Update faraday gem to support additional HTTP methods

[megamorf]

Only some HTTP methods can be used in the http resource. TRACE and CONNECT are not supported at the moment so invoking the http resource with them fails.

inspec> http('https://www.example.org', method: 'TRACE').headers
ArgumentError: unknown http method: trace
from /opt/inspec/embedded/lib/ruby/gems/2.6.0/gems/faraday-0.15.4/lib/faraday/connection.rb:373:in `run_request'

Detailed Description

Update the faraday gem once a new version has been released that includes the additional HTTP methods. The latest version 0.15.4 was released 27th Nov 2018.

Context

I want to validate web server hardening measures. One of the typical steps is to verify that the TRACE method is not allowed. This should be possible with the built-in http resource instead of having to rely on invoking the curl binary.

Possible Implementation

I've asked the faraday maintainers about a new release that includes the change for the HTTP methods so that the required functionality can be made available in InSpec: lostisland/faraday#462

[technoweenie]

Thanks for the reminder. We should have an RC out this week.

Question: do you need CONNECT? I believe that method is usually only used for proxy or websocket requests, so it probably won't ever be used by a Faraday end user.

[megamorf]

@technoweenie Actually I only need TRACE and only mentioned CONNECT because you've added support for it as well. Thanks for the quick response 👍

[megamorf]

Looks like Faraday is nearing version v1.0. It might be a good idea to check if there are any incompatibilities between InSpec and their upcoming release.