fix(google-apis-core): ignore non-2xx status codes in streaming downloads (googleapis#27256)

* fix(google-apis-core): ignore non-2xx status codes in streaming downloads

Prevents error response bodies (e.g. 503 Service Unavailable or 4xx error payloads) from being written into destination file streams during streaming downloads. Restores original pre-v1.0.0 allowlist filtering behavior (`!(200..299).include?(status)`) to prevent corrupted download offsets on retryable errors.

Fixes googleapis/google-cloud-ruby#34750

* test(google-apis-core): disable retries in non-2xx streaming unit tests

Explicitly sets retries = 0 in non-2xx streaming specs to prevent Retriable from looping.

Author: torreypayne

google-apis-core/lib/google/apis/core/download.rb

@@ -81,11 +81,12 @@ def execute_once(client, &block)
 
           http_res = client.get(url.to_s, query, request_header) do |request|
             request.options.on_data = proc do |chunk, _size, res|
-              # The on_data callback is only invoked on a successful response.
               # Some Faraday adapters (e.g. Typhoeus) may not provide a response
               # object in the callback, so we default to a 200 OK status.
+              # Note: Ignore non-2xx responses (redirects and 4xx/5xx error payloads)
+              # so error messages are not written to the download stream.
               status = res ? res.status.to_i : 200
-              next if chunk.nil? || (status >= 300 && status < 400)
+              next if chunk.nil? || !(200..299).include?(status)
 
               # HTTP 206 is Partial Content
               download_offset ||= (status == 206 ? @offset : 0)

google-apis-core/lib/google/apis/core/storage_download.rb

@@ -48,11 +48,12 @@ def execute_once(client, &block)
 
           http_res = client.get(url.to_s, query, request_header) do |request|
             request.options.on_data = proc do |chunk, _size, res|
-              # The on_data callback is only invoked on a successful response.
               # Some Faraday adapters (e.g. Typhoeus) may not provide a response
               # object in the callback, so we default to a 200 OK status.
+              # Note: Ignore non-2xx responses (redirects and 4xx/5xx error payloads)
+              # so error messages are not written to the download stream.
               status = res ? res.status.to_i : 200
-              next if chunk.nil? || (status >= 300 && status < 400)
+              next if chunk.nil? || !(200..299).include?(status)
 
               download_offset ||= (status == 206 ? @offset : 0)
               download_offset  += chunk.bytesize

google-apis-core/spec/google/apis/core/download_spec.rb

@@ -157,6 +157,24 @@ def write(data)
     end
   end
 
+  context 'when server responds with non-2xx status and error body' do
+    let(:dest) { StringIO.new }
+
+    it 'does not write error body to destination IO' do
+      command.options.retries = 0
+      response = Faraday::Response.new(status: 503, body: 'Service Unavailable')
+      expect(client).to receive(:get) do |_url, _params, _headers, &block|
+        request = Faraday::Request.new
+        request.options = Faraday::RequestOptions.new
+        block.call(request)
+        request.options.on_data.call('Service Unavailable', 19, response)
+        response
+      end
+      expect { command.execute(client) }.to raise_error(Google::Apis::ServerError)
+      expect(dest.string).to be_empty
+    end
+  end
+
   context 'with pathname destination' do
     let(:dest) { Pathname.new(File.join(Dir.mktmpdir, 'test-path.txt')) }
     let(:received) do

google-apis-core/spec/google/apis/core/storage_download_spec.rb

@@ -162,4 +162,22 @@ def write(data)
       expect(received).to eql 'Hello world'
     end
   end
+
+  context 'when server responds with non-2xx status and error body' do
+    let(:dest) { StringIO.new }
+
+    it 'does not write error body to destination IO' do
+      command.options.retries = 0
+      response = Faraday::Response.new(status: 503, body: 'Service Unavailable')
+      expect(client).to receive(:get) do |_url, _params, _headers, &block|
+        request = Faraday::Request.new
+        request.options = Faraday::RequestOptions.new
+        block.call(request)
+        request.options.on_data.call('Service Unavailable', 19, response)
+        response
+      end
+      expect { command.execute(client) }.to raise_error(Google::Apis::ServerError)
+      expect(dest.string).to be_empty
+    end
+  end
 end