wreq 1.2.16 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e05412727cca397064368fd0c6f79c77efced70c13467850aad2cc4941aeeb9f
-  data.tar.gz: d5c40280a601d1ead2e79f647ce737bb6f442ed750d04eca609803c1d403dce6
+  metadata.gz: a684244b1b3a988034a958ba6d5be4bd1c3233a958834eb103cabf8b57c7c7d2
+  data.tar.gz: 2246ef7c885c1d4c429b1a0630795b8fe24bd1923dd4205267dd727ff552bb90
 SHA512:
-  metadata.gz: fef4a8ba4a3be468852f69a2d54f8ae2a4b33acdba75258836593ce263ff92993070ad1f5c43db07b5f45f5c0b72d7ca801667c2612238f0797d87faa95271b0
-  data.tar.gz: a7681af7b04813bb2826eb04b47b4ebb9af9343897f85b241cc7b61756c180ac2712530180044b1d1558a827b8da1032d9e3a8a64e0a7193f24fc31f96470d41
+  metadata.gz: 4a1e164422249f5cc1df7d1259879e640c4e822ef3e9e2d0d67c11128e7f90c023119ddb6d1610a098b1d2c43657f72cdf0f0780f29f80f81e58be6b2cf66f72
+  data.tar.gz: 8298504fd0e17008572c3d0a7ed0ee1ef949bbce9c88a73729fcece75ba87fb54c43ce38fa1ae961fcf297db8e0c2ca58b528155d14aac588ee23499255b860e

data/Cargo.lock

@@ -1490,7 +1490,7 @@ dependencies = [
 
 [[package]]
 name = "wreq-ruby"
-version = "1.2.16"
+version = "1.3.0"
 dependencies = [
  "arc-swap",
  "bytes",

data/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["SearchApi <support@searchapi.io>"]
 homepage = "https://github.com/SearchApi/wreq-ruby"
 repository = "https://github.com/SearchApi/wreq-ruby"
 edition = "2024"
-version = "1.2.16"
+version = "1.3.0"
 rust-version = "1.98"
 
 [lib]

data/crates/wreq-util/CHANGELOG.md

@@ -17,6 +17,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Match Trust Anchor ID ordering by Chrome version: randomized per native configuration for 152/153, and sorted by raw ID bytes for 154.
+
 - *(emulate)* Fix Firefox 150 and 151 cipher suite lists.
 
 ## [3.0.0-rc.14](https://github.com/0x676e67/wreq-util/compare/v3.0.0-rc.13...v3.0.0-rc.14) - 2026-07-04

data/crates/wreq-util/src/emulate/profile/chrome/tls.rs

@@ -50,13 +50,16 @@ macro_rules! tls_options {
             .alps_use_new_codepoint(true))
     };
     (9, $curves:expr) => {
+        tls_options!(9, $curves, shuffled_trust_anchors(crate::rand::fast_random))
+    };
+    (9, $curves:expr, $trust_anchors:expr) => {
         tls_options!(@build ChromeTlsConfig::builder()
             .permute_extensions(true)
             .enable_ech_grease(true)
             .pre_shared_key(true)
             .curves($curves)
             .sigalgs_list(NEW_SIGALGS_LIST)
-            .trust_anchors(CHROME_TRUST_ANCHORS)
+            .trust_anchors($trust_anchors)
             .grease_sigalgs_enabled(true)
             .alps_use_new_codepoint(true))
     };
@@ -115,6 +118,44 @@ pub const NEW_SIGALGS_LIST: &str = join!(
 // Encoded IDs and wreq's Chromium root store come from the same root set.
 pub(super) const CHROME_TRUST_ANCHORS: &[u8] = &chromium_roots::encoded_trust_anchor_ids();
 
