Merge branch 'master' into reserved-char-in-scheme

.document

@@ -0,0 +1,5 @@
+BSDL
+COPYING
+README.md
+docs/
+lib/

.github/workflows/gh-pages.yml

@@ -21,9 +21,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Ruby
-        uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 # v1.152.0
+        uses: ruby/setup-ruby@32110d4e311bd8996b2a82bf2a43b714ccc91777 # v1.221.0
         with:
-          ruby-version: '3.3'
+          ruby-version: '3.4'
           bundler-cache: true
       - name: Setup Pages
         id: pages

.github/workflows/push_gem.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
         with:
           egress-policy: audit
 

.rdoc_options

@@ -0,0 +1,4 @@
+main_page: README.md
+op_dir: _site
+warn_missing_rdoc_ref: true
+title: URI Documentation

docs/kernel.rb

@@ -0,0 +1,2 @@
+# :stopdoc:
+module Kernel end

lib/uri/common.rb

@@ -13,15 +13,19 @@
 require_relative "rfc3986_parser"
 
 module URI
+  # The default parser instance for RFC 2396.
   RFC2396_PARSER = RFC2396_Parser.new
   Ractor.make_shareable(RFC2396_PARSER) if defined?(Ractor)
 
+  # The default parser instance for RFC 3986.
   RFC3986_PARSER = RFC3986_Parser.new
   Ractor.make_shareable(RFC3986_PARSER) if defined?(Ractor)
 
+  # The default parser instance.
   DEFAULT_PARSER = RFC3986_PARSER
   Ractor.make_shareable(DEFAULT_PARSER) if defined?(Ractor)
 
+  # Set the default parser instance.
   def self.parser=(parser = RFC3986_PARSER)
     remove_const(:Parser) if defined?(::URI::Parser)
     const_set("Parser", parser.class)
@@ -40,7 +44,7 @@ def self.parser=(parser = RFC3986_PARSER)
   end
   self.parser = RFC3986_PARSER
 
-  def self.const_missing(const)
+  def self.const_missing(const) # :nodoc:
     if const == :REGEXP
       warn "URI::REGEXP is obsolete. Use URI::RFC2396_REGEXP explicitly.", uplevel: 1 if $VERBOSE
       URI::RFC2396_REGEXP
@@ -87,7 +91,7 @@ def make_components_hash(klass, array_hash)
     module_function :make_components_hash
   end
 
-  module Schemes
+  module Schemes # :nodoc:
     class << self
       ReservedChars = ".+-"
       EscapedChars = "\u01C0\u01C1\u01C2"
@@ -335,7 +339,7 @@ def self.regexp(schemes = nil)# :nodoc:
   256.times do |i|
     TBLENCWWWCOMP_[-i.chr] = -('%%%02X' % i)
   end
-  TBLENCURICOMP_ = TBLENCWWWCOMP_.dup.freeze
+  TBLENCURICOMP_ = TBLENCWWWCOMP_.dup.freeze # :nodoc:
   TBLENCWWWCOMP_[' '] = '+'
   TBLENCWWWCOMP_.freeze
   TBLDECWWWCOMP_ = {} # :nodoc:

lib/uri/generic.rb

@@ -737,12 +737,12 @@ def check_registry(v) # :nodoc:
     end
     private :check_registry
 
-    def set_registry(v) #:nodoc:
+    def set_registry(v) # :nodoc:
       raise InvalidURIError, "cannot set registry"
     end
     protected :set_registry
 
-    def registry=(v)
+    def registry=(v) # :nodoc:
       raise InvalidURIError, "cannot set registry"
     end
 
@@ -1133,17 +1133,16 @@ def merge(oth)
       base.fragment=(nil)
 
       # RFC2396, Section 5.2, 4)
-      if !authority
-        base.set_path(merge_path(base.path, rel.path)) if base.path && rel.path
-      else
-        # RFC2396, Section 5.2, 4)
-        base.set_path(rel.path) if rel.path
+      if authority
+        base.set_userinfo(rel.userinfo)
+        base.set_host(rel.host)
+        base.set_port(rel.port || base.default_port)
+        base.set_path(rel.path)
+      elsif base.path && rel.path
+        base.set_path(merge_path(base.path, rel.path))
       end
 
       # RFC2396, Section 5.2, 7)
-      base.set_userinfo(rel.userinfo) if rel.userinfo
-      base.set_host(rel.host)         if rel.host
-      base.set_port(rel.port)         if rel.port
       base.query = rel.query       if rel.query
       base.fragment=(rel.fragment) if rel.fragment
 
@@ -1392,10 +1391,12 @@ def ==(oth)
       end
     end
 
+    # Returns the hash value.
     def hash
       self.component_ary.hash
     end
 
+    # Compares with _oth_ for Hash.
     def eql?(oth)
       self.class == oth.class &&
       parser == oth.parser &&
@@ -1438,7 +1439,7 @@ def select(*components)
       end
     end
 
-    def inspect
+    def inspect # :nodoc:
       "#<#{self.class} #{self}>"
     end
 

lib/uri/rfc2396_parser.rb

@@ -321,14 +321,14 @@ def unescape(str, escaped = @regexp[:ESCAPED])
       str.gsub(escaped) { [$&[1, 2]].pack('H2').force_encoding(enc) }
     end
 
-    @@to_s = Kernel.instance_method(:to_s)
-    if @@to_s.respond_to?(:bind_call)
-      def inspect
-        @@to_s.bind_call(self)
+    TO_S = Kernel.instance_method(:to_s) # :nodoc:
+    if TO_S.respond_to?(:bind_call)
+      def inspect # :nodoc:
+        TO_S.bind_call(self)
       end
     else
-      def inspect
-        @@to_s.bind(self).call
+      def inspect # :nodoc:
+        TO_S.bind(self).call
       end
     end
 

lib/uri/version.rb

@@ -1,6 +1,6 @@
 module URI
   # :stopdoc:
-  VERSION_CODE = '010002'.freeze
+  VERSION_CODE = '010003'.freeze
   VERSION = VERSION_CODE.scan(/../).collect{|n| n.to_i}.join('.').freeze
   # :startdoc:
 end

test/uri/test_generic.rb

@@ -175,6 +175,17 @@ def test_parse
     # must be empty string to identify as path-abempty, not path-absolute
     assert_equal('', url.host)
     assert_equal('http:////example.com', url.to_s)
+
+    # sec-2957667
+    url = URI.parse('http://user:pass@example.com').merge('//example.net')
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
+    url = URI.join('http://user:pass@example.com', '//example.net')
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
+    url = URI.parse('http://user:pass@example.com') + '//example.net'
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
   end
 
   def test_parse_scheme_with_symbols
@@ -267,6 +278,13 @@ def test_merge
     assert_equal(u0, u1)
   end
 
+  def test_merge_authority
+    u = URI.parse('http://user:pass@example.com:8080')
+    u0 = URI.parse('http://new.example.org/path')
+    u1 = u.merge('//new.example.org/path')
+    assert_equal(u0, u1)
+  end
+
   def test_route
     url = URI.parse('http://hoge/a.html').route_to('http://hoge/b.html')
     assert_equal('b.html', url.to_s)