kataba 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 91cf7e773f0cead00236519792f3b0b6bf888fb8
-  data.tar.gz: 2033b27334cefc6ad872c7084759e60da09edc19
+SHA256:
+  metadata.gz: 1849ebd6214469739d5a16981525a9c5ab23d0ca7ddb91ad028064a43e63dad0
+  data.tar.gz: 46da3306e49890c4801362c7c5af2c8e7cbf68cf2d3a8b9604e4d69f9d3f7887
 SHA512:
-  metadata.gz: 0c2cf4238e8b166b3646427aeeb40ca80107e8a5b08f80eea2e02a8906a2fdeb94121d3465333ad4bff29ac766a7ce90187f84af84c9c5876c5aa5b727449eff
-  data.tar.gz: 38a54143ba8b1ac21f7c5da6b1556bfc810f2a9d2ceaf8bf7ff391b09cddb42f2f7f677e26a7a532e8074eace7538170d52b6d9202330286a3e5355571aabac3
+  metadata.gz: 7d26265f3e4b30fbc11c82f12bec40860b56f3910d8a7aefccc9150bf6cd24d61a543da9fb33eb11111a8410386e1c632df6c02f56e2f91a8681515e4f2e5548
+  data.tar.gz: e35b99af877e7b660838d9b58943806c35084861c8295ea93e4a456d66e20943fb987261ee5adf795a0c858c26fa8a7c4cd41212d9012d26d5ba14cab80d51bc

data/lib/kataba/fetcher.rb

@@ -0,0 +1,88 @@
+require 'net/http'
+require 'uri'
+
+module Kataba
+  # Fetches a schema body, recovering from LoC-shaped delivery quirks
+  # that a verbatim URI.open would surface as cache-poisoning errors:
+  #
+  #   - 5xx (Cloudflare bot-management 503/529, origin overload):
+  #     retry once on the alternate scheme.
+  #   - same-origin HTTPS->HTTP 3xx: follow. open-uri refuses all
+  #     scheme downgrades; we relax to same-origin because the
+  #     consumer already trusted this host by putting it in their
+  #     schemaLocation. Cross-origin downgrades stay refused — that's
+  #     the actual DNS-redirect attack vector.
+  #
+  # mirror_list remains the consumer's backstop for URI-identity
+  # changes (path renames, host moves) that no delivery heuristic
+  # can rescue.
+  class Fetcher
+    MAX_REDIRECTS = 5
+
+    class FetchError < StandardError; end
+
+    def initialize(uri)
+      @original_uri = uri
+    end
+
+    def fetch
+      attempt(@original_uri, alt_scheme_retry: true)
+    end
+
+    private
+
+    def attempt(uri, alt_scheme_retry:)
+      response = request_with_redirects(uri, redirect_depth: 0)
+
+      case response
+      when Net::HTTPSuccess
+        response.body
+      when Net::HTTPServerError
+        if alt_scheme_retry && (alt = swap_scheme(uri))
+          attempt(alt, alt_scheme_retry: false)
+        else
+          raise FetchError, "#{response.code} #{response.message} fetching #{uri}"
+        end
+      else
+        raise FetchError, "#{response.code} #{response.message} fetching #{uri}"
+      end
+    end
+
+    def request_with_redirects(uri, redirect_depth:)
+      raise FetchError, "too many redirects fetching #{@original_uri}" if redirect_depth > MAX_REDIRECTS
+
+      parsed = URI.parse(uri)
+      http = Net::HTTP.new(parsed.host, parsed.port)
+      http.use_ssl = (parsed.scheme == 'https')
+      response = http.get(parsed.request_uri)
+
+      if response.is_a?(Net::HTTPRedirection)
+        target = resolve_redirect(parsed, response['location'])
+        request_with_redirects(target, redirect_depth: redirect_depth + 1)
+      else
+        response
+      end
+    end
+
+    def resolve_redirect(from, location)
+      raise FetchError, "redirect with no Location header from #{from}" if location.nil? || location.empty?
+
+      target = URI.parse(location)
+      target = from + target if target.relative?
+
+      if from.scheme == 'https' && target.scheme == 'http' && from.host != target.host
+        raise FetchError, "cross-origin HTTPS->HTTP redirect refused: #{from} -> #{target}"
+      end
+
+      target.to_s
+    end
+
+    def swap_scheme(uri)
+      if uri.start_with?('https://')
+        uri.sub(/\Ahttps:/, 'http:')
+      elsif uri.start_with?('http://')
+        uri.sub(/\Ahttp:/, 'https:')
+      end
+    end
+  end
+end

data/lib/kataba.rb

@@ -1,15 +1,12 @@
 require 'nokogiri'
 require 'tmpdir'
 require 'digest/md5'
-require 'open-uri'
+require 'fileutils'
+require 'yaml'
+require 'kataba/fetcher'
 
 module Kataba
 
-  class << self
-    # Simple attribute for configuration
-    attr_accessor :configuration
-  end
-
   # Allows for configuration by block
   #
   # Example:
@@ -69,17 +66,27 @@ module Kataba
     dir_path = "#{self.configuration.offline_storage}"
     xsd_path = "#{dir_path}/#{uri_md5}.xsd"
 
