disarm 0.13.0-x86_64-linux → 0.14.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d81c4bbe604fd099bba7266d2921248be9972a688da6a5b15b355f582a69f058
-  data.tar.gz: 0ec9829b26b563078dfac28f4b13989055d85ba80fcf985b917627c983ed1ed5
+  metadata.gz: 4e0669625aaa90d822968d52986b7fe06971564991ab212439d18c23e8f6a71b
+  data.tar.gz: 27e026ce2b0985c5c42a837ec80078fba14ab8c41dd9e853212c2999cf335f23
 SHA512:
-  metadata.gz: 466a9a07bf889ecd2d17acdb319bd306f52bbad97bc1ba09dd99243c6c9450bac2a54c651022a2c0c0ca0da388933d5442cf8fbd25328f0e9a457642d80e5f39
-  data.tar.gz: 87ec554bed96f2dcc23d8642a20e41a7e88d8f772a3410a3751c1056ed3978bfd25c07025070ca3e49803ca4cc55a567195dde8a0f7efb176b172e5cf3ee646a
+  metadata.gz: 41f8fa679ebcb84c16b801f33c7d5a6ef943d4bd6b87a80ab7f40d152a02c62c6ac394fe0376224e4a22746ee26432dc807e223e7991d1737ce4d78f42a826a5
+  data.tar.gz: d96b321c9a911bd50d3d02deb89e9cee5dde089f2c56edb418999a093e6a772f5f9e6cd10bb9276724d91e60d5979e3e1147e2e3bb8ebfe0ad9815c2f8422dba

data/lib/disarm/version.rb

@@ -2,5 +2,5 @@
 
 module Disarm
   # Kept in lockstep with the Rust crate / Python package version.
-  VERSION = "0.13.0"
+  VERSION = "0.14.0"
 end

data/lib/disarm.rb

@@ -54,8 +54,18 @@ module Disarm
     end
 
     # Fold cross-script confusables toward `target:` (:latin or :cyrillic).
-    def normalize_confusables(text, target: :latin)
-      translate_errors { _normalize_confusables(text, target.to_s) }
+    #
+    # `digit_policy:` selects how non-Latin DIGITS fold (#561). `:numeric` (default)
+    # sends them to the ASCII digit — `०` becomes `0` — which is right for prose, where
+    # a Devanagari zero really is a zero. `:tr39` uses upstream's targets, which send
+    # most of them to a Latin letter (`०` → `o`; three of the 45 rows fold to `.` or
+    # to the two characters `rn` instead); that is what an identifier *skeleton*
+    # wants, since its only job is to make two confusable identifiers collide. The two
+    # differ on 45 rows and agree everywhere else. Scoped to `target: :latin` — the
+    # override rows are generated from the Latin table and carry TR39's Latin-script
+    # targets, so with `target: :cyrillic` it is a no-op.
+    def normalize_confusables(text, target: :latin, digit_policy: :numeric)
+      translate_errors { _normalize_confusables(text, target.to_s, digit_policy.to_s) }
     end
 
     # Whether `text` contains a character confusable with `target:` (:latin or
@@ -151,9 +161,43 @@ module Disarm
       translate_errors { _fold_case(text) }
     end
 
