dmarcator 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00c852a4815b31a240c4c24071c523ff0af57f6d87b447fbcec7515f8b502e55
-  data.tar.gz: b325e8eb13e3ee9f91215800492a9d81142338ad71992c998f1d0976756b4214
+  metadata.gz: 2c4ed90f1362c3a69141cadeb2e7360b71a7f86c18f74f433990d0760d2bab0d
+  data.tar.gz: 63d27b1fc2acbf70627757d7a5604c1cf471e2d2f7dc71c80e8e221f663f3a70
 SHA512:
-  metadata.gz: d7b2dd3cbcbd800cfc3b1de240200ec0493fa6d82794282f00aa4c23d209f4269f8335f55468091e4f69dad70206b56c6dcac33c5da578f385507a1bd3eb531a
-  data.tar.gz: 3faa47a127473ce206dc30d983772f5189d4d7cec302394ab96dcf64afe481463bfdaad645bf99e2c38cd14bd133d1c7c637744646dfed2d62662a5b105578f7
+  metadata.gz: 92f2851179be4e2ee8eaaa542afa87ab6efcb2aed546161001778efda5f41579a78a552b1a30010ff625f877f94cbf08c7b7506ffbdacc06fc1d68c9753ef415
+  data.tar.gz: 10ad6dc240c07a14705ac06c83388c0981b4476ae03c980323b0d288f69693ea552218b94615524c9c7b8692b521a316157fd0c3fed87f96726acf2dfc7ce4b8

data/ChangeLog.md

@@ -1,3 +1,12 @@
+### 0.4.0 / 2026-10-26
+
+* Add `strict: true` parsing mode to reject unknown tags and invalid tag values.
+* Return `nil` for non-numeric report integers (`count`, `pct`) instead of coercing them to `0`.
+* Disable network access (`NONET`) explicitly when parsing XML reports.
+* Reject DNS labels with leading or trailing hyphens.
+* Set explicit DNS query timeouts.
+* Reject XML reports larger than 25 MiB.
+
 ### 0.3.1 / 2026-10-26
 
 * Update the gemspec maintainer metadata to list only the fork's author.

data/README.md

@@ -65,7 +65,7 @@ record.aspf
 # => :r
 
 record.fo
-# => ["0"]
+# => ["1"]
 
 record.pct
 # => 100
@@ -93,6 +93,16 @@ record = DMARCator::Record.query("twitter.com")
 # => #<DMARCator::Record ... @p=:reject, @rua=[...], ...>
 ```
 
+## Strict parsing
+
+By default, unknown tags and tags with invalid values are ignored. Pass
+`strict: true` to reject them instead:
+
+```ruby
+DMARCator::Record.parse("v=DMARC1; p=none; pct=abc", strict: true)
+# => DMARCator::InvalidRecord: invalid DMARC tag value: "pct=abc"
+```
+
 ## Parsing XML reports
 
 Parse a DMARC aggregate/forensic report:
@@ -113,6 +123,18 @@ report.records.first.source_ip
 # => "209.85.220.69"
 ```
 
+## Security
+
+DMARC records and XML reports are treated as untrusted input:
+
+* XML reports are parsed with network access disabled (`NONET`), so external
+  entities are never resolved or fetched.
+* Reports larger than 25 MiB are rejected before parsing.
+* A warning is emitted at load time if the bundled `resolv` gem is affected by
+  CVE-2026-80212/CVE-2026-80213.
+* Domain names are validated before resolution (labels ≤ 63 octets, total ≤
+  248 octets, no leading/trailing hyphens).
+
 ## Requirements
 
 * [Ruby] >= 3.3.13

data/lib/dmarcator/exceptions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'parslet'
 
 module DMARCator

data/lib/dmarcator/parser.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'dmarcator/exceptions'
 require 'dmarcator/uri'
 
@@ -45,8 +47,14 @@ module DMARCator
 
     def self.tag_rule(name,tag,&block)
       rule(:"dmarc_#{name}") do
-        str(tag) >> wsp? >> str('=') >> wsp? >>
-        (instance_eval(&block).as(tag.to_sym) | unknown_value)
+        (
+          str(tag) >> wsp? >> str('=') >> wsp? >>
+          instance_eval(&block).as(tag.to_sym)
+        ) |
+        (
+          str(tag) >> wsp? >> str('=') >> wsp? >>
+          match["^; \t"].repeat(1)
+        ).as(:invalid_tag)
       end
     end
 
@@ -81,8 +89,7 @@ module DMARCator
     tag_rule(:adkim, 'adkim') { match['rs'] }
     tag_rule(:aspf, 'aspf')   { match['rs'] }
 
