whois-parser-next 0.4.9 → 0.4.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5663fd18a8e122c6ccc8085b25e18be3b61fab9ff9cbd9bda64cdefbf2e10f5
-  data.tar.gz: a34398419d706543bf070bfa3edda47c501b06cb9ac0452c8e18c0c11d414204
+  metadata.gz: 9e023caaec0b71465576d51e1aab35e0fa956f22fe435c9ebe91e7eae29e0d18
+  data.tar.gz: e90fe07318d7c90413f88ba7201eade76e7fc8ada882da016f1bcfb9574bc68e
 SHA512:
-  metadata.gz: 2ae5c942ba61ee7143b6eec11d41d33b16f0a13046b8c1c150be040fbcedc377fea3580caeab8a8bce22b063e7d09c8f6fa7436056dd1240e17250670478dfcc
-  data.tar.gz: '089dfc0682b7bee5730c452b7ffb7b4e9022b3b82cea695f0ac6532d789c052cf2eead16de4d8ca6f651f9909b2f4e9ac34f80f2f2f7bab9e4bd43d69d66c1d2'
+  metadata.gz: 2a55f20c2508a3a06d2a704e255532940ddf67b7ae3c9249b1a893b60c1f664c56ddd497aeac46cb1e14b4f6a9a8576db3411d318f768504027f0131916232c2
+  data.tar.gz: 3bd083076d0699b8520cd1cd232f09a8c755dcd33192198d7512974f44d73c50044201e34a919eb617c6132079710628c4fa3069e4306b4754292fbc8446f406

data/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 This project uses [Semantic Versioning 2.0.0](http://semver.org/).
 
+#### Release 0.4.10 (2026-11-02)
+
+- SAFETY: A response no longer keeps a scanner looping forever. A reply cut
+  off right after a disclaimer or notice header, with no final newline (for
+  example a Verisign body of just `TERMS OF USE:`, or the CIRA, `.ie`, ATI,
+  SX, PIR and configured Afilias disclaimers), made the tokenizer report
+  success without consuming input, so parsing never finished. The scanner now
+  raises `Whois::ParserError` when tokens stop consuming input, while still
+  allowing the short in-place state changes some scanners use to close a
+  section.
+- SAFETY: The `whois.iana.org` scanner matches repeated field keys literally.
+  A key taken from the response was used as a regular expression, so a key
+  such as `()|^` matched without consuming input and looped forever. Contact
+  handles in the `.fr`-family, `.br` and `.ua` parsers are also matched
+  literally instead of as patterns.
+- TESTED: `spec/whois/scanners/progress_spec.rb` covers each truncated
+  prefix and the regex-shaped IANA keys under a deadline.
+
 #### Release 0.4.9 (2026-10-25)
 
 - ADDED: Added `registrar`, `registrant_contacts` and `technical_contacts` to

data/lib/whois/parser/version.rb

@@ -1,6 +1,6 @@
 module Whois
   class Parser
     # The current library version.
-    VERSION = "0.4.9".freeze
+    VERSION = "0.4.10".freeze
   end
 end

data/lib/whois/parsers/base_nic_fr.rb

@@ -117,7 +117,7 @@ module Whois
         return unless content_for_scanner =~ /#{element}:\s+(.+)\n/
 
         id = ::Regexp.last_match(1)
-        content_for_scanner.scan(/nic-hdl:\s+#{id}\n((.+\n)+)\n/).any? ||
+        content_for_scanner.scan(/nic-hdl:\s+#{Regexp.escape(id)}\n((.+\n)+)\n/).any? ||
             Whois::Parser.bug!(ParserError, "Unable to parse contact block for nic-hdl: #{id}")
         values = build_hash(::Regexp.last_match(1).scan(/(.+?):\s+(.+?)\n/))
 

data/lib/whois/parsers/whois.registro.br.rb

@@ -96,7 +96,7 @@ module Whois
         return unless content_for_scanner =~ /#{element}:\s+(.+)\n/
 
         id = ::Regexp.last_match(1)
-        content_for_scanner.scan(/nic-hdl-br:\s+#{id}\n((.+\n)+)\n/).any? ||
+        content_for_scanner.scan(/nic-hdl-br:\s+#{Regexp.escape(id)}\n((.+\n)+)\n/).any? ||
             Whois.bug!(ParserError, "Unable to parse contact block for nic-hdl-br: #{id}")
         values = build_hash(::Regexp.last_match(1).scan(/(.+?):\s+(.+?)\n/))
 

data/lib/whois/parsers/whois.ua.rb

@@ -65,7 +65,7 @@ module Whois
           return if contact_ids.empty?
 
           contact_ids.map do |contact_id|
-            textblock = content.slice(/contact-id:\s+#{contact_id}\n((?:.+\n)+)\n/, 1)
+            textblock = content.slice(/contact-id:\s+#{Regexp.escape(contact_id)}\n((?:.+\n)+)\n/, 1)
 
             address = textblock.scan(/address:\s+(.+)\n/).flatten
             address = address.reject { |a| a == "n/a" }
@@ -137,7 +137,7 @@ module Whois
           return if contact_ids.empty?
 
           contact_ids.map do |contact_id|
-            textblock = content.slice(/nic-handle:\s+#{contact_id}\n((?:.+\n)+)\n/, 1)
+            textblock = content.slice(/nic-handle:\s+#{Regexp.escape(contact_id)}\n((?:.+\n)+)\n/, 1)
 
             address = textblock.scan(/address:\s+(.+)\n/).flatten
             zip = nil

data/lib/whois/scanners/base.rb

@@ -6,6 +6,9 @@ module Whois
       class_attribute :tokenizers
       self.tokenizers = []
 
+      # Consecutive tokens allowed to succeed without consuming input.
+      MAX_IDLE_TOKENS = 100
+
       def self.tokenizer(name, &block)
         define_method(name, &block)
       end
@@ -26,7 +29,21 @@ module Whois
         @ast = {}
 
         @input = StringScanner.new(content)
-        tokenize until @input.eos?
+        idle = 0
+        until @input.eos?
+          position = @input.pos
+          tokenize
+          if @input.pos == position
+            # Some tokenizers succeed once without consuming input to change
+            # state (e.g. close a section) for the next one. One that keeps
+            # succeeding in place loops forever, e.g. a disclaimer header matched
+            # by lookahead in a reply truncated before its final newline.
+            idle += 1
+            unexpected_token if idle > MAX_IDLE_TOKENS
+          else
+            idle = 0
+          end
+        end
 
         @ast
       end

data/lib/whois/scanners/iana.rb

@@ -79,7 +79,9 @@ module Whois
       end
 
       def parse_section_pair_newlinevalue(key)
-        if @input.scan(/^#{key}:\s*(.+)\n/)
+        # The key comes from the response: match it literally. As a pattern, a
+        # key such as "()|^" matches without consuming input and loops forever.
+        if @input.scan(/^#{Regexp.escape(key)}:\s*(.+)\n/)
           @input[1].strip
         end
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: whois-parser-next
 version: !ruby/object:Gem::Version
-  version: 0.4.9
+  version: 0.4.10
 platform: ruby
 authors:
 - Simone Carletti