gamba 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50c5a0eb0a2606ff06311c8ce8ea69acd633ef34846f86cc61990744658a2746
-  data.tar.gz: a0f8a019e088c71f118d751e2160712e242aa1666ab6cd269b898730f0ad4ab1
+  metadata.gz: 6909a10a173cb8d39f9f93432f7b47495e2bf18ca5d56559b263ac8292235ba7
+  data.tar.gz: 1a54fa9a6878a7eab8ed06e4d9b57fde344ad3c3edd850c93de2fb5b2bd099fd
 SHA512:
-  metadata.gz: 84ff4a9295d3078e0864f681e65dcf72f9e624d4a5542bc3cc4fd2233fc2db15c33f0e936e539b6ae29ce7dd5114debceafec21c0d93780044fcd1f2ea189650
-  data.tar.gz: 5c3a6d22c9d427386ba0a4fb4ff259c78c05d4ca9b72b73fda006c1a5180f9a3bb554914a9d49b9e5cd7c5da504f03ca86cb68ca7742d9561bd49c44151483c1
+  metadata.gz: f8eb03f65d8d6e26264a0fbea81cb38bf68968b171bb84b41aeafd3b11360024c2ad6cfa2ce171a321861a6bfc2756ec8cd445168d20d345724358eb10604b3c
+  data.tar.gz: bf668afa09665f836ed62ff0b8d2a593baabaa062353c1b46b9297439bdc6c9cd3e0c977b937a397fa3a3e03dd53dd4cf8478133d49b0aadd7602b20c2cfbc18

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [2.0.2] — 2026-11-07
+
+SVGs that users send can no longer crash or stall a server through `<use>`, `<image>` or `<tref>`.
+
+**Fixed**
+- An SVG loaded through `<use>` or `<image>` is checked like the document, attributes included: a `data:` URL nested
+  thousands of levels deep overflowed the stack, and entities in an attribute raised `RuntimeError`.
+- `<tref>` draws through the `<use>` path: a tref inside its own text no longer overflows the stack, one to a missing
+  id no longer raises `NoMethodError`, and trefs doubling at each level stop at the 20,000-element budget.
+- Embedded SVG images share the budget of the SVG that embeds them and stop at 16 levels, and `data:` URLs are
+  decoded once per document.
+- An `@font-face` that is not a font becomes a warning, and a table with no cells draws nothing instead of raising
+  `NoMethodError`.
+- addressable 2.9.1 or later is required: before it, an `@import` path took quadratic time to resolve
+  (GHSA-qq38-m9mg-xjj5).
+
 ## [2.0.1] — 2026-11-06
 
 Fonts, images, SVGs and PDFs that users send can no longer hang a server, exhaust its memory or crash it.
@@ -88,7 +104,8 @@ speed. Same API and same pages as Prawn, pixel for pixel, in lighter files.
   place of combine_pdf.
 - `Gamba::VERSION` is the gem's; `Prawn::VERSION` stays 2.5.0, the API reproduced.
 
-[Unreleased]: https://github.com/levups/gamba/compare/v2.0.1...HEAD
+[Unreleased]: https://github.com/levups/gamba/compare/v2.0.2...HEAD
+[2.0.2]: https://github.com/levups/gamba/compare/v2.0.1...v2.0.2
 [2.0.1]: https://github.com/levups/gamba/compare/v2.0.0...v2.0.1
 [2.0.0]: https://github.com/levups/gamba/compare/v1.1.0...v2.0.0
 [1.1.0]: https://github.com/levups/gamba/compare/v1.0.1...v1.1.0

