fix(netty): preserve all redirect body types (#2316)

## Summary

- Build keep-body redirects from the original request, preserving every
supported body representation and per-request setting.
- Clear target-specific routing and credential state when a redirect
crosses an origin, including separately stored Cookie objects.
- Preserve an explicit `Content-Length` when replaying a raw
`InputStream` or an unknown-length `InputStreamBodyGenerator`.
- Replay resettable streams and fail promptly for consumed raw streams,
streamed multipart parts, and vanished files that cannot be replayed
safely.
- Pin body bytes, headers, body-selection precedence, caller-owned
`ByteBuf` references, and the new failure modes with focused tests.

## Problem

`Redirect30xInterceptor` rebuilds a request when it follows a strict
302, 307, or 308 redirect. Its keep-body copy chain handled form
parameters, strings, byte arrays, `ByteBuffer`, body generators, and
multipart bodies, but omitted four real request send paths:

- `List<byte[]>` / composite byte arrays
- Netty `ByteBuf`
- `InputStream`
- `File`

The redirected request therefore kept its method and Content-Type but
sent zero bytes. The `File` case is especially risky for uploads because
the target can accept an apparently valid empty PUT or POST.
Reconstructing the request field by field also omitted unrelated
per-request state such as the read timeout and range offset, and
maintaining a second body-selection chain alongside
`NettyRequestFactory` made future drift likely.

This is a pre-existing omission. AHC issue
[#1643](#1643)
previously fixed the same class of bug for multipart bodies. The copy
chain was carried through pull request
[#1843](#1843)
without a policy discussion. Focused searches found no existing issue or
pull request covering these four representations.

## Change

Build a keep-body redirect with `request.toBuilder()` and then replace
only redirect-specific state. This preserves all current and future body
representations and per-request options without duplicating
`NettyRequestFactory.body`. Headers are copied before redirect-only
values are removed, so the original request is not mutated.

On a cross-origin redirect, the copied request drops the previous
resolved address, virtual host, realm, authorization headers, and Cookie
objects before the cookie store adds cookies that legitimately match the
new URI. The body is not covered by that boundary. It follows the
existing keep-body policy, which means a `File` or `InputStream` body
that a cross-origin redirect leg previously received as empty is now
sent in full, and a target that keeps redirecting can receive it once
per hop up to `maxRedirects`. That is the same exposure byte arrays,
strings, form parameters, and multipart bodies already have today.

Composite byte arrays, caller-owned `ByteBuf`s, and files are
repeatable. A resettable `InputStream`, such as `ByteArrayInputStream`,
also replays. A caller-supplied `Content-Length` is retained for a raw
`InputStream` or an `InputStreamBodyGenerator` without a declared
length, because neither has an intrinsic size from which to recompute
it. A consumed stream that cannot be reset reaches the existing
fail-fast guard added in #2312 and completes the future with
`IOException`; that is preferable to silently succeeding with an empty
body.

An `InputStreamPart` is closed by the first multipart send and has no
equivalent replay guard, so a keep-body redirect now fails promptly
instead of risking a hang or incomplete multipart request. A selected
`File` or `FileBodyGenerator` is also checked before dispatching the
redirect; if it disappeared after the first send, the future fails with
`IOException` before a target pooled channel can be removed and an
unchecked constructor exception can escape. The validation follows
`NettyRequestFactory` precedence so a sticky `File` field is ignored
when a higher-priority body representation was actually sent.

The change does not alter which methods or status codes keep a body, nor
does it introduce a new cross-origin policy. It makes the existing
strict-302, 307, and 308 behavior complete for every supported
request-body representation.

## Compatibility

There is no public API change. Requests that previously sent an empty
body on a keep-body redirect now resend their configured body.

**Behavior changes:**

- A non-resettable `InputStream` on a keep-body redirect previously
completed successfully after sending an empty redirected request. It now
completes the request future exceptionally with `IOException`. This
includes `FileInputStream`, which is closed after the first send and
cannot be reset for replay.
- A multipart `InputStreamPart` now fails promptly with `IOException`
when a keep-body redirect requires replay. Reusing its already-consumed
and closed stream could previously hang or send incomplete multipart
content.
- A selected file that disappears between the first request and redirect
now fails with `IOException` before redirect dispatch rather than
allowing an unchecked `IllegalArgumentException` to escape while
constructing the next request.
- A `File` or `InputStream` body is now sent on a keep-body redirect to
a different origin, where the redirected request previously carried no
body. Credentials are still stripped at that boundary, but the payload
is not.

Callers that accidentally relied on an empty or incomplete redirected
request will observe an exception, but the failure is explicit instead
of silently losing configured content. There is no public API change.