-    # Does the offline version exist already?
-    if !(File.exists?(xsd_path))
-      # If not, go download
-      xsd_array = []
-      xsd_array << xsd_uri
-      download_xsd(xsd_array)
-    end
+    attempts = 0
+    begin
+      # Does the offline version exist already?
+      if !(File.exist?(xsd_path))
+        # If not, go download
+        xsd_array = []
+        xsd_array << xsd_uri
+        download_xsd(xsd_array)
+      end
 
-    # Validate and return Nokogiri schema
-    Dir.chdir(dir_path) do
-      return Nokogiri::XML::Schema(IO.read(xsd_path))
+      # Validate and return Nokogiri schema
+      Dir.chdir(dir_path) do
+        return Nokogiri::XML::Schema(IO.read(xsd_path))
+      end
+    rescue Nokogiri::XML::SyntaxError
+      # Poisoned cache (e.g. a pre-fix install that stored a bad fetch).
+      # Evict the offending file and refetch once.
+      File.delete(xsd_path) if File.exist?(xsd_path)
+      attempts += 1
+      retry if attempts < 2
+      raise
     end
   end
 
@@ -101,23 +108,36 @@ module Kataba
         end
 
         file_path = "#{dir_name}/#{uri_md5}.xsd"
+        tmp_path  = "#{file_path}.part"
+
+        # Resolve mirror first, if configured, then fetch. Fetching BEFORE
+        # opening tmp_path means a failed network fetch can't leave an
+        # orphaned 0-byte .part on disk — the file simply isn't created.
+        fetch_uri = xsd_uri
+        if !self.configuration.mirror_list.to_s.empty?
+          mirror_list = YAML.load_file(self.configuration.mirror_list)
+          mirror = mirror_list[xsd_uri]
+          fetch_uri = mirror unless mirror.to_s.empty?
+        end
 
-        file_paths << file_path
+        body = Kataba::Fetcher.new(fetch_uri).fetch
+
+        # Write to a .part file first; only rename to the final cache path
+        # after we've confirmed the bytes parse as XML. Without this, a
+        # malformed response (HTML error page, truncated TCP stream, captive
+        # portal stub) would land at the canonical cache path and poison
+        # every subsequent fetch.
+        File.open(tmp_path, "wb+") { |file| file.write(body) }
 
-        open(file_path, "wb+") do |file|
-          if !self.configuration.mirror_list.to_s.empty?
-            mirror_list = YAML.load_file(self.configuration.mirror_list)
-            mirror = mirror_list[xsd_uri]
-            if mirror.to_s.empty?
-              # No mirror for that uri
-              file.write(open(xsd_uri).read)
-            else
-              file.write(open(mirror).read)
-            end
-          else
-            file.write(open(xsd_uri).read)
-          end
+        begin
+          Nokogiri::XML(File.read(tmp_path)) { |c| c.strict }
+        rescue Nokogiri::XML::SyntaxError
+          File.delete(tmp_path)
+          raise
         end
+
+        File.rename(tmp_path, file_path)
+        file_paths << file_path
       end
 
       # Search inside for other schemaLocations

metadata

@@ -1,29 +1,71 @@
 --- !ruby/object:Gem::Specification
 name: kataba
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - David Cliff
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-10-02 00:00:00.000000000 Z
+date: 2026-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - '>='
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '1.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - '>='
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '1.19'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Kataba allows for mirroring and offline storage of XSD files, to enhance
   Nokogiri
 email: d.cliff@northeastern.edu
@@ -32,28 +74,28 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/kataba.rb
+- lib/kataba/fetcher.rb
 homepage: http://rubygems.org/gems/kataba
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ~>
+  - - '>='
     - !ruby/object:Gem::Version
-      version: '2.0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.2.2
-signing_key: 
+rubygems_version: 3.0.9
+signing_key:
 specification_version: 4
 summary: XML Schema Definition (XSD) mirroring and offline validation for Nokogiri
 test_files: []