data/README.md

@@ -96,11 +96,18 @@ Any of it can be built to attack the server that renders it.
 - SVG images fetch nothing from the web unless you pass `enable_web_requests: true`. prawn-svg 0.40 fetched by
   default, so a submitted SVG could make your server request any URL. prawn-svg 1.0 plans the same default as
   Gamba.
-- An SVG can't make Gamba loop or run out of stack through references (`<use>`, gradients) or deep nesting, and
-  fonts it declares with `@font-face` disappear once it is drawn. In prawn-svg, an uploaded SVG declaring a
-  "Helvetica" font changed the font of the application's own text.
+- An SVG reads only what you allow. Base64 `data:` URLs of PNG, JPEG and SVG images always load; `http` and
+  `https` URLs need `enable_web_requests: true`; files need `enable_file_requests_with_root`, and only regular
+  files inside that directory load, symbolic links in it followed. Any other URL, path or scheme is skipped with a
+  warning, and an entity the SVG declares from a file or URL is never read.
+- An SVG can't make Gamba loop or run out of stack through references (`<use>`, `<tref>`, gradients) or deep
+  nesting. An SVG it loads with `<use>` or `<image>` is checked the same way, SVG images stop 16 levels inside
+  one another, and they draw within the budget of the SVG that embeds them.
+- Fonts an SVG declares with `@font-face` disappear once it is drawn, and one that is not a font is left out. In
+  prawn-svg, an uploaded SVG declaring a "Helvetica" font changed the font of the application's own text.
 - A damaged or malicious PNG, JPEG, TrueType or OpenType file either renders or raises an error Gamba names
-  (`Prawn::Errors::UnsupportedImageType`, `Prawn::Images::JPG::FormatError`, `Gamba::TrueType::Error`). A PNG
+  (`Prawn::Errors::UnsupportedImageType`, `Prawn::Images::JPG::FormatError`, `Gamba::TrueType::Error`, or
+  `Prawn::Errors::CannotFit` when a damaged font makes a glyph wider than the page). A PNG
   inflates no further than the size its header gives. CI corrupts sample files on every run to check this.
 - `Gamba.combine` stops at 64 levels of nested arrays and dictionaries and at 256 MB of decompressed data, and
   ignores references that lead back to themselves, so a crafted PDF can't send it into a loop or fill
@@ -110,7 +117,8 @@ Any of it can be built to attack the server that renders it.
   without them.
 
 Inline formatting still turns `<link href="...">` into a clickable link. Escape user text before you put it inside
-markup.
+markup. A word with no space to break at, thousands of characters long, takes time that grows with the square of its
+length, as in Prawn: limit the length of what users type.
 
 To report a vulnerability, see [SECURITY.md](SECURITY.md).
 

data/lib/gamba/table.rb

@@ -77,6 +77,9 @@ module Prawn
     alias_method :column, :columns
 
     def draw
+      # Gamba: rows without a single cell, such as [[]], draw nothing, where prawn-table raised NoMethodError.
+      return if @cells.empty?
+
       with_position do
         reference_bounds = @pdf.reference_bounds
         started_new_page_at_row = initial_row_on_initial_page

data/lib/gamba/version.rb

@@ -6,5 +6,5 @@ module Prawn
 end
 
 module Gamba
-  VERSION = "2.0.1"
+  VERSION = "2.0.2"
 end

data/lib/prawn/svg/document.rb

@@ -10,6 +10,8 @@ class Prawn::SVG::Document
   MAXIMUM_ELEMENTS_THROUGH_USE = 20_000
   # Elements inside one another: deeper, Ruby's stack runs out, and REXML resolves each namespace by its ancestors.
   MAXIMUM_DEPTH = 256
+  # SVG images inside SVG images: over the web, an SVG can embed itself without end.
+  MAXIMUM_EMBEDDING_DEPTH = 16
 
   class << self
     attr_accessor :enable_web_requests_warned
@@ -26,19 +28,20 @@ class Prawn::SVG::Document
     :elements_by_id, :gradients,
     :element_styles,
     :color_mode,
-    :external_svg_cache
+    :external_svg_cache,
+    :embedding_depth,
+    :raster_dimensions_by_data
 
