purl 1.8.0 → 1.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6632d8fa11800fb9a4b376c1555505ba87047f98de52a42103c27c2d2b46e2a
-  data.tar.gz: c248313079783e3d5ac6c9e7dfc8663067671d4a19356757cd493e4fb23c2d8f
+  metadata.gz: c9aa1c0a95990683d5731be306c256d83b5d4d8025910955744f8b526f95de9a
+  data.tar.gz: d946e4542c898fd36feb07eaf21ad4829fd74688f0834b705a2c232c71469a88
 SHA512:
-  metadata.gz: fc9b6cdde9d6efe15a93cd6760ec3c88aa8be1594d962682c9c27642c72408ebd242d2fa4cbbfc9f87e72e135f337bac8fbc278c69f991f4cbf7d5b3388a4b1b
-  data.tar.gz: db4bffcde1032b421fba9b68d717bad523482b2d457b304c997606d538bee59bbfbe185bc9f456c8e72a4150ed74f5bd80d38d757bfeba41ae533ff5260c7ffb
+  metadata.gz: a4e483648dbcad8106813a90f51521ea158ef07a3b8817671c49aa9622abb239f993c64c0e1b92395245abb606621b252af35f17c2745ff0ddb28cfe2d3a969a
+  data.tar.gz: 543d9d81c3ae2c6cc4a692386ff3baf89e9da3e41826567e6806047fbf6228a4e568603b52d3bf25abf508c1e8306c0cda3afe2ccfd86feabbdbbfa478292359

data/lib/purl/advisory.rb

@@ -9,6 +9,8 @@ module Purl
   # Provides advisory lookup functionality for packages using the advisories.ecosyste.ms API
   class Advisory
     ADVISORIES_API_BASE = "https://advisories.ecosyste.ms/api/v1"
+    ALLOWED_HOSTS = ["advisories.ecosyste.ms"].freeze
+    MAX_RESPONSE_BYTES = 10 * 1024 * 1024
 
     # Initialize a new Advisory instance
     #
@@ -55,6 +57,10 @@ module Purl
     private
 
     def make_request(uri)
+      unless uri.scheme == "https" && ALLOWED_HOSTS.include?(uri.host)
+        raise AdvisoryError, "Refusing request to disallowed host: #{uri.host}"
+      end
+
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = true
       http.read_timeout = @timeout
@@ -67,7 +73,11 @@ module Purl
 
       case response.code.to_i
       when 200
-        JSON.parse(response.body)
+        body = response.body
+        if body.bytesize > MAX_RESPONSE_BYTES
+          raise AdvisoryError, "Response too large (#{body.bytesize} bytes)"
+        end
+        JSON.parse(body)
       when 404
         []
       else

data/lib/purl/lookup.rb

@@ -9,6 +9,8 @@ module Purl
   # Provides lookup functionality for packages using the ecosyste.ms API
   class Lookup
     ECOSYSTE_MS_API_BASE = "https://packages.ecosyste.ms/api/v1"
+    ALLOWED_HOSTS = ["packages.ecosyste.ms", "repos.ecosyste.ms"].freeze
+    MAX_RESPONSE_BYTES = 10 * 1024 * 1024
     
     # Initialize a new Lookup instance
     #
@@ -100,7 +102,7 @@ module Purl
     private
 
     def http_for(uri)
-      key = "#{uri.host}:#{uri.port}"
+      key = connection_key(uri)
       @connections ||= {}
       @connections[key] ||= begin
         http = Net::HTTP.new(uri.host, uri.port)
@@ -113,11 +115,14 @@ module Purl
     end
 
     def reset_connection(uri)
-      key = "#{uri.host}:#{uri.port}"
-      old = @connections&.delete(key)
+      old = @connections&.delete(connection_key(uri))
       old&.finish rescue nil
     end
 
+    def connection_key(uri)
+      "#{uri.scheme}://#{uri.host}:#{uri.port}"
+    end
+
     def close
       return unless @connections
       @connections.each_value { |http| http.finish rescue nil }
@@ -125,6 +130,10 @@ module Purl
     end
 
     def make_request(uri, retried: false)
+      unless uri.scheme == "https" && ALLOWED_HOSTS.include?(uri.host)
+        raise LookupError, "Refusing request to disallowed host: #{uri.host}"
+      end
+
       http = http_for(uri)
 
       request = Net::HTTP::Get.new(uri)
@@ -134,7 +143,11 @@ module Purl
 
       case response.code.to_i
       when 200
-        JSON.parse(response.body)
+        body = response.body
+        if body.bytesize > MAX_RESPONSE_BYTES
+          raise LookupError, "Response too large (#{body.bytesize} bytes)"
+        end
+        JSON.parse(body)
       when 404
         nil
       else

data/lib/purl/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Purl
-  VERSION = "1.8.0"
+  VERSION = "1.8.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: purl
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.8.1
 platform: ruby
 authors:
 - Andrew Nesbitt