+// Chrome 152/153 iterate a salted flat_hash_set held by SSLClientContext, rather than
+// the root store's source order. Generate an order once per native configuration;
+// connections using that client configuration retain the order.
+// https://chromium.googlesource.com/chromium/src/+/f7b831a4e249fbd98eae4b391c69f70300a849d1/net/ssl/ssl_config_service.cc
+pub(super) fn shuffled_trust_anchors(mut random: impl FnMut() -> u64) -> Vec<u8> {
+    let mut ids = chromium_roots::trust_anchor_ids();
+    for index in (1..ids.len()).rev() {
+        let bound = (index + 1) as u64;
+        let limit = u64::MAX - u64::MAX % bound;
+        let mut value = random();
+        while value >= limit {
+            value = random();
+        }
+        ids.swap(index, (value % bound) as usize);
+    }
+
+    encode_trust_anchors(&ids)
+}
+
+// Chrome 154 sorts the raw IDs before adding their length prefixes.
+// https://chromium.googlesource.com/chromium/src/+/731082f0a26ce4b3976c3d82943092f5d13daf13/net/cert/x509_util.cc
+pub(super) fn sorted_trust_anchors() -> Vec<u8> {
+    let mut ids = chromium_roots::trust_anchor_ids();
+    ids.sort_unstable();
+    encode_trust_anchors(&ids)
+}
+
+fn encode_trust_anchors(ids: &[&[u8]]) -> Vec<u8> {
+    let mut encoded = Vec::with_capacity(CHROME_TRUST_ANCHORS.len());
+    for id in ids {
+        // encoded_trust_anchor_ids() validates these same IDs at compile time:
+        // each length is nonzero and fits in one byte.
+        encoded.push(id.len() as u8);
+        encoded.extend_from_slice(id);
+    }
+    encoded
+}
+
 pub const CERTIFICATE_COMPRESSORS: &[&'static dyn CertificateCompressor] = &[&BrotliCompressor];
 
 #[derive(TypedBuilder)]
@@ -144,7 +185,7 @@ pub struct ChromeTlsConfig {
     pre_shared_key: bool,
 
     #[builder(default, setter(strip_option))]
-    trust_anchors: Option<&'static [u8]>,
+    trust_anchors: Option<Vec<u8>>,
 
     #[builder(default, setter(strip_option))]
     grease_sigalgs_enabled: Option<bool>,
@@ -181,3 +222,65 @@ impl From<ChromeTlsConfig> for TlsOptions {
         builder.build()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wreq::IntoEmulation;
+
+    #[test]
+    fn chrome_profiles_retain_trust_anchor_order_when_cloned() {
+        for profile in [
+            crate::Profile::Chrome152,
+            crate::Profile::Chrome153,
+            crate::Profile::Chrome154,
+        ] {
+            let native = profile.into_emulation();
+            let cloned = native.clone();
+            let ids = native.tls_options.unwrap().trust_anchors.unwrap();
+            assert_eq!(ids.len(), CHROME_TRUST_ANCHORS.len());
+            assert_eq!(ids, cloned.tls_options.unwrap().trust_anchors.unwrap());
+            let decoded = decode_ids(&ids);
+            let mut expected = chromium_roots::trust_anchor_ids();
+            expected.sort_unstable();
+            if profile == crate::Profile::Chrome154 {
+                assert_eq!(decoded, expected);
+            }
+            let mut actual = decoded;
+            actual.sort_unstable();
+            assert_eq!(actual, expected);
+        }
+        assert!(
+            crate::Profile::Chrome151
+                .into_emulation()
+                .tls_options
+                .unwrap()
+                .trust_anchors
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn trust_anchor_shuffle_preserves_ids_without_pinning_the_first() {
+        // Choosing index zero at every step rotates the entire list left.
+        // Rejecting u64::MAX also covers the unbiased sampling boundary.
+        let mut samples = std::iter::once(u64::MAX).chain(std::iter::repeat(0));
+        let encoded = shuffled_trust_anchors(|| samples.next().unwrap());
+        let decoded = decode_ids(&encoded);
+        let mut expected = chromium_roots::trust_anchor_ids();
+        expected.rotate_left(1);
+        assert_eq!(decoded, expected);
+        assert_eq!(encoded.len(), CHROME_TRUST_ANCHORS.len());
+    }
+
+    fn decode_ids(mut remaining: &[u8]) -> Vec<&[u8]> {
+        let mut decoded = Vec::new();
+        while let Some((&length, rest)) = remaining.split_first() {
+            assert_ne!(length, 0);
+            let (id, rest) = rest.split_at(usize::from(length));
+            decoded.push(id);
+            remaining = rest;
+        }
+        decoded
+    }
+}

