tina4ruby 3.13.137 → 3.13.138

data/lib/tina4/webserver.rb

@@ -1,6 +1,13 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require_relative "port_takeover"
+require_relative "http_server"
 
 module Tina4
   class WebServer
@@ -69,8 +76,6 @@ module Tina4
         exit 1
       end
 
-      require "webrick"
-      require "stringio"
       require "socket"
 
       # Ensure the main port is available — kill whatever is on it if needed
@@ -88,14 +93,11 @@ module Tina4
         end
       end
 
-      Tina4.print_banner(host: @host, port: @port)
-      Tina4::Log.info("Starting Tina4 WEBrick server on http://#{@host}:#{@port}")
-      @server = WEBrick::HTTPServer.new(
-        BindAddress: @host,
-        Port: @port,
-        Logger: WEBrick::Log.new(File::NULL),
-        AccessLog: []
-      )
+      Tina4.print_banner(host: @host, port: @port, server_name: Tina4::HttpServer::SOFTWARE)
+      display = (@host == "0.0.0.0" || @host == "::") ? "localhost" : @host
+      Tina4::Log.info("Server started http://#{display}:#{@port} (#{Tina4::HttpServer::SOFTWARE})")
+      @server = Tina4::HttpServer.new(server_name: @host)
+      @server.listen(@host, @port, @app)
 
       # Dual-stack loopback: ALSO listen on the sibling loopback family on the
       # MAIN port, so `localhost` reaches this server whether the OS resolves it
@@ -104,14 +106,13 @@ module Tina4
       # IPv4 wildcard, which does NOT cover IPv6 -- refuses the browser with
       # ERR_CONNECTION_REFUSED even though it is serving. The primary bind above
       # is unchanged (keeps its fail-closed throw + port-takeover); each sibling
-      # is BEST-EFFORT via WEBrick::GenericServer#listen, which appends to the
-      # listener set the accept loop already services. A family that is
-      # unavailable, or that the primary bind already answers, raises and is
-      # skipped -- a sibling failure NEVER fails the boot. Main port only
-      # (mirrors tina4-php PR #206); the AI/debug port is left alone.
+      # is BEST-EFFORT: a family that is unavailable, or that the primary bind
+      # already answers, raises and is skipped -- a sibling failure NEVER fails
+      # the boot. Main port only (mirrors tina4-php PR #206); the AI/debug port
+      # is left alone.
       self.class.loopback_bind_hosts(@host).each do |sibling_host|
         begin
-          @server.listen(sibling_host, @port)
+          @server.listen(sibling_host, @port, @app)
         rescue Errno::EADDRINUSE, Errno::EADDRNOTAVAIL, SocketError, Errno::EAFNOSUPPORT => e
           Tina4::Log.debug("Dual-stack loopback: skipped #{sibling_host}:#{@port} (#{e.class})")
         end
@@ -121,42 +122,19 @@ module Tina4
       # `tina4 serve` can identify it as reclaimable (TAKEOVER-DEC-01).
       Tina4::PortTakeover.write_pidfile(@port)
 
-      # Setup graceful shutdown with WEBrick server reference
+      # Graceful shutdown: Tina4::Shutdown closes the listeners first, then
+      # drains in-flight requests (bounded by TINA4_SHUTDOWN_TIMEOUT).
       Tina4::Shutdown.setup(server: @server)
 
-      # Use a custom servlet that passes ALL methods (including OPTIONS) to Rack
-      rack_app = @app
-      servlet = build_rack_servlet(@host, @port.to_s)
-
-      @server.mount("/", servlet, rack_app)
-
       # Test port (port + 1000) — stable, no-browser
-      @ai_server = nil
-      @ai_thread = nil
       no_ai_port = %w[true 1 yes].include?(ENV.fetch("TINA4_NO_AI_PORT", "").downcase)
       is_debug   = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "").downcase)
 
       if is_debug && !no_ai_port
         ai_port = @port + 1000
         begin
-          test = TCPServer.new("0.0.0.0", ai_port)
-          test.close
-
-          @ai_server = WEBrick::HTTPServer.new(
-            BindAddress: @host,
-            Port: ai_port,
-            Logger: WEBrick::Log.new(File::NULL),
-            AccessLog: []
-          )
-
-          # Wrap the rack app so AI-port requests are tagged
-          ai_rack_app = Tina4::AiPortRackApp.new(@app)
-
-          # Same servlet as the main port, bound to the AI port's host/port.
-          ai_servlet = build_rack_servlet(@host, ai_port.to_s)
-
-          @ai_server.mount("/", ai_servlet, ai_rack_app)
-          @ai_thread = Thread.new { @ai_server.start }
+          # Tagged so the pipeline suppresses live reload on this port.
+          @server.listen(@host, ai_port, Tina4::AiPortRackApp.new(@app))
           puts "  Test Port: http://localhost:#{ai_port} (stable — no hot-reload)"
         rescue Errno::EADDRINUSE
           puts "  Test Port: SKIPPED (port #{ai_port} in use)"
@@ -166,15 +144,13 @@ module Tina4
       @server.start
 
       # Shutdown closes the listener FIRST, so #start returns as soon as the
-      # in-flight workers are joined - potentially while the signal handler's
-      # thread is still stopping background tasks and closing the database.
-      # Wait for that teardown instead of exiting out from under it.
+      # accept loop stops - potentially while the signal handler's thread is
+      # still draining requests, stopping background tasks and closing the
+      # database. Wait for that teardown instead of exiting out from under it.
       Tina4::Shutdown.wait_for_completion
     end
 
     def stop
-      @ai_server&.shutdown
-      @ai_thread&.join(5)
       @server&.shutdown
       # Drop our identity marker so a later takeover does not match a dead PID.
       Tina4::PortTakeover.remove_pidfile(@port)
@@ -200,7 +176,7 @@ module Tina4
     # is normalised (downcased, surrounding whitespace and brackets stripped) so
     # "[::1]", " ::1 " and "::1" all resolve alike.
     #
-    # Mirrors the tina4-php Server::loopbackBindHosts mapping exactly. WEBrick
+    # Mirrors the tina4-php Server::loopbackBindHosts mapping exactly. Ruby
     # binds "::1" WITHOUT brackets (PHP's stream URL needed "[::1]"; the brackets
     # are not carried into Ruby).
     #
@@ -215,99 +191,5 @@ module Tina4
       else []
       end
     end
-
-    private
-
-    # Build the Rack->WEBrick servlet class bound to a specific host/port.
-    # The main port and the debug AI port mount an identical servlet; the ONLY
-    # difference is the host/port reported in the Rack env, bound below via
-    # define_method. Extracted from two verbatim-identical copies.
-    def build_rack_servlet(host, port)
-      servlet = Class.new(WEBrick::HTTPServlet::AbstractServlet) do
-        define_method(:initialize) do |server, app|
-          super(server)
-          @app = app
-        end
-
-        %w[GET POST PUT DELETE PATCH HEAD OPTIONS].each do |http_method|
-          define_method("do_#{http_method}") do |webrick_req, webrick_res|
-            handle_request(webrick_req, webrick_res)
-          end
-        end
-
-        define_method(:handle_request) do |webrick_req, webrick_res|
-          # Belt-and-braces, NOT the primary mechanism. Shutdown closes the
-          # listening socket FIRST, so a connection arriving after the signal is
-          # refused by the kernel and never reaches here. What is left is a
-          # genuine race: WEBrick accepts a connection and parses its request in
-          # a worker thread, and the @shutting_down flag can flip in the gap
-          # before that worker reaches this line.
-          #
-          # Measured (macOS 26.5.2, Ruby 4.0.2, webrick 1.9.2, 48 threads
-          # hammering across a real SIGTERM): the window is the ~10-90ms between
-          # the flag flip and the listener actually closing, and 0-2 requests per
-          # run land in it out of ~2000. Every request after that is
-          # ECONNREFUSED. Rare, but reachable - so the guard stays.
-          if Tina4::Shutdown.shutting_down?
-            webrick_res.status = 503
-            webrick_res.body = '{"error":"Service shutting down"}'
-            webrick_res["content-type"] = "application/json"
-            return
-          end
-
-          Tina4::Shutdown.track_request do
-            env = build_rack_env(webrick_req)
-            status, headers, body = @app.call(env)
-
-            webrick_res.status = status
-            headers.each do |key, value|
-              if key.downcase == "set-cookie"
-                Array(value.split("\n")).each { |c| webrick_res.cookies << WEBrick::Cookie.parse_set_cookie(c) }
-              else
-                webrick_res[key] = value
-              end
-            end
-
-            response_body = ""
-            body.each { |chunk| response_body += chunk }
-            webrick_res.body = response_body
-          end
-        end
-
-        define_method(:build_rack_env) do |req|
-          input = StringIO.new(req.body || "")
-          env = {
-            "REQUEST_METHOD" => req.request_method,
-            "PATH_INFO" => req.path,
-            "QUERY_STRING" => req.query_string || "",
-            "SERVER_NAME" => webrick_req_host,
-            "SERVER_PORT" => webrick_req_port,
-            "CONTENT_TYPE" => req.content_type || "",
-            "CONTENT_LENGTH" => (req.content_length rescue 0).to_s,
-            "REMOTE_ADDR" => req.peeraddr&.last || "127.0.0.1",
-            "rack.input" => input,
-            "rack.errors" => $stderr,
-            "rack.url_scheme" => "http",
-            "rack.version" => [1, 3],
-            "rack.multithread" => true,
-            "rack.multiprocess" => false,
-            "rack.run_once" => false
-          }
-
-          req.header.each do |key, values|
-            env_key = "HTTP_#{key.upcase.gsub('-', '_')}"
-            env[env_key] = values.join(", ")
-          end
-
-          env
-        end
-      end
-
-      # Bind the per-server host/port the Rack env reports (the ONLY thing that
-      # differs between the main port and the AI port).
-      servlet.define_method(:webrick_req_host) { host }
-      servlet.define_method(:webrick_req_port) { port }
-      servlet
-    end
   end
 end

data/lib/tina4/websocket.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "socket"
 require "digest"
-require "base64"
+require_relative "base64"
 require "json"
 require "set"
 require "securerandom"
@@ -22,7 +28,7 @@ module Tina4
 
   # Compute Sec-WebSocket-Accept from Sec-WebSocket-Key per RFC 6455.
   def self.compute_accept_key(key)
-    Base64.strict_encode64(Digest::SHA1.digest("#{key}#{WEBSOCKET_GUID}"))
+    Tina4::Base64.strict_encode64(Digest::SHA1.digest("#{key}#{WEBSOCKET_GUID}"))
   end
 
   # Return true if the request's Origin is permitted to upgrade to a WebSocket.
@@ -499,7 +505,7 @@ module Tina4
       }
       # JSON can't carry raw bytes — encode binary as base64, text as text.
       if binary_payload?(message)
-        envelope["b64"] = Base64.strict_encode64(message.b)
+        envelope["b64"] = Tina4::Base64.strict_encode64(message.b)
       else
         envelope["text"] = message
       end
@@ -514,7 +520,7 @@ module Tina4
     # carry bytes, so text → {"text": ...} and bytes → {"b64": base64(...)}.
     def decode_envelope_message(env)
       return env["text"] if env.key?("text")
-      return Base64.strict_decode64(env["b64"]).b if env.key?("b64")
+      return Tina4::Base64.strict_decode64(env["b64"]).b if env.key?("b64")
 
       nil
     end

data/lib/tina4/websocket_backplane.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # WebSocket Backplane Abstraction for Tina4 Ruby.
 #
@@ -17,6 +23,8 @@
 #     backplane.publish("chat", '{"user":"A","text":"hello"}')
 #   end
 
+require_relative "database_url"
+
 module Tina4
   # Base backplane interface for scaling WebSocket broadcast across instances.
   #
@@ -81,8 +89,17 @@ module Tina4
       end
 
       @url = url || ENV.fetch("TINA4_WS_BACKPLANE_URL", "redis://localhost:6379")
-      @redis = Redis.new(url: @url)
-      @subscriber = Redis.new(url: @url)
+      begin
+        @redis = Redis.new(url: @url)
+        @subscriber = Redis.new(url: @url)
+      rescue StandardError => e
+        # A URL the client cannot parse raises URI::InvalidURIError quoting the
+        # WHOLE raw URL, password included, and WebSocket#ensure_backplane logs
+        # e.message. Re-raise naming only the redacted form.
+        raise ArgumentError,
+              "Invalid TINA4_WS_BACKPLANE_URL for the Redis backplane: " \
+              "#{Tina4::DatabaseUrl.redact(@url)} (#{e.class})"
+      end
       @threads = {}
       @running = true
     end

data/lib/tina4/wsdl.rb

@@ -1,6 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
-require "rexml/document"
+
+require_relative "xml_parser"
 
 module Tina4
   # SOAP 1.1 / WSDL server — zero-dependency, mirrors tina4-python's wsdl module.
@@ -20,7 +26,7 @@ module Tina4
   #
   # Supported:
   #   - WSDL 1.1 generation from Ruby type declarations
-  #   - SOAP 1.1 request/response handling via REXML
+  #   - SOAP 1.1 request/response handling via Tina4::WSDL::XmlParser (UTF-8 only, no DTDs)
   #   - Lifecycle hooks (on_request, on_result)
   #   - Auto type mapping (Integer -> int, String -> string, Float -> double, etc.)
   #   - XML escaping on all response values
@@ -273,17 +279,18 @@ module Tina4
     def process_soap(xml_body)
       on_request(@request)
 
-      # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message.
-      # Rejecting any DOCTYPE/DTD up front also closes the XML entity-expansion
-      # (billion-laughs) and external-entity (XXE) attack surface — REXML expands
-      # internal entities, so a DTD is a live DoS vector. Reject before parsing.
-      if xml_body =~ /<!DOCTYPE/i
+      # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message, so
+      # reject any DOCTYPE up front with the same Client fault as the other three
+      # frameworks. The parser has no DTD support at all (no entity expansion, no
+      # XXE) and accepts UTF-8 only, so a UTF-16 body that hides its DOCTYPE from
+      # this byte regex is refused by the parser as Malformed XML.
+      if doctype?(xml_body)
         return soap_fault("Client", "DOCTYPE declarations are not allowed in SOAP messages")
       end
 
       begin
-        doc = REXML::Document.new(xml_body)
-      rescue REXML::ParseException
+        doc = XmlParser.parse(xml_body)
+      rescue XmlParser::ParseError
         return soap_fault("Client", "Malformed XML")
       end
 
@@ -328,7 +335,13 @@ module Tina4
       soap_response(op_name, result)
     end
 
-    # ── XML helpers (REXML) ──────────────────────────────────────────────
+    # ── XML helpers ──────────────────────────────────────────────────────
+
+    # Byte-level match, so a body whose bytes are not valid UTF-8 cannot raise
+    # ArgumentError out of the regex before the parser gets to refuse it.
+    def doctype?(xml_body)
+      xml_body.to_s.b.match?(/<!DOCTYPE/in)
+    end
 
     def find_child(parent, local)
       parent.each_element do |el|
@@ -338,7 +351,7 @@ module Tina4
     end
 
     def local_name(element)
-      element.name  # REXML already strips the prefix for .name
+      element.name  # XmlParser::Element#name is the local name (prefix stripped)
     end
 
     # ── Type conversion ──────────────────────────────────────────────────
@@ -486,12 +499,14 @@ module Tina4
       end
 
       def handle_soap_request(xml_body)
-        # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing — this
-        # closes the REXML internal-entity expansion (billion-laughs) and XXE
-        # surface. Mirrors the class-based process_soap path.
-        return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages") if xml_body =~ /<!DOCTYPE/i
+        # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing; the parser
+        # itself has no DTD support and accepts UTF-8 only. Mirrors the
+        # class-based process_soap path.
+        if xml_body.to_s.b.match?(/<!DOCTYPE/in)
+          return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages")
+        end
 
-        doc = REXML::Document.new(xml_body)
+        doc = XmlParser.parse(xml_body)
 
         # Find Body element (namespace-agnostic)
         body_el = _find_child(doc.root, "Body")

data/lib/tina4/xml_parser.rb

@@ -0,0 +1,259 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require "strscan"
+
+module Tina4
+  class WSDL
+    # A small, strict XML parser for SOAP request bodies (replaces REXML).
+    #
+    # Ported from the stack-based parser in tina4-nodejs (packages/core/src/wsdl.ts)
+    # and made strict, because the Ruby WSDL server has always answered
+    # "Malformed XML" for a broken body (Python's ElementTree does the same):
+    # tags must nest, there is exactly one root, and only the five predefined
+    # entities plus character references are understood.
+    #
+    # Deliberately NOT supported, so the attack surface does not exist:
+    #   * DTDs. `<!DOCTYPE` and every other `<!` declaration is a ParseError, so
+    #     there is no entity expansion (billion laughs) and no external entity
+    #     (XXE). The WSDL server also rejects DOCTYPE before parsing.
+    #   * Any encoding but UTF-8. A UTF-16/UTF-32 body (BOM or NUL bytes) or
+    #     invalid UTF-8 is a ParseError. A UTF-16 body used to slip past the
+    #     `<!DOCTYPE` regex guard, because the guard read "<\0!\0D\0..." while
+    #     REXML decoded the BOM and parsed the DTD. A UTF-8 BOM is skipped.
+    #
+    # Element#text follows ElementTree (the Python master): the character data
+    # before the first child element, entity- and CDATA-decoded; nil when there
+    # is none. Element#name is the local name (prefix stripped), as REXML gave.
+    module XmlParser
+      class ParseError < StandardError; end
+
+      class Element
+        attr_reader :name, :prefix, :attributes, :elements
+
+        def initialize(qualified_name, attributes)
+          @prefix, _, local = qualified_name.rpartition(":")
+          @prefix = nil if @prefix.empty?
+          @name = local
+          @attributes = attributes
+          @elements = []
+          @text = nil
+          @seen_child = false
+        end
+
+        # Character data before the first child element (ElementTree .text).
+        def text
+          @text
+        end
+
+        def each_element(&block)
+          @elements.each(&block)
+        end
+
+        def append_text(data) # :nodoc:
+          return if @seen_child || data.empty?
+
+          @text = @text ? @text + data : data.dup
+        end
+
+        def append_child(element) # :nodoc:
+          @seen_child = true
+          @elements << element
+        end
+      end
+
+      Document = Struct.new(:root)
+
+      PREDEFINED_ENTITIES = { "lt" => "<", "gt" => ">", "amp" => "&", "quot" => '"', "apos" => "'" }.freeze
+      NAME = /[A-Za-z_:\u00C0-\u{EFFFF}][A-Za-z0-9_:.\-\u00B7\u00C0-\u{EFFFF}]*/
+      UTF16_OR_32_BOMS = ["\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+
+      module_function
+
+      # Parse +xml+ (a String of any encoding tag; its BYTES must be UTF-8).
+      # Returns a Document whose #root is the single root Element.
+      def parse(xml)
+        Reader.new(utf8_text(xml)).document
+      end
+
+      def utf8_text(xml)
+        bytes = xml.to_s.b
+        if UTF16_OR_32_BOMS.any? { |bom| bytes.start_with?(bom) } || bytes.include?("\x00")
+          raise ParseError, "only UTF-8 XML is accepted (UTF-16/UTF-32 body)"
+        end
+
+        bytes = bytes.byteslice(3..) if bytes.start_with?("\xEF\xBB\xBF".b)
+        text = bytes.force_encoding(Encoding::UTF_8)
+        raise ParseError, "only UTF-8 XML is accepted (invalid UTF-8 bytes)" unless text.valid_encoding?
+
+        text
+      end
+
+      def decode_references(raw)
+        return raw unless raw.include?("&")
+
+        raw.gsub(/&([^;&\s]*);?/) do |match|
+          raise ParseError, "unterminated reference #{match[0, 20].inspect}" unless match.end_with?(";")
+
+          name = Regexp.last_match(1)
+          if (replacement = PREDEFINED_ENTITIES[name])
+            replacement
+          elsif name =~ /\A#x([0-9A-Fa-f]{1,6})\z/ || name =~ /\A#([0-9]{1,7})\z/
+            codepoint = name.start_with?("#x") ? Regexp.last_match(1).to_i(16) : Regexp.last_match(1).to_i
+            raise ParseError, "invalid character reference &#{name};" unless xml_char?(codepoint)
+
+            [codepoint].pack("U")
+          else
+            raise ParseError, "undefined entity &#{name}; (DTDs are not supported)"
+          end
+        end
+      end
+
+      def xml_char?(codepoint)
+        [0x9, 0xA, 0xD].include?(codepoint) ||
+          (0x20..0xD7FF).cover?(codepoint) ||
+          (0xE000..0xFFFD).cover?(codepoint) ||
+          (0x10000..0x10FFFF).cover?(codepoint)
+      end
+
+      # Iterative (no recursion, so nesting depth cannot exhaust the stack).
+      class Reader
+        def initialize(text)
+          @scanner = StringScanner.new(text)
+          @stack = []        # open Elements, innermost last
+          @open_names = []   # their qualified names, for end-tag matching
