anodizer_core/
content_source.rs

1//! Resolve a [`ContentSource`] to its string content.
2//!
3//! Hoisted to core so multiple stages (release, changelog, ...) can share one
4//! implementation. Supports `Inline`, `FromFile` (template-render the path,
5//! read the file), and `FromUrl` (template-render URL + headers, fetch via
6//! HTTP GET with retries on transient errors / 5xx, fail fast on 4xx).
7//!
8//! `FromUrl` enforces a 256 KiB body cap and rejects CR/LF in rendered header
9//! values to defend against header-injection via templated user data.
10
11use std::time::Duration;
12
13use anyhow::{Context as _, Result};
14
15use crate::config::ContentSource;
16use crate::context::Context;
17use crate::log::StageLogger;
18use crate::retry::{RetryLog, RetryPolicy, SuccessClass, retry_http_blocking};
19
20const MAX_BODY_BYTES: usize = 256 * 1024;
21/// Total per-request deadline. `reqwest::blocking::ClientBuilder` does
22/// not expose a separate `read_timeout` (the API is async-only); the
23/// total `timeout` bounds connect + transfer for the blocking surface,
24/// so a stalled server cannot hold the connection open past 30 s.
25const HTTP_TIMEOUT: Duration = Duration::from_secs(30);
26/// Connect-only deadline. Allows the connect phase to fail fast on a
27/// dead host without consuming the full request budget; the remaining
28/// time is then available for the actual transfer.
29const HTTP_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
30const POLICY: RetryPolicy = RetryPolicy {
31    max_attempts: 3,
32    base_delay: Duration::from_millis(500),
33    max_delay: Duration::from_secs(2),
34};
35
36/// Resolve a [`ContentSource`] to its string content.
37///
38/// `kind` is a short label (e.g. `"release header"`, `"changelog footer"`)
39/// surfaced in error messages so misconfigured fields are easy to identify.
40pub fn resolve(
41    source: &ContentSource,
42    kind: &str,
43    ctx: &Context,
44    log: &StageLogger,
45) -> Result<String> {
46    match source {
47        ContentSource::Inline(s) => Ok(s.clone()),
48        ContentSource::FromFile { from_file } => {
49            let rendered_path = ctx
50                .render_template(from_file)
51                .with_context(|| format!("{kind}: render from_file path '{from_file}'"))?;
52            std::fs::read_to_string(&rendered_path)
53                .with_context(|| format!("{kind}: read from_file '{rendered_path}'"))
54        }
55        ContentSource::FromUrl { from_url, headers } => {
56            let rendered_url = ctx
57                .render_template(from_url)
58                .with_context(|| format!("{kind}: render from_url '{from_url}'"))?;
59
60            // Render header values (keys are literal).
61            // Reject CR/LF anywhere in keys or rendered values — a template
62            // interpolating user-tainted data could otherwise inject a new
63            // header line.
64            let mut rendered_headers: Vec<(String, String)> = Vec::new();
65            if let Some(map) = headers {
66                for (k, v) in map {
67                    if k.contains('\r') || k.contains('\n') {
68                        anyhow::bail!(
69                            "{kind} from_url header key contains CR/LF (possible injection): {:?}",
70                            k
71                        );
72                    }
73                    let rendered_v = ctx.render_template(v).with_context(|| {
74                        format!("{kind}: render header value for '{k}' at URL {rendered_url}")
75                    })?;
76                    if rendered_v.contains('\r') || rendered_v.contains('\n') {
77                        anyhow::bail!(
78                            "{kind} from_url header '{}' rendered to a value containing \
79                             CR/LF (possible injection): {:?}",
80                            k,
81                            rendered_v
82                        );
83                    }
84                    rendered_headers.push((k.clone(), rendered_v));
85                }
86            }
87
88            let client = reqwest::blocking::Client::builder()
89                .user_agent(crate::http::USER_AGENT)
90                .timeout(HTTP_TIMEOUT)
91                .connect_timeout(HTTP_CONNECT_TIMEOUT)
92                .build()
93                .context("build blocking HTTP client for ContentSource::FromUrl")?;
94
95            // `retry_http_blocking` handles 5xx → retry, 4xx → fast-fail, and
96            // transport errors via the shared `is_retriable` classifier.
97            // Body-cap and label-formatting are applied on the returned
98            // body string.
99            let label = format!("{kind} from_url {rendered_url}");
100            let rendered_url_for_err = rendered_url.clone();
101            let (_status, body) = retry_http_blocking(
102                RetryLog::new(&label, log),
103                &POLICY,
104                SuccessClass::Strict,
105                |_attempt| {
106                    let mut req = client.get(&rendered_url);
107                    for (k, v) in &rendered_headers {
108                        req = req.header(k.as_str(), v.as_str());
109                    }
110                    req.send()
111                },
112                |status, _body| format!("returned HTTP {status}"),
113            )?;
114
115            if body.len() > MAX_BODY_BYTES {
116                anyhow::bail!(
117                    "{kind} from_url {} body is {} bytes, exceeds {} KiB limit",
118                    rendered_url_for_err,
119                    body.len(),
120                    MAX_BODY_BYTES / 1024,
121                );
122            }
123            Ok(body)
124        }
125    }
126}
127
128#[cfg(test)]
129mod tests {
130    use super::*;
131    use crate::config::Config;
132    use crate::context::{Context, ContextOptions};
133    use crate::test_helpers::responder::{
134        spawn_oneshot_http_responder, spawn_request_capturing_responder,
135    };
136    use std::collections::HashMap;
137    use std::sync::atomic::Ordering;
138
139    fn ctx() -> Context {
140        let config = Config {
141            project_name: "myapp".to_string(),
142            ..Config::default()
143        };
144        Context::new(config, ContextOptions::default())
145    }
146
147    fn tlog() -> &'static StageLogger {
148        static L: std::sync::OnceLock<StageLogger> = std::sync::OnceLock::new();
149        L.get_or_init(|| StageLogger::new("test", crate::log::Verbosity::Quiet))
150    }
151
152    // ---- Inline ----
153
154    #[test]
155    fn inline_returns_string_verbatim() {
156        let src = ContentSource::Inline("hello world".to_string());
157        assert_eq!(resolve(&src, "k", &ctx(), tlog()).unwrap(), "hello world");
158    }
159
160    // ---- FromFile ----
161
162    #[test]
163    fn from_file_renders_path_template_and_reads_contents() {
164        let dir = tempfile::tempdir().unwrap();
165        let body = "release header from disk\n";
166        // Render a path template that interpolates a template var so the
167        // rendered path differs from the raw template string — proves the
168        // template engine actually ran on the path.
169        let file_path = dir.path().join("myapp-notes.md");
170        std::fs::write(&file_path, body).unwrap();
171        let template = format!("{}/{{{{ .ProjectName }}}}-notes.md", dir.path().display());
172        let src = ContentSource::FromFile {
173            from_file: template,
174        };
175        assert_eq!(
176            resolve(&src, "release header", &ctx(), tlog()).unwrap(),
177            body
178        );
179    }
180
181    #[test]
182    fn from_file_bails_when_path_template_invalid() {
183        // Unknown filter is a recognized template parse error (see
184        // `template/tests.rs::test_unknown_filter_error`). Routes through
185        // the `render from_file path` `with_context` arm.
186        let src = ContentSource::FromFile {
187            from_file: "{{ ProjectName | nonexistent_filter }}".to_string(),
188        };
189        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
190        let chain = format!("{err:#}");
191        assert!(
192            chain.contains("render from_file path"),
193            "context missing: {chain}"
194        );
195    }
196
197    #[test]
198    fn from_file_bails_when_file_missing() {
199        let dir = tempfile::tempdir().unwrap();
200        let missing = dir.path().join("does-not-exist.md");
201        let src = ContentSource::FromFile {
202            from_file: missing.display().to_string(),
203        };
204        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
205        let chain = format!("{err:#}");
206        assert!(chain.contains("read from_file"), "context missing: {chain}");
207    }
208
209    // ---- FromUrl ----
210
211    #[test]
212    fn from_url_success_returns_body() {
213        let body = "remote header body";
214        let body_len = body.len();
215        let response: &'static str = Box::leak(
216            format!("HTTP/1.1 200 OK\r\nContent-Length: {body_len}\r\n\r\n{body}").into_boxed_str(),
217        );
218        let (addr, calls) = spawn_oneshot_http_responder(vec![response]);
219        let src = ContentSource::FromUrl {
220            from_url: format!("http://{addr}/header.md"),
221            headers: None,
222        };
223        let got = resolve(&src, "release header", &ctx(), tlog()).unwrap();
224        assert_eq!(got, body);
225        assert_eq!(calls.load(Ordering::SeqCst), 1, "single attempt on 200");
226    }
227
228    #[test]
229    fn from_url_renders_header_values_and_sends_them_verbatim() {
230        let response = "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok";
231        let (addr, captured) = spawn_request_capturing_responder(response);
232
233        let mut headers = HashMap::new();
234        // Key is literal; value is template-rendered.
235        headers.insert(
236            "X-App-Name".to_string(),
237            "name={{ .ProjectName }}".to_string(),
238        );
239        let src = ContentSource::FromUrl {
240            from_url: format!("http://{addr}/h.md"),
241            headers: Some(headers),
242        };
243        let body = resolve(&src, "release header", &ctx(), tlog()).unwrap();
244        assert_eq!(body, "ok");
245
246        // Poll the capture briefly — the responder thread writes the
247        // captured string asynchronously.
