tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/webserver.rb

@@ -1,6 +1,13 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require_relative "port_takeover"
+require_relative "http_server"
 
 module Tina4
   class WebServer
@@ -69,8 +76,6 @@ module Tina4
         exit 1
       end
 
-      require "webrick"
-      require "stringio"
       require "socket"
 
       # Ensure the main port is available — kill whatever is on it if needed
@@ -88,14 +93,11 @@ module Tina4
         end
       end
 
-      Tina4.print_banner(host: @host, port: @port)
-      Tina4::Log.info("Starting Tina4 WEBrick server on http://#{@host}:#{@port}")
-      @server = WEBrick::HTTPServer.new(
-        BindAddress: @host,
-        Port: @port,
-        Logger: WEBrick::Log.new(File::NULL),
-        AccessLog: []
-      )
+      Tina4.print_banner(host: @host, port: @port, server_name: Tina4::HttpServer::SOFTWARE)
+      display = (@host == "0.0.0.0" || @host == "::") ? "localhost" : @host
+      Tina4::Log.info("Server started http://#{display}:#{@port} (#{Tina4::HttpServer::SOFTWARE})")
+      @server = Tina4::HttpServer.new(server_name: @host)
+      @server.listen(@host, @port, @app)
 
       # Dual-stack loopback: ALSO listen on the sibling loopback family on the
       # MAIN port, so `localhost` reaches this server whether the OS resolves it
@@ -104,14 +106,13 @@ module Tina4
       # IPv4 wildcard, which does NOT cover IPv6 -- refuses the browser with
       # ERR_CONNECTION_REFUSED even though it is serving. The primary bind above
       # is unchanged (keeps its fail-closed throw + port-takeover); each sibling
-      # is BEST-EFFORT via WEBrick::GenericServer#listen, which appends to the
-      # listener set the accept loop already services. A family that is
-      # unavailable, or that the primary bind already answers, raises and is
-      # skipped -- a sibling failure NEVER fails the boot. Main port only
-      # (mirrors tina4-php PR #206); the AI/debug port is left alone.
+      # is BEST-EFFORT: a family that is unavailable, or that the primary bind
+      # already answers, raises and is skipped -- a sibling failure NEVER fails
+      # the boot. Main port only (mirrors tina4-php PR #206); the AI/debug port
+      # is left alone.
       self.class.loopback_bind_hosts(@host).each do |sibling_host|
         begin
-          @server.listen(sibling_host, @port)
+          @server.listen(sibling_host, @port, @app)
         rescue Errno::EADDRINUSE, Errno::EADDRNOTAVAIL, SocketError, Errno::EAFNOSUPPORT => e
           Tina4::Log.debug("Dual-stack loopback: skipped #{sibling_host}:#{@port} (#{e.class})")
         end
@@ -121,42 +122,19 @@ module Tina4
       # `tina4 serve` can identify it as reclaimable (TAKEOVER-DEC-01).
       Tina4::PortTakeover.write_pidfile(@port)
 
-      # Setup graceful shutdown with WEBrick server reference
+      # Graceful shutdown: Tina4::Shutdown closes the listeners first, then
+      # drains in-flight requests (bounded by TINA4_SHUTDOWN_TIMEOUT).
       Tina4::Shutdown.setup(server: @server)
 
-      # Use a custom servlet that passes ALL methods (including OPTIONS) to Rack
-      rack_app = @app
-      servlet = build_rack_servlet(@host, @port.to_s)
-
-      @server.mount("/", servlet, rack_app)
-
       # Test port (port + 1000) — stable, no-browser
-      @ai_server = nil
-      @ai_thread = nil
       no_ai_port = %w[true 1 yes].include?(ENV.fetch("TINA4_NO_AI_PORT", "").downcase)
       is_debug   = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "").downcase)
 
       if is_debug && !no_ai_port
         ai_port = @port + 1000
         begin
-          test = TCPServer.new("0.0.0.0", ai_port)
-          test.close
-
-          @ai_server = WEBrick::HTTPServer.new(
-            BindAddress: @host,
-            Port: ai_port,
-            Logger: WEBrick::Log.new(File::NULL),
-            AccessLog: []
-          )
-
-          # Wrap the rack app so AI-port requests are tagged
-          ai_rack_app = Tina4::AiPortRackApp.new(@app)
-
-          # Same servlet as the main port, bound to the AI port's host/port.
-          ai_servlet = build_rack_servlet(@host, ai_port.to_s)
-
-          @ai_server.mount("/", ai_servlet, ai_rack_app)
-          @ai_thread = Thread.new { @ai_server.start }
+          # Tagged so the pipeline suppresses live reload on this port.
+          @server.listen(@host, ai_port, Tina4::AiPortRackApp.new(@app))
           puts "  Test Port: http://localhost:#{ai_port} (stable — no hot-reload)"
         rescue Errno::EADDRINUSE
           puts "  Test Port: SKIPPED (port #{ai_port} in use)"
@@ -166,15 +144,13 @@ module Tina4
       @server.start
 
       # Shutdown closes the listener FIRST, so #start returns as soon as the
-      # in-flight workers are joined - potentially while the signal handler's
-      # thread is still stopping background tasks and closing the database.
-      # Wait for that teardown instead of exiting out from under it.
+      # accept loop stops - potentially while the signal handler's thread is
+      # still draining requests, stopping background tasks and closing the
+      # database. Wait for that teardown instead of exiting out from under it.
       Tina4::Shutdown.wait_for_completion
     end
 
     def stop
-      @ai_server&.shutdown
-      @ai_thread&.join(5)
       @server&.shutdown
       # Drop our identity marker so a later takeover does not match a dead PID.
       Tina4::PortTakeover.remove_pidfile(@port)
@@ -200,7 +176,7 @@ module Tina4
     # is normalised (downcased, surrounding whitespace and brackets stripped) so
     # "[::1]", " ::1 " and "::1" all resolve alike.
     #
-    # Mirrors the tina4-php Server::loopbackBindHosts mapping exactly. WEBrick
+    # Mirrors the tina4-php Server::loopbackBindHosts mapping exactly. Ruby
     # binds "::1" WITHOUT brackets (PHP's stream URL needed "[::1]"; the brackets
     # are not carried into Ruby).
     #
@@ -215,99 +191,5 @@ module Tina4
       else []
       end
     end
-
-    private
-
-    # Build the Rack->WEBrick servlet class bound to a specific host/port.
-    # The main port and the debug AI port mount an identical servlet; the ONLY
-    # difference is the host/port reported in the Rack env, bound below via
-    # define_method. Extracted from two verbatim-identical copies.
-    def build_rack_servlet(host, port)
-      servlet = Class.new(WEBrick::HTTPServlet::AbstractServlet) do
-        define_method(:initialize) do |server, app|
-          super(server)
-          @app = app
-        end
-
-        %w[GET POST PUT DELETE PATCH HEAD OPTIONS].each do |http_method|
-          define_method("do_#{http_method}") do |webrick_req, webrick_res|
-            handle_request(webrick_req, webrick_res)
-          end
-        end
-
-        define_method(:handle_request) do |webrick_req, webrick_res|
-          # Belt-and-braces, NOT the primary mechanism. Shutdown closes the
-          # listening socket FIRST, so a connection arriving after the signal is
-          # refused by the kernel and never reaches here. What is left is a
-          # genuine race: WEBrick accepts a connection and parses its request in
-          # a worker thread, and the @shutting_down flag can flip in the gap
-          # before that worker reaches this line.
-          #
-          # Measured (macOS 26.5.2, Ruby 4.0.2, webrick 1.9.2, 48 threads
-          # hammering across a real SIGTERM): the window is the ~10-90ms between
-          # the flag flip and the listener actually closing, and 0-2 requests per
-          # run land in it out of ~2000. Every request after that is
-          # ECONNREFUSED. Rare, but reachable - so the guard stays.
-          if Tina4::Shutdown.shutting_down?
-            webrick_res.status = 503
-            webrick_res.body = '{"error":"Service shutting down"}'
-            webrick_res["content-type"] = "application/json"
-            return
-          end
-
-          Tina4::Shutdown.track_request do
-            env = build_rack_env(webrick_req)
-            status, headers, body = @app.call(env)
-
-            webrick_res.status = status
-            headers.each do |key, value|
-              if key.downcase == "set-cookie"
-                Array(value.split("\n")).each { |c| webrick_res.cookies << WEBrick::Cookie.parse_set_cookie(c) }
-              else
-                webrick_res[key] = value
-              end
-            end
-
-            response_body = ""
-            body.each { |chunk| response_body += chunk }
-            webrick_res.body = response_body
-          end
-        end
-
-        define_method(:build_rack_env) do |req|
-          input = StringIO.new(req.body || "")
-          env = {
-            "REQUEST_METHOD" => req.request_method,
-            "PATH_INFO" => req.path,
-            "QUERY_STRING" => req.query_string || "",
-            "SERVER_NAME" => webrick_req_host,
-            "SERVER_PORT" => webrick_req_port,
-            "CONTENT_TYPE" => req.content_type || "",
-            "CONTENT_LENGTH" => (req.content_length rescue 0).to_s,
-            "REMOTE_ADDR" => req.peeraddr&.last || "127.0.0.1",
-            "rack.input" => input,
-            "rack.errors" => $stderr,
-            "rack.url_scheme" => "http",
-            "rack.version" => [1, 3],
-            "rack.multithread" => true,
-            "rack.multiprocess" => false,
-            "rack.run_once" => false
-          }
-
-          req.header.each do |key, values|
-            env_key = "HTTP_#{key.upcase.gsub('-', '_')}"
-            env[env_key] = values.join(", ")
-          end
-
-          env
-        end
-      end
-
-      # Bind the per-server host/port the Rack env reports (the ONLY thing that
-      # differs between the main port and the AI port).
-      servlet.define_method(:webrick_req_host) { host }
-      servlet.define_method(:webrick_req_port) { port }
-      servlet
-    end
   end
 end

data/lib/tina4/websocket.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "socket"
 require "digest"
-require "base64"
+require_relative "base64"
 require "json"
 require "set"
 require "securerandom"
@@ -22,7 +28,7 @@ module Tina4
 
   # Compute Sec-WebSocket-Accept from Sec-WebSocket-Key per RFC 6455.
   def self.compute_accept_key(key)
-    Base64.strict_encode64(Digest::SHA1.digest("#{key}#{WEBSOCKET_GUID}"))
+    Tina4::Base64.strict_encode64(Digest::SHA1.digest("#{key}#{WEBSOCKET_GUID}"))
   end
 
   # Return true if the request's Origin is permitted to upgrade to a WebSocket.
@@ -107,7 +113,10 @@ module Tina4
     return [nil, false] unless token
 
     payload = Tina4::Auth.valid_token(token)
-    [payload, !payload.nil?]
+    # A form token is not an identity (ADR-0079 s1).
+    return [nil, false] unless Tina4::Auth.identity_payload?(payload)
+
+    [payload, true]
   end
 
   # Whether the client offered the "bearer" subprotocol — in which case the
@@ -193,6 +202,17 @@ module Tina4
       @connections
     end
 
+    # Seconds a client may take to send its upgrade request (Python uses 10).
+    HANDSHAKE_TIMEOUT = 10
+    # Upper bound on the request head; a longer one is not a WebSocket upgrade.
+    MAX_REQUEST_HEAD = 16_384
+
+    # Run a standalone WebSocket server. port: 0 picks a free port (see #port).
+    #
+    # Each accepted socket gets its own thread that reads the HTTP request head,
+    # builds the Rack-style env handle_upgrade expects, and upgrades. This loop
+    # used to hand handle_upgrade an EMPTY env, so no Sec-WebSocket-Key was ever
+    # seen and no handshake could complete (the socket was left open, too).
     def start(host: "0.0.0.0", port: 7147)
       require "socket"
       @server_socket = TCPServer.new(host, port)
@@ -201,9 +221,8 @@ module Tina4
         while @running
           begin
             client = @server_socket.accept
-            env = {}
-            handle_upgrade(env, client)
-          rescue => e
+            Thread.new(client) { |socket| serve_standalone(socket) }
+          rescue StandardError
             break unless @running
           end
         end
@@ -211,6 +230,53 @@ module Tina4
       self
     end
 
