dmarcator 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bdd3aafe769b2b0da2829b7247b4c65cd5cb15a28f41f1703e4b198938f43a58
-  data.tar.gz: 22cd8f8dfed8f93c89b329af83b8b057288b15087033f2ee3646f17dbc631a06
+  metadata.gz: 00c852a4815b31a240c4c24071c523ff0af57f6d87b447fbcec7515f8b502e55
+  data.tar.gz: b325e8eb13e3ee9f91215800492a9d81142338ad71992c998f1d0976756b4214
 SHA512:
-  metadata.gz: 18710be1b05e3d8c6301654a0ed9a9957d8d67eafa2e873e83cc3d43b0d1d4d2f2551a808b180177d3140cabc2bf3460be61578ae0ecba6d9b9e2ac4a0ad4a29
-  data.tar.gz: e03b01fa23c6981ca858da830e73f08ddc6ca522dc28849d7efc076dbb0f6d319e41e8687522c5ecbe10bfeeda1e8726e9289ed8566711e9abc672e294ffdc54
+  metadata.gz: d7b2dd3cbcbd800cfc3b1de240200ec0493fa6d82794282f00aa4c23d209f4269f8335f55468091e4f69dad70206b56c6dcac33c5da578f385507a1bd3eb531a
+  data.tar.gz: 3faa47a127473ce206dc30d983772f5189d4d7cec302394ab96dcf64afe481463bfdaad645bf99e2c38cd14bd133d1c7c637744646dfed2d62662a5b105578f7

data/ChangeLog.md

@@ -1,3 +1,17 @@
+### 0.3.1 / 2026-10-26
+
+* Update the gemspec maintainer metadata to list only the fork's author.
+
+### 0.3.0 / 2026-10-26
+
+* Raise `DMARCator::InvalidReport` for malformed XML reports instead of returning an empty report.
+* Return `nil` for a non-numeric report `version` instead of raising `ArgumentError`.
+* Return `nil` for a non-numeric report timestamp instead of coercing it to the Unix epoch.
+* Add `DMARCator::Uri#eql?` and `#hash` for correct Hash/Set semantics.
+* Harden `DMARCator.validate_domain` against CVE-2026-80213 (63-octet label limit and 248-octet total limit).
+* Warn at load time when the `resolv` gem is affected by CVE-2026-80212/CVE-2026-80213.
+* Require Ruby >= 3.3.13 to pick up the Regexp compilation fixes behind GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264.
+
 ### 0.2.0 / 2026-10-13
 
 * Added DMARC XML report parsing, ported from the `dmarc_parser` gem by D Salko.

data/README.md

@@ -115,7 +115,7 @@ report.records.first.source_ip
 
 ## Requirements
 
-* [Ruby] >= 3.0.0
+* [Ruby] >= 3.3.13
 * [parslet] >= 1.0.0, < 3.0.0
 * [nokogiri] >= 1.10
 * [bigdecimal] >= 1.0

data/lib/dmarcator/exceptions.rb

@@ -3,4 +3,10 @@ require 'parslet'
 module DMARCator
   class InvalidRecord < Parslet::ParseFailed
   end
+
+  #
+  # Raised when a DMARC XML report cannot be parsed.
+  #
+  class InvalidReport < StandardError
+  end
 end

data/lib/dmarcator/query.rb

@@ -1,6 +1,43 @@
 require 'resolv'
+require 'rubygems'
 
 module DMARCator
+  #
+  # Resolv gem versions affected by CVE-2026-80212 and CVE-2026-80213.
+  #
+  VULNERABLE_RESOLV = [
+    Gem::Requirement.new('< 0.3.2'),
+    Gem::Requirement.new('>= 0.4.0', '< 0.7.2')
+  ].freeze
+
+  #
+  # Determines the version of the loaded `resolv` gem, if available.
+  #
+  # @return [String, nil]
+  #
+  def self.resolv_version
+    if defined?(Resolv::VERSION)
+      Resolv::VERSION
+    elsif (spec = Gem.loaded_specs['resolv'])
+      spec.version.to_s
+    end
+  end
+
+  #
+  # Determines whether the loaded `resolv` gem is affected by
+  # CVE-2026-80212 or CVE-2026-80213.
+  #
+  # @return [Boolean]
+  #
+  def self.vulnerable_resolv?
+    version = resolv_version
+    return false unless version
+
+    VULNERABLE_RESOLV.any? do |requirement|
+      requirement.satisfied_by?(Gem::Version.new(version))
+    end
+  end
+
   #
   # Validates a domain before using it in a DNS query.
   #
@@ -15,10 +52,11 @@ module DMARCator
   #
   def self.validate_domain(domain)
     unless domain.is_a?(String) && !domain.empty? &&
-           domain.length <= 253 &&
+           domain.length <= 248 &&
            !domain.start_with?('.') &&
            !domain.include?('..') &&
-           !domain.match?(/[^A-Za-z0-9._-]/)
+           !domain.match?(/[^A-Za-z0-9._-]/) &&
+           domain.split('.').all? { |label| label.length <= 63 }
       raise ArgumentError, "invalid domain: #{domain.inspect}"
     end
 