+          @root = nil
+        end
+
+        def document
+          skip_xml_declaration
+          until @scanner.eos?
+            if @stack.empty?
+              read_outside_root
+            else
+              read_content
+            end
+          end
+          raise ParseError, "unclosed element <#{@stack.last.name}>" unless @stack.empty?
+          raise ParseError, "no root element" unless @root
+
+          Document.new(@root)
+        end
+
+        private
+
+        def skip_xml_declaration
+          return unless @scanner.check(/<\?xml[\s?]/)
+
+          @scanner.scan_until(/\?>/) or raise ParseError, "unterminated XML declaration"
+        end
+
+        # Between the prolog and the end: whitespace, comments, PIs, the root.
+        def read_outside_root
+          return if @scanner.skip(/\s+/)
+          return skip_comment if @scanner.check(/<!--/)
+          return skip_processing_instruction if @scanner.check(/<\?/)
+          raise ParseError, "DOCTYPE and other declarations are not supported" if @scanner.check(/<!/)
+          raise ParseError, "content after the root element" if @root
+          raise ParseError, "text outside the root element" unless @scanner.check(/</)
+
+          open_element
+        end
+
+        def read_content
+          if (data = @scanner.scan(/[^<]+/))
+            raise ParseError, "']]>' is not allowed in character data" if data.include?("]]>")
+
+            @stack.last.append_text(XmlParser.decode_references(data))
+          elsif @scanner.check(/<\//)
+            close_element
+          elsif @scanner.check(/<!--/)
+            skip_comment
+          elsif @scanner.skip(/<!\[CDATA\[/)
+            cdata = @scanner.scan_until(/\]\]>/) or raise ParseError, "unterminated CDATA section"
+            @stack.last.append_text(cdata[0...-3])
+          elsif @scanner.check(/<!/)
+            raise ParseError, "DOCTYPE and other declarations are not supported"
+          elsif @scanner.check(/<\?/)
+            skip_processing_instruction
+          else
+            open_element
+          end
+        end
+
+        def open_element
+          @scanner.skip(/</)
+          name = @scanner.scan(NAME) or raise ParseError, "invalid tag name at byte #{@scanner.pos}"
+          attributes = read_attributes
+          self_closing = !@scanner.skip(%r{/>}).nil?
+          raise ParseError, "unterminated tag <#{name}>" unless self_closing || @scanner.skip(/>/)
+
+          element = Element.new(name, attributes)
+          if @stack.empty?
+            @root = element
+          else
+            @stack.last.append_child(element)
+          end
+          return if self_closing
+
+          @stack.push(element)
+          @open_names.push(name)
+        end
+
+        def read_attributes
+          attributes = {}
+          loop do
+            had_space = @scanner.skip(/\s+/)
+            break if @scanner.check(%r{/?>})
+
+            raise ParseError, "attributes must be separated by whitespace" unless had_space
+
+            key = @scanner.scan(NAME) or raise ParseError, "invalid attribute at byte #{@scanner.pos}"
+            @scanner.skip(/\s*=\s*/) or raise ParseError, "attribute #{key} has no value"
+            quote = @scanner.getch
+            raise ParseError, "attribute #{key} value must be quoted" unless ['"', "'"].include?(quote)
+
+            value = @scanner.scan_until(/#{quote}/) or raise ParseError, "unterminated attribute #{key}"
+            value = value[0...-1]
+            raise ParseError, "'<' is not allowed in attribute #{key}" if value.include?("<")
+            raise ParseError, "duplicate attribute #{key}" if attributes.key?(key)
+
+            attributes[key] = XmlParser.decode_references(value)
+          end
+          attributes
+        end
+
+        def close_element
+          @scanner.skip(%r{</})
+          name = @scanner.scan(NAME) or raise ParseError, "invalid closing tag at byte #{@scanner.pos}"
+          @scanner.skip(/\s*/)
+          @scanner.skip(/>/) or raise ParseError, "unterminated closing tag </#{name}>"
+          expected = @open_names.last
+          raise ParseError, "unexpected closing tag </#{name}>" unless expected
+          raise ParseError, "mismatched tag: expected </#{expected}>, found </#{name}>" unless expected == name
+
+          @open_names.pop
+          @stack.pop
+        end
+
+        def skip_comment
+          @scanner.skip(/<!--/)
+          @scanner.skip_until(/-->/) or raise ParseError, "unterminated comment"
+        end
+
+        def skip_processing_instruction
+          @scanner.skip(/<\?/)
+          target = @scanner.check(NAME)
+          raise ParseError, "an XML declaration is only allowed at the very start" if target&.casecmp?("xml")
+
+          @scanner.skip_until(/\?>/) or raise ParseError, "unterminated processing instruction"
+        end
+      end
+    end
+  end
+end