Net::HTTP required the whole DNS resolver, which also reads the system DNS configuration at load time, only to match Resolv::IPv4::Regex and Resolv::IPv6::Regex when deciding whether to send SNI. Use the same inlined regexps as the copy vendored in RubyGems, so that the two stay identical.
https://github.com/ruby/net-http/commit/5b42d75812
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(https://github.com/ruby/net-http/pull/348)
The current implementation has a problem with the following case:
```ruby
print("HTTP/1.1 200 OK\r\n")
print("Content-Length: 5\r\n")
print(" \t\r\n")
print("X-After: value\r\n")
print("\r\n")
print("hello")
```
The `" \t\r\n"` line should be processed as obs-fold in RFC 9112:
https://www.rfc-editor.org/rfc/rfc9112.html#section-5.2
> obs-fold = OWS CRLF RWS
> ; obsolete line folding
>
> A user agent that receives an obs-fold in a response message that
> is not within a "message/http" container MUST replace each received
> obs-fold with one or more SP octets prior to interpreting the field
> value.
But it's processed as the header part end:
Header:
```text
HTTP/1.1 200 OK
Content-Length: 5
```
Body:
```text
X-After: value
hello
```
It must be processed as the following (whitespace only obs-fold is
ignored):
Header:
```text
HTTP/1.1 200 OK
Content-Length: 5
X-After: value
```
Body:
```text
hello
```
https://github.com/ruby/net-http/commit/6e2bc82919
Once chunked is not the final transfer coding, read_body_0 fell through
to Content-Length and framed the body by it, which leaves the client and
the server disagreeing about where the response ends.
See RFC 9112 Section 6.3:
https://www.rfc-editor.org/rfc/rfc9112.html#section-6.3
If a message is received with both a Transfer-Encoding and a
Content-Length header field, the Transfer-Encoding overrides the
Content-Length.
https://github.com/ruby/net-http/commit/9fb5b93b52
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Net::HTTPHeader#chunked? matched the token anywhere in
Transfer-Encoding, so a response carrying `chunked, gzip` was
chunk-framed and the bytes after the terminating chunk were left
unread on the connection.
See RFC 9112 Section 6.3:
https://www.rfc-editor.org/rfc/rfc9112.html#section-6.3
If a Transfer-Encoding header field is present in a response and
the chunked transfer coding is not the final encoding, the message
body length is determined by reading the connection until it is
closed by the server.
https://github.com/ruby/net-http/commit/e70762aaf9
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(https://github.com/ruby/net-http/pull/324)
`Content-Length` value must have only digits.
See also RFC 9110 Section 8.6:
https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6
Content-Length = 1*DIGIT
The current implementation accepts garbage before/after digits such as
`abc5` and `5abc`.
This rejects these invalid values.
But this accepts same values in one `Content-Length`
Content-Length: 5, 5
and in multiple `Content-Length`es:
Content-Length: 5
Content-Length: 5
This is for the following part in the RFC:
https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6-13
> Likewise, a sender MUST NOT forward a message with a Content-Length
> header field value that does not match the ABNF above, with one
> exception: a recipient of a Content-Length header field value
> consisting of the same decimal value repeated as a comma-separated
> list (e.g, "Content-Length: 42, 42") MAY either reject the message
> as invalid or replace that invalid field value with a single
> instance of the decimal value, since this likely indicates that a
> duplicate was generated or combined by an upstream message
> processor.
https://github.com/ruby/net-http/commit/23e859e92e
A peer that keeps sending 1xx responses keeps the client in the read
loop of transport_request indefinitely, since the per-response header
limit resets for each response. Cap the count at 100, the same value
CPython's http.client uses.
https://github.com/ruby/net-http/commit/39cf5f648a
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The response header cap added by #219 applies only once a complete line
has arrived, so a server that never sends a line terminator can still
grow the read buffer without bound, as reported in #315. Read the
status line, header lines, chunk-size lines and chunk trailers through
net-protocol's readuntil(limit:) so they fail with
Net::HTTPBadResponse at MAX_RESPONSE_HEADER_LENGTH, and require the
net-protocol that provides it.
