mailreport 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4144dc7ef1d3210db021841accb097def4cf61d4edd582064920f994da16a262
-  data.tar.gz: cdeffe809666d65141cbbc169d110eadb3be17a30bfaf6311b5382af0ddd69ee
+  metadata.gz: f3d7ccde2b425bc6a1c990efde170016e4ec813c00d3c7ee69c289463f418052
+  data.tar.gz: b2e035153e75905c2d13ee5277dd64aac25a7f8bd328f83a7507ee074a457b24
 SHA512:
-  metadata.gz: fe3ab048394c0dd88eb5d8ff99f1a0be42eff511c2add007753e39423e75d01d156a6815b07853a78469c8e7e839e01ffc265b404648a542494e21799b14f092
-  data.tar.gz: 8d59fb0ec330e5e5099ebeac2bd15420b9f53257a1a0f5ebb3b6c420de653ffcf26577396093f87aec4c86a26102ae1b4696a91824de7e7489addb9a1dc8cf62
+  metadata.gz: 65e069ab2aaf56f78be9fcf0553ebefc53e4c68d5831cc6aaa79f609aa7c1e0e4a827c9b612ca8a43af0917954aa65320737021a68edf160e49c7bcf4220d87e
+  data.tar.gz: a976676695518993833d4b742907113fa2a57bea2a7c767e2dfff2f43c5073e731475f2e1c2685a7cdd77be65a95497653a99259aa20ee1526af9a312ede1469

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.2
+
+- Security: a zip was held to `max_size` by its entries but not by its own size, so an oversized archive was read rather than refused.
+- The default `max_size` drops to 2 MB.
+
+## 0.1.1
+
+Documentation
+
 ## 0.1.0
 
 Initial release.

data/README.md

@@ -1,8 +1,10 @@
 # mailreport
 
-📧 Read the reports receivers send back about your domain
+📧 DMARC report parsing for Ruby.
 
-Answers one question: what are receivers seeing?.
+Answers one question: how does your mail look on their end?
+
+**mailreport** reads the reports receivers send back about your domain.
 
 ## Features
 
@@ -20,11 +22,14 @@ Answers one question: what are receivers seeing?.
 - [What Is Not Filled In](#what-is-not-filled-in)
 - [Unreadable Documents](#unreadable-documents)
 - [Testing](#testing)
+- [History](#history)
 - [Contributing](#contributing)
 - [License](#license)
 
 ## Getting Started
 
+Add this line to your application's Gemfile:
+
 ```ruby
 gem "mailreport"
 ```
@@ -119,12 +124,13 @@ This is deliberately different from a report carrying no records - that one is a
 A `rua` address is published in DNS, so anyone can send anything to it, and the limits assume as much:
 
 - **Entity declarations are refused.** A report has none of its own, so the expansion bomb is refused with them. Escapes a real document needs (`&`, `é`) still read.
-- **Decompression stops at 25 MB** rather than running to completion. Lower it where you'd rather hold less:
+- **Decompression stops at 2 MB** rather than running to completion.
 
 ```ruby
 MailReport::Archive.open(bytes, max_size: 1024 * 1024)
 ```
 
+- **A document of more than 25,000 tags is refused**, however few bytes it spends on them. Tags cost time and memory to read whatever their size, so the count is bounded to 500 records.
 - **External references are never resolved** - no document reads a file, a URL, or a DNS name.
 - **A zip entry is bounded as it inflates**, not on the size it claims.
 