data/crates/wreq-util/src/emulate/profile/chrome.rs

@@ -1931,7 +1931,8 @@ mod_generator!(
 
 mod_generator!(
     v154,
-    v152::build_emulation,
+    tls_options!(9, CURVES_3, sorted_trust_anchors()),
+    http2_options!(3),
     header_initializer_with_zstd_priority,
     [
         (

data/crates/wreq-util/src/emulate.rs

@@ -216,6 +216,11 @@ impl Platform {
 /// The `Emulation` struct allows you to configure various aspects of profile and platform
 /// emulation, including the profile, platform, and whether to enable certain features
 /// like HTTP/2 or headers.
+///
+/// Conversion through [`wreq::IntoEmulation`] creates a native configuration,
+/// including a randomized Trust Anchor ID order for Chrome 152/153 profiles.
+/// Client-level emulation retains that order for subsequent connections.
+/// Chrome 154 sorts the IDs by their raw bytes instead.
 #[derive(Default, Clone, TypedBuilder)]
 pub struct Emulation {
     /// Whether to change the profile (browser/okhttp) information.

data/lib/wreq_ruby/emulate.rb

@@ -264,6 +264,14 @@ module Wreq
   # for HTTP/2 and automatic default headers. The actual implementation is
   # provided by Rust.
   #
+  # Construction generates the native configuration once. For Chrome 152/153,
+  # the TLS trust_anchors extension's ID order is randomized at construction;
+  # Chrome 154 sorts those IDs by their raw bytes instead. Reusing this object
+  # across clients or requests retains that order. Creating a new object generates
+  # a new configuration, including a fresh shuffle for Chrome 152/153.
+  # This does not freeze other per-handshake randomness or force a new handshake
+  # when a request reuses an existing connection.
+  #
   # `profile:` defaults to the library's default profile when omitted.
   # `platform:` defaults to the library's default platform when omitted.
   #
@@ -289,6 +297,10 @@ module Wreq
     # Native fields and methods are set by the extension.
     # This stub is for documentation only.
     unless singleton_methods(false).include?(:new)
+      # Generates a reusable native configuration. Chrome 152/153 Trust Anchor ID
+      # order is chosen here and retained when this object is reused; Chrome 154
+      # uses raw-byte sorted order. See {Emulation} for connection semantics.
+      #
       # @param profile [Wreq::Profile, nil] Fingerprint profile to emulate
       # @param platform [Wreq::Platform, nil] Operating system platform to emulate
       # @param http2 [Boolean, nil] Whether HTTP/2 emulation is enabled; defaults

data/src/emulate.rs

@@ -1,5 +1,6 @@
 use ::serde::Deserialize;
 use magnus::{Error, Module, Object, RModule, Ruby, Value, function, method, typed_data::Obj};
+use wreq::IntoEmulation;
 
 use crate::options::{NativeOption, Options};
 
@@ -206,10 +207,13 @@ define_ruby_enum!(
     IOS => "ios",
 );
 
-/// A struct to represent the `EmulationOption` class.
+/// Materialized emulation configuration owned by the Ruby object.
+///
+/// Clients and requests clone this value rather than regenerating profile settings,
+/// preserving configuration-level randomness for the lifetime of the object.
 #[derive(Clone)]
 #[magnus::wrap(class = "Wreq::Emulation", free_immediately, size)]
-pub struct Emulation(pub wreq_util::Emulation);
+pub struct Emulation(pub wreq::Emulation);
 
 // ===== impl Emulation =====
 
@@ -246,7 +250,8 @@ impl Emulation {
             )
             .http2(params.http2.unwrap_or(true))
             .headers(params.headers.unwrap_or(true))
-            .build();
+            .build()
+            .into_emulation();
 
