dmarcator 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d8d5d903f5d6ec715a2cd5042610d7f28f730981f460baceee5abbc4d6eb916
-  data.tar.gz: d6ebe47854a74d046cf47b720ce60cc0598c83d5b529ed665951d45012a504fc
+  metadata.gz: d37cadaa1defc7108fecde4077ce8a97cf50a6d3f654b78306a953ef95f66202
+  data.tar.gz: 9ae6e328b4c09f784fafca8d2b933dda7f152ae9f2156f17e5f4f4429784affd
 SHA512:
-  metadata.gz: b7ea01f6b847ccbb11bb6e4e1ead4c972a0c12e404631c462a8d4b249ca7622c7345b17bfbfd1651807fdd3ce269fdb6a0774ee9c8cb9e2d85cec6e7e55d871d
-  data.tar.gz: 702597e80f58d060b1a0c6ef334697fa008ba9e0fad70d1096c6b71933901edf68643aa7234195507a12c2011624d5402cb6bc9fb1c7bbbbcb55e7bc914128a6
+  metadata.gz: 53e2957b0eeaa2741f7aee2a8b8f479f98c09f2cb78a8b3c1f5bb91ab625323aedde59162c7d90c22044e00d0ae7d9ed20a358b5c049f64a7ec09f9424736a7d
+  data.tar.gz: 9e6469b8b9d53a2d64a3f4963569f4d7564363c35e9805def960de165480b5fcef7458c6712cc7f38028522fcb5c93bb526a320a5c65886d0e2b45d1476caba9

data/ChangeLog.md

@@ -1,3 +1,19 @@
+### 0.5.0 / 2026-10-28
+
+* Performance: extract each report record in a single pass over its children instead of one XPath query per field (roughly 3x faster `Report#records`).
+* Performance: extract report metadata and policy in a single pass.
+* Performance: build `Record#reasons` and `Record#auth_results` lazily, so callers that only read scalar fields skip roughly half of record construction.
+* Performance: reuse one memoized parser and transform instance, making `Record.parse` roughly 30% faster.
+* Add `DMARCator::Report.max_report_bytes` to configure the maximum accepted report size; parsing builds a DOM roughly 13x the input size, so lower it to bound memory.
+* Report elements that appear more than once now consistently use the first value, matching prior behavior for records.
+* Assign `policy_published` fields explicitly instead of by element name.
+
+### 0.4.2 / 2026-10-28
+
+* Do not raise when the loaded `resolv` version is not a valid gem version; an unparseable version is treated as unknown instead of failing at load time.
+* Reject DMARC records larger than 4 KiB (`Parser::MAX_RECORD_BYTES`) before parsing to bound work on hostile input.
+* Raise the documented `InvalidRecord`/`InvalidReport` for non-String input instead of `ArgumentError`, `TypeError`, or a silently empty report.
+
 ### 0.4.1 / 2026-10-28
 
 * Accept a case-insensitive `mailto:` scheme in `rua`/`ruf` report URIs.

data/README.md

@@ -129,7 +129,13 @@ DMARC records and XML reports are treated as untrusted input:
 
 * XML reports are parsed with network access disabled (`NONET`), so external
   entities are never resolved or fetched.
-* Reports larger than 25 MiB are rejected before parsing.
+* Reports larger than `DMARCator::Report.max_report_bytes` (25 MiB by
+  default) are rejected before parsing. Parsing builds a DOM roughly 13× the
+  input size, so lower the limit to bound memory:
+
+  ```ruby
+  DMARCator::Report.max_report_bytes = 5 * 1024 * 1024
+  ```
 * A warning is emitted at load time if the bundled `resolv` gem is affected by
   CVE-2026-80212/CVE-2026-80213.
 * Domain names are validated before resolution (labels ≤ 63 octets, total ≤

data/lib/dmarcator/parser.rb

@@ -14,6 +14,11 @@ module DMARCator
   #
   class Parser < Parslet::Parser
 
+    # Maximum accepted DMARC record size in bytes. Real records are far
+    # smaller; the cap bounds parsing work on hostile input.
+    #
+    MAX_RECORD_BYTES = 4096
+
     root :dmarc_record
 
