httpr 0.4.6__tar.gz → 0.4.8__tar.gz

{httpr-0.4.6 → httpr-0.4.8}/Cargo.lock

@@ -492,7 +492,7 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpr"
-version = "0.4.6"
+version = "0.4.8"
 dependencies = [
  "anyhow",
  "bytes",

{httpr-0.4.6 → httpr-0.4.8}/Cargo.toml

@@ -2,7 +2,7 @@
 name = "httpr"
 # Version is set dynamically by CI from git tags (e.g., v1.2.3 -> 1.2.3).
 # Do not edit manually. See .github/actions/set-version/ for details.
-version = "0.4.6"
+version = "0.4.8"
 edition = "2021"
 description = "Fast HTTP client for python"
 authors = ["thomasht86"]

{httpr-0.4.6 → httpr-0.4.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: httpr
-Version: 0.4.6
+Version: 0.4.8
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only

{httpr-0.4.6 → httpr-0.4.8}/pyproject.toml

@@ -11,7 +11,7 @@ keywords = [ "python", "request",]
 classifiers = [ "Programming Language :: Rust", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Programming Language :: Python :: Implementation :: CPython", "Programming Language :: Python :: Implementation :: PyPy", "Topic :: Internet :: WWW/HTTP", "Topic :: Software Development :: Libraries :: Python Modules",]
 # Version is set dynamically by CI from git tags (e.g., v1.2.3 -> 1.2.3).
 # Do not edit manually. See .github/actions/set-version/ for details.
-version = "0.4.6"
+version = "0.4.8"
 dependencies = []
 [[project.authors]]
 name = "thomasht86"

{httpr-0.4.6 → httpr-0.4.8}/src/lib.rs

@@ -199,29 +199,28 @@ impl RClient {
         // Verify
         if verify.unwrap_or(true) {
             client_builder = client_builder.tls_built_in_root_certs(true);
-            if let Ok(certs) = load_ca_certs() {
-                for cert in certs {
-                    client_builder = client_builder.add_root_certificate(cert);
-                }
-            }
-            // Load client pem identity if provided
-            // Either from file path (client_pem) or direct data (client_pem_data)
-            let client_identity_pem = if let Some(pem_data) = &client_pem_data {
-                Some(pem_data.clone())
-            } else if let Some(pem_path) = &client_pem {
-                Some(fs::read(pem_path).map_err(|e| map_anyhow_error(anyhow::Error::new(e)))?)
-            } else {
-                None
-            };
-
-            if let Some(pem_bytes) = client_identity_pem {
-                let identity = Identity::from_pem(&pem_bytes).map_err(map_reqwest_error)?;
-                client_builder = client_builder.identity(identity);
+            for cert in load_ca_certs().map_err(map_anyhow_error)? {
+                client_builder = client_builder.add_root_certificate(cert);
             }
         } else {
             client_builder = client_builder.danger_accept_invalid_certs(true);
         }
 
+        // Client mTLS identity must be applied regardless of `verify`: disabling
+        // server verification doesn't imply disabling client authentication.
+        let client_identity_pem = if let Some(pem_data) = &client_pem_data {
+            Some(pem_data.clone())
+        } else if let Some(pem_path) = &client_pem {
+            Some(fs::read(pem_path).map_err(|e| map_anyhow_error(anyhow::Error::new(e)))?)
+        } else {
+            None
+        };
+
+        if let Some(pem_bytes) = client_identity_pem {
+            let identity = Identity::from_pem(&pem_bytes).map_err(map_reqwest_error)?;
+            client_builder = client_builder.identity(identity);
+        }
+
         // Https_only
         if let Some(true) = https_only {
             client_builder = client_builder.https_only(true);

{httpr-0.4.6 → httpr-0.4.8}/src/utils.rs

@@ -29,17 +29,26 @@ fn read_pem_certificates(path: &str) -> Result<Vec<Certificate>> {
     let cert_bytes = fs::read(path).context("Failed to read certificate file")?;
     let mut certificates = vec![];
     let mut cursor = std::io::Cursor::new(cert_bytes);
-    while let Ok(Some(cert)) = rustls_pemfile::read_one(&mut cursor) {
-        match cert {
-            rustls_pemfile::Item::X509Certificate(cert) => {
+    loop {
+        match rustls_pemfile::read_one(&mut cursor)
+            .context("Failed to parse PEM data from certificate file")?
+        {
+            None => break,
+            Some(rustls_pemfile::Item::X509Certificate(cert)) => {
                 let certificate = Certificate::from_der(&cert)?;
                 certificates.push(certificate);
             }
-            _ => {
+            Some(_) => {
                 tracing::warn!("Skipping non-certificate item");
             }
         }
     }
+    if certificates.is_empty() {
+        anyhow::bail!(
+            "No X.509 certificates found in {}: refusing to silently fall back to built-in roots",
+            path
+        );
+    }
     Ok(certificates)
 }
 
@@ -129,16 +138,60 @@ Q29uc3VsdGF0aW9uczEiMCAGCSqGSIb3DQEJARYTcGVyc29uYWwtZW1haWwuY29t
 
         // Clean up
         fs::remove_file(ca_cert_path).unwrap();
+        env::remove_var("HTTPR_CA_BUNDLE");
     }
 
     #[test]
     fn test_load_ca_certs_without_env_var() {
+        env::remove_var("HTTPR_CA_BUNDLE");
         // Call the function
         let result = load_ca_certs();
 
         // Check the result
         assert!(result.is_ok());
     }
+
+    #[test]
+    fn test_load_ca_certs_malformed_bundle_errors() {
+        // A readable file whose contents are not a valid PEM bundle must error
+        // rather than silently returning an empty cert list (which would cause
+        // a silent fall-back to built-in roots).
+        let path = Path::new("test_ca_malformed.pem");
+        fs::write(path, b"this is not a PEM certificate at all").unwrap();
+        env::set_var("HTTPR_CA_BUNDLE", path);
+
+        let result = load_ca_certs();
+
+        fs::remove_file(path).unwrap();
+        env::remove_var("HTTPR_CA_BUNDLE");
+
+        assert!(
+            result.is_err(),
+            "expected error for malformed PEM, got {:?}",
+            result
+        );
+    }
+
+    #[test]
+    fn test_load_ca_certs_no_certs_errors() {
+        // A syntactically-valid PEM file containing only non-certificate items
+        // (e.g. an unrelated private key, or just comments) yields zero certs
+        // and must error rather than silently fall back to built-in roots.
+        let path = Path::new("test_ca_no_certs.pem");
+        fs::write(path, b"# only a comment, no certs here\n").unwrap();
+        env::set_var("HTTPR_CA_BUNDLE", path);
+
+        let result = load_ca_certs();
+
+        fs::remove_file(path).unwrap();
+        env::remove_var("HTTPR_CA_BUNDLE");
+
+        assert!(
+            result.is_err(),
+            "expected error for cert-less bundle, got {:?}",
+            result
+        );
+    }
 }
 
 #[cfg(test)]

{httpr-0.4.6 → httpr-0.4.8}/tests/unit/test_ssl.py

@@ -132,10 +132,45 @@ class TestClientSSL(unittest.TestCase):
                 client.get(f"https://localhost:{self.server_port}")
 
     def test_invalid_ca_cert_file(self):
-        """Using an invalid CA certificate file should cause a handshake failure."""
-        with Client(client_pem=self.client_cert_path, ca_cert_file="nonexistent_ca.pem") as client:
-            with self.assertRaises(Exception):
-                client.get(f"https://localhost:{self.server_port}")
+        """A non-existent ca_cert_file must fail loudly at client construction.
+
+        Previously load_ca_certs() errors were swallowed at the call site, so a
+        bad bundle silently fell back to the built-in Mozilla roots — the client
+        would then trust servers the user never intended to trust.
+        """
+        with self.assertRaises(httpr.RequestError):
+            Client(client_pem=self.client_cert_path, ca_cert_file="nonexistent_ca.pem")
+
+    def test_malformed_ca_cert_file(self):
+        """A readable but non-PEM ca_cert_file must also fail at construction.
+
+        The parse-error path was previously swallowed inside read_pem_certificates,
+        so a corrupt bundle silently produced zero certs and the client fell back
+        to built-in roots.
+        """
+        with tempfile.NamedTemporaryFile(
+            suffix=".pem", delete=False, mode="wb"
+        ) as f:
+            f.write(b"this is not a valid PEM bundle")
+            bad_path = f.name
+        try:
+            with self.assertRaises(httpr.RequestError):
+                Client(client_pem=self.client_cert_path, ca_cert_file=bad_path)
+        finally:
+            os.unlink(bad_path)
+
+    def test_empty_ca_cert_file(self):
+        """A PEM file with no X.509 certs (e.g. only comments) must also fail."""
+        with tempfile.NamedTemporaryFile(
+            suffix=".pem", delete=False, mode="wb"
+        ) as f:
+            f.write(b"# bundle with no certificates\n")
+            empty_path = f.name
+        try:
+            with self.assertRaises(httpr.RequestError):
+                Client(client_pem=self.client_cert_path, ca_cert_file=empty_path)
+        finally:
+            os.unlink(empty_path)
 
     def test_verify_disabled_with_valid_client_cert(self):
         """
@@ -184,6 +219,38 @@ class TestClientSSL(unittest.TestCase):
                 ca_cert_file=self.client_ca_path,
             )
 
+    def test_client_cert_sent_when_verify_disabled(self):
+        """Regression for issue #65: client cert must still be presented when verify=False.
+
+        Disabling server verification should not disable client authentication.
+        """
+        # client_pem (file path) + verify=False
+        with Client(client_pem=self.client_cert_path, verify=False) as client:
+            response = client.get(f"https://localhost:{self.server_port}")
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.text, "OK")
+
+        # client_pem_data (bytes) + verify=False
+        with open(self.client_cert_path, "rb") as f:
+            cert_data = f.read()
+        with Client(client_pem_data=cert_data, verify=False) as client:
+            response = client.get(f"https://localhost:{self.server_port}")
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.text, "OK")
+
+    def test_async_client_cert_sent_when_verify_disabled(self):
+        """Regression for issue #65 on the AsyncClient Python wrapper."""
+        with open(self.client_cert_path, "rb") as f:
+            cert_data = f.read()
+
+        async def make_request():
+            async with AsyncClient(client_pem_data=cert_data, verify=False) as client:
+                return await client.get(f"https://localhost:{self.server_port}")
+
+        response = asyncio.run(make_request())
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.text, "OK")
+
     def test_async_client_pem_and_data_are_mutually_exclusive(self):
         """AsyncClient should also enforce mutual exclusivity."""
         with open(self.client_cert_path, "rb") as f: