dmarcator 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d8d5d903f5d6ec715a2cd5042610d7f28f730981f460baceee5abbc4d6eb916
-  data.tar.gz: d6ebe47854a74d046cf47b720ce60cc0598c83d5b529ed665951d45012a504fc
+  metadata.gz: bf9c3559d1b305ece3b68de7e2e0eb72f1371be508b7499ce34160e543cbd6a1
+  data.tar.gz: f082d761778abd9e66e8bed82cee7a3aafc498567814021120a5780dc9c5f5fc
 SHA512:
-  metadata.gz: b7ea01f6b847ccbb11bb6e4e1ead4c972a0c12e404631c462a8d4b249ca7622c7345b17bfbfd1651807fdd3ce269fdb6a0774ee9c8cb9e2d85cec6e7e55d871d
-  data.tar.gz: 702597e80f58d060b1a0c6ef334697fa008ba9e0fad70d1096c6b71933901edf68643aa7234195507a12c2011624d5402cb6bc9fb1c7bbbbcb55e7bc914128a6
+  metadata.gz: 85da1dd8330918fb7ae6c167a9c08b23c97589f5fb3d8586c7866e64d19cd9bdf04a39efdfa161be70c01ef276cadc3b907e04b35df3ed10f9c32ffd28eb2be8
+  data.tar.gz: 4ed5b91fa75ba6eda666357a1541e27b11d008c5ec952f9573cf3a89243877a9757d09b6ae7d0488bb449b6c6dc798ed594d9ab75de1d911490e86bcda82a041

data/ChangeLog.md

@@ -1,3 +1,9 @@
+### 0.4.2 / 2026-10-28
+
+* Do not raise when the loaded `resolv` version is not a valid gem version; an unparseable version is treated as unknown instead of failing at load time.
+* Reject DMARC records larger than 4 KiB (`Parser::MAX_RECORD_BYTES`) before parsing to bound work on hostile input.
+* Raise the documented `InvalidRecord`/`InvalidReport` for non-String input instead of `ArgumentError`, `TypeError`, or a silently empty report.
+
 ### 0.4.1 / 2026-10-28
 
 * Accept a case-insensitive `mailto:` scheme in `rua`/`ruf` report URIs.

data/lib/dmarcator/parser.rb

@@ -14,6 +14,11 @@ module DMARCator
   #
   class Parser < Parslet::Parser
 
+    # Maximum accepted DMARC record size in bytes. Real records are far
+    # smaller; the cap bounds parsing work on hostile input.
+    #
+    MAX_RECORD_BYTES = 4096
+
     root :dmarc_record
 
     rule(:dmarc_record) do
@@ -194,10 +199,18 @@ module DMARCator
     #   The Hash of tags within the record.
     #
     # @raise [InvalidRecord]
-    #   The record is malformed, or (in strict mode) contains an unknown tag
-    #   or invalid tag value.
+    #   The record is not a String, is malformed, is too large, or (in strict
+    #   mode) contains an unknown tag or invalid tag value.
     #
     def self.parse(record, strict: false)
+      unless record.is_a?(String)
+        raise InvalidRecord, "DMARC record must be a String, got #{record.class}"
+      end
+
+      if record.bytesize > MAX_RECORD_BYTES
+        raise InvalidRecord, "DMARC record exceeds maximum size of #{MAX_RECORD_BYTES} bytes"
+      end
+
       tree = new.parse(record)
 
       if strict

data/lib/dmarcator/query.rb

@@ -40,8 +40,15 @@ module DMARCator
     version = resolv_version
     return false unless version
 
+    begin
+      parsed = Gem::Version.new(version)
+    rescue ArgumentError
+      # A non-semver version string means we cannot tell; do not warn.
+      return false
+    end
+
     VULNERABLE_RESOLV.any? do |requirement|
-      requirement.satisfied_by?(Gem::Version.new(version))
+      requirement.satisfied_by?(parsed)
     end
   end
 

data/lib/dmarcator/report.rb

@@ -29,10 +29,18 @@ module DMARCator
     # @param [String] xml
     #   The raw DMARC XML report.
     #
+    # @raise [InvalidReport]
+    #   The report is not a String, exceeds {MAX_REPORT_BYTES}, or is not
+    #   well-formed XML.
+    #
     def initialize(xml)
+      unless xml.is_a?(String)
+        raise InvalidReport, "DMARC XML report must be a String, got #{xml.class}"
+      end
+
       @xml = xml
 
-      if xml.is_a?(String) && xml.bytesize > MAX_REPORT_BYTES
+      if xml.bytesize > MAX_REPORT_BYTES
         raise InvalidReport, "DMARC XML report exceeds maximum size of #{MAX_REPORT_BYTES} bytes"
       end
 

data/lib/dmarcator/version.rb

@@ -2,5 +2,5 @@
 
 module DMARCator
   # dmarcator version
-  VERSION = '0.4.1'
+  VERSION = '0.4.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Noah Berman