Upgrading ethon 0.18 to 0.19
Breaking0.18.0 → 0.19.1Breaking9Security9New17Changed17Fixed87Other13
SecurityEasy#headers= now rejects CR and LF in header names and values with Ethon::Errors::InvalidValue, preventing header injection via custom headers.#327 ↗
BreakingUpgrade verdict
9 breaking changes and 9 security fixes.
In plain terms
- Setting an option the installed curl library does not support now raises an error instead of silently doing something else.
- Cleaned-up handles cannot be reused, and easy handles attached to a multi handle cannot be performed or reset. Create new handles instead.
- When the underlying curl library reports a fatal multi-transfer error, Ethon now stops with an exception rather than carrying on in a broken state.
- Handles made before forking cannot be used in the child process anymore. Use fork plus exec, or create handles after forking.
Must act Top 5 of 18 that need code or config changes
What you must change
Breaking9
Errors from curl_easy_setopt and curl_multi_setopt are no longer ignored; unknown options raise UnsupportedOption and rejected values raise SetOption.
curl_easy_setoptcurl_multi_setoptEthon::Errors::UnsupportedOptionEthon::Errors::SetOptionEasy#http_versionCurl.supports_option?Curl.version_at_least?Easy#cleanup and Multi#cleanup are terminal, and Easy#perform and Easy#reset raise while the handle is attached to a Multi.
Easy#cleanupMulti#cleanupEasy#performEasy#resetMultiFatal errors from curl_multi_perform now raise Ethon::Errors::MultiPerform instead of continuing Multi execution with invalid state.
curl_multi_performEthon::Errors::MultiPerformEasy and Multi handles created before a fork can no longer be used or cleaned up in the child process; Ethon raises Ethon::Errors::ForkSafety.
EasyMultiEthon::Errors::ForkSafetyforkexecUnknown named enum and bitmask option values now raise Ethon::Errors::InvalidValue instead of silently becoming 0.
Ethon::Errors::InvalidValueExceptions raised by on_body callbacks are now consistently re-raised for Easy and Multi transfers, including in verbose mode.
on_bodyrequire 'ethon' no longer loads mime-types; the registry loads on first file upload, saving about 2.4 MB and 100 ms per process.
require 'ethon'MIME::TypesEasy#cleanup is terminal; using the handle afterwards raises Ethon::Errors::EthonError instead of silently sending requests without callbacks.
Easy#cleanupEthon::Errors::EthonErrorUnsupported libcurl callback ABIs now raise NotImplementedError instead of being registered with the generic read/write callback signature.
NotImplementedErrorioctlfunction=seekfunction=opensocketfunction=Security9
Easy#headers= now rejects CR and LF in header names and values with Ethon::Errors::InvalidValue, preventing header injection via custom headers.
Easy#headers=Ethon::Errors::InvalidValueInvalidOption, UnsupportedOption, and SetOption now inspect the option name in messages, so control characters in an untrusted option key cannot inject log lines.
InvalidOptionUnsupportedOptionSetOptionEthon::Errors::InvalidValue now escapes the value in its message, so CR or LF in a rejected URL or request-line value cannot be injected into logs.
Ethon::Errors::InvalidValueThe haproxy_client_ip option now rejects whitespace, since libcurl writes it into the space-separated PROXY protocol line without validation.
haproxy_client_ipURL values now reject CR and LF before libcurl stores them, preventing header injection via Easy#curlu= or Easy#url; percent-encoded line breaks remain valid.
Easy#curlu=Easy#urlEasy#log_inspect and Mirror#log_informations redact credentials in effective_url so debug logs do not contain URL passwords.
Easy#log_inspecteffective_urlMirror#log_informationsEasy#effective_urlMirror#optionsCurl::Slist.build rejects CR, LF, and NUL in list lines to prevent command injection in FTP quotes, SMTP recipients, and other verbatim commands.
Curl::Slist.buildMIME part headers reject CR, LF, and NUL bytes, and empty header lines are dropped so an empty string clears part headers.
String options written verbatim into request lines, protocol headers, or protocol commands now reject CR and LF to prevent header or command injection.
customrequestrequest_targetuseragentreferercookieaccept_encodingrange