whois-parser-next 0.4.6 → 0.4.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66e7767b738ae0cf7df9736dc9a6a7685f9ddf7d344506a3a4233accf905f0d2
-  data.tar.gz: c15b010e832b1e52cebdb02fd473e8c75176a0f232c777ba385e39b17676b327
+  metadata.gz: dd5238487b0cc29b77e6d56f3594c009ea7712fe877fc31a41079dc1e49178be
+  data.tar.gz: 6f94667791431a36eb9b45ce8550143c89b91e9f08d88eafded9411722ae92fc
 SHA512:
-  metadata.gz: 587e231a29331459c3d14a9cd655ef2fa0230b819cbbcde397be5465500fd4a8eef4b5742407f402ed203d7104a9dc235553795427ec1b2daa1d08a34a24e82e
-  data.tar.gz: d4e01866484c46fcf88ef68889d677459ae34db5c0920dcabfc4bb2eaf390f16af8d5524436056a543154320742d51cc445dfb3553de4eb4386adc5c0ef511f1
+  metadata.gz: 454380ba261a261d3f13e91646c54fde3adf7141b5782580323c3511f45b13c1dde9fd5f3f29b03855a090d7d48585304d660788e5a2942f943706670ae104cf
+  data.tar.gz: 21b62020ab6c094190a908d3e3e926b38928589c1727266fb691743b06003662a8ee3c22a973c6904b38f37402f6596e68de25efcf2a2f2443f9079e709f2564

data/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 This project uses [Semantic Versioning 2.0.0](http://semver.org/).
 
+#### Release 0.4.8 (2026-10-24)
+
+- ADDED: Added `registrant_contacts` to the `whois.trabis.gov.tr` (`.tr`)
+  parser. The `** Registrant:` block yields the name, and the email when one is
+  published. Address, city, country, phone and fax are read only from the fully
+  published eight-line layout, because hidden fields ("Hidden upon user
+  request") shorten the block. Fully hidden blocks, no-match responses and
+  throttled responses yield no contact.
+- EVIDENCE: Bounded 2026-10-22 observations of `whois.trabis.gov.tr` returned a
+  fully published registrant block, a block with only the name visible
+  (`google.com.tr`), a fully hidden block, and the `No match found` response.
+  The fully published and fully hidden fixtures are redacted: the registrant
+  name, address and email, the domain name and the name servers are replaced
+  with placeholders while the line layout and whitespace are preserved.
+- FIXED: The `whois.aeda.net.ae` (`.ae`) parser no longer reports the
+  registry's rate-limit reply ("BLACKLISTED: You have exceeded the query limit
+  ...") as registered. `registered?` was the negation of `available?`, so any
+  reply other than an explicit absence marker counted as a registration. The
+  parser now includes `RegistryResponseSafety` and treats the `BLACKLISTED:`
+  reply as throttled, so status, availability and registration raise
+  `Whois::ResponseIsThrottled`. Empty and access-denied replies now raise
+  `Whois::ResponseIsUnavailable` instead of counting as registered.
+- EVIDENCE: On 2026-10-22, after a bounded series of lookups, `whois.aeda.net.ae`
+  answered every query from the client network, including `google.ae` and
+  generated unregistered names, with the single `BLACKLISTED:` line in the new
+  `response_blacklisted.txt` fixture (unmodified). Earlier the same day,
+  registered names and generated unregistered names returned the regular
+  registered and `No Data Found` responses.
+
+#### Release 0.4.7 (2026-10-19)
+
+- ADDED: Added strict parsing for the official `.gt` and `.com.gt` web WHOIS
+  response. Registration requires one result heading with a single valid domain
+  and `ACTIVO`; absence requires one `alert alert-danger` result with the same
+  domain and the registry's exact `no está registrado` marker. Duplicate,
+  contradictory, malformed, mismatched, incomplete, denied, throttled, or
+  challenge responses remain non-positive. The parser ignores scripts, styles,
+  comments, and unrelated page content; contacts and dates are not parsed.
+- EVIDENCE: The official UVG registry lookup is
+  [`whois.php?dn=...`](https://www.gt/sitio/whois.php?dn={domain}). Bounded
+  2026-10-19 observations returned registered results for `google.gt` and
+  `google.com.gt`, and exact absence results for generated eight-letter names
+  under both suffixes. The registry's
+  [policy](https://www.gt/sitio/registration_policy.php?lang=en) limits lookup
+  to individual names rather than lists of registered names. Regression
+  examples use only minimal synthetic HTML. This is a web WHOIS source; no
+  TCP/43 or RDAP service is claimed. See the
+  [dated evidence report](docs/audits/guatemala-web-whois-2026-10-19.md).
+
 #### Release 0.4.6 (2026-10-19)
 
 - ADDED: Added `.ga` parsing for ANINF's current French WHOIS response, requiring

data/lib/whois/parser/version.rb

@@ -1,6 +1,6 @@
 module Whois
   class Parser
     # The current library version.
-    VERSION = "0.4.6".freeze
+    VERSION = "0.4.8".freeze
   end
 end

data/lib/whois/parsers/whois.aeda.net.ae.rb

@@ -8,6 +8,7 @@
 
 
 require_relative 'base'
+require_relative 'registry_response_safety'
 
 
 module Whois
@@ -23,6 +24,14 @@ module Whois
     #   The Example parser for the list of all available methods.
     #
     class WhoisAedaNetAe < Base
+      include RegistryResponseSafety
+
+      # The registry answers rate-limited clients with a single "BLACKLISTED:"
+      # line. That reply carries no domain data, so it must not be read as
+      # either registered or available.
+      def response_throttled?
+        super || content_for_scanner.match?(/^BLACKLISTED:/i)
+      end
 
       property_supported :status do
         if content_for_scanner =~ /Status:\s+(.+?)\n/

data/lib/whois/parsers/whois.trabis.gov.tr.rb

@@ -7,6 +7,9 @@ module Whois
     class WhoisTrabisGovTr < Base
       include RegistryResponseSafety
 
+      HIDDEN = "Hidden upon user request".freeze
+      EMAIL  = /[\w.+-]+@[\w-]+(?:\.[\w-]+)+/
+
       property_supported :domain do
         content_for_scanner.slice(/^\*\* Domain Name:\s+(.+)\n/, 1)
       end
@@ -43,7 +46,35 @@ module Whois
 
       property_not_supported :updated_on
       property_not_supported :registrar
-      property_not_supported :registrant_contacts
+
+      # The "** Registrant:" block runs until the first blank line. A fully
+      # published block has eight lines: name, two address lines, "city,",
+      # country, email, phone and fax. Each hidden field reads "Hidden upon user
+      # request" and hidden blocks are shorter (a visible name plus four hidden
+      # lines), so positional fields are read only from the eight-line layout.
+      # The name is always the first line and the email is matched anywhere in
+      # the block. A block with no visible field yields no contact.
+      property_supported :registrant_contacts do
+        block = content_for_scanner.slice(/^\*\* Registrant:\n((?:.+\n)+)/, 1)
+        return [] unless block
+
+        lines = block.lines.map(&:strip)
+        value = ->(i) { (v = lines[i].to_s).empty? || v == "+" || v == HIDDEN ? nil : v }
+        email = lines.find { |l| l.match?(EMAIL) }&.slice(EMAIL)
+        name  = value.call(0)
+        full  = lines.size == 8
+
+        address = full ? [value.call(1), value.call(2)].compact.join("\n").presence : nil
+        city    = full ? value.call(3)&.chomp(",")&.strip : nil
+        country = full ? value.call(4) : nil
+        phone   = full ? value.call(6) : nil
+        fax     = full ? value.call(7) : nil
+        return [] if [name, email, address, city, country, phone, fax].all?(&:nil?)
+
+        [Parser::Contact.new(type: Parser::Contact::TYPE_REGISTRANT, name: name, address: address,
+                             city: city, country: country, email: email, phone: phone, fax: fax)]
+      end
+
       property_not_supported :admin_contacts
       property_not_supported :technical_contacts
 