+    # The port the standalone server is listening on (useful with port: 0).
+    def port
+      @server_socket&.local_address&.ip_port
+    end
+
+    # Read one upgrade request from +socket+ and hand it to handle_upgrade; a
+    # request that is not a WebSocket upgrade gets a 400 and is closed.
+    def serve_standalone(socket)
+      env = read_upgrade_request(socket)
+      unless env && env["HTTP_SEC_WEBSOCKET_KEY"] && upgrade?(env)
+        socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n") rescue nil
+        socket.close rescue nil
+        return
+      end
+      handle_upgrade(env, socket)
+    rescue StandardError => e
+      Tina4::Log.warning("WebSocket standalone upgrade failed: #{e.message}") if defined?(Tina4::Log)
+      socket.close rescue nil
+    end
+
+    # The request head as a Rack-style env (REQUEST_PATH, QUERY_STRING and
+    # HTTP_* headers), or nil when it does not arrive in time or is too long.
+    # Read a byte at a time so nothing after the head is consumed.
+    def read_upgrade_request(socket)
+      head = +""
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + HANDSHAKE_TIMEOUT
+      until head.end_with?("\r\n\r\n")
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return nil if remaining <= 0 || head.bytesize > MAX_REQUEST_HEAD || !socket.wait_readable(remaining)
+
+        head << socket.readpartial(1)
+      end
+      request_line, *header_lines = head.split("\r\n")
+      method, target, = request_line.to_s.split(" ")
+      path, _, query = target.to_s.partition("?")
+      env = { "REQUEST_METHOD" => method.to_s, "REQUEST_PATH" => path, "PATH_INFO" => path, "QUERY_STRING" => query }
+      header_lines.each do |line|
+        name, value = line.split(":", 2)
+        next if value.nil?
+
+        env["HTTP_#{name.strip.upcase.tr("-", "_")}"] = value.strip
+      end
+      env
+    rescue IOError, SystemCallError
+      nil
+    end
+
     def stop
       @running = false
       @server_socket&.close rescue nil
@@ -499,7 +565,7 @@ module Tina4
       }
       # JSON can't carry raw bytes — encode binary as base64, text as text.
       if binary_payload?(message)
-        envelope["b64"] = Base64.strict_encode64(message.b)
+        envelope["b64"] = Tina4::Base64.strict_encode64(message.b)
       else
         envelope["text"] = message
       end
@@ -514,7 +580,7 @@ module Tina4
     # carry bytes, so text → {"text": ...} and bytes → {"b64": base64(...)}.
     def decode_envelope_message(env)
       return env["text"] if env.key?("text")
-      return Base64.strict_decode64(env["b64"]).b if env.key?("b64")
+      return Tina4::Base64.strict_decode64(env["b64"]).b if env.key?("b64")
 
       nil
     end
@@ -733,13 +799,14 @@ module Tina4
 
     def send(message)
       data = message.is_a?(String) ? message : message.to_s
-      # Text frames must be valid UTF-8; binary payloads are sent verbatim.
-      data = data.encode("UTF-8") if data.encoding != Encoding::ASCII_8BIT
-      frame = build_frame(0x1, data)
-      @socket.write(frame)
-    rescue IOError
-      # Connection closed — mark dead so the broadcast path prunes it.
-      @closed = true
+      # A binary (ASCII-8BIT) payload goes out as a BINARY frame, verbatim. It
+      # used to go out as a TEXT frame, which is invalid UTF-8 on the wire and
+      # makes a browser fail the connection. Text frames must be valid UTF-8.
+      if data.encoding == Encoding::ASCII_8BIT
+        write_frame(build_frame(0x2, data))
+      else
+        write_frame(build_frame(0x1, data.encode("UTF-8")))
+      end
     end
 
     alias_method :send_text, :send
@@ -751,16 +818,48 @@ module Tina4
     end
 
     def send_pong(data)
-      frame = build_frame(0xA, data || "")
-      @socket.write(frame)
-    rescue IOError
-      @closed = true
+      write_frame(build_frame(0xA, data || ""))
     end
 
     def close(code: 1000, reason: "")
       payload = [code].pack("n") + reason
       frame = build_frame(0x8, payload)
-      @socket.write(frame) rescue nil
+      # Best effort and never blocking: a peer that stopped reading must not
+      # hold up the reaper or a shutdown. The close frame only goes out when no
+      # earlier frame is still queued, so it can never land mid-frame.
+      write_lock.synchronize do
+        @socket.write_nonblock(frame, exception: false) if pending.empty?
+      end
+    rescue IOError, SystemCallError
+      nil
+    ensure
+      @closed = true
+      @socket.close rescue nil
+    end
+
+    # Hand a frame to the socket WITHOUT blocking the caller. What the kernel
+    # cannot take yet waits in a per-connection queue that a flusher thread
+    # drains as the peer reads. A peer whose queue passes TINA4_WS_MAX_BACKLOG
+    # bytes (default 1 MiB, 0 = unbounded; the same setting as tina4-nodejs) is
+    # hopelessly behind or never reads, so it is closed. A blocking write here
+    # used to stall every broadcast forever on one client that stopped reading.
+    def write_frame(frame)
+      return if @closed
+
+      write_lock.synchronize do
+        pending << frame.b
+        flush_pending
+        limit = max_backlog
+        if limit.positive? && pending.bytesize > limit
+          backlog = pending.bytesize
+          drop_slow_client("backlog #{backlog} bytes exceeds TINA4_WS_MAX_BACKLOG (#{limit})")
+        elsif !pending.empty?
+          start_flusher
+        end
+      end
+    rescue IOError, SystemCallError
+      # Broken pipe / reset / closed socket: mark dead so the broadcast path prunes it.
+      @closed = true
       @socket.close rescue nil
     end
 
@@ -796,6 +895,57 @@ module Tina4
     def build_frame(opcode, data)
       Tina4.build_frame(opcode, data)
     end
+
+    private
+
+    def write_lock
+      @write_lock ||= Mutex.new
+    end
+
+    def pending
+      @pending ||= +"".b
+    end
+
+    def max_backlog
+      Integer(ENV["TINA4_WS_MAX_BACKLOG"] || "1048576")
+    rescue ArgumentError, TypeError
+      1_048_576
+    end
+
+    # Write as much of the queue as the kernel takes right now. Caller holds the lock.
+    def flush_pending
+      until pending.empty?
+        written = @socket.write_nonblock(pending, exception: false)
+        break if written == :wait_writable
+
+        @pending = pending.byteslice(written..)
+      end
+    end
+
+    # One background drainer per connection while bytes are queued.
+    def start_flusher
+      return if @flusher&.alive?
+
+      @flusher = Thread.new do
+        until @closed
+          done = write_lock.synchronize { pending.empty? }
+          break if done
+
+          @socket.wait_writable(1)
+          write_lock.synchronize { flush_pending }
+        end
+      rescue IOError, SystemCallError
+        @closed = true
+        @socket.close rescue nil
+      end
+    end
+
+    def drop_slow_client(reason)
+      Tina4::Log.warning("WebSocket client #{@id} dropped as too slow: #{reason}") if defined?(Tina4::Log)
+      @pending = +"".b
+      @closed = true
+      @socket.close rescue nil
+    end
   end
 
   # Shared, process-wide manager for the dev-reload channel (/__dev_reload).

data/lib/tina4/websocket_backplane.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # WebSocket Backplane Abstraction for Tina4 Ruby.
 #
@@ -17,6 +23,8 @@
 #     backplane.publish("chat", '{"user":"A","text":"hello"}')
 #   end
 
+require_relative "database_url"
+
 module Tina4
   # Base backplane interface for scaling WebSocket broadcast across instances.
   #
@@ -81,8 +89,17 @@ module Tina4
       end
 
       @url = url || ENV.fetch("TINA4_WS_BACKPLANE_URL", "redis://localhost:6379")
-      @redis = Redis.new(url: @url)
-      @subscriber = Redis.new(url: @url)
+      begin
+        @redis = Redis.new(url: @url)
+        @subscriber = Redis.new(url: @url)
+      rescue StandardError => e
+        # A URL the client cannot parse raises URI::InvalidURIError quoting the
+        # WHOLE raw URL, password included, and WebSocket#ensure_backplane logs
+        # e.message. Re-raise naming only the redacted form.
+        raise ArgumentError,
+              "Invalid TINA4_WS_BACKPLANE_URL for the Redis backplane: " \
+              "#{Tina4::DatabaseUrl.redact(@url)} (#{e.class})"
+      end
       @threads = {}
       @running = true
     end
@@ -98,6 +115,12 @@ module Tina4
             block.call(msg) if @running
           end
         end
+      rescue StandardError => e
+        # A refused login or a dropped connection ends this listener for good.
+        # Say so in the framework log: before, the thread died with only a raw
+        # stack trace on stderr while "backplane active" stood as the last word.
+        # The redis client's messages carry the URL without its userinfo.
+        Tina4::Log.error("WebSocket backplane subscriber stopped on '#{channel}': #{e.message}") if @running && defined?(Tina4::Log)
       end
     end
 

data/lib/tina4/wsdl.rb

@@ -1,6 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
-require "rexml/document"
+
+require_relative "xml_parser"
 
 module Tina4
   # SOAP 1.1 / WSDL server — zero-dependency, mirrors tina4-python's wsdl module.
@@ -20,7 +26,7 @@ module Tina4
   #
   # Supported:
   #   - WSDL 1.1 generation from Ruby type declarations
-  #   - SOAP 1.1 request/response handling via REXML
+  #   - SOAP 1.1 request/response handling via Tina4::WSDL::XmlParser (UTF-8 only, no DTDs)
   #   - Lifecycle hooks (on_request, on_result)
   #   - Auto type mapping (Integer -> int, String -> string, Float -> double, etc.)
   #   - XML escaping on all response values
@@ -273,17 +279,26 @@ module Tina4
     def process_soap(xml_body)
       on_request(@request)
 
-      # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message.
-      # Rejecting any DOCTYPE/DTD up front also closes the XML entity-expansion
-      # (billion-laughs) and external-entity (XXE) attack surface — REXML expands
-      # internal entities, so a DTD is a live DoS vector. Reject before parsing.
-      if xml_body =~ /<!DOCTYPE/i
+      # The shared body rule, before anything reads the bytes: UTF-8 only, no
+      # byte order mark, no NUL byte, no other declared encoding.
+      begin
+        xml_body = XmlParser.utf8_text(xml_body)
+      rescue XmlParser::ParseError
+        return soap_fault("Client", "Malformed XML")
+      end
+
+      # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message, so
+      # reject any DOCTYPE up front with the same Client fault as the other three
+      # frameworks. The parser has no DTD support at all (no entity expansion, no
+      # XXE) and accepts UTF-8 only, so a UTF-16 body that hides its DOCTYPE from
+      # this byte regex is refused by the parser as Malformed XML.
+      if doctype?(xml_body)
         return soap_fault("Client", "DOCTYPE declarations are not allowed in SOAP messages")
       end
 
       begin
-        doc = REXML::Document.new(xml_body)
-      rescue REXML::ParseException
+        doc = XmlParser.parse(xml_body)
+      rescue XmlParser::ParseError
         return soap_fault("Client", "Malformed XML")
       end
 
@@ -328,7 +343,13 @@ module Tina4
       soap_response(op_name, result)
     end
 
-    # ── XML helpers (REXML) ──────────────────────────────────────────────
+    # ── XML helpers ──────────────────────────────────────────────────────
+
+    # Byte-level match, so a body whose bytes are not valid UTF-8 cannot raise
+    # ArgumentError out of the regex before the parser gets to refuse it.
+    def doctype?(xml_body)
+      xml_body.to_s.b.match?(/<!DOCTYPE/in)
+    end
 
     def find_child(parent, local)
       parent.each_element do |el|
@@ -338,7 +359,7 @@ module Tina4
     end
 
     def local_name(element)
-      element.name  # REXML already strips the prefix for .name
+      element.name  # XmlParser::Element#name is the local name (prefix stripped)
     end
 
     # ── Type conversion ──────────────────────────────────────────────────
@@ -486,12 +507,27 @@ module Tina4
       end
 
       def handle_soap_request(xml_body)
-        # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing — this
-        # closes the REXML internal-entity expansion (billion-laughs) and XXE
-        # surface. Mirrors the class-based process_soap path.
-        return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages") if xml_body =~ /<!DOCTYPE/i
+        # Malformed XML is the CLIENT's fault, as in Python and WSDL#process_soap.
+        # Both refusals below used to fall into the operation catch-all at the end
+        # of this method and answer "Internal server error" (a soap:Server fault).
+        begin
+          xml_body = XmlParser.utf8_text(xml_body) # the shared body encoding rule
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
 
-        doc = REXML::Document.new(xml_body)
+        # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing; the parser
+        # itself has no DTD support and accepts UTF-8 only. Mirrors the
+        # class-based process_soap path.
+        if xml_body.b.match?(/<!DOCTYPE/in)
+          return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages")
+        end
+
+        begin
+          doc = XmlParser.parse(xml_body)
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
 
         # Find Body element (namespace-agnostic)
         body_el = _find_child(doc.root, "Body")
@@ -575,11 +611,11 @@ module Tina4
         xml
       end
 
-      def _soap_fault(message)
+      def _soap_fault(message, code: "soap:Server")
         '<?xml version="1.0" encoding="UTF-8"?>' \
         '<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">' \
         "<soap:Body><soap:Fault>" \
-        "<faultcode>soap:Server</faultcode>" \
+        "<faultcode>#{code}</faultcode>" \
         "<faultstring>#{_escape_xml(message)}</faultstring>" \
         "</soap:Fault></soap:Body></soap:Envelope>"
       end