## AI disclosure

OpenAI Codex on behalf of Matthias Kurz. The commit includes
`Co-Authored-By: OpenAI Codex <codex@openai.com>` per `AGENTS.md`.

## Test plan

- [x] On untouched `upstream/main`, the focused suite reproduced five
failures: four body types arrived as zero bytes and a non-resettable
stream incorrectly completed successfully.
- [x] Before the generator fix, a one-argument
`InputStreamBodyGenerator` sent `Content-Length: 13` on the first leg
and no `Content-Length` on the redirected leg.
- [x] `./mvnw -pl client
-Dtest=RedirectBodyTest,RedirectCredentialSecurityTest test` on JDK 11:
40 tests passed, including Netty leak detection.
- [x] `./mvnw clean verify` on JDK 11: 1,496 tests passed and Revapi
completed without failures (`BUILD SUCCESS`).

Generated with OpenAI Codex.

---------

Co-authored-by: OpenAI Codex <codex@openai.com>
Co-authored-by: Aayush Atharva <24762260+hyperxpro@users.noreply.github.com>

Author: 3 people

client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java

@@ -21,6 +21,7 @@
 import io.netty.handler.codec.http.HttpStatusClass;
 import io.netty.handler.codec.http.HttpUtil;
 import io.netty.handler.codec.http.cookie.Cookie;
+import io.netty.handler.codec.http2.Http2StreamChannel;
 import org.asynchttpclient.AsyncHttpClientConfig;
 import org.asynchttpclient.Realm;
 import org.asynchttpclient.Realm.AuthScheme;
@@ -32,11 +33,16 @@
 import org.asynchttpclient.netty.channel.ChannelManager;
 import org.asynchttpclient.netty.channel.PrincipalScopedPartitionKey;
 import org.asynchttpclient.netty.request.NettyRequestSender;
-import io.netty.handler.codec.http2.Http2StreamChannel;
+import org.asynchttpclient.request.body.generator.FileBodyGenerator;
+import org.asynchttpclient.request.body.generator.InputStreamBodyGenerator;
+import org.asynchttpclient.request.body.multipart.InputStreamPart;
+import org.asynchttpclient.request.body.multipart.Part;
 import org.asynchttpclient.uri.Uri;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.File;
+import java.io.IOException;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -56,7 +62,6 @@
 import static org.asynchttpclient.util.HttpConstants.ResponseStatusCodes.SEE_OTHER_303;
 import static org.asynchttpclient.util.HttpConstants.ResponseStatusCodes.TEMPORARY_REDIRECT_307;
 import static org.asynchttpclient.util.HttpUtils.followRedirect;
-import static org.asynchttpclient.util.MiscUtils.isNonEmpty;
 import static org.asynchttpclient.util.ThrowableUtil.unknownStackTrace;
 
 public class Redirect30xInterceptor {
@@ -132,13 +137,28 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
                     LOGGER.debug("Stripping credentials on redirect to {}", newUri);
                 }
 
-                final RequestBuilder requestBuilder = new RequestBuilder(switchToGet ? GET : originalMethod)
-                        .setChannelPoolPartitioning(request.getChannelPoolPartitioning())
+                final RequestBuilder requestBuilder;
+                if (keepBody) {
+                    ensureBodyReplayable(request);
+                    requestBuilder = request.toBuilder();
+                    if (!sameBase) {
+                        // An explicitly resolved address and virtual host belong to the previous target.
+                        requestBuilder.setAddress(null);
+                        requestBuilder.setVirtualHost(null);
+                    }
+                } else {
+                    requestBuilder = new RequestBuilder(switchToGet ? GET : originalMethod)
+                            .setChannelPoolPartitioning(request.getChannelPoolPartitioning())
+                            .setLocalAddress(request.getLocalAddress())
+                            .setNameResolver(request.getNameResolver())
+                            .setProxyServer(request.getProxyServer())
+                            .setRangeOffset(request.getRangeOffset());
+                }
+
+                requestBuilder.setMethod(switchToGet ? GET : originalMethod)
                         .setFollowRedirect(true)
-                        .setLocalAddress(request.getLocalAddress())
-                        .setNameResolver(request.getNameResolver())
-                        .setProxyServer(request.getProxyServer())
                         .setRealm(stripAuth ? null : request.getRealm())
+                        .setHeaders(propagatedHeaders(request, realm, keepBody, stripAuth))
                         .setRequestTimeout(request.getRequestTimeout())
                         .setReadTimeout(request.getReadTimeout());
 
