mailreport 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77edcdf57f9e324d318c45251384bd4cc7a21340280654d686c1a42627df88bd
-  data.tar.gz: 6dbc12089ee32f07f8e1a6c9b8539ce3bb4d40069b21c879d151dd405a0426c5
+  metadata.gz: f3d7ccde2b425bc6a1c990efde170016e4ec813c00d3c7ee69c289463f418052
+  data.tar.gz: b2e035153e75905c2d13ee5277dd64aac25a7f8bd328f83a7507ee074a457b24
 SHA512:
-  metadata.gz: d35ab1ed5769680d4536e5cf32b790c75110757c15a4297f799f29e916f347514f4db719bedaee46cdaa2aa4ed8109b2c124800af6c9a382c7283cb28452ca79
-  data.tar.gz: 25ab27ad73f9cb8b67d9f704c528822ed19df7de3c32e1d1967401ccb3c2f96a6c9bda0a9649ccd54599c48f3ef9bef2b8e79532b7ab3400ece2ec3e59054974
+  metadata.gz: 65e069ab2aaf56f78be9fcf0553ebefc53e4c68d5831cc6aaa79f609aa7c1e0e4a827c9b612ca8a43af0917954aa65320737021a68edf160e49c7bcf4220d87e
+  data.tar.gz: a976676695518993833d4b742907113fa2a57bea2a7c767e2dfff2f43c5073e731475f2e1c2685a7cdd77be65a95497653a99259aa20ee1526af9a312ede1469

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.2
+
+- Security: a zip was held to `max_size` by its entries but not by its own size, so an oversized archive was read rather than refused.
+- The default `max_size` drops to 2 MB.
+
 ## 0.1.1
 
 Documentation

data/README.md

@@ -124,12 +124,13 @@ This is deliberately different from a report carrying no records - that one is a
 A `rua` address is published in DNS, so anyone can send anything to it, and the limits assume as much:
 
 - **Entity declarations are refused.** A report has none of its own, so the expansion bomb is refused with them. Escapes a real document needs (`&`, `é`) still read.
-- **Decompression stops at 25 MB** rather than running to completion. Lower it where you'd rather hold less:
+- **Decompression stops at 2 MB** rather than running to completion.
 
 ```ruby
 MailReport::Archive.open(bytes, max_size: 1024 * 1024)
 ```
 
+- **A document of more than 25,000 tags is refused**, however few bytes it spends on them. Tags cost time and memory to read whatever their size, so the count is bounded to 500 records.
 - **External references are never resolved** - no document reads a file, a URL, or a DNS name.
 - **A zip entry is bounded as it inflates**, not on the size it claims.
 

data/lib/mailreport/archive.rb

@@ -9,7 +9,9 @@ module MailReport
     GZIP = "\x1f\x8b".b
     ZIP = "PK".b
 
-    MAX_SIZE = 25 * 1024 * 1024
+    # Real reports run to KBs; this is headroom, not an expectation - and
+    # every byte of it is parse cost a caller may pay before refusing.
+    MAX_SIZE = 2 * 1024 * 1024
     CHUNK_SIZE = 64 * 1024
     STORED = 0
 
@@ -23,13 +25,18 @@ module MailReport
       def open(bytes, max_size: MAX_SIZE, name: nil)
         bytes = bytes.to_s.b
 
+        # A real report's container never exceeds what it holds; refuse before
+        # reading a zip's central directory, whose entry count (not its bytes)
+        # is what costs time to walk.
         if bytes.empty?
           nil
+        elsif bytes.bytesize > max_size
+          nil
         elsif gzipped?(bytes)
           inflated(bytes, max_size)
         elsif zipped?(bytes)
           unzipped(bytes, max_size, name)
-        elsif bytes.bytesize <= max_size
+        else
           bytes
         end
       rescue *UNREADABLE

data/lib/mailreport/dmarc/document.rb

@@ -10,8 +10,11 @@ module MailReport
 
       PREDEFINED_ENTITIES = %w[ lt gt amp quot apos ].freeze
 
-      # REXML raises a bare RuntimeError when expansion limits trip; match the
-      # message so our own RuntimeErrors are not swallowed as unreadable input.
+      # A tag costs time and memory to build however few bytes it spends, so
+      # the count is bounded as well as the size. Room for some 500 records
+      MAX_TAGS = 25_000
+
+      # REXML raises a bare RuntimeError when expansion limits trip
       EXPANSION_ABANDONED = /entity expansions exceeded|entity expansion has grown too large/
 
       def initialize(xml)
@@ -34,9 +37,17 @@ module MailReport
 
       private
         def feedback
-          document = REXML::Document.new(@xml)
+          if countable?
+            document = REXML::Document.new(@xml)
+
+            document.root if readable?(document) && document.root&.name == ROOT
+          end
+        end
 
-          document.root if readable?(document) && document.root&.name == ROOT
+        # Every tag opens with one, so this over-counts where text or a comment
+        # holds a `<` — which refuses in the direction we want.
+        def countable?
+          @xml.to_s.count("<") <= MAX_TAGS
         end
 
         # Refuse any declared entity before text is read (expansion timing).

data/lib/mailreport/version.rb

@@ -1,3 +1,3 @@
 module MailReport
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

data/mailreport.gemspec

@@ -9,7 +9,7 @@ Gem::Specification.new do |spec|
   spec.authors = [ "Simon Lev" ]
 
   spec.summary = "DMARC report parsing for Ruby."
-  spec.description = "Answers one question: how does your mail look on their end? Reads the reports receivers send back about your domain."
+  spec.description = "Answers one question: how does your mail look on their end? Reads the reports receivers send back about your domain. Parses DMARC aggregate (RUA) and failure (RUF) reports."
 
   spec.homepage = "https://github.com/mailpiece/mailreport"
   spec.license = "MIT"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailreport
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Simon Lev
@@ -38,7 +38,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6.3'
 description: 'Answers one question: how does your mail look on their end? Reads the
-  reports receivers send back about your domain.'
+  reports receivers send back about your domain. Parses DMARC aggregate (RUA) and
+  failure (RUF) reports.'
 executables: []
 extensions: []
 extra_rdoc_files: []