The cumulative header budget stays separate from the per-line limit so
that exhausting the total still reports 'response header too large'
rather than blaming a line that is not long.
https://github.com/ruby/net-http/issues/315https://github.com/ruby/net-http/commit/132c8cc1b1
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
readuntil buffers until the terminator arrives, so a peer that never
sends one grows the read buffer without bound. The limit lets a protocol
implementation cap what a single read may return, raising the new
Net::ReadLimitExceeded instead of reading on.
The exception derives from ProtocolError because an over-long line is
the peer violating the protocol rather than an I/O failure, and because
IOError would place it in the generic socket-error rescue that Net::HTTP
retries on.
https://github.com/ruby/net-http/issues/315https://github.com/ruby/net-protocol/commit/e1b38d98b7
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BufferedIO#readuntil resumed searching at the previous buffer end, so a
multi-byte terminator split across two fills, such as "\r" ending one
chunk and "\n" starting the next, was never matched and readuntil
returned data past the terminator. Rewind the search by
terminator.bytesize - 1 before refilling, floored at @rbuf_offset.
https://github.com/ruby/net-protocol/commit/84ef3aba09
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes https://github.com/ruby/net-http/issues/202
As of June 2026, [RFC 10008][] is a proposed standard.
From the RFC Abstract:
> This specification defines the QUERY method for HTTP. A QUERY requests
> that the request target process the enclosed content in a safe and
> idempotent manner and then respond with the result of that processing.
> This is similar to POST requests, but QUERY requests can be
> automatically repeated or restarted without concern for partial state
> changes.
This commit proposes support for the HTTP Query method by way of the
`Net::HTTP::Query` class along with the corresponding `#query` and
`#request_query` methods.
[RFC 10008]: https://www.rfc-editor.org/rfc/rfc10008.htmlhttps://github.com/ruby/net-http/commit/76b11b3a26
Replace attributes and decode escaped punctuations.
```
Net/HTTP.html: `rdoc-ref:OpenSSL::SSL::SSLContext#max_version-3D` can't be resolved for ``
Net/HTTP.html: `rdoc-ref:OpenSSL::SSL::SSLContext#min_version-3D` can't be resolved for ``
Net/HTTP.html: `rdoc-ref:OpenSSL::SSL::SSLContext#ssl_version-3D` can't be resolved for ``
Net/HTTP.html: `rdoc-ref:OpenSSL::SSL::SSLContext#attribute-i-verify_hostname` can't be resolved for ``
```
each_response_header read header lines until the blank separator with no
bound on their total size, so a server could exhaust client memory by
sending a large header block. Cap the cumulative size at 1 MiB and raise
Net::HTTPBadResponse once it is exceeded.
https://github.com/ruby/net-http/commit/ebe8f3876f
Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The length limits only ran in initialize_http_header, which responses
bypass: each_response_header builds the response through add_field and
set_field, so an oversized response header field was never bounded. Check
the field value length in set_field and append_field_value, and fold the
key length check into validate_field_name so set_field and
initialize_http_header share one place for validating field names.
https://github.com/ruby/net-http/commit/ab084fdc0c
Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The CR/LF check via Regexp#match? requires a String, but the per-part
content type was previously interpolated through to_s and accepted any
object such as a Symbol. Coerce it first to keep that behavior.
https://github.com/ruby/net-http/commit/c07d6581ce
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Field values and the request line are already validated against CR/LF,
but field names were interpolated into the request as-is, allowing
header injection via the key. Validate names in set_field and
initialize_http_header, which cover all paths into @header with a
user-supplied key.
https://github.com/ruby/net-http/commit/4f13ea5047
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* `Socket.tcp` and `TCPSocket.new` raises `IO::TiemoutError` with user specified timeout
In https://github.com/ruby/ruby/pull/11880, `rsock_connect()` was changed to raise `IO::TimeoutError` when a user-specified timeout occurs.
However, when `TCPSocket.new` attempts to connect to multiple destinations, it does not use `rsock_connect()`, and instead raises `Errno::ETIMEDOUT` on timeout.
As a result, the exception class raised on timeout could differ depending on whether there were multiple destinations or not.
To align this behavior with the implementation of `rsock_connect()`, this change makes `TCPSocket.new` raise `IO::TimeoutError` when a user-specified timeout occurs.
Similarly, `Socket.tcp` is updated to raise `IO::TimeoutError` when a timeout occurs within the method.
