Re: Patch for minor OpenURI annoyance

In article <[e-mail]>,
  "Mel Gray" <[e-mail]> writes:

> When attempting to open a web page that redirects from a regular http
> connection to a https connection, OpenURI dies.
>
> It is a very common thing to have web pages redirect users to and from
> secure connections, so I made a minor modification to the "redirectable?"
> method to allow this.

There is security problem on automatic https to http redirect.

If https request has privacy information such as secure
cookie or referer, it should not redirect to http.

* secure cookie: RFC 2109 4.3.1
* referer: RFC 2616 15.1.3

> This is a short term fix. A more long term solution would be to extend the
> "redirectable?" check to allow users to configure what they want to allow

Now I think redirectable? method is not possible to treat
real world problem.  It is just a conservative predicate.

I made :redirect=>false option to disable redirection in
open-uri.  When it is used, OpenURI::HTTPRedirect exception
is raised on redirection.  The exception has uri method to
express redirect target.  You can control redirection as
follows.

uri = URI("http://www.ruby-lang.org/")
begin
  puts uri.read(:redirect=>false)
rescue OpenURI::HTTPRedirect
  # I know this request has no privacy information.
  # I know the result is just printed to terminal.
  # So I think any redirection is safe.
  uri = $!.uri
  retry
end
-- 
Tanaka Akira