-  def initialize(data, bounds, options, font_registry: nil, css_parser: CssParser::Parser.new, attribute_overrides: {})
+  # Gamba: embedder is the document whose <image> embeds this one, for the budgets they share.
+  def initialize(data, bounds, options, font_registry: nil, css_parser: CssParser::Parser.new, attribute_overrides: {}, embedder: nil)
     begin
-      @root = REXML::Document.new(data).root or raise_parse_error(data)
+      @root = self.class.parse(data) or raise_parse_error(data)
     rescue REXML::ParseException => e
       raise_parse_error(data, e.message)
-    rescue RuntimeError => e
-      # Gamba: REXML's entity expansion limits raise a bare RuntimeError.
-      raise InvalidSVGData, "The data supplied is not a valid SVG document: #{e.message}"
     end
-    check_tree!(@root)
 
+    @embedder = embedder
+    @embedding_depth = embedder ? embedder.embedding_depth + 1 : 0
     @warnings = []
     @options = options
     @elements_by_id = {}
@@ -48,6 +51,7 @@ class Prawn::SVG::Document
     @depth = 0
     @gradients = Prawn::SVG::Gradients.new(self)
     @external_svg_cache = {}
+    @raster_dimensions_by_data = {}.compare_by_identity
     @fallback_font_name = options.fetch(:fallback_font_name, DEFAULT_FALLBACK_FONT_NAME)
     @font_registry = font_registry
     @color_mode = load_color_mode
@@ -96,26 +100,54 @@ class Prawn::SVG::Document
   def drawing_through_use(source)
     raise Prawn::SVG::Elements::Base::SkipElementError, "use tag references an element that contains it" if @references_in_use.any? { _1.equal?(source) }
 
-    @elements_through_use += 1
-    source.each_recursive { @elements_through_use += 1 }
-    raise Prawn::SVG::Elements::Base::SkipElementError, "use tags draw more than #{MAXIMUM_ELEMENTS_THROUGH_USE} elements" if @elements_through_use > MAXIMUM_ELEMENTS_THROUGH_USE
-
+    draw_again(self.class.element_count(source))
     @references_in_use << source
     yield
   ensure
     @references_in_use.pop if @references_in_use.last.equal?(source)
   end
 
-  # Gamba: walked without recursion, before anything else walks the tree with it. Texts expand their entities
-  # here, so that REXML's limits on expansion raise InvalidSVGData rather than a RuntimeError mid-render.
-  def check_tree!(root)
+  # Gamba: elements drawn once more, counted against one budget for this document and the SVG images it embeds.
+  def draw_again(element_count)
+    return @embedder.draw_again(element_count) if @embedder
+
+    @elements_through_use += element_count
+    raise Prawn::SVG::Elements::Base::SkipElementError, "use tags and SVG images draw more than #{MAXIMUM_ELEMENTS_THROUGH_USE} elements" if @elements_through_use > MAXIMUM_ELEMENTS_THROUGH_USE
+  end
+
+  def self.element_count(source)
+    count = 1
+    source.each_recursive { count += 1 }
+    count
+  end
+
+  # Gamba: the root of an SVG, checked before anything walks it: the document's own, and every SVG it loads with
+  # <use> or <image>. REXML's limits on entity expansion raise a bare RuntimeError.
+  def self.parse(data)
+    root = REXML::Document.new(data).root
+    check_tree!(root) if root
+    root
+  rescue REXML::ParseException
+    raise
+  rescue RuntimeError => e
+    raise InvalidSVGData, "The data supplied is not a valid SVG document: #{e.message}"
+  end
+
+  # Gamba: walked without recursion. Texts and attributes expand their entities here, so that REXML's limits on
+  # expansion raise InvalidSVGData rather than a RuntimeError mid-render.
+  def self.check_tree!(root)
     level = [root]
     MAXIMUM_DEPTH.times do
-      level.each { |element| element.texts.each(&:value) }
+      level.each do |element|
+        element.texts.each(&:value)
+        element.attributes.each_attribute(&:value)
+      end
       level = level.flat_map { _1.elements.to_a }
       return if level.empty?
     end
     raise InvalidSVGData, "The SVG document nests elements deeper than #{MAXIMUM_DEPTH} levels"
+  rescue REXML::ParseException
+    raise
   rescue RuntimeError => e
     raise InvalidSVGData, "The data supplied is not a valid SVG document: #{e.message}"
   end
@@ -199,10 +231,12 @@ class Prawn::SVG::Document
     tempfile.write(data)
     tempfile.close
     @font_face_tempfiles << tempfile
+    # Gamba: read now, so that a damaged font is a warning like a missing one, not an error mid-render.
+    Gamba::TrueType::File.open(tempfile.path).glyph_by_code
 
     font_registry.register_font_face(family, weight, style, stretch, tempfile.path)
     true
-  rescue Prawn::SVG::UrlLoader::Error => e
+  rescue Prawn::SVG::UrlLoader::Error, Gamba::TrueType::Error => e
     warnings << "Failed to load @font-face font from #{source[:url]}: #{e.message}"
     false
   end

data/lib/prawn/svg/elements/image.rb

@@ -82,10 +82,11 @@ class Prawn::SVG::Elements::Image < Prawn::SVG::Elements::Base
 
   def process_image(data, width, height, preserve_aspect_ratio)
     if (handler = find_image_handler(data))
-      image = handler.new(data)
-      ImageData.new([image.width.to_f, image.height.to_f], nil)
+      ImageData.new(raster_dimensions(handler, data), nil)
 
     elsif potentially_svg?(data)
+      raise SkipElementError, "SVG images nested deeper than #{Prawn::SVG::Document::MAXIMUM_EMBEDDING_DEPTH} levels" if @document.embedding_depth >= Prawn::SVG::Document::MAXIMUM_EMBEDDING_DEPTH
+
       attribute_overrides = {}
       attribute_overrides["preserveAspectRatio"] = preserve_aspect_ratio if preserve_aspect_ratio
 
@@ -98,8 +99,10 @@ class Prawn::SVG::Elements::Image < Prawn::SVG::Elements::Base
       document = Prawn::SVG::Document.new(
         data, [width, height], {width:, height:, enable_web_requests: has_web_loader},
         # Gamba: the parent's fonts, without which an embedded SVG holding text failed to render.
-        attribute_overrides:, font_registry: @document.font_registry
+        attribute_overrides:, font_registry: @document.font_registry, embedder: @document
       )
+      # Gamba: drawn again for each <use> of it, and for each image of an image, which a few kilobytes can repeat.
+      @document.draw_again(Prawn::SVG::Document.element_count(document.root)) if state.inside_use || @document.embedding_depth.positive?
 
       dimensions = [document.sizing.output_width, document.sizing.output_height]
       ImageData.new(dimensions, document)
@@ -111,6 +114,18 @@ class Prawn::SVG::Elements::Image < Prawn::SVG::Elements::Base
     raise_invalid_image_type
   end
 
+  # Gamba: the image of a data: URL, which the loader keeps, is read once however many times <use> draws it.
+  def raster_dimensions(handler, data)
+    return read_raster_dimensions(handler, data) unless @url[0, 5].casecmp?("data:")
+
+    @document.raster_dimensions_by_data[data] ||= read_raster_dimensions(handler, data)
+  end
+
+  def read_raster_dimensions(handler, data)
+    image = handler.new(data)
+    [image.width.to_f, image.height.to_f]
+  end
+
   def extract_fragment(url)
     return [url, nil] if url.start_with?("data:")
 
@@ -149,7 +164,7 @@ class Prawn::SVG::Elements::Image < Prawn::SVG::Elements::Base
   end
 
   def find_view_element_attributes(data, fragment)
-    root = REXML::Document.new(data).root
+    root = Prawn::SVG::Document.parse(data)
     return unless root
 
     element = Prawn::SVG::Document.element_by_id(root, fragment)

data/lib/prawn/svg/elements/text_component.rb

@@ -27,20 +27,12 @@ module Prawn::SVG
 
       @font, @fallback_fonts = select_fonts
 
-      @children = svg_text_children.flat_map do |child|
-        if child.node_type == :text
-          build_text_node(child)
-        else
-          case child.name
-          when "tspan", "tref"
-            build_child(child)
-          when "textPath"
-            build_text_path(child)
-          else
-            warnings << "Unknown tag '#{child.name}' inside text tag; ignoring"
-            []
-          end
-        end
+      @children = if name == "tref"
+        # Gamba: a <tref> draws its text again, as a <use> does: not inside itself, and within the same budget.
+        reference = find_referenced_element
+        reference ? document.drawing_through_use(reference.source) { build_children(reference.source.children) } : []
+      else
+        build_children(source.children)
       end
     end
 
@@ -158,9 +150,29 @@ module Prawn::SVG
       Elements::TextNode.new(self, text, leading, trailing)
     end
 
+    def build_children(nodes)
+      svg_text_children(nodes).flat_map do |child|
+        if child.node_type == :text
+          build_text_node(child)
+        else
+          case child.name
+          when "tspan", "tref"
+            build_child(child)
+          when "textPath"
+            build_text_path(child)
+          else
+            warnings << "Unknown tag '#{child.name}' inside text tag; ignoring"
+            []
+          end
+        end
+      end
+    end
+
     def build_child(child)
       component = self.class.new(document, child, [], state.dup, self)
       component.process
+      return [] unless component.children
+
       component
     end
 
@@ -172,8 +184,8 @@ module Prawn::SVG
       component
     end
 
-    def svg_text_children
-      text_children.select do |child|
+    def svg_text_children(nodes)
+      nodes.select do |child|
         child.node_type == :text || (
           child.node_type == :element &&
             [SVG_NAMESPACE, ""].include?(child.namespace)
@@ -182,21 +194,12 @@ module Prawn::SVG
       end
     end
 
-    def text_children
-      if name == "tref"
-        reference = find_referenced_element
-        reference ? reference.source.children : []
-      else
-        source.children
-      end
-    end
-
     def find_referenced_element
       href = href_attribute
 
       if href && href[0..0] == "#"
         element = document.elements_by_id[href[1..]] # rubocop:disable Performance/ArraySemiInfiniteRangeSlice -- String
-        element if element.name == "text"
+        element if element&.name == "text"
       end
     end
 

data/lib/prawn/svg/elements/use.rb

@@ -101,8 +101,8 @@ class Prawn::SVG::Elements::Use < Prawn::SVG::Elements::Base
       data = @document.url_loader.load(url)
 
       root = begin
-        REXML::Document.new(data).root
-      rescue REXML::ParseException
+        Prawn::SVG::Document.parse(data)
+      rescue REXML::ParseException, Prawn::SVG::Document::InvalidSVGData
         raise SkipElementError, "use tag references external SVG at '#{url}' which could not be parsed"
       end
 

data/lib/prawn/svg/url_loader.rb

@@ -29,7 +29,8 @@ class Prawn::SVG::UrlLoader
 
   def perform_and_cache(url)
     data = perform(url)
-    add_to_cache(url, data) if enable_cache
+    # Gamba: a data: URL decodes to the same bytes every time, and <use> can make a document load it thousands of times.
+    add_to_cache(url, data) if enable_cache || url[0, 5].casecmp?("data:")
     data
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gamba
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Level UP Solutions
@@ -9,6 +9,26 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: addressable
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.9.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.9.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: css_parser
   requirement: !ruby/object:Gem::Requirement
@@ -63,9 +83,9 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
-description: 'A drop-in replacement for prawn, prawn-table and prawn-svg: the same
-  API and the same pages as Prawn 2.5, written faster, with fewer allocations and
-  lighter files.'
+description: 'Gamba is a Ruby library that writes PDF files. It is a faster rewrite
+  of Prawn 2.5, prawn-table and prawn-svg: code written for them runs unchanged and
+  draws the same pages, in lighter files.'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -259,5 +279,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.20
 specification_version: 4
-summary: 'Prawn''s API, rewritten for speed: same pages, lighter files'
+summary: A faster rewrite of Prawn, prawn-table and prawn-svg that draws the same
+  pages
 test_files: []