-    rule(:unknown_tag) { match["^; \t"].repeat(1) }
-    rule(:unknown_value) { match["^; \t"].repeat(1) }
+    rule(:unknown_tag) { match["^; \t"].repeat(1).as(:unknown_tag) }
 
     rule(:dmarc_uri) do
       mailto_uri.as(:uri) >> (
@@ -93,7 +100,8 @@ module DMARCator
     end
 
     rule(:mailto_uri) do
-      str('mailto:') >> mailto_address
+      match['mM'] >> match['aA'] >> match['iI'] >> match['lL'] >> match['tT'] >> match['oO'] >>
+      str(':') >> mailto_address
     end
 
     rule(:mailto_address) do
@@ -176,11 +184,33 @@ module DMARCator
     # @param [String] record
     #   The raw DMARC record to parse.
     #
+    # @param [Boolean] strict (false)
+    #   When `true`, raise on unknown tags or invalid tag values instead of
+    #   silently ignoring them.
+    #
     # @return [Hash{Symbol => Object}]
     #   The Hash of tags within the record.
     #
-    def self.parse(record)
-      tags = Transform.new.apply(new.parse(record))
+    # @raise [InvalidRecord]
+    #   The record is malformed, or (in strict mode) contains an unknown tag
+    #   or invalid tag value.
+    #
+    def self.parse(record, strict: false)
+      tree = new.parse(record)
+
+      if strict
+        tree.each do |node|
+          next unless ignored?(node)
+
+          if node.key?(:unknown_tag)
+            raise InvalidRecord, "unknown DMARC tag: #{Transform.truncate(node[:unknown_tag].to_s).inspect}"
+          else
+            raise InvalidRecord, "invalid DMARC tag value: #{Transform.truncate(node[:invalid_tag].to_s).inspect}"
+          end
+        end
+      end
+
+      tags = Transform.new.apply(tree.reject { |node| ignored?(node) })
       hash = {}
 
       tags.each do |tag|
@@ -198,6 +228,19 @@ module DMARCator
       return hash
     end
 
+    #
+    # Determines whether a parse-tree node represents a tag that the lenient
+    # parser dropped because it was unknown or had an invalid value.
+    #
+    # @param [Object] node
+    #   The parse-tree node.
+    #
+    # @return [Boolean]
+    #
+    def self.ignored?(node)
+      node.is_a?(Hash) && (node.key?(:unknown_tag) || node.key?(:invalid_tag))
+    end
+
     #
     # Validates the parsed tags.
     #

data/lib/dmarcator/query.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'resolv'
 require 'rubygems'
 
@@ -10,6 +12,11 @@ module DMARCator
     Gem::Requirement.new('>= 0.4.0', '< 0.7.2')
   ].freeze
 
+  #
+  # DNS query timeouts in seconds, tried in order.
+  #
+  DNS_TIMEOUTS = [2, 4, 8].freeze
+
   #
   # Determines the version of the loaded `resolv` gem, if available.
   #
@@ -56,7 +63,7 @@ module DMARCator
            !domain.start_with?('.') &&
            !domain.include?('..') &&
            !domain.match?(/[^A-Za-z0-9._-]/) &&
-           domain.split('.').all? { |label| label.length <= 63 }
+           domain.split('.').all? { |label| label.length <= 63 && !label.start_with?('-') && !label.end_with?('-') }
       raise ArgumentError, "invalid domain: #{domain.inspect}"
     end
 
@@ -70,7 +77,7 @@ module DMARCator
   #   The domain to query DMARC for.
   #
   # @param [Resolv::DNS] resolver
-  #   The resolver to use.
+  #   The resolver to use. Its timeouts are set to {DNS_TIMEOUTS}.
   #
   # @return [String, nil]
   #   The domain's DMARC record or `nil` if none exists.
@@ -82,6 +89,8 @@ module DMARCator
   def self.query(domain,resolver=Resolv::DNS.new)
     validate_domain(domain)
 
+    resolver.timeouts = DNS_TIMEOUTS
+
     host = "_dmarc.#{domain}"
 
     begin

data/lib/dmarcator/record.rb

@@ -1,9 +1,10 @@
+# frozen_string_literal: true
+
 require 'dmarcator/query'
 require 'dmarcator/parser'
 require 'dmarcator/exceptions'
 
 require 'resolv'
-require 'uri'
 
 module DMARCator
   class Record
@@ -18,7 +19,7 @@ module DMARCator
     # @return [Array<Uri>]
     attr_reader :rua
 
-    # `rua` field.
+    # `ruf` field.
     #
     # @return [Array<Uri>]
     attr_reader :ruf
@@ -76,7 +77,7 @@ module DMARCator
     end
 
     #
-    # Determines if the `sp=` field was specified?
+    # Determines if the `sp=` field was specified.
     #
     # @return [Boolean]
     #
@@ -160,7 +161,7 @@ module DMARCator
     end
 
     #
-    # Determines if the `p=` field was specified?
+    # Determines if the `p=` field was specified.
     #
     # @return [Boolean]
     #
@@ -234,7 +235,7 @@ module DMARCator
     end
 
     #
-    # Determines if the `rua=` field was specified?
+    # Determines if the `rua=` field was specified.
     #
     # @return [Boolean]
     #
@@ -245,7 +246,7 @@ module DMARCator
     end
 
