dmarcator 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c4ed90f1362c3a69141cadeb2e7360b71a7f86c18f74f433990d0760d2bab0d
-  data.tar.gz: 63d27b1fc2acbf70627757d7a5604c1cf471e2d2f7dc71c80e8e221f663f3a70
+  metadata.gz: bf9c3559d1b305ece3b68de7e2e0eb72f1371be508b7499ce34160e543cbd6a1
+  data.tar.gz: f082d761778abd9e66e8bed82cee7a3aafc498567814021120a5780dc9c5f5fc
 SHA512:
-  metadata.gz: 92f2851179be4e2ee8eaaa542afa87ab6efcb2aed546161001778efda5f41579a78a552b1a30010ff625f877f94cbf08c7b7506ffbdacc06fc1d68c9753ef415
-  data.tar.gz: 10ad6dc240c07a14705ac06c83388c0981b4476ae03c980323b0d288f69693ea552218b94615524c9c7b8692b521a316157fd0c3fed87f96726acf2dfc7ce4b8
+  metadata.gz: 85da1dd8330918fb7ae6c167a9c08b23c97589f5fb3d8586c7866e64d19cd9bdf04a39efdfa161be70c01ef276cadc3b907e04b35df3ed10f9c32ffd28eb2be8
+  data.tar.gz: 4ed5b91fa75ba6eda666357a1541e27b11d008c5ec952f9573cf3a89243877a9757d09b6ae7d0488bb449b6c6dc798ed594d9ab75de1d911490e86bcda82a041

data/ChangeLog.md

@@ -1,3 +1,19 @@
+### 0.4.2 / 2026-10-28
+
+* Do not raise when the loaded `resolv` version is not a valid gem version; an unparseable version is treated as unknown instead of failing at load time.
+* Reject DMARC records larger than 4 KiB (`Parser::MAX_RECORD_BYTES`) before parsing to bound work on hostile input.
+* Raise the documented `InvalidRecord`/`InvalidReport` for non-String input instead of `ArgumentError`, `TypeError`, or a silently empty report.
+
+### 0.4.1 / 2026-10-28
+
+* Accept a case-insensitive `mailto:` scheme in `rua`/`ruf` report URIs.
+* Fix parsing of `rua`/`ruf` lists that mix valid and invalid URIs.
+* Restrict `mailto:` address characters to a safe whitelist.
+* Reject underscores in validated domain names.
+* Remove the dead Alexa Top 500 scraping task and its fixture.
+* Drop the `simplecov` development dependency.
+* Housekeeping: remove dead rescue code, fix documentation typos, add frozen string literals, make `Uri` delegation private, and drop the deprecated `gem.test_files`.
+
 ### 0.4.0 / 2026-10-26
 
 * Add `strict: true` parsing mode to reject unknown tags and invalid tag values.