248        let deadline = std::time::Instant::now() + Duration::from_secs(2);
249        let captured_str = loop {
250            let s = captured.lock().unwrap().clone();
251            if !s.is_empty() || std::time::Instant::now() >= deadline {
252                break s;
253            }
254            std::thread::sleep(Duration::from_millis(10));
255        };
256        let lower = captured_str.to_ascii_lowercase();
257        assert!(
258            lower.contains("x-app-name: name=myapp"),
259            "header missing or unrendered in request: {captured_str:?}"
260        );
261    }
262
263    #[test]
264    fn from_url_rejects_crlf_in_header_key() {
265        let mut headers = HashMap::new();
266        headers.insert("X-Bad\r\nInjected".to_string(), "v".to_string());
267        let src = ContentSource::FromUrl {
268            // Address doesn't matter; the key check fires before any
269            // network IO.
270            from_url: "http://127.0.0.1:1/".to_string(),
271            headers: Some(headers),
272        };
273        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
274        let chain = format!("{err:#}");
275        assert!(
276            chain.contains("header key contains CR/LF"),
277            "expected CR/LF key guard, got: {chain}"
278        );
279    }
280
281    #[test]
282    fn from_url_rejects_crlf_in_rendered_header_value() {
283        // The header value template renders a literal CR/LF sequence —
284        // simulating an attacker-controlled template var that injected
285        // a header-line terminator. `Env.X` falls back to literal-empty
286        // when unset, so embed the CR/LF directly to make the test
287        // deterministic.
288        let mut headers = HashMap::new();
289        headers.insert("X-Hdr".to_string(), "ok\r\nX-Injected: yes".to_string());
290        let src = ContentSource::FromUrl {
291            from_url: "http://127.0.0.1:1/".to_string(),
292            headers: Some(headers),
293        };
294        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
295        let chain = format!("{err:#}");
296        assert!(
297            chain.contains("rendered to a value containing CR/LF"),
298            "expected CR/LF value guard, got: {chain}"
299        );
300    }
301
302    #[test]
303    fn from_url_bails_when_body_exceeds_cap() {
304        // 256 KiB + 1 byte body — the cap is a strict `>` check.
305        let oversize = "x".repeat(MAX_BODY_BYTES + 1);
306        let body_len = oversize.len();
307        let response: &'static str = Box::leak(
308            format!("HTTP/1.1 200 OK\r\nContent-Length: {body_len}\r\n\r\n{oversize}")
309                .into_boxed_str(),
310        );
311        let (addr, _calls) = spawn_oneshot_http_responder(vec![response]);
312        let src = ContentSource::FromUrl {
313            from_url: format!("http://{addr}/big.md"),
314            headers: None,
315        };
316        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
317        let chain = format!("{err:#}");
318        assert!(
319            chain.contains("exceeds 256 KiB limit"),
320            "expected body-cap error, got: {chain}"
321        );
322    }
323
324    #[test]
325    fn from_url_4xx_fast_fails_no_retry() {
326        let (addr, calls) = spawn_oneshot_http_responder(vec![
327            "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n",
328        ]);
329        let src = ContentSource::FromUrl {
330            from_url: format!("http://{addr}/missing.md"),
331            headers: None,
332        };
333        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
334        let chain = format!("{err:#}");
335        assert!(chain.contains("404"), "status missing from chain: {chain}");
336        assert_eq!(
337            calls.load(Ordering::SeqCst),
338            1,
339            "4xx must not retry (only one attempt observed)"
340        );
341    }
342
343    #[test]
344    fn from_url_5xx_exhausts_retries_then_fails() {
345        // Drive exactly POLICY.max_attempts canned 500s so the responder
346        // counter pins to the configured retry budget. Wiring through the
347        // const means a future bump of POLICY.max_attempts updates the
348        // test atomically without a stale literal silently passing.
349        let max_attempts = POLICY.max_attempts as usize;
350        let responses: Vec<&'static str> = std::iter::repeat_n(
351            "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\n\r\n",
352            max_attempts,
353        )
354        .collect();
355        let (addr, calls) = spawn_oneshot_http_responder(responses);
356        let src = ContentSource::FromUrl {
357            from_url: format!("http://{addr}/flaky.md"),
358            headers: None,
359        };
360        let err = resolve(&src, "release header", &ctx(), tlog()).unwrap_err();
361        let chain = format!("{err:#}");
362        assert!(chain.contains("500"), "status missing from chain: {chain}");
363        assert_eq!(
364            calls.load(Ordering::SeqCst),
365            max_attempts as u32,
366            "all POLICY.max_attempts retries must run before bailing"
367        );
368    }
369}
anodizer_core/content_source.rs

anodizer_core/
content_source.rs