     #
-    # Determines if the `ruf=` field was specified?
+    # Determines if the `ruf=` field was specified.
     #
     # @return [Boolean]
     #
@@ -261,6 +262,10 @@ module DMARCator
     # @param [String] record
     #   The raw DMARC record.
     #
+    # @param [Boolean] strict (false)
+    #   When `true`, raise on unknown tags or invalid tag values instead of
+    #   silently ignoring them.
+    #
     # @return [Record]
     #   The parsed DMARC record.
     #
@@ -271,8 +276,8 @@ module DMARCator
     #
     # @api public
     #
-    def self.parse(record)
-      attributes = Parser.parse(record)
+    def self.parse(record, strict: false)
+      attributes = Parser.parse(record, strict: strict)
 
       unless attributes[:p]
         raise InvalidRecord, "DMARC record is missing the required 'p' tag"
@@ -281,8 +286,6 @@ module DMARCator
       new(attributes)
     rescue Parslet::ParseFailed => error
       raise InvalidRecord.new(truncate_error_message(error.message), error.cause)
-    rescue URI::Error => error
-      raise InvalidRecord.new(truncate_error_message(error.message), error)
     end
 
     #

data/lib/dmarcator/report/policy.rb

@@ -21,7 +21,7 @@ module DMARCator
           self.public_send("#{attr}=", get_text("feedback/policy_published/#{attr}"))
         end
 
-        self.pct = self.pct && !self.pct.empty? ? self.pct.to_i : nil
+        self.pct = get_int('feedback/policy_published/pct')
       end
     end
   end

data/lib/dmarcator/report.rb

@@ -14,12 +14,15 @@ module DMARCator
   #
   # Represents a parsed DMARC aggregate/forensic XML report.
   #
-  # Nokogiri's default parse options are used, which do not resolve external
-  # entities or fetch network resources; treat report XML as untrusted input.
+  # Parsing disables network access (NONET) so external entities are never
+  # resolved or fetched; treat report XML as untrusted input.
   #
   class Report
     include XmlHelper
 
+    # Maximum accepted report size in bytes (25 MiB).
+    MAX_REPORT_BYTES = 25 * 1024 * 1024
+
     #
     # Initializes the report from an XML string.
     #
@@ -28,7 +31,12 @@ module DMARCator
     #
     def initialize(xml)
       @xml = xml
-      @node = Nokogiri::XML(xml)
+
+      if xml.is_a?(String) && xml.bytesize > MAX_REPORT_BYTES
+        raise InvalidReport, "DMARC XML report exceeds maximum size of #{MAX_REPORT_BYTES} bytes"
+      end
+
+      @node = Nokogiri::XML(xml) { |config| config.nonet }
 
       unless @node.errors.empty?
         raise InvalidReport, "invalid DMARC XML report: #{@node.errors.first}"

data/lib/dmarcator/uri.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DMARCator
   #
   # Represents a DMARC URI.
@@ -113,7 +115,7 @@ module DMARCator
       return str
     end
 
-    protected
+    private
 
     #
     # Pass all missing methods to {#uri}.

data/lib/dmarcator/version.rb

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
+
 module DMARCator
   # dmarcator version
-  VERSION = '0.3.1'
+  VERSION = '0.4.0'
 end

data/lib/dmarcator/xml_helper.rb

@@ -48,7 +48,12 @@ module DMARCator
     #
     def get_int(xpath)
       value = get_text(xpath)
-      value && !value.empty? ? value.to_i : nil
+      return nil if value.nil? || value.empty?
+
+      digits = value.strip
+      return nil unless digits.match?(/\A\d+\z/)
+
+      digits.to_i
     end
   end
 end

data/lib/dmarcator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'dmarcator/exceptions'
 require 'dmarcator/query'
 require 'dmarcator/record'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Noah Berman
@@ -82,15 +82,6 @@ files:
 - lib/dmarcator/uri.rb
 - lib/dmarcator/version.rb
 - lib/dmarcator/xml_helper.rb
-- spec/data/alexa.csv
-- spec/dmarcator_spec.rb
-- spec/parser_spec.rb
-- spec/record_spec.rb
-- spec/report_spec.rb
-- spec/spec_helper.rb
-- spec/support/complete.xml
-- spec/support/google.xml
-- spec/uri_spec.rb
 homepage: https://github.com/bermannoah/dmarc
 licenses:
 - MIT
@@ -115,13 +106,4 @@ requirements: []
 rubygems_version: 4.0.23
 specification_version: 4
 summary: DMARC record parser and query client
-test_files:
-- spec/data/alexa.csv
-- spec/dmarcator_spec.rb
-- spec/parser_spec.rb
-- spec/record_spec.rb
-- spec/report_spec.rb
-- spec/spec_helper.rb
-- spec/support/complete.xml
-- spec/support/google.xml
-- spec/uri_spec.rb
+test_files: []