@@ -154,27 +174,10 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
                 if (stripAuth) {
                     future.setRealm(null);
                     future.setProxyRealm(null);
+                    // Request.toBuilder copies Cookie objects separately from the Cookie header.
+                    requestBuilder.resetCookies();
                 }
 
-                if (keepBody) {
-                    requestBuilder.setCharset(request.getCharset());
-                    if (isNonEmpty(request.getFormParams())) {
-                        requestBuilder.setFormParams(request.getFormParams());
-                    } else if (request.getStringData() != null) {
-                        requestBuilder.setBody(request.getStringData());
-                    } else if (request.getByteData() != null) {
-                        requestBuilder.setBody(request.getByteData());
-                    } else if (request.getByteBufferData() != null) {
-                        requestBuilder.setBody(request.getByteBufferData());
-                    } else if (request.getBodyGenerator() != null) {
-                        requestBuilder.setBody(request.getBodyGenerator());
-                    } else if (isNonEmpty(request.getBodyParts())) {
-                        requestBuilder.setBodyParts(request.getBodyParts());
-                    }
-                }
-
-                requestBuilder.setHeaders(propagatedHeaders(request, realm, keepBody, stripAuth));
-
                 // in case of a redirect from HTTP to HTTPS, future
                 // attributes might change
                 final boolean initialConnectionKeepAlive = future.isKeepAlive();
@@ -192,7 +195,7 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
                     }
                 }
 
-                if (sameBase) {
+                if (sameBase && !keepBody) {
                     // we can only assume the virtual host is still valid if the baseUrl is the same
                     requestBuilder.setVirtualHost(request.getVirtualHost());
                 }
@@ -229,10 +232,76 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
         return false;
     }
 
+    private static void ensureBodyReplayable(Request request) throws IOException {
+        for (Part part : request.getBodyParts()) {
+            if (part instanceof InputStreamPart) {
+                throw new IOException("Multipart InputStream body part '" + part.getName()
+                        + "' cannot be replayed after redirect");
+            }
+        }
+
+        File file = selectedBodyFile(request);
+        if (file != null && !file.isFile()) {
+            throw new IOException("Redirect request body file " + file.getAbsolutePath()
+                    + " is not a file or does not exist");
+        }
+    }
+
+    private static File selectedBodyFile(Request request) {
+        // Keep this precedence aligned with NettyRequestFactory.body. A File can remain set alongside a
+        // higher-priority representation, so only validate it when the original request actually sent it.
+        if (hasBodyBeforeFile(request)) {
+            return null;
+        }
+        if (request.getFile() != null) {
+            return request.getFile();
+        }
+        return request.getBodyGenerator() instanceof FileBodyGenerator
+                ? ((FileBodyGenerator) request.getBodyGenerator()).getFile()
+                : null;
+    }
+
+    private static boolean hasBodyBeforeFile(Request request) {
+        return hasBodyBeforeStream(request)
+                || request.getStreamData() != null
+                || !request.getFormParams().isEmpty()
+                || !request.getBodyParts().isEmpty();
+    }
+
+    private static boolean hasBodyBeforeStream(Request request) {
+        return request.getByteData() != null
+                || request.getCompositeByteData() != null
+                || request.getStringData() != null
+                || request.getByteBufferData() != null
+                || request.getByteBufData() != null;
+    }
+
+    private static boolean selectedBodyHasUnknownLength(Request request) {
+        if (hasBodyBeforeStream(request)) {
+            return false;
+        }
+        if (request.getStreamData() != null) {
+            return true;
+        }
+        if (!request.getFormParams().isEmpty()
+                || !request.getBodyParts().isEmpty()
+                || request.getFile() != null) {
+            return false;
+        }
+        if (request.getBodyGenerator() instanceof InputStreamBodyGenerator) {
+            return ((InputStreamBodyGenerator) request.getBodyGenerator()).getContentLength() < 0;
+        }
+        return request.getBodyGenerator() != null
+                && !(request.getBodyGenerator() instanceof FileBodyGenerator);
+    }
+
     private static HttpHeaders propagatedHeaders(Request request, Realm realm, boolean keepBody, boolean stripAuthorization) {
-        HttpHeaders headers = request.getHeaders()
-                .remove(HOST)
-                .remove(CONTENT_LENGTH);
+        HttpHeaders headers = request.getHeaders().copy().remove(HOST);
+
+        // Preserve an explicit length when the selected stream representation cannot rebuild it.
+        if (!keepBody || !selectedBodyHasUnknownLength(request)) {
+            headers.remove(CONTENT_LENGTH);
+        }
 
         if (!keepBody) {
             headers.remove(CONTENT_TYPE);