Module: StillActive::HttpHelper

Extended by:
HttpHelper
Included in:
HttpHelper
Defined in:
lib/helpers/http_helper.rb

Constant Summary collapse

TRUSTED_HOSTS = 
["github.com", "gitlab.com", "codeberg.org", "api.deps.dev", "api.osv.dev", "endoflife.date", "rubygems.pkg.github.com", "repos.ecosyste.ms", "packages.ecosyste.ms", "pypi.org"].freeze
TRANSPORT_ERRORS =

Transport-level failures ("host unreachable / connection broke", not an HTTP error status). Every network entry point degrades to a safe empty result on these rather than letting one escape and vanish a gem from the audit. SystemCallError is the superclass of the whole Errno::* family (EHOSTUNREACH, ENETUNREACH, ETIMEDOUT, EPIPE, ECONNREFUSED, ECONNRESET, ...), so we don't have to enumerate each one and miss the next.

[
  Net::OpenTimeout,
  Net::ReadTimeout,
  SocketError,
  SystemCallError,
  OpenSSL::SSL::SSLError,
  EOFError
].freeze
MAX_REDIRECTS = 
3
MAX_BODY_BYTES =

Ceiling on a single response body. These are metadata endpoints (version lists, scorecards, advisories); legitimate responses are well under this. A source URL is lockfile-derived and a *.jfrog.io host is attacker- registerable, so without a cap a hostile or broken source could stream a multi-GB body and OOM the process. 16 MiB leaves generous headroom for a gem with thousands of versions while bounding worst-case memory.

16 * 1024 * 1024
JSON_PARSER = 
->(body) { JSON.parse(body) }
IDENTITY = 
->(body) { body }

Instance Method Summary collapse

Instance Method Details

#get_json(base_uri, path, headers: {}, params: {}) ⇒ Object 



37
38
39
40
41
42
43
 
# File 'lib/helpers/http_helper.rb', line 37

def get_json(base_uri, path, headers: {}, params: {})
  uri = base_uri.dup
  uri.path = path
  uri.query = URI.encode_www_form(params) unless params.empty?

  request_json(uri, headers) { |target| Net::HTTP::Get.new(target) }
end

#get_text(base_uri, path, headers: {}) ⇒ Object

As get_json, but for endpoints that answer in plain text (the RubyGems compact index). Shares the redirect, auth-scoping and body-cap handling; only the parse step differs.



48
49
50
51
52
53
 
# File 'lib/helpers/http_helper.rb', line 48

def get_text(base_uri, path, headers: {})
  uri = base_uri.dup
  uri.path = path

  request_json(uri, headers, parse: IDENTITY) { |target| Net::HTTP::Get.new(target) }
end

#post_json(base_uri, path, body:, headers: {}) ⇒ Object 



55
56
57
58
59
60
61
62
63
64
 
# File 'lib/helpers/http_helper.rb', line 55

def post_json(base_uri, path, body:, headers: {})
  uri = base_uri.dup
  uri.path = path

  request_json(uri, headers) do |target|
    request = Net::HTTP::Post.new(target)
    request.body = body
    request
  end
end