         Ok(Self(emulation))
     }

data/test/emulation_test.rb

@@ -1,8 +1,28 @@
 # frozen_string_literal: true
 
 require "test_helper"
+require "socket"
+require "stringio"
+require "timeout"
 
 class EmulationTest < Minitest::Test
+  def test_reused_emulation_retains_trust_anchors_across_clients_and_requests
+    [Wreq::Profile::Chrome152, Wreq::Profile::Chrome153, Wreq::Profile::Chrome154].each do |profile|
+      emulation = Wreq::Emulation.new(profile: profile)
+      client = Wreq::Client.new(emulation: emulation, no_proxy: true)
+      expected = capture_trust_anchors { |url| client.get(url, timeout: 5) }
+      refute_empty expected, profile.to_s
+
+      request_client = Wreq::Client.new(no_proxy: true)
+      2.times do
+        actual = capture_trust_anchors do |url|
+          request_client.get(url, emulation: emulation, timeout: 5)
+        end
+        assert_equal expected, actual, "#{profile}: reusing an object must retain its configuration"
+      end
+    end
+  end
+
   def test_all_emulation_device_constants_are_non_nil
     Wreq::Profile.constants.each do |name|
       const = Wreq::Profile.const_get(name)
@@ -37,4 +57,60 @@ class EmulationTest < Minitest::Test
         "#{name} should be Platform, got #{const.inspect}"
     end
   end
+
+  private
+
+  # Each listener forces a new connection. Stop after ClientHello so this test
+  # inspects the extension bytes without depending on certificates or the network.
+  def capture_trust_anchors
+    server = TCPServer.new("127.0.0.1", 0)
+    thread = Thread.new do
+      socket = nil
+      Timeout.timeout(5) do
+        socket = server.accept
+        handshake = +"".b
+        loop do
+          header = read_tls_bytes(socket, 5)
+          raise "expected a TLS handshake record" unless header.getbyte(0) == 22
+          handshake << read_tls_bytes(socket, header.byteslice(3, 2).unpack1("n"))
+          next if handshake.bytesize < 4
+          length = handshake.byteslice(1, 3).bytes.reduce(0) { |n, byte| (n << 8) | byte }
+          break if handshake.bytesize >= length + 4
+        end
+        trust_anchors_from_client_hello(handshake)
+      end
+    ensure
+      socket&.close
+    end
+    thread.report_on_exception = false
+
+    assert_raises(Wreq::ConnectionError) { yield "https://127.0.0.1:#{server.addr[1]}/" }
+    thread.value
+  ensure
+    server&.close
+    thread&.kill if thread&.alive?
+    thread&.join
+  end
+
+  def read_tls_bytes(io, length)
+    bytes = io.read(length)
+    raise EOFError, "truncated ClientHello" unless bytes&.bytesize == length
+    bytes
+  end
+
+  def trust_anchors_from_client_hello(handshake)
+    io = StringIO.new(handshake)
+    raise "expected ClientHello" unless read_tls_bytes(io, 1).unpack1("C") == 1
+    read_tls_bytes(io, 3 + 2 + 32) # Handshake length, legacy version and random.
+    read_tls_bytes(io, read_tls_bytes(io, 1).unpack1("C")) # Session ID.
+    read_tls_bytes(io, read_tls_bytes(io, 2).unpack1("n")) # Cipher suites.
+    read_tls_bytes(io, read_tls_bytes(io, 1).unpack1("C")) # Compression methods.
+    extensions = StringIO.new(read_tls_bytes(io, read_tls_bytes(io, 2).unpack1("n")))
+    until extensions.eof?
+      type, length = read_tls_bytes(extensions, 4).unpack("nn")
+      data = read_tls_bytes(extensions, length)
+      return data if type == 51764
+    end
+    raise "missing trust_anchors extension"
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wreq
 version: !ruby/object:Gem::Version
-  version: 1.2.16
+  version: 1.3.0
 platform: ruby
 authors:
 - SearchApi