@@ -61,3 +99,9 @@ module DMARCator
     nil
   end
 end
+
+if DMARCator.vulnerable_resolv?
+  warn "dmarcator: resolv #{DMARCator.resolv_version} is affected by " \
+       "CVE-2026-80212 and CVE-2026-80213; upgrade to resolv >= 0.7.2 " \
+       "(or >= 0.3.2 on Ruby 3.3)"
+end

data/lib/dmarcator/report.rb

@@ -5,6 +5,7 @@ require 'bigdecimal'
 require 'bigdecimal/util'
 
 require_relative 'xml_helper'
+require_relative 'exceptions'
 require_relative 'report/metadata'
 require_relative 'report/policy'
 require_relative 'report/record'
@@ -28,6 +29,11 @@ module DMARCator
     def initialize(xml)
       @xml = xml
       @node = Nokogiri::XML(xml)
+
+      unless @node.errors.empty?
+        raise InvalidReport, "invalid DMARC XML report: #{@node.errors.first}"
+      end
+
       @node.remove_namespaces!
     end
 
@@ -39,7 +45,14 @@ module DMARCator
     def version
       @version ||= begin
         value = get_text('feedback/version')
-        BigDecimal(value) if value && !value.empty?
+
+        if value && !value.empty?
+          begin
+            BigDecimal(value)
+          rescue ArgumentError
+            nil
+          end
+        end
       end
     end
 

data/lib/dmarcator/uri.rb

@@ -75,6 +75,27 @@ module DMARCator
       (@unit == other.unit)
     end
 
+    #
+    # Determines if the DMARC URI is equivalent to the other.
+    #
+    # @param [Object] other
+    #   the other DMARC URI to compare against.
+    #
+    # @return [Boolean]
+    #
+    def eql?(other)
+      self == other
+    end
+
+    #
+    # Computes a hash value consistent with {#eql?}.
+    #
+    # @return [Integer]
+    #
+    def hash
+      [self.class, @uri, @size, @unit].hash
+    end
+
     #
     # Converts the DMARC URI back into a String.
     #

data/lib/dmarcator/version.rb

@@ -1,4 +1,4 @@
 module DMARCator
   # dmarcator version
-  VERSION = '0.2.0'
+  VERSION = '0.3.1'
 end

data/lib/dmarcator/xml_helper.rb

@@ -30,7 +30,12 @@ module DMARCator
     #
     def get_timestamp(xpath)
       value = get_text(xpath)
-      value && !value.empty? ? Time.at(value.to_i) : nil
+      return nil if value.nil? || value.empty?
+
+      digits = value.strip
+      return nil unless digits.match?(/\A\d+\z/)
+
+      Time.at(digits.to_i)
     end
 