@@ -137,9 +143,18 @@ bundle install
 rake
 ```
 
+## History
+
+View the [changelog](CHANGELOG.md).
+
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Bug reports: [GitHub issues](https://github.com/mailpiece/mailreport/issues). Security: [SECURITY.md](SECURITY.md).
+Everyone is encouraged to help improve this project:
+
+- [Report bugs](https://github.com/mailpiece/mailreport/issues)
+- Fix bugs and submit pull requests
+- Write, clarify, or fix documentation
+- Suggest or add new features
 
 ## License
 

data/lib/mailreport/archive.rb

@@ -9,7 +9,9 @@ module MailReport
     GZIP = "\x1f\x8b".b
     ZIP = "PK".b
 
-    MAX_SIZE = 25 * 1024 * 1024
+    # Real reports run to KBs; this is headroom, not an expectation - and
+    # every byte of it is parse cost a caller may pay before refusing.
+    MAX_SIZE = 2 * 1024 * 1024
     CHUNK_SIZE = 64 * 1024
     STORED = 0
 
@@ -23,13 +25,18 @@ module MailReport
       def open(bytes, max_size: MAX_SIZE, name: nil)
         bytes = bytes.to_s.b
 
+        # A real report's container never exceeds what it holds; refuse before
+        # reading a zip's central directory, whose entry count (not its bytes)
+        # is what costs time to walk.
         if bytes.empty?
           nil
+        elsif bytes.bytesize > max_size
+          nil
         elsif gzipped?(bytes)
           inflated(bytes, max_size)
         elsif zipped?(bytes)
           unzipped(bytes, max_size, name)
-        elsif bytes.bytesize <= max_size
+        else
           bytes
         end
       rescue *UNREADABLE

data/lib/mailreport/dmarc/document.rb

@@ -10,8 +10,11 @@ module MailReport
 
       PREDEFINED_ENTITIES = %w[ lt gt amp quot apos ].freeze
 
-      # REXML raises a bare RuntimeError when expansion limits trip; match the
-      # message so our own RuntimeErrors are not swallowed as unreadable input.
+      # A tag costs time and memory to build however few bytes it spends, so
+      # the count is bounded as well as the size. Room for some 500 records
+      MAX_TAGS = 25_000
+
+      # REXML raises a bare RuntimeError when expansion limits trip
       EXPANSION_ABANDONED = /entity expansions exceeded|entity expansion has grown too large/
 
       def initialize(xml)
@@ -34,9 +37,17 @@ module MailReport
 
       private
         def feedback
-          document = REXML::Document.new(@xml)
+          if countable?
+            document = REXML::Document.new(@xml)
+
+            document.root if readable?(document) && document.root&.name == ROOT
+          end
+        end
 
-          document.root if readable?(document) && document.root&.name == ROOT
+        # Every tag opens with one, so this over-counts where text or a comment
+        # holds a `<` — which refuses in the direction we want.
+        def countable?
+          @xml.to_s.count("<") <= MAX_TAGS
         end
 
         # Refuse any declared entity before text is read (expansion timing).

data/lib/mailreport/version.rb

@@ -1,3 +1,3 @@
 module MailReport
-  VERSION = "0.1.0"
+  VERSION = "0.1.2"
 end

data/mailreport.gemspec

@@ -7,10 +7,9 @@ Gem::Specification.new do |spec|
   spec.platform = Gem::Platform::RUBY
   spec.required_ruby_version = ">= 3.3.4"
   spec.authors = [ "Simon Lev" ]
-  spec.email = [ "support@postrider.dev" ]
 
-  spec.summary = "DMARC aggregate and SMTP TLS reports, parsed in pure Ruby."
-  spec.description = "Answers one question about your domain: what are receivers seeing?"
+  spec.summary = "DMARC report parsing for Ruby."
+  spec.description = "Answers one question: how does your mail look on their end? Reads the reports receivers send back about your domain. Parses DMARC aggregate (RUA) and failure (RUF) reports."
 
   spec.homepage = "https://github.com/mailpiece/mailreport"
   spec.license = "MIT"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailreport
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Simon Lev
@@ -37,9 +37,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '6.3'
-description: 'Answers one question about your domain: what are receivers seeing?'
-email:
-- support@postrider.dev
+description: 'Answers one question: how does your mail look on their end? Reads the
+  reports receivers send back about your domain. Parses DMARC aggregate (RUA) and
+  failure (RUF) reports.'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -79,5 +79,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.3
 specification_version: 4
-summary: DMARC aggregate and SMTP TLS reports, parsed in pure Ruby.
+summary: DMARC report parsing for Ruby.
 test_files: []