lib/httpx/connection.rb in httpx-0.6.2 vs lib/httpx/connection.rb in httpx-0.6.3

@@ -78,11 +78,20 @@
     end
 
     def match?(uri, options)
       return false if @state == :closing || @state == :closed
 
-      (@origins.include?(uri.origin) || match_altsvcs?(uri)) && @options == options
+      (
+        (
+          @origins.include?(uri.origin) &&
+          # if there is more than one origin to match, it means that this connection
+          # was the result of coalescing. To prevent blind trust in the case where the
+          # origin came from an ORIGIN frame, we're going to verify the hostname with the
+          # SSL certificate
+          (@origins.size == 1 || @origin == uri.origin || (@io && @io.verify_hostname(uri.host)))
+        ) || match_altsvcs?(uri)
+      ) && @options == options
     end
 
     def mergeable?(connection)
       return false if @state == :closing || @state == :closed || !@io
 
@@ -100,12 +109,12 @@
     end
 
     def merge(connection)
       @origins += connection.instance_variable_get(:@origins)
       pending = connection.instance_variable_get(:@pending)
-      pending.each do |req, args|
-        send(req, args)
+      pending.each do |req|
+        send(req)
       end
     end
 
     def unmerge(connection)
       @origins -= connection.instance_variable_get(:@origins)
@@ -119,22 +128,23 @@
     end
 
     def purge_pending
       [@parser.pending, @pending].each do |pending|
         pending.reject! do |request, *args|
-          yield(request, args)
+          yield(request, args) if block_given?
         end
       end
     end
 
     # checks if this is connection is an alternative service of
     # +uri+
     def match_altsvcs?(uri)
-      AltSvc.cached_altsvc(@origin).any? do |altsvc|
-        origin = altsvc["origin"]
-        origin.altsvc_match?(uri.origin)
-      end
+      @origins.any? { |origin| uri.altsvc_match?(origin) } ||
+        AltSvc.cached_altsvc(@origin).any? do |altsvc|
+          origin = altsvc["origin"]
+          origin.altsvc_match?(uri.origin)
+        end
     end
 
     def connecting?
       @state == :idle
     end
@@ -271,9 +281,12 @@
         emit(:altsvc, alt_origin, origin, alt_params)
       end
 
       parser.on(:promise) do |request, stream|
         request.emit(:promise, parser, stream)
+      end
+      parser.on(:origin) do |origin|
+        @origins << origin
       end
       parser.on(:close) do
         transition(:closing)
       end
       parser.on(:reset) do