* fix(http): decode response header values as ISO-8859-1
Response header values were decoded with String::from_utf8 before being
sent over IPC. Raw UTF-8 bytes produced JS strings with code points
above 255, which new Headers() rejects as invalid ByteStrings
("Type error" on WebKit), and bytes that were not valid UTF-8 failed
the fetch outright. Decode as ISO-8859-1 instead so every byte maps to a
char 0-255, matching what browsers expose for the same response.
Fixes#2898
* fix(http): add tests for ISO-8859-1 response header decoding
Cover the #2898 Content-Disposition case and non-UTF-8 header bytes on
the same conversion fetch_send uses, so a revert to UTF-8 fails the suite.
* request headers, e2e test
---------
Co-authored-by: Lucas Nogueira <lucas@tauri.app>
* feat(http, upload): update reqwest to 0.13
`tauri-plugin-http` re-exports `reqwest`, so moving it is a breaking change and
belongs on v3 rather than v2 (#3462). `tauri-plugin-updater` already took 0.13
in #3213; these two follow the same shape.
`rustls-tls` maps to `reqwest/rustls-no-provider` plus `rustls` with `ring`,
and the provider is installed as the process default only when none is set yet,
exactly as the updater does. Without it `reqwest::Client::new()` has no crypto
provider to build with.
Features reqwest 0.13 removed are removed here rather than remapped silently:
- `native-tls-alpn`: ALPN is part of `native-tls` now.
- `rustls-tls-manual-roots`, `rustls-tls-webpki-roots`, `rustls-tls-native-roots`:
certificate verification goes through the platform verifier.
- `trust-dns`: renamed `hickory-dns`.
- `macos-system-configuration`: superseded by `system-proxy`, which the default
feature set already carries and which the deprecation note pointed at.
Verified with the CI commands for both packages: clippy --all-targets and
clippy --all-targets --all-features under -D warnings, cargo test (http 8,
upload 7 with --all-features), and cargo fmt --all --check.
* feat(http): drop the reqwest re-export
* chore(http): drop duplicate macos-system-configuration changelog entry
* remove .tauri
---------
Co-authored-by: Lucas Nogueira <lucas@tauri.app>
* refactor(http)!: remove deprecated macos-system-configuration feature
Use `system-proxy` (enabled by default) instead.
* chore(upload): enable reqwest's system-proxy feature instead of the deprecated alias
---------
Co-authored-by: Lucas Nogueira <lucas@crabnebula.dev>
* refactor(http)!: always enforce the scope on redirects
Removes the `scopeRedirects` option (and the `Config` struct with it) that
was added as an opt-in in 2.7.0. Every hop of a redirect chain is now
checked against the URL scope, so a server on an allowed origin can no
longer redirect the request to a URL the scope denies.
`tauri_plugin_http::init()` returns `TauriPlugin<R>` again.
* chore(http): compile without warnings when the cookies feature is disabled
Checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend.
Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.
* fix(http): stop unhandled rejections from the fetch cleanup path
The request/body cleanup commands are fired as floating promises, and the
Rust side releases a resource only once: fetch_cancel_body is
resources_table.close(rid)?, and fetch_read_body also closes the rid at
end-of-body. So every release after the first rejects with BadResourceId
into a promise nobody is listening to.
Make dropBody idempotent and let both cleanup calls handle their own
rejection.
* chore: add changefile
* chore(http): rebuild api-iife.js
github-actions[bot]