kataba 1.0.3 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97107593bef37bc5a20d934c683ca45c5c1142d301bc705067a20b3e94a07d58
-  data.tar.gz: fee7e5c92557a7f85170a395a97de0055b447d978d822575aadf8a6fe301b391
+  metadata.gz: 1849ebd6214469739d5a16981525a9c5ab23d0ca7ddb91ad028064a43e63dad0
+  data.tar.gz: 46da3306e49890c4801362c7c5af2c8e7cbf68cf2d3a8b9604e4d69f9d3f7887
 SHA512:
-  metadata.gz: 28c18ab1818719194b5f9ae1a512bfad8716caf430fac3ce4509dad455e4796cf9634bf33fec4b0e51501cea3dc70b1908945dfd4c80d71316d61bac2fa68293
-  data.tar.gz: d7d05f52acc72e4f6ed031d255304b7d37984f07e89d24bf76c74e9e6be40bf06e1dab08a07f9eb8e7b2d8633c39b6d93ea10df503752189672ea0689e397dc0
+  metadata.gz: 7d26265f3e4b30fbc11c82f12bec40860b56f3910d8a7aefccc9150bf6cd24d61a543da9fb33eb11111a8410386e1c632df6c02f56e2f91a8681515e4f2e5548
+  data.tar.gz: e35b99af877e7b660838d9b58943806c35084861c8295ea93e4a456d66e20943fb987261ee5adf795a0c858c26fa8a7c4cd41212d9012d26d5ba14cab80d51bc

data/lib/kataba/fetcher.rb

@@ -0,0 +1,88 @@
+require 'net/http'
+require 'uri'
+
+module Kataba
+  # Fetches a schema body, recovering from LoC-shaped delivery quirks
+  # that a verbatim URI.open would surface as cache-poisoning errors:
+  #
+  #   - 5xx (Cloudflare bot-management 503/529, origin overload):
+  #     retry once on the alternate scheme.
+  #   - same-origin HTTPS->HTTP 3xx: follow. open-uri refuses all
+  #     scheme downgrades; we relax to same-origin because the
+  #     consumer already trusted this host by putting it in their
+  #     schemaLocation. Cross-origin downgrades stay refused — that's
+  #     the actual DNS-redirect attack vector.
+  #
+  # mirror_list remains the consumer's backstop for URI-identity
+  # changes (path renames, host moves) that no delivery heuristic
+  # can rescue.
+  class Fetcher
+    MAX_REDIRECTS = 5
+
+    class FetchError < StandardError; end
+
+    def initialize(uri)
+      @original_uri = uri
+    end
+
+    def fetch
+      attempt(@original_uri, alt_scheme_retry: true)
+    end
+
+    private
+
+    def attempt(uri, alt_scheme_retry:)
+      response = request_with_redirects(uri, redirect_depth: 0)
+
+      case response
+      when Net::HTTPSuccess
+        response.body
+      when Net::HTTPServerError
+        if alt_scheme_retry && (alt = swap_scheme(uri))
+          attempt(alt, alt_scheme_retry: false)
+        else
+          raise FetchError, "#{response.code} #{response.message} fetching #{uri}"
+        end
+      else
+        raise FetchError, "#{response.code} #{response.message} fetching #{uri}"
+      end
+    end
+
+    def request_with_redirects(uri, redirect_depth:)
+      raise FetchError, "too many redirects fetching #{@original_uri}" if redirect_depth > MAX_REDIRECTS
+
+      parsed = URI.parse(uri)
+      http = Net::HTTP.new(parsed.host, parsed.port)
+      http.use_ssl = (parsed.scheme == 'https')
+      response = http.get(parsed.request_uri)
+
+      if response.is_a?(Net::HTTPRedirection)
+        target = resolve_redirect(parsed, response['location'])
+        request_with_redirects(target, redirect_depth: redirect_depth + 1)
+      else
+        response
+      end
+    end
+
+    def resolve_redirect(from, location)
+      raise FetchError, "redirect with no Location header from #{from}" if location.nil? || location.empty?
+
+      target = URI.parse(location)
+      target = from + target if target.relative?
+
+      if from.scheme == 'https' && target.scheme == 'http' && from.host != target.host
+        raise FetchError, "cross-origin HTTPS->HTTP redirect refused: #{from} -> #{target}"
+      end
+
+      target.to_s
+    end
+
+    def swap_scheme(uri)
+      if uri.start_with?('https://')
+        uri.sub(/\Ahttps:/, 'http:')
+      elsif uri.start_with?('http://')
+        uri.sub(/\Ahttp:/, 'https:')
+      end
+    end
+  end
+end

data/lib/kataba.rb

@@ -1,9 +1,9 @@
 require 'nokogiri'
 require 'tmpdir'
 require 'digest/md5'
-require 'open-uri'
 require 'fileutils'
 require 'yaml'
+require 'kataba/fetcher'
 
 module Kataba
 
@@ -110,25 +110,24 @@ module Kataba
         file_path = "#{dir_name}/#{uri_md5}.xsd"
         tmp_path  = "#{file_path}.part"
 
+        # Resolve mirror first, if configured, then fetch. Fetching BEFORE
+        # opening tmp_path means a failed network fetch can't leave an
+        # orphaned 0-byte .part on disk — the file simply isn't created.
+        fetch_uri = xsd_uri
+        if !self.configuration.mirror_list.to_s.empty?
+          mirror_list = YAML.load_file(self.configuration.mirror_list)
+          mirror = mirror_list[xsd_uri]
+          fetch_uri = mirror unless mirror.to_s.empty?
+        end
+
+        body = Kataba::Fetcher.new(fetch_uri).fetch
+
         # Write to a .part file first; only rename to the final cache path
         # after we've confirmed the bytes parse as XML. Without this, a
         # malformed response (HTML error page, truncated TCP stream, captive
         # portal stub) would land at the canonical cache path and poison
         # every subsequent fetch.
-        File.open(tmp_path, "wb+") do |file|
-          if !self.configuration.mirror_list.to_s.empty?
-            mirror_list = YAML.load_file(self.configuration.mirror_list)
-            mirror = mirror_list[xsd_uri]
-            if mirror.to_s.empty?
-              # No mirror for that uri
-              file.write(URI.open(xsd_uri).read)
-            else
-              file.write(URI.open(mirror).read)
-            end
-          else
-            file.write(URI.open(xsd_uri).read)
-          end
-        end
+        File.open(tmp_path, "wb+") { |file| file.write(body) }
 
         begin
           Nokogiri::XML(File.read(tmp_path)) { |c| c.strict }

metadata

@@ -1,69 +1,69 @@
 --- !ruby/object:Gem::Specification
 name: kataba
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.1.0
 platform: ruby
 authors:
 - David Cliff
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-15 00:00:00.000000000 Z
+date: 2026-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '1.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '1.19'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: Kataba allows for mirroring and offline storage of XSD files, to enhance
@@ -74,6 +74,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/kataba.rb
+- lib/kataba/fetcher.rb
 homepage: http://rubygems.org/gems/kataba
 licenses:
 - MIT
@@ -84,16 +85,16 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.0.9
 signing_key:
 specification_version: 4
 summary: XML Schema Definition (XSD) mirroring and offline validation for Nokogiri