     #

data/spec/dmarcator_spec.rb

@@ -59,4 +59,70 @@ describe DMARCator do
       expect { subject.query("foo bar") }.to raise_error(ArgumentError)
     end
   end
+
+  describe ".validate_domain" do
+    it "accepts a valid domain" do
+      expect(subject.validate_domain("example.com")).to eq("example.com")
+    end
+
+    it "rejects a label longer than 63 octets" do
+      expect {
+        subject.validate_domain("#{'a' * 64}.com")
+      }.to raise_error(ArgumentError)
+    end
+
+    it "accepts a 63-octet label" do
+      domain = "#{'a' * 63}.com"
+
+      expect(subject.validate_domain(domain)).to eq(domain)
+    end
+
+    it "rejects a domain longer than 248 octets" do
+      domain = "#{'a' * 62}.#{'a' * 62}.#{'a' * 62}.#{'a' * 60}"
+
+      expect { subject.validate_domain(domain) }.to raise_error(ArgumentError)
+    end
+
+    it "accepts a domain at the 248-octet limit" do
+      domain = "#{'a' * 62}.#{'a' * 62}.#{'a' * 62}.#{'a' * 59}"
+
+      expect(subject.validate_domain(domain)).to eq(domain)
+    end
+
+    it "rejects a non-string domain" do
+      expect { subject.validate_domain(123) }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe ".vulnerable_resolv?" do
+    it "is true for resolv 0.3.1 and earlier" do
+      allow(subject).to receive(:resolv_version).and_return("0.3.1")
+
+      expect(subject.vulnerable_resolv?).to be(true)
+    end
+
+    it "is false for resolv 0.3.2" do
+      allow(subject).to receive(:resolv_version).and_return("0.3.2")
+
+      expect(subject.vulnerable_resolv?).to be(false)
+    end
+
+    it "is true for resolv 0.4.0 through 0.7.1" do
+      allow(subject).to receive(:resolv_version).and_return("0.7.1")
+
+      expect(subject.vulnerable_resolv?).to be(true)
+    end
+
+    it "is false for resolv 0.7.2 and later" do
+      allow(subject).to receive(:resolv_version).and_return("0.7.2")
+
+      expect(subject.vulnerable_resolv?).to be(false)
+    end
+
+    it "is false when the version is unknown" do
+      allow(subject).to receive(:resolv_version).and_return(nil)
+
+      expect(subject.vulnerable_resolv?).to be(false)
+    end
+  end
 end

data/spec/report_spec.rb

@@ -23,6 +23,34 @@ RSpec.describe DMARCator::Report do
     expect(google.version).to be_nil
   end
 
+  it 'returns nil for a non-numeric report version' do
+    report = described_class.new('<feedback><version>abc</version></feedback>')
+
+    expect(report.version).to be_nil
+  end
+
+  it 'raises InvalidReport for malformed XML' do
+    expect {
+      described_class.new('this is not xml')
+    }.to raise_error(DMARCator::InvalidReport)
+  end
+
+  it 'returns nil for a non-numeric timestamp' do
+    report = described_class.new(
+      '<feedback><report_metadata><date_range><begin>notanumber</begin></date_range></report_metadata></feedback>'
+    )
+
+    expect(report.metadata.begin_at).to be_nil
+  end
+
+  it 'parses timestamps with surrounding whitespace' do
+    report = described_class.new(
+      '<feedback><report_metadata><date_range><begin> 1593648000 </begin></date_range></report_metadata></feedback>'
+    )
+
+    expect(report.metadata.begin_at).to eq(Time.at(1_593_648_000))
+  end
+
   it 'reads report metadata' do
     report = described_class.new(xml_report)
 

data/spec/uri_spec.rb

@@ -109,6 +109,52 @@ describe DMARCator::Uri do
     end
   end
 
+  describe "#eql?" do
+    it "is true when all fields match" do
+      other = described_class.new(uri.dup, size, unit)
+
+      expect(subject.eql?(other)).to be(true)
+    end
+
+    it "is false when the uri differs" do
+      other = described_class.new(URI("mailto:other@example.com"), size, unit)
+
+      expect(subject.eql?(other)).to be(false)
+    end
+
+    it "is false for a different class" do
+      expect(subject.eql?(Object.new)).to be(false)
+    end
+  end
+
+  describe "#hash" do
+    it "is equal for equivalent URIs" do
+      other = described_class.new(uri.dup, size, unit)
+
+      expect(subject.hash).to eq(other.hash)
+    end
+
+    it "differs for non-equivalent URIs" do
+      other = described_class.new(URI("mailto:other@example.com"), size, unit)
+
+      expect(subject.hash).not_to eq(other.hash)
+    end
+  end
+
+  describe "Hash/Set semantics" do
+    it "deduplicates equivalent URIs" do
+      other = described_class.new(uri.dup, size, unit)
+
+      expect([subject, other].uniq.size).to eq(1)
+    end
+
+    it "treats equivalent URIs as the same Hash key" do
+      other = described_class.new(uri.dup, size, unit)
+
+      expect({ subject => 1 }.key?(other)).to be(true)
+    end
+  end
+
   describe "#to_s" do
     context "when only the uri is set" do
       subject { described_class.new(uri) }

metadata

@@ -1,11 +1,10 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Noah Berman
-- Davis Gallinghouse
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
@@ -62,7 +61,6 @@ description: A hardened DMARC record parser and query client, forked from the Tr
   of Bits 'dmarc' gem.
 email:
 - noah@noahberman.org
-- davis@trailofbits.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -107,14 +105,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.3.13
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.23
 specification_version: 4
 summary: DMARC record parser and query client
 test_files: