oxygene 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d85155d1ce53a32be48e557bd81995deea20b096f0d5ac7797aad798f6527680
-  data.tar.gz: 70d1b127ab875cc3a7d2f04b922aa48c950cb2db33b46240e35a29080edc5fc8
+  metadata.gz: 330529457cdaebeb17c7cc3f3edf18b93c8e1a5a4a88c79738e8dbab9a0ef12a
+  data.tar.gz: d489d30eb02c4c2a4667ec294e6cc13f1961a3ded3ca2e42df6185d77556a516
 SHA512:
-  metadata.gz: ec92728d10052f07d4fced7e9aa973bb14f655f67fb1f4c1684535b7d4e2dcaac2fda995fa64243253c1ef56e0ee66eb33d1ba66b31fb76c37437beaacf0f85e
-  data.tar.gz: 133a216c0b0016c18d269355eb5336fcaa754cb30b8fa648786644648f06820ccec4e9608d00f8de57229ea3d493bd10de4bc06368ac901a71c674605d841159
+  metadata.gz: f3258bd11dcb7f8fd2ac81e8e602ac848f6dd13e38a1bbe54b0a3e35661eea8b778805443f83decc3941804a9d2ebe55549ae268aaac6030b7e0244a03525c40
+  data.tar.gz: de40782159c5cd2febdeaeb876bee0bda1f0ddea0639ebe5f954bc0458d6fc1da2e0788834cee13bb059a3b87011e6258d70c331e0cf889569b62992083cd32d

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.1.1] - 2026-11-06
+
+* added experimental parser for STAR archives (`Oxygene::STARArchive`)
+* some minor optimizations
+* bumped up `cbor` gem dependency to 0.6
+
 ## [0.1.0] - 2026-08-17
 
 * added custom, much faster Base32 encoder/decoder, dropping `base32` gem dependency

data/SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## How To Report a Vulnerability
+
+If you find a potential vulnerability in one of my projects, it's recommended not to report it through a standard publicly-readable issue report, in order to avoid giving possible clues to any potential attackers who could abuse it before it's fixed (see: ["Just a rumour of a bug is enough to find a security exploit these days"](https://anil.recoil.org/notes/rumour-is-the-exploit)).
+
+You can use one of these to contact me instead:
+
+- [@mackuba.eu](https://bsky.app/profile/did:plc:oio4hkxaop4ao4wz2pp3f4cr) on Bluesky (my DMs should be open, or mention me discretely with a request for contact)
+- [@mackuba@martianbase.net](https://martianbase.net/@mackuba) on Mastodon (my personal instance)
+- email: mackuba `@` protonmail.ch (optionally with [this PGP key](https://mail-api.proton.me/pks/lookup?op=get&search=mackuba@protonmail.ch))
+- ["Report a vulnerability"](https://github.com/mackuba/oxygene/security/advisories/new) form on GitHub
+
+I do not check my Twitter/X or LinkedIn accounts regularly.
+
+Note: please don't submit AI-reported issues that have not been verified manually :)

data/lib/oxygene/car_archive.rb

@@ -268,13 +268,16 @@ module Oxygene
 
     def read_section(buffer)
       len = buffer.read_varint
+      raise DecodeError, "Section length is too short: #{len}" if len < 36
 
       # TODO: verify content CIDs
-      section_data = buffer.read(len)
-      raise DecodeError.new("Section too short: #{section_data}") unless section_data.length == len
+      cid_data = buffer.read(36)
+      body_data = buffer.read(len - 36)
+
+      unless cid_data&.bytesize == 36 && body_data&.bytesize == len - 36
+        raise DecodeError, "Section is truncated"
+      end
 
-      cid_data = section_data.byteslice(0, 36)
-      body_data = section_data.byteslice(36..)
       cid_data.prepend(CID::CBOR_TAG_PREFIX)
       cid = CID.new(cid_data, binary: true, cbor_prefix: true, codec: :drisl)
 

data/lib/oxygene/car_repo.rb

@@ -102,7 +102,7 @@ module Oxygene
 
       (data['e'] || []).each do |e|
         if previous
-          key = previous[0...e['p']]
+          key = previous.byteslice(0, e['p'])
           key << e['k']
         else
           key = e['k']

data/lib/oxygene/star_archive.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require_relative 'errors'
+require_relative 'extensions'
+
+require 'cbor'
+require 'stringio'
+
+module Oxygene
+
+  #
+  # Parser for STAR archives (experimental).
+  #
+
+  class STARArchive
+    using Oxygene::Extensions
+
+    MAGIC_PREFIX = "\x2A\x6C\x01\x00"
+
+    attr_reader :data_pairs, :data_map, :metadata
+
+    def initialize(data)
+      @buffer = StringIO.new(data)
+      @data_pairs = []
+      @data_map = {}
+
+      read_header(@buffer)
+
+      loop do
+        had_data = read_section(@buffer)
+        break if !had_data
+      end
+
+      @buffer = nil
+    end
+
+    def inspect
+      vars = (instance_variables - [:@data_map]).map { |v|
+        "#{v}=#{instance_variable_get(v).inspect}"
+      }
+
+      "#<#{self.class}:0x#{object_id} #{vars.join(", ")}>"
+    end
+
+
+    private
+
+    def read_header(buffer)
+      magic = buffer.read(MAGIC_PREFIX.length)
+      raise DecodeError.new("Missing initial magic bytes") unless magic == MAGIC_PREFIX
+
+      header_len = read_varint(buffer)
+      raise DecodeError.new("Header length cannot be 0") if header_len == 0
+
+      header_data = buffer.read(header_len)
+
+      unless header_data.length == header_len
+        raise DecodeError.new("Header too short: got #{header_data.length} bytes, expected #{header_len}")
+      end
+
+      begin
+        metadata = CBOR.decode(header_data)
+      rescue StandardError
+        raise DecodeError.new("Malformed CBOR data")
+      end
+
+      raise DecodeError.new("Metadata object should be a hash") unless metadata.is_a?(Hash)
+
+      type = metadata['$type']
+      raise DecodeError.new("Missing '$type' field") if type.nil?
+      raise DecodeError.new("Invalid '$type' field: #{type.inspect}") unless type.is_a?(String)
+
+      @type = type
+      @metadata = metadata
+    end
+
+    def read_section(buffer)
+      control_byte = buffer.getbyte
+
+      case control_byte
+      when 0
+        # end of file
+        if @buffer.eof?
+          return false
+        else
+          raise DecodeError, "Unexpected content after end of file marker"
+        end
+      when 1
+        # continue with the next section
+      when nil
+        raise DecodeError, "Unexpected end of file"
+      else
+        raise DecodeError, "Unexpected control byte: #{control_byte}"
+      end
+
+      k_len = read_varint(buffer)
+      raise DecodeError, "Unexpected end of file" if k_len.nil?
+
+      key = buffer.read(k_len)
+      raise DecodeError, "Truncated key data" if key.nil? || key.length != k_len
+
+      v_len = read_varint(buffer)
+      raise DecodeError, "Unexpected end of file" if v_len.nil?
+
+      value = buffer.read(v_len)
+      raise DecodeError, "Truncated value data" if value.nil? || value.length != v_len
+
+      @data_pairs << [key, value]
+      @data_map[key] = value
+
+      true
+    end
+
+    def read_varint(buffer)
+      pos_before = buffer.pos
+      value = buffer.read_varint
+      length = buffer.pos - pos_before
+
+      raise DecodeError, "Varint length exceeds limit" if length > 9
+
+      value
+    end
+  end
+end

data/lib/oxygene/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oxygene
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

data/lib/oxygene.rb

@@ -4,6 +4,7 @@ require_relative 'oxygene/base32'
 require_relative 'oxygene/car_archive'
 require_relative 'oxygene/car_repo'
 require_relative 'oxygene/cid'
+require_relative 'oxygene/star_archive'
 require_relative 'oxygene/version'
 
 #

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oxygene
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Kuba Suder
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.9
+        version: 0.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.9
+        version: 0.6.1
 email:
 - jakub.suder@gmail.com
 executables: []
@@ -47,6 +47,7 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - lib/oxygene.rb
 - lib/oxygene/base32.rb
 - lib/oxygene/car_archive.rb
@@ -55,6 +56,7 @@ files:
 - lib/oxygene/cid.rb
 - lib/oxygene/errors.rb
 - lib/oxygene/extensions.rb
+- lib/oxygene/star_archive.rb
 - lib/oxygene/version.rb
 - sig/oxygene.rbs
 homepage: https://ruby.sdk.blue
@@ -79,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Various data decoding primitives for ATProto (CAR, CID, CBOR)
 test_files: []