(Note that the existing behavior of `Addrinfo#connect_internal`, which Socket.tcp depends on internally and which raises `Errno::ETIMEDOUT` on timeout, is not changed.)
* [ruby/net-http] Raise `Net::OpenTimeout` when `TCPSocket.open` raises `IO::TimeoutError`.
With the changes in https://github.com/ruby/ruby/pull/15602, `TCPSocket.open` now raises `IO::TimeoutError` when a user-specified timeout occurs.
This change updates #connect to handle this case accordingly.
https://github.com/ruby/net-http/commit/f64109e1cf
The try-open_timeout-then-fallback-to-timeout introduced in
https://github.com/ruby/net-http/commit/1903cedd8cd0 works well, but when it errors
due to any reason in Rubies which do not support `open_timeout`, it
spits the rescued ArgumentError that is unrelated to user code and not
actionable.
Net::HTTP.start('foo.bar', 80)
/.../net-http-0.8.0/lib/net/http.rb:1691:in 'TCPSocket#initialize': Failed to open TCP connection to foo.bar:80 (getaddrinfo(3): nodename nor servname provided, or not known) (Socket::ResolutionError)
from /.../net-http-0.8.0/lib/net/http.rb:1691:in 'IO.open'
from /.../net-http-0.8.0/lib/net/http.rb:1691:in 'block in Net::HTTP#connect'
from /.../timeout-0.4.4/lib/timeout.rb:188:in 'block in Timeout.timeout'
from /.../timeout-0.4.4/lib/timeout.rb:195:in 'Timeout.timeout'
from /.../net-http-0.8.0/lib/net/http.rb:1690:in 'Net::HTTP#connect'
from /.../net-http-0.8.0/lib/net/http.rb:1655:in 'Net::HTTP#do_start'
from /.../net-http-0.8.0/lib/net/http.rb:1635:in 'Net::HTTP#start'
from /.../net-http-0.8.0/lib/net/http.rb:1064:in 'Net::HTTP.start'
(snip)
/.../net-http-0.8.0/lib/net/http.rb:1682:in 'TCPSocket#initialize': unknown keyword: :open_timeout (ArgumentError)
sock = TCPSocket.open(conn_addr, conn_port, @local_host, @local_port, open_timeout: @open_timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
from /.../net-http-0.8.0/lib/net/http.rb:1682:in 'IO.open'
from /.../net-http-0.8.0/lib/net/http.rb:1682:in 'Net::HTTP#connect'
from /.../net-http-0.8.0/lib/net/http.rb:1655:in 'Net::HTTP#do_start'
from /.../net-http-0.8.0/lib/net/http.rb:1635:in 'Net::HTTP#start'
from /.../net-http-0.8.0/lib/net/http.rb:1064:in 'Net::HTTP.start'
(snip)
... 8 levels...
This patch suppresses the ArgumentError by moving the retry out of the
rescue clause.
https://github.com/ruby/net-http/commit/86232d62f5
For open_timeout support detection, the previous implementation relied
on an ArgumentError being raised and then rescued. In Ruby, rescue is a
rather expensive operation and should be avoided when possible.
This patch reduces the number of begin-rescues by remembering if the
TCPSocket implementation supports open_timeout.
https://github.com/ruby/net-http/commit/06d982f3a1
This patch replaces the implementation of #open_timeout from Timeout.timeout from the builtin timeout in TCPSocket.open, which was introduced in Ruby 3.5 (https://bugs.ruby-lang.org/issues/21347).
The builtin timeout in TCPSocket.open is better in several ways than Timeout.timeout. It does not rely on a separate Ruby Thread for monitoring Timeout (which is what the timeout library internally does).
Furthermore, it is compatible with Ractors, as opposed to Timeout.timeout (it internally uses Thread::Mutex which can not be used in non-main Ractors).
This change allows the following code to work.
require 'net/http'
Ractor.new {
uri = URI('http://example.com/')
http = Net::HTTP.new(uri.host, uri.port)
http.open_timeout = 1
http.get(uri.path)
}.value
In Ruby <3.5 environments where `TCPSocket.open` does not have the `open_timeout` option, I have kept the behavior unchanged. net/http will use `Timeout.timeout { TCPSocket.open }`.
https://github.com/ruby/net-http/commit/728eb8fc42