data/README.md

@@ -150,12 +150,6 @@ To run the RSpec tests:
 rake spec
 ```
 
-To test the parser against the bundled Alexa Top 500 fixture:
-
-```sh
-rake spec:gauntlet
-```
-
 ## License
 
 This project is released under the MIT License. See the [LICENSE.txt] file for

data/lib/dmarcator/parser.rb

@@ -14,6 +14,11 @@ module DMARCator
   #
   class Parser < Parslet::Parser
 
+    # Maximum accepted DMARC record size in bytes. Real records are far
+    # smaller; the cap bounds parsing work on hostile input.
+    #
+    MAX_RECORD_BYTES = 4096
+
     root :dmarc_record
 
     rule(:dmarc_record) do
@@ -67,13 +72,13 @@ module DMARCator
     end
 
     tag_rule(:auri, 'rua') do
-      dmarc_uri >> (wsp? >> str(',') >> wsp? >> dmarc_uri).repeat
+      dmarc_uri >> (uri_list_sep.present? >> uri_list_sep).repeat >> (wsp? >> str(',')).absent?
     end
 
     tag_rule(:ainterval,'ri') { digit.repeat(1, 10) >> digit.absent? }
 
     tag_rule(:furi,'ruf') do
-      dmarc_uri >> (wsp? >> str(',') >> wsp? >> dmarc_uri).repeat
+      dmarc_uri >> (uri_list_sep.present? >> uri_list_sep).repeat >> (wsp? >> str(',')).absent?
     end
 
     tag_rule(:fo,'fo') do
@@ -99,6 +104,8 @@ module DMARCator
       ).maybe >> str('!').absent?
     end
 
+    rule(:uri_list_sep) { wsp? >> str(',') >> wsp? >> dmarc_uri }
+
     rule(:mailto_uri) do
       match['mM'] >> match['aA'] >> match['iI'] >> match['lL'] >> match['tT'] >> match['oO'] >>
       str(':') >> mailto_address
@@ -110,7 +117,7 @@ module DMARCator
 
     rule(:mailto_local)  { mailto_char.repeat(1) }
     rule(:mailto_domain) { mailto_char.repeat(1) }
-    rule(:mailto_char)   { match["^;,! \t@"] }
+    rule(:mailto_char)   { match["A-Za-z0-9._%+-"] }
 
     rule(:digit) { match('[0-9]') }
     rule(:wsp) { str(' ') | str("\t") }
@@ -192,10 +199,18 @@ module DMARCator
     #   The Hash of tags within the record.
     #
     # @raise [InvalidRecord]
-    #   The record is malformed, or (in strict mode) contains an unknown tag
-    #   or invalid tag value.
+    #   The record is not a String, is malformed, is too large, or (in strict
+    #   mode) contains an unknown tag or invalid tag value.
     #
     def self.parse(record, strict: false)
+      unless record.is_a?(String)
+        raise InvalidRecord, "DMARC record must be a String, got #{record.class}"
+      end
+
+      if record.bytesize > MAX_RECORD_BYTES
+        raise InvalidRecord, "DMARC record exceeds maximum size of #{MAX_RECORD_BYTES} bytes"
+      end
+
       tree = new.parse(record)
 
       if strict

data/lib/dmarcator/query.rb

@@ -40,8 +40,15 @@ module DMARCator
     version = resolv_version
     return false unless version
 
+    begin
+      parsed = Gem::Version.new(version)
+    rescue ArgumentError
+      # A non-semver version string means we cannot tell; do not warn.
+      return false
+    end
+
     VULNERABLE_RESOLV.any? do |requirement|
-      requirement.satisfied_by?(Gem::Version.new(version))
+      requirement.satisfied_by?(parsed)
     end
   end
 
@@ -62,7 +69,7 @@ module DMARCator
            domain.length <= 248 &&
            !domain.start_with?('.') &&
            !domain.include?('..') &&
-           !domain.match?(/[^A-Za-z0-9._-]/) &&
+           !domain.match?(/[^A-Za-z0-9.-]/) &&
            domain.split('.').all? { |label| label.length <= 63 && !label.start_with?('-') && !label.end_with?('-') }
       raise ArgumentError, "invalid domain: #{domain.inspect}"
     end

data/lib/dmarcator/record.rb

@@ -44,7 +44,7 @@ module DMARCator
     #
     # @option attributes [:r, :s] :aspf (:r)
     #
-    # @option attributes [Array<'0', '1', 'd', 's'>] :fo ('0')
+    # @option attributes [Array<String>] :fo (['0'])
     #
     # @option attributes [:none, :quarantine, :reject] :p
     #
@@ -153,7 +153,7 @@ module DMARCator
     #
     # `fo` field.
     #
-    # @return [Array<'0', '1', 'd', 's'>]
+    # @return [Array<String>]
     #   The value of the `fo=` field, or `["0"]` if the field was omitted.
     #
     def fo

data/lib/dmarcator/report.rb

@@ -29,10 +29,18 @@ module DMARCator
     # @param [String] xml
     #   The raw DMARC XML report.
     #
+    # @raise [InvalidReport]
+    #   The report is not a String, exceeds {MAX_REPORT_BYTES}, or is not
+    #   well-formed XML.
+    #
     def initialize(xml)
+      unless xml.is_a?(String)
+        raise InvalidReport, "DMARC XML report must be a String, got #{xml.class}"
+      end
+
       @xml = xml
 
-      if xml.is_a?(String) && xml.bytesize > MAX_REPORT_BYTES
+      if xml.bytesize > MAX_REPORT_BYTES
         raise InvalidReport, "DMARC XML report exceeds maximum size of #{MAX_REPORT_BYTES} bytes"
       end
 

data/lib/dmarcator/version.rb

@@ -2,5 +2,5 @@
 
 module DMARCator
   # dmarcator version
-  VERSION = '0.4.0'
+  VERSION = '0.4.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - Noah Berman