dmarcator 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39f655b89bd8e953e40ba9ada0fe936fde9d754acfa93e5825378c8b261034c3
-  data.tar.gz: 19abc3658c2339af30ef478befdb01e5c4ab019d15abdf51c341e53e3ae9da9a
+  metadata.gz: cbafae55c92fefeee56b1e5d5e714433cd595facbeb078925b5f54ae55c05ffb
+  data.tar.gz: 9be9ee7752f5ec16a6c7c6e2da499e909a9ff4d5d05c11af8057bf760bff4bac
 SHA512:
-  metadata.gz: c64d68c98be76d6611d0a30407172f83dc7ed3c412123745007c21a46ced185d063a62654fd285ad0c81f94ed9d72e468223736aaf2f61024a9d0f345c7b0db8
-  data.tar.gz: 1dab899381cd01d67279ba81a173fec42599e46c585bbed0637e934cf059b8044d55676120ddd0b376c17ceb30bc081b9a773ab8cfae0f94433bca074c39f35c
+  metadata.gz: 4206b0cd61595bcffb31487edf88fc6bb7bbc36a3148ab94dec83c5911b49a9d5b05de05dac01c13c232b733ed3a3d40bcd3ee1c96ed123a0a6dbbe812fded3e
+  data.tar.gz: dafdc7d98f728a42398a5a8e9c9c05709592b6e5b341d6b7e5848176b6a3563388608432f30f4e5a538621ba163107880357bdf7ff2e85aee6d1ba7623e576a1

data/ChangeLog.md

@@ -1,3 +1,10 @@
+### 1.4.0 / 2026-11-01
+
+* Enforce the per-record `max_auth_results` and `max_reasons` limits eagerly during the streaming pre-check, before any DOM is built. Previously a report with one record containing an enormous `auth_results`/`reason` collection reached DOM construction unless another global limit caught it.
+* Require a `<feedback>` root element: well-formed XML that is not a DMARC aggregate report is rejected with `InvalidReport` instead of being parsed into an empty report.
+* Stop echoing libxml2 error text (which can contain tag, attribute or entity names from the untrusted input) in `InvalidReport` messages; report only line and column position.
+* Add near-limit regression tests (reports just below every configured limit still parse) and a deterministic fuzz test that random bytes, tag soup, huge text and many attributes only ever raise `DMARCator::Error`.
+
 ### 1.3.0 / 2026-11-01
 
 * Treat report XML as hostile by rejecting DTD and entity declarations outright (`DMARCator::ForbiddenXml`). DMARC reports never need a DTD, so external-entity (XXE) and entity-expansion (billion-laughs) attacks are rejected before parsing rather than merely having their resolution disabled.

data/README.md

@@ -347,9 +347,13 @@ for the reporting policy and scope.
   rejected outright (`DMARCator::ForbiddenXml`), and parsing disables network
   access, entity substitution, DTD loading, and libxml2's `HUGE` relaxation.
   External-entity (XXE) and entity-expansion (billion-laughs) attacks are
-  therefore impossible rather than merely mitigated.
-* Report structural complexity is bounded before any DOM is built. A report
-  that exceeds a configured limit raises `DMARCator::ReportTooComplex`:
+  therefore impossible rather than merely mitigated. A report must have a
+  `<feedback>` root element; arbitrary well-formed XML is rejected with
+  `DMARCator::InvalidReport`.
+* Report structural complexity is bounded before any DOM is built. Every limit
+  below — including the per-record `auth_results`/`reason` limits — is enforced
+  by a streaming pre-check, so a report that exceeds a configured limit raises
+  `DMARCator::ReportTooComplex` before a DOM is allocated:
 
   | Setting | Default | Bounds |
   |---|---|---|
@@ -367,6 +371,11 @@ for the reporting policy and scope.
   ```ruby
   DMARCator.configure { |config| config.max_report_bytes = 5 * 1024 * 1024 }
   ```
+
+  These limits are not the outer boundary. They bound the work the C parser is
+  asked to do, but a libxml2 bug can still bypass Ruby-level checks. Applications
+  parsing reports from untrusted sources should still run the parse in an
+  isolated worker or subprocess with its own resource limits.
 * A warning is emitted at load time if the bundled `resolv` gem is affected by
   CVE-2026-80212/CVE-2026-80213.
 * Domain names are validated before resolution (labels ≤ 63 octets, total ≤

data/lib/dmarcator/internal/xml_guard.rb

@@ -20,7 +20,12 @@ module DMARCator
     # rejected outright, and libxml2 is configured to disable everything that
     # could fetch or expand them. Structural complexity is bounded with a
     # streaming reader pass before any DOM is built, so a report that exceeds a
-    # limit is rejected without first allocating a tree for it.
+    # limit is rejected without first allocating a tree for it. Every configured
+    # limit — including the per-record `auth_results` and `reason` limits — is
+    # enforced here, before DOM allocation.
+    #
+    # A report must have a `<feedback>` root element; arbitrary well-formed XML
+    # that is not a DMARC aggregate report is rejected.
     #
     # Ruby's `Timeout` is deliberately not used here: it cannot reliably
     # interrupt libxml2's C-level parsing. Callers that need a hard wall-clock
@@ -38,6 +43,12 @@ module DMARCator
       # see (for example UTF-16).
       FORBIDDEN_DECLARATION = /<!doctype|<!entity/i
 
