"
+
+      name, value = line.split(":", 2)
+      headers[name.downcase] = value.strip
+    end
+    headers
+  end
+end