     rule(:dmarc_record) do
@@ -194,11 +199,19 @@ module DMARCator
     #   The Hash of tags within the record.
     #
     # @raise [InvalidRecord]
-    #   The record is malformed, or (in strict mode) contains an unknown tag
-    #   or invalid tag value.
+    #   The record is not a String, is malformed, is too large, or (in strict
+    #   mode) contains an unknown tag or invalid tag value.
     #
     def self.parse(record, strict: false)
-      tree = new.parse(record)
+      unless record.is_a?(String)
+        raise InvalidRecord, "DMARC record must be a String, got #{record.class}"
+      end
+
+      if record.bytesize > MAX_RECORD_BYTES
+        raise InvalidRecord, "DMARC record exceeds maximum size of #{MAX_RECORD_BYTES} bytes"
+      end
+
+      tree = parser.parse(record)
 
       if strict
         tree.each do |node|
@@ -212,7 +225,7 @@ module DMARCator
         end
       end
 
-      tags = Transform.new.apply(tree.reject { |node| ignored?(node) })
+      tags = transform.apply(tree.reject { |node| ignored?(node) })
       hash = {}
 
       tags.each do |tag|
@@ -243,6 +256,29 @@ module DMARCator
       node.is_a?(Hash) && (node.key?(:unknown_tag) || node.key?(:invalid_tag))
     end
 
+    #
+    # The memoized parser instance. Parslet caches rules per instance, so
+    # reusing it avoids rebuilding the grammar on every call.
+    #
+    # @return [Parser]
+    #
+    # @api private
+    #
+    def self.parser
+      @parser ||= new
+    end
+
+    #
+    # The memoized transform instance.
+    #
+    # @return [Transform]
+    #
+    # @api private
+    #
+    def self.transform
+      @transform ||= Transform.new
+    end
+
     #
     # Validates the parsed tags.
     #

data/lib/dmarcator/query.rb

@@ -40,8 +40,15 @@ module DMARCator
     version = resolv_version
     return false unless version
 
+    begin
+      parsed = Gem::Version.new(version)
+    rescue ArgumentError
+      # A non-semver version string means we cannot tell; do not warn.
+      return false
+    end
+
     VULNERABLE_RESOLV.any? do |requirement|
-      requirement.satisfied_by?(Gem::Version.new(version))
+      requirement.satisfied_by?(parsed)
     end
   end
 

data/lib/dmarcator/report/auth_result.rb

@@ -17,10 +17,19 @@ module DMARCator
       def initialize(node)
         @node = node
         self.type = node.name
-        self.domain = get_text('domain')
-        self.result = get_text('result')
-        self.selector = get_text('selector')
-        self.scope = get_text('scope')
+
+        node.element_children.each do |element|
+          case element.name
+          when 'domain'
+            self.domain ||= element.text
+          when 'result'
+            self.result ||= element.text
+          when 'selector'
+            self.selector ||= element.text
+          when 'scope'
+            self.scope ||= element.text
+          end
+        end
       end
     end
   end

data/lib/dmarcator/report/metadata.rb

@@ -19,13 +19,40 @@ module DMARCator
 
       def initialize(node)
         @node = node
-        self.org_name = get_text('feedback/report_metadata/org_name')
-        self.email = get_text('feedback/report_metadata/email')
-        self.extra_contact_info = get_text('feedback/report_metadata/extra_contact_info')
-        self.report_id = get_text('feedback/report_metadata/report_id')
-        self.begin_at = get_timestamp('feedback/report_metadata/date_range/begin')
-        self.end_at = get_timestamp('feedback/report_metadata/date_range/end')
-        self.errors = @node.xpath('feedback/report_metadata/error').map(&:text)
+        self.errors = []
+
+        metadata = node.at_xpath('feedback/report_metadata')
+        return unless metadata
+
+        metadata.element_children.each do |element|
+          case element.name
+          when 'org_name'
+            self.org_name ||= element.text
+          when 'email'
+            self.email ||= element.text
+          when 'extra_contact_info'
+            self.extra_contact_info ||= element.text
+          when 'report_id'
+            self.report_id ||= element.text
+          when 'error'
+            errors << element.text
+          when 'date_range'
+            parse_date_range(element)
+          end
+        end
+      end
+
+      private
+
+      def parse_date_range(date_range)
+        date_range.element_children.each do |element|
+          case element.name
+          when 'begin'
+            self.begin_at ||= parse_timestamp(element.text)
+          when 'end'
+            self.end_at ||= parse_timestamp(element.text)
+          end
+        end
       end
     end
   end

data/lib/dmarcator/report/policy.rb

@@ -17,11 +17,27 @@ module DMARCator
       def initialize(node)
         @node = node
 
-        ATTRIBUTES.each do |attr|
-          self.public_send("#{attr}=", get_text("feedback/policy_published/#{attr}"))
-        end
+        policy = node.at_xpath('feedback/policy_published')
+        return unless policy
 
-        self.pct = get_int('feedback/policy_published/pct')
+        policy.element_children.each do |element|
+          case element.name
+          when 'pct'
+            self.pct ||= parse_integer(element.text)
+          when 'domain'
+            self.domain ||= element.text
+          when 'adkim'
+            self.adkim ||= element.text
+          when 'aspf'
+            self.aspf ||= element.text
+          when 'p'
+            self.p ||= element.text
+          when 'sp'
+            self.sp ||= element.text
+          when 'fo'
+            self.fo ||= element.text
+          end
+        end
       end
     end
   end

data/lib/dmarcator/report/reason.rb

@@ -16,8 +16,15 @@ module DMARCator
 
       def initialize(node)
         @node = node
-        self.type = get_text('type')
-        self.comment = get_text('comment')
+
+        node.element_children.each do |element|
+          case element.name
+          when 'type'
+            self.type ||= element.text
+          when 'comment'
+            self.comment ||= element.text
+          end
+        end
       end
     end
   end

data/lib/dmarcator/report/record.rb

@@ -14,27 +14,99 @@ module DMARCator
 
       ATTRIBUTES = [
         :source_ip, :count, :disposition, :dkim, :spf,
-        :envelope_to, :envelope_from, :header_from,
-        :auth_results, :reasons
+        :envelope_to, :envelope_from, :header_from
       ]
 
       attr_accessor(*ATTRIBUTES)
+      attr_writer :auth_results, :reasons
 
       def initialize(node)
         @node = node
-        self.source_ip = get_text('row/source_ip')
-        self.count = get_int('row/count')
-        self.disposition = get_text('row/policy_evaluated/disposition')
-        self.dkim = get_text('row/policy_evaluated/dkim')
-        self.spf = get_text('row/policy_evaluated/spf')
-        self.reasons = node.xpath('row/policy_evaluated/reason').map do |reason_node|
-          Reason.new(reason_node)
+        @reason_nodes = []
+        @auth_result_nodes = []
+
+        node.element_children.each do |section|
+          case section.name
+          when 'row'
+            parse_row(section)
+          when 'identifiers'
+            parse_identifiers(section)
+          when 'auth_results'
+            collect_auth_results(section)
+          end
+        end
+      end
+
+      #
+      # The record's `reason` elements.
+      #
+      # @return [Array<Reason>]
+      #
+      def reasons
+        return @reasons if defined?(@reasons)
+
+        @reasons = @reason_nodes.map { |reason_node| Reason.new(reason_node) }
+      end
+
+      #
+      # The record's `auth_results` entries.
+      #
+      # @return [Array<AuthResult>]
+      #
+      def auth_results
+        return @auth_results if defined?(@auth_results)
+
+        @auth_results = @auth_result_nodes.map do |auth_result_node|
+          AuthResult.new(auth_result_node)
+        end
+      end
+
+      private
+
+      def parse_row(row)
+        row.element_children.each do |element|
+          case element.name
+          when 'source_ip'
+            self.source_ip ||= element.text
+          when 'count'
+            self.count ||= parse_integer(element.text)
+          when 'policy_evaluated'
+            parse_policy_evaluated(element)
+          end
+        end
+      end
+
+      def parse_policy_evaluated(policy_evaluated)
+        policy_evaluated.element_children.each do |element|
+          case element.name
+          when 'disposition'
+            self.disposition ||= element.text
+          when 'dkim'
+            self.dkim ||= element.text
+          when 'spf'
+            self.spf ||= element.text
+          when 'reason'
+            @reason_nodes << element
+          end
         end
-        self.envelope_to = get_text('identifiers/envelope_to')
-        self.envelope_from = get_text('identifiers/envelope_from')
-        self.header_from = get_text('identifiers/header_from')
-        self.auth_results = node.xpath('auth_results/*').map do |auth_results_node|
-          AuthResult.new(auth_results_node)
+      end
+
+      def parse_identifiers(identifiers)
+        identifiers.element_children.each do |element|
+          case element.name
+          when 'envelope_to'
+            self.envelope_to ||= element.text
+          when 'envelope_from'
+            self.envelope_from ||= element.text
+          when 'header_from'
+            self.header_from ||= element.text
+          end
+        end
+      end
+
+      def collect_auth_results(auth_results)
+        auth_results.element_children.each do |element|
+          @auth_result_nodes << element
         end
       end
     end

data/lib/dmarcator/report.rb

@@ -20,20 +20,47 @@ module DMARCator
   class Report
     include XmlHelper
 
-    # Maximum accepted report size in bytes (25 MiB).
+    # Default maximum accepted report size in bytes (25 MiB).
     MAX_REPORT_BYTES = 25 * 1024 * 1024
 
+    class << self
+      #
+      # The maximum accepted report size in bytes.
+      #
+      # Defaults to {MAX_REPORT_BYTES}. Parsing a report builds a DOM that is
+      # roughly 13x the input size, so lower this to bound memory for reports
+      # from untrusted sources.
+      #
+      # @return [Integer]
+      #
+      attr_writer :max_report_bytes
+
+      def max_report_bytes
+        @max_report_bytes || MAX_REPORT_BYTES
+      end
+    end
+
     #
     # Initializes the report from an XML string.
     #
     # @param [String] xml
     #   The raw DMARC XML report.
     #
+    # @raise [InvalidReport]
+    #   The report is not a String, exceeds {.max_report_bytes}, or is not
+    #   well-formed XML.
+    #
     def initialize(xml)
+      unless xml.is_a?(String)
+        raise InvalidReport, "DMARC XML report must be a String, got #{xml.class}"
+      end
+
       @xml = xml
 
-      if xml.is_a?(String) && xml.bytesize > MAX_REPORT_BYTES
-        raise InvalidReport, "DMARC XML report exceeds maximum size of #{MAX_REPORT_BYTES} bytes"
+      limit = self.class.max_report_bytes
+
+      if xml.bytesize > limit
+        raise InvalidReport, "DMARC XML report exceeds maximum size of #{limit} bytes"
       end
 
       @node = Nokogiri::XML(xml) { |config| config.nonet }

data/lib/dmarcator/version.rb

@@ -2,5 +2,5 @@
 
 module DMARCator
   # dmarcator version
-  VERSION = '0.4.1'
+  VERSION = '0.5.0'
 end

data/lib/dmarcator/xml_helper.rb

@@ -29,13 +29,7 @@ module DMARCator
     # @return [Time, nil]
     #
     def get_timestamp(xpath)
-      value = get_text(xpath)
-      return nil if value.nil? || value.empty?
-
-      digits = value.strip
-      return nil unless digits.match?(/\A\d+\z/)
-
-      Time.at(digits.to_i)
+      parse_timestamp(get_text(xpath))
     end
 
     #
@@ -47,7 +41,37 @@ module DMARCator
     # @return [Integer, nil]
     #
     def get_int(xpath)
-      value = get_text(xpath)
+      parse_integer(get_text(xpath))
+    end
+
+    #
+    # Parses a Unix timestamp from raw element text.
+    #
+    # @param [String, nil] value
+    #   The element text.
+    #
+    # @return [Time, nil]
+    #
+    # @api private
+    #
+    def parse_timestamp(value)
+      seconds = parse_integer(value)
+
+      Time.at(seconds) if seconds
+    end
+
+    #
+    # Parses an integer from raw element text, returning `nil` for values that
+    # are not plain decimal digits.
+    #
+    # @param [String, nil] value
+    #   The element text.
+    #
+    # @return [Integer, nil]
+    #
+    # @api private
+    #
+    def parse_integer(value)
       return nil if value.nil? || value.empty?
 
       digits = value.strip

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Noah Berman