+    # Whether `text` is a stable identity key under case folding — whether
+    # `fold_case` and `String#downcase` agree on it (#619). A false result means
+    # some other string folds to the same value, so a table keyed on this one can
+    # collide: "groß.txt" and "gross.txt" are the pair node-tar collided on
+    # (CVE-2026-23950). It is a fact about the string, not an accusation.
+    def case_fold_stable?(text)
+      translate_errors { _is_case_fold_stable?(text) }
+    end
+
+    # Which of `values` are the same name under `key` (#620).
+    #
+    # Every other disarm detector is a single-string predicate, and a collision is
+    # not a property of a single string — "groß.txt" is an ordinary German filename,
+    # and "аdmin" is only a problem next to "admin". This is the set-shaped question
+    # node-tar's PathReservations guard failed to ask (CVE-2026-23950).
+    #
+    # `key:` is one of "fold_case", "search_key", "catalog_key", "canonicalize",
+    # "canonicalize_strict", "normalize_confusables". There is no default: a stronger
+    # key finds more collisions, including ones nobody attacked ("search_key" collides
+    # "Muller" with "Müller"), so the choice is the policy.
+    #
+    # A group is reported only when two or more DISTINCT inputs share a key; the same
+    # name twice is the same name twice. `lang:` reaches "search_key" and
+    # "catalog_key" and is ignored by the rest.
+    #
+    # Returns an array of hashes with `:key`, `:values` (distinct, first-appearance
+    # order) and `:indices` (every position, ascending — not parallel to `:values`).
+    def find_key_collisions(values, key:, lang: nil)
+      translate_errors { _find_key_collisions(values, key.to_s, lang&.to_s) }
+        .map { |k, vals, idx| { key: k, values: vals, indices: idx } }
+    end
+
     # Whether the hostname looks like a mixed-script / confusable / bidi-reorder
     # IDN spoof. Flags a mixed-script label, a Latin confusable, or a
-    # bidi-direction conflict (see #bidi_conflict?, the "BiDi Swap" precondition).
+    # bidi-direction conflict (see #bidi_conflict?, the "BiDi Swap" precondition),
+    # or a UAX #9 bidi control character (#603 — the RLO spoof, which the direction
+    # conflict is blind to).
     # A false result asserts nothing was *found*, not that the host is safe.
     def suspicious_hostname?(host)
       translate_errors { _suspicious_hostname?(host) }
@@ -163,21 +207,24 @@ module Disarm
     # as a Hash. `:suspicious` is a maximally conservative screen (an any-character
     # confusable test flags essentially every non-Latin host), not a precise verdict;
     # branch on the granular signals plus your own policy. Keys: :suspicious,
-    # :scripts, :mixed_script, :has_confusables, :bidi_conflict, :cross_label_script,
+    # :scripts, :mixed_script, :has_confusables, :bidi_conflict, :bidi_control,
+    # :has_invisible, :cross_label_script,
     # :label_scripts, :whole_script_confusable, :label_whole_script_confusable,
     # :canonical. `:whole_script_confusable` is a graded signal, NOT folded into
     # `:suspicious` (see #545).
-    def analyze_hostname(host)
+    def analyze_hostname(host, contractions: false)
       suspicious, scripts, mixed_script, has_confusables, bidi_conflict,
-        cross_label_script, label_scripts, whole_script_confusable,
-        label_whole_script_confusable, canonical =
-        translate_errors { _analyze_hostname(host) }
+        bidi_control, has_invisible, cross_label_script, label_scripts,
+        whole_script_confusable, label_whole_script_confusable, canonical =
+        translate_errors { _analyze_hostname(host, contractions) }
       {
         suspicious:,
         scripts:,
         mixed_script:,
         has_confusables:,
         bidi_conflict:,
+        bidi_control:,
+        has_invisible:,
         cross_label_script:,
         label_scripts:,
         whole_script_confusable:,
@@ -314,6 +361,41 @@ module Disarm
       end
     end
 
+    # Every upstream confusable source the bundled table does not fold, as a sorted
+    # Array of single-character Strings (#563). An Array rather than a Set, matching
+    # `list_scripts` and avoiding a `require "set"` in the gem entrypoint.
+    #
+    # Read as exposure, not as a score — this is where an adaptive attacker goes once
+    # the mapped sources stop working. It includes five ASCII characters ("%", "0",
+    # "1", "I", "m"): TR39 is a skeleton transform, and disarm deliberately does not
+    # apply those rows because folding a legitimate "m" to "rn" corrupts prose.
+    def unmapped_confusables(target: :latin)
+      translate_errors { _unmapped_confusables(target.to_s) }
+    end
+
+    # Confusable sources in `text` the bundled table does not fold, as an Array of
+    # `{ char:, offset: }` hashes in order of appearance — the confusables analogue of
+    # `find_untranslatable`, with the same byte-offset convention (#563).
+    def find_unmapped_confusables(text, target: :latin)
+      translate_errors do
+        _find_unmapped_confusables(text, target.to_s)
+          .map { |ch, offset| { char: ch, offset: offset } }
+      end
+    end
+
+    # ML/NLP normalization: NFKC → emoji→text → transliterate → strip accents →
+    # [case fold] → strip control → strip zero-width → collapse whitespace.
+    #
+    # `fold_case:` defaults to true. Pass false in front of a CASED model — folding is
+    # destructive, cannot be undone downstream, and an uncased evaluation harness cannot
+    # measure what it cost. It restores case, not diacritics: accents are still stripped.
+    #
+    # Folds no confusables, so it is not a homoglyph defence at any setting; compose it
+    # after `normalize_confusables` when a model needs both.
+    def ml_normalize(text, lang: nil, emoji_style: "cldr", fold_case: true)
+      translate_errors { _ml_normalize(text, lang&.to_s, emoji_style.to_s, fold_case) }
+    end
+
     # The Unicode scripts present in `text`, in first-appearance order
     # (Common/Inherited excluded), as stable UCD identifiers (e.g. "Latin").
     def detect_scripts(text)
@@ -356,6 +438,13 @@ module Disarm
       translate_errors { _script_info(name.to_s) }
     end
 
+    # The Unicode `confusables.txt` release the bundled confusable tables were folded
+    # from, e.g. "17.0.0". Not a Unicode version for the library as a whole — the
+    # case-folding and width tables track different releases (see docs/provenance.md).
+    def confusables_version
+      translate_errors { _confusables_version }
+    end
+
     # Every script disarm knows, as stable UCD script identifiers (includes
     # "Common"/"Inherited"), sorted by name.
     def list_scripts

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: disarm
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: x86_64-linux
 authors:
 - Richard Quinn
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-17 00:00:00.000000000 Z
+date: 2026-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake