joliegg 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f27a41cfa159b96583ae4631a134e57c2e87ae617c148747e68019e7cd2af91
-  data.tar.gz: 5c1094ecae586a0ed3705d041737435a5a51d5a31361e50454d4d455e4c815a4
+  metadata.gz: 9191af5aa744f9251907a02c5951ab251e88e1398ba40f4f78103a38b94e7cf8
+  data.tar.gz: 226262ee89d48d83d33401b7328bb1160b8053d8380e07eb4d92604afdb9a0b6
 SHA512:
-  metadata.gz: f266a1b303854cf4178440d6004a397d44d4b7b3ced2faccea9bdd718f57f4e2519d5fab919b23a155b8bb7f7f632fb794fc52bb9f3198758f9f62e011f16a70
-  data.tar.gz: 46101a1d04b5fc80feb86c89172be49f15606b6f4245874ae0e903217a296c428ddc252ad2fd0a6c91ca766d49e3e5c3b3dc036fea9c5976ba837c2f7734ff6a
+  metadata.gz: 7a481cda89dd46a9294df6165357656feac6f502610fecb3dfbc37d7c795dae59b8768cc99bb3a1cad75df7ceca6d0b6229c7181488203499fda7f11a816eeb9
+  data.tar.gz: 2a137407c21298fb394312b8cb916f16cc6dfff2c907bdb6fdb9465d3ab40091a9f14e00a170c55dbbb0a3d9571fc3616af9739297016eefefca6e2553428fbd

data/lib/jolie/moderation/url_blocklist.rb

@@ -43,37 +43,48 @@ module Jolie
         find_in(shorteners, input)
       end
 
-      # Reduces a URL, bare domain, or email address to a bare lowercase host:
+      # Reduces a URL, bare domain, or email address to its primary host:
       #   "User@Sub.Example.COM"          -> "sub.example.com"
       #   "HTTPS://example.com:8080/a?b"  -> "example.com"
       #   "a/b@mailinator.com"            -> "mailinator.com"
       #   "example.com."                  -> "example.com"
-      # Returns "" when nothing host-like can be extracted. IP literals pass
-      # through unchanged (the lists hold domains, so they simply never match).
-      #
-      # A schemeless input containing @ is treated as an email address FIRST:
-      # the local part may legally contain / ? # (RFC 5322 atext), so applying
-      # URL delimiters to it would sever the domain ("a/b@mailinator.com" would
-      # otherwise read as host "a"). The host is everything after the LAST @.
-      #
-      # With a scheme:// present it's a URL: the authority is isolated BEFORE
-      # any @ handling, so an @ in the path/query/fragment
-      # ("/redirect?to=user@mailinator.com") is never mistaken for userinfo,
-      # and only the LAST @ within the authority is the userinfo delimiter (per
-      # RFC 3986), so "example.com@evil.example" still resolves to
-      # "evil.example".
+      # Returns "" when nothing host-like can be extracted. This is the FIRST
+      # candidate host; matching uses candidate_hosts, which can hold both
+      # readings of an ambiguous input.
       def extract_host(input)
-        candidate = input.to_s.strip.downcase
-
-        if !candidate.match?(%r{\A[a-z][a-z0-9+.-]*://}) && candidate.include?("@")
-          return candidate.split("@").last.to_s.sub(/:\d*\z/, "").sub(/\.\z/, "")
-        end
+        candidate_hosts(input).first.to_s
+      end
 
-        candidate = candidate.sub(%r{\A[a-z][a-z0-9+.-]*://}, "") # scheme
-        candidate = candidate.split(%r{[/\\?#]}).first.to_s # authority: cut path/query/fragment
-        candidate = candidate.split("@").last.to_s # URL userinfo
-        candidate = candidate.sub(/:\d*\z/, "") # port
-        candidate.sub(/\.\z/, "") # trailing root dot
+      # Every host an input may resolve to, deduplicated, most likely reading
+      # first. Whitespace is stripped EVERYWHERE (not just the ends), matching
+      # the normalization URL validators and crawlers apply before resolving —
+      # "https://mai linator.com" resolves to mailinator.com for them, so it
+      # must match here too.
+      #
+      # - With a scheme:// the URL authority only: an @ later in the URL is
+      #   path/query content, not userinfo, and only the LAST @ within the
+      #   authority is the userinfo delimiter (RFC 3986), so
+      #   "example.com@evil.example" resolves to "evil.example".
+      # - Schemeless with an @ is ambiguous: an email whose local part may
+      #   legally contain / ? # (RFC 5322 atext — "a/b@mailinator.com"), or a
+      #   bare URL carrying an @ ("mailinator.com/path@allowed.example", whose
+      #   crawled host is mailinator.com). Both readings are returned so
+      #   neither interpretation slips a listed host past the guard.
+      # - Otherwise the bare host itself.
+      def candidate_hosts(input)
+        candidate = input.to_s.downcase.gsub(/\s+/, "")
+        return [] if candidate.empty?
+
+        hosts =
+          if candidate.match?(%r{\A[a-z][a-z0-9+.-]*://})
+            [authority_host(candidate)]
+          elsif candidate.include?("@")
+            [candidate.split("@").last.to_s, authority_host(candidate)]
+          else
+            [authority_host(candidate)]
+          end
+
+        hosts.map { |host| normalize_host(host) }.reject(&:empty?).uniq
       end
 
       def blocklist
@@ -98,18 +109,40 @@ module Jolie
         @shorteners = nil
       end
 
+      # The candidate host that produced a blocklist match, or nil — e.g.
+      # "sub.mailinator.com" for a match on entry "mailinator.com".
+      def matched_host(input)
+        match_in(blocklist, input)&.last
+      end
+
       def find_in(set, input)
-        host = extract_host(input)
-        return nil if host.empty?
+        match_in(set, input)&.first
+      end
 
-        parts = host.split(".")
-        (parts.length - 1).downto(0) do |index|
-          suffix = parts[index..].join(".")
-          return suffix if set.include?(suffix)
+      def match_in(set, input)
+        candidate_hosts(input).each do |host|
+          parts = host.split(".")
+          (parts.length - 1).downto(0) do |index|
+            suffix = parts[index..].join(".")
+            return [suffix, host] if set.include?(suffix)
+          end
         end
         nil
       end
 
+      # The host out of a URL authority: strips any scheme, cuts path/query/
+      # fragment, and keeps only what follows the LAST @ (userinfo delimiter).
+      def authority_host(candidate)
+        candidate
+          .sub(%r{\A[a-z][a-z0-9+.-]*://}, "")
+          .split(%r{[/\\?#]}).first.to_s
+          .split("@").last.to_s
+      end
+
+      def normalize_host(host)
+        host.sub(/:\d*\z/, "").sub(/\.\z/, "")
+      end
+
       def load_set(path)
         Set.new(JSON.parse(File.read(path)))
       end

data/lib/jolie/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Jolie
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: joliegg
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Diana Islas Ocampo