disarm 0.15.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: d75406993aaa2ac76a20429c567601447bcffa79708398444b83dc8b445ebf01
+  data.tar.gz: cfea208f2da86fd373ed82f4e25a9166277ffd1806c22614551418ddb20acb05
+SHA512:
+  metadata.gz: 68a46c759f40421b154e1879500edecf0ced53931224e317b1f3dacfb5a03750ebe132bfe7b1efd7f4be21d384f4478bfc104d826e27675c85b61c79723b40a1
+  data.tar.gz: 93d71a7e1d5aac2f0a33e26a72e6658ad842a2408b4e744f70ed73bdc1d141b567b2b575ec241c8e738e2c54dc39d4f49309118b353f7985084226d089de7ca3

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Richard Quinn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,104 @@
+# disarm (Ruby)
+
+Ruby bindings for [**disarm**](https://github.com/raeq/disarm) — Unicode
+confusable / text-security building blocks (homoglyph & bidi & zalgo handling,
+plus standards-based transliteration), powered by Rust.
+
+The native extension wraps the **pure-Rust `disarm` core** (no Python), via
+[magnus](https://github.com/matsadler/magnus) + [rb-sys](https://github.com/oxidize-rb/rb-sys).
+Precompiled platform gems install without a local Rust toolchain.
+
+## Install
+
+```ruby
+# Gemfile
+gem "disarm"
+```
+
+```sh
+gem install disarm
+```
+
+Requires Ruby >= 3.1. Precompiled platform gems ship for Ruby 3.1 through 4.0
+(Linux x86_64/aarch64, macOS x86_64/arm64, Windows). On a supported Ruby with no
+matching platform gem, the source gem installs and compiles locally, which needs a
+Rust toolchain. Below 3.1 the gem does not install at all.
+
+## Usage
+
+```ruby
+require "disarm"
+
+# Standards-based transliteration to ASCII. `scheme:` is a symbol (or string):
+# :default (general-purpose), :strict_iso9 (ISO 9:1995), :gost7034. `lang:`
+# applies a language profile on top (e.g. "uk" → Київ → "Kyiv").
+Disarm.transliterate("Москва")                       # => "Moskva"
+Disarm.transliterate("Київ", lang: :uk)              # => "Kyiv"
+Disarm.transliterate("Москва", scheme: :strict_iso9)
+
+# TR39 confusable folding (homoglyph defense). `target:` defaults to :latin.
+Disarm.normalize_confusables("раypal")               # => "paypal"
+Disarm.confusable?("pаypal")                          # => true
+Disarm.normalize_confusables("paypal", target: :cyrillic)
+
+# Canonicalization primitives
+Disarm.strip_accents("café")                         # => "cafe"
+Disarm.fold_case("HELLO")                            # => "hello"
+Disarm.slugify("Héllo Wörld")                        # => "hello-world"
+Disarm.slugify("Hello World", separator: "_", max_length: 5, word_boundary: true)
+Disarm.demojize("I ❤️ Ruby")                          # => "I red heart Ruby"
+Disarm.demojize("👍🏽", strip_modifiers: true)
+
+# Security presets
+Disarm.strip_obfuscation("Ѕ𝗲𝗰𝗿𝗲𝘁  \u200bdata")            # deobfuscated
+Disarm.canonicalize("…")                           # homoglyph/bidi/zero-width clean
+
+# IDN / hostname spoof check (a false result is not a safety guarantee)
+Disarm.suspicious_hostname?("pаypal.com")            # => true (Cyrillic 'а')
+```
+
+Every option past the text is a keyword argument with the core's default, and
+scheme/target tokens accept symbols or strings. `slugify` exposes the core's
+`SlugConfig` surface (`separator:`, `lowercase:`, `max_length:`,
+`word_boundary:`, `save_order:`, `stopwords:`, `allow_unicode:`, `lang:`,
+`entities:`, `decimal:`, `hexadecimal:`, `safe_chars:`).
+
+### Errors
+
+Every public method is wrapped so that everything disarm raises descends from
+`Disarm::Error < StandardError` — a single `rescue Disarm::Error` catches all of
+them. An invalid scheme/target, a non-String argument, or any other bad input
+raises the more specific `Disarm::InvalidArgument`; the original backtrace is
+preserved so the failing call site stays visible.
+
+```ruby
+begin
+  Disarm.transliterate("x", scheme: :klingon)
+rescue Disarm::InvalidArgument => e   # also rescuable as Disarm::Error
+  warn e.message
+end
+```
+
+## Security posture
+
+This binding inherits the core's guarantees and limitations verbatim — it adds
+no logic of its own. disarm is an **input-normalization** layer, not an output
+sanitizer; read the [Threat Model](https://github.com/raeq/disarm/blob/main/THREAT_MODEL.md)
+before relying on it in a security context.
+
+## Development
+
+```sh
+cd bindings/ruby
+bundle install
+bundle exec rake compile   # builds the native ext for the host platform
+bundle exec rake spec      # runs the RSpec suite against it
+```
+
+`bundle exec rake compile` requires a Rust toolchain (the core is a path
+dependency until disarm 0.10 is published to crates.io). Cross-platform release
+gems are built in CI with `rb-sys-dock`.
+
+## License
+
+MIT — same as the disarm core.

data/ext/disarm/Cargo.toml

@@ -0,0 +1,36 @@
+# Ruby (magnus) native extension for the disarm Unicode text-security core (#45).
+#
+# This is a *binding crate*, not published to crates.io — it is compiled into the
+# `disarm` RubyGem by rake-compiler/rb-sys. It wraps the pure-Rust `disarm` core
+# (no pyo3) and exposes an idiomatic `Disarm` Ruby module. It is a member of the
+# gem-root workspace (../../Cargo.toml) so rb-sys's `cargo metadata` resolves here
+# rather than walking up to the repo-root core crate.
+#
+# Named `disarm` (matching the gem / lib / loader) but pinned to version 0.0.0,
+# distinct from the `disarm` core (0.10) it depends on — two same-named crates of
+# different versions coexist in the lockfile; same name + same version would not.
+[package]
+name = "disarm"
+version = "0.0.0"
+edition = "2021"
+rust-version = "1.81"
+license = "MIT"
+description = "Ruby bindings for disarm — Unicode confusable/text-security building blocks"
+publish = false
+
+[lib]
+# Output the `disarm` shared object the gem's `require "disarm/disarm"` loads.
+# The core is imported under the alias `disarm_core` (see [dependencies]) so the
+# `disarm_core::` paths in src never clash with this crate's own `disarm` name.
+name = "disarm"
+crate-type = ["cdylib"]
+
+[dependencies]
+# The pure-Rust core from crates.io (default features = pyo3-free). A registry
+# dep — not a path — so the gem is self-contained and the rb-sys-dock cross-gem
+# build (which mounts only this gem dir) can fetch it. Imported as `disarm_core`
+# because the package name `disarm` would otherwise clash with this crate.
+disarm_core = { package = "disarm", version = "0.15", default-features = false }
+# magnus: ergonomic, safe Ruby<->Rust bindings over rb-sys. 0.8 supports Ruby >= 3.0
+# (the gem's required_ruby_version); rb-sys handles the platform glue.
+magnus = "0.8"

data/ext/disarm/extconf.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# rb-sys builds the Cargo cdylib in `ext/disarm/` into the loadable extension.
+require "mkmf"
+require "rb_sys/mkmf"
+
+create_rust_makefile("disarm/disarm")