+      # Message raised when a DTD or entity declaration is present.
+      #
+      # Kept free of input-derived content: declaration details are never
+      # echoed to callers.
+      FORBIDDEN_MESSAGE = 'DMARC XML reports must not contain a DTD or entity declaration'
+
       #
       # Parse options shared by the streaming reader and the DOM parser.
       #
@@ -113,7 +124,7 @@ module DMARCator
 
         return unless haystack.match?(FORBIDDEN_DECLARATION)
 
-        raise ForbiddenXml, 'DMARC XML reports must not contain a DTD or entity declaration'
+        raise ForbiddenXml, FORBIDDEN_MESSAGE
       end
 
       def enforce_structural_limits!
@@ -123,20 +134,49 @@ module DMARCator
         records = 0
         attributes = 0
 
+        stack = []
+        root_seen = false
+        record_auth_results = 0
+        record_reasons = 0
+
         while reader.read
           case reader.node_type
           when Nokogiri::XML::Reader::TYPE_DOCUMENT_TYPE,
                Nokogiri::XML::Reader::TYPE_ENTITY
-            raise ForbiddenXml, 'DMARC XML reports must not contain a DTD or entity declaration'
+            raise ForbiddenXml, FORBIDDEN_MESSAGE
           when Nokogiri::XML::Reader::TYPE_ELEMENT
             nodes += 1
-            records += 1 if reader.name == 'record'
             attributes += reader.attribute_count
 
             enforce(:max_xml_nodes, nodes)
-            enforce(:max_report_records, records)
-            enforce(:max_xml_depth, reader.depth + 1)
             enforce(:max_xml_attributes, attributes)
+            enforce(:max_xml_depth, reader.depth + 1)
+
+            unless root_seen
+              root_seen = true
+
+              unless reader.name == 'feedback'
+                raise InvalidReport, 'DMARC XML report must have a <feedback> root element'
+              end
+            end
+
+            if reader.name == 'record'
+              records += 1
+              enforce(:max_report_records, records)
+
+              record_auth_results = 0
+              record_reasons = 0
+            elsif stack.include?('record')
+              if stack.last == 'auth_results'
+                record_auth_results += 1
+                enforce(:max_auth_results, record_auth_results)
+              elsif stack.last == 'policy_evaluated' && reader.name == 'reason'
+                record_reasons += 1
+                enforce(:max_reasons, record_reasons)
+              end
+            end
+
+            stack.push(reader.name) unless reader.empty_element?
           when Nokogiri::XML::Reader::TYPE_TEXT,
                Nokogiri::XML::Reader::TYPE_CDATA,
                Nokogiri::XML::Reader::TYPE_WHITESPACE,
@@ -149,10 +189,12 @@ module DMARCator
 
             value = reader.value
             enforce(:max_text_length, value.bytesize) if value
+          when Nokogiri::XML::Reader::TYPE_END_ELEMENT
+            stack.pop
           end
         end
       rescue Nokogiri::XML::SyntaxError => e
-        raise InvalidReport, "invalid DMARC XML report: #{e.message}"
+        raise InvalidReport, sanitize_syntax_error(e)
       end
 
       def enforce(setting, value)
@@ -162,12 +204,28 @@ module DMARCator
         raise ReportTooComplex, "DMARC XML report exceeds #{setting} of #{limit}"
       end
 
+      #
+      # Renders a parse error using only position information. Nokogiri's
+      # messages can echo tag, attribute or entity names from the input, and
+      # those are untrusted; line/column numbers are not.
+      #
+      def sanitize_syntax_error(error)
+        line = error.respond_to?(:line) ? error.line : nil
+        column = error.respond_to?(:column) ? error.column : nil
+
+        if line && column
+          "invalid DMARC XML report at line #{line}, column #{column}"
+        else
+          'invalid DMARC XML report'
+        end
+      end
+
       def parse_document
         document = Nokogiri::XML.parse(@xml, nil, nil, self.class.parse_options)
 
         document
       rescue Nokogiri::XML::SyntaxError => e
-        raise InvalidReport, "invalid DMARC XML report: #{e.message}"
+        raise InvalidReport, sanitize_syntax_error(e)
       end
     end
   end

data/lib/dmarcator/report/row.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../config'
-require_relative '../exceptions'
 require_relative '../internal/xml_helper'
 require_relative 'auth_result'
 require_relative 'reason'
@@ -108,11 +106,6 @@ module DMARCator
             @spf ||= element.text.freeze
           when 'reason'
             @reason_nodes << element
-
-            if @reason_nodes.length > DMARCator.config.max_reasons
-              raise ReportTooComplex,
-                    "DMARC XML report exceeds max_reasons of #{DMARCator.config.max_reasons} per record"
-            end
           end
         end
       end
@@ -133,11 +126,6 @@ module DMARCator
       def collect_auth_results(auth_results)
         auth_results.element_children.each do |element|
           @auth_result_nodes << element
-
-          if @auth_result_nodes.length > DMARCator.config.max_auth_results
-            raise ReportTooComplex,
-                  "DMARC XML report exceeds max_auth_results of #{DMARCator.config.max_auth_results} per record"
-          end
         end
       end
     end

data/lib/dmarcator/version.rb

@@ -2,5 +2,5 @@
 
 module DMARCator
   # dmarcator version
-  VERSION = '1.3.0'
+  VERSION = '1.4.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Noah Berman