data/lib/whois/parsers/www.gt.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require 'cgi'
+require 'strscan'
+require_relative 'base'
+require_relative 'registry_response_safety'
+
+module Whois
+  class Parsers
+    # The registry's per-domain public web WHOIS, observed 2026-10-19.
+    # Inspect only its result heading/alert, never navigation or script text.
+    class WwwGt < Base
+      include RegistryResponseSafety
+
+      property_supported(:status) { web_result[:status] }
+      property_supported(:domain) { web_result[:domain] }
+      property_supported(:registered?) { status == :registered }
+      property_supported(:available?) { status == :available }
+
+      def response_unavailable?
+        super || content_for_scanner.match?(/<cap-widget\b|\bclass=["']g-recaptcha["']|cf-chl-/i)
+      end
+
+      private
+
+      def web_result
+        @web_result ||= classify_web_result
+      end
+
+      def classify_web_result
+        blocks = result_blocks
+        return { status: :unknown } unless blocks
+
+        candidates = blocks.filter_map do |kind, text|
+          text = CGI.unescapeHTML(text.gsub('&aacute;', 'á').gsub('&Aacute;', 'Á')).gsub(/[ \t\r\n]+/, ' ').strip
+          if kind == 'h3' && (match = /\A(\S+)\. ACTIVO\z/i.match(text))
+            [match[1].downcase, :registered]
+          elsif kind == 'div' && (match = /\A(\S+)\. no está registrado \.\z/i.match(text))
+            [match[1].downcase, :available]
+          end
+        end
+        return { status: :unknown } unless candidates.size == 1
+
+        name, state = candidates.first
+        return { status: :unknown } unless name.bytesize <= 253 &&
+          name.match?(/\A(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+gt\z/)
+
+        { domain: name, status: state }
+      end
+
+      # One forward scan, including malformed tags. Limit each tag before
+      # inspecting attributes and skip scripts, styles and comments entirely.
+      def result_blocks
+        input = StringScanner.new(content_for_scanner)
+        blocks = []
+        active = nil
+        depth = 0
+        text = +''
+        until input.eos?
+          chunk = input.scan_until(/</)
+          unless chunk
+            text << input.rest if active
+            input.terminate
+            break
+          end
+          text << chunk[0...-1] if active
+          if input.peek(3) == '!--'
+            return nil unless input.scan_until(/-->/)
+            next
+          end
+          tag = input.scan_until(/>/)
+          return nil unless tag && tag.bytesize <= 16_384
+          match = /\A[ \t]*(\/?)[ \t]*([a-z0-9]+)/i.match(tag)
+          next unless match
+          closing = match[1] == '/'
+          name = match[2].downcase
+          if !closing && %w[script style].include?(name)
+            return nil if active
+            return nil unless input.scan_until(%r{</#{name}[ \t\r\n]*>}i)
+            next
+          end
+          if active
+            depth += 1 if !closing && name == active
+            depth -= 1 if closing && name == active
+            if depth.zero?
+              blocks << [active, text]
+              active = nil
+              text = +''
+            else
+              text << ' '
+            end
+          elsif !closing && (name == 'h3' || (name == 'div' && alert_classes?(tag)))
+            active = name
+            depth = 1
+          end
+        end
+        active ? nil : blocks
+      end
+
+      def alert_classes?(tag)
+        value = tag[/\bclass[ \t]*=[ \t]*["']([^"']*)["']/i, 1]
+        classes = value.to_s.split
+        classes.include?('alert') && classes.include?('alert-danger')
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: whois-parser-next
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.4.8
 platform: ruby
 authors:
 - Simone Carletti
@@ -753,6 +753,7 @@ files:
 - lib/whois/parsers/whois.za.org.rb
 - lib/whois/parsers/whois.zicta.zm.rb
 - lib/whois/parsers/whois1.nic.bi.rb
+- lib/whois/parsers/www.gt.rb
 - lib/whois/parsers/za_central_registry.rb
 - lib/whois/safe_record.rb
 - lib/whois/scanners/base.rb