datoon 1.7.2__tar.gz → 1.7.4__tar.gz

{datoon-1.7.2 → datoon-1.7.4}/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.7.4](https://github.com/andrii-su/datoon/compare/v1.7.3...v1.7.4) (2026-07-07)
+
+
+### Bug Fixes
+
+* **xml:** refuse DTD/DOCTYPE to block entity-expansion DoS ([#38](https://github.com/andrii-su/datoon/issues/38)) ([ef6a35e](https://github.com/andrii-su/datoon/commit/ef6a35e624176aab0a648794715c2d99411421d7))
+
+## [1.7.3](https://github.com/andrii-su/datoon/compare/v1.7.2...v1.7.3) (2026-07-07)
+
+
+### Bug Fixes
+
+* **converter:** reject non-finite JSON constants instead of passing them through ([#37](https://github.com/andrii-su/datoon/issues/37)) ([ed73b53](https://github.com/andrii-su/datoon/commit/ed73b53922ac9b72a906e565303043d27f7ae686))
+
 ## [1.7.2](https://github.com/andrii-su/datoon/compare/v1.7.1...v1.7.2) (2026-07-07)
 
 

{datoon-1.7.2 → datoon-1.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datoon
-Version: 1.7.2
+Version: 1.7.4
 Summary: Smart structured-data-to-TOON gateway with pragmatic auto-gating for LLM prompts.
 Author-email: Andrii Suruhov <andrii.suruhov@gmail.com>
 License: MIT License

{datoon-1.7.2 → datoon-1.7.4}/src/datoon/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.7.2'
-__version_tuple__ = version_tuple = (1, 7, 2)
+__version__ = version = '1.7.4'
+__version_tuple__ = version_tuple = (1, 7, 4)
 
-__commit_id__ = commit_id = 'ga011eb92d'
+__commit_id__ = commit_id = 'g9c1017702'

{datoon-1.7.2 → datoon-1.7.4}/src/datoon/converter.py

@@ -23,14 +23,23 @@ class DatoonError(RuntimeError):
     """Raised when datoon cannot process the payload safely."""
 
 
+def _reject_non_finite(constant: str) -> Any:
+    """Reject Infinity/-Infinity/NaN, which are invalid JSON and break serialization."""
+    raise DatoonError(
+        f"Input contains non-finite constant '{constant}', which is not valid JSON."
+    )
+
+
 def _normalize_json(raw_text: str) -> tuple[Any, str]:
     """Parse and re-serialize JSON into a deterministic compact representation."""
     try:
-        parsed = json.loads(raw_text)
+        parsed = json.loads(raw_text, parse_constant=_reject_non_finite)
     except json.JSONDecodeError as exc:
         raise DatoonError(f"Invalid JSON input: {exc.msg} (pos={exc.pos}).") from exc
 
-    normalized = json.dumps(parsed, ensure_ascii=False, separators=(",", ":"))
+    normalized = json.dumps(
+        parsed, ensure_ascii=False, separators=(",", ":"), allow_nan=False
+    )
     return parsed, normalized
 
 

{datoon-1.7.2 → datoon-1.7.4}/src/datoon/readers/xml.py

@@ -1,15 +1,30 @@
-"""XML reader using stdlib xml.etree.ElementTree."""
+"""XML reader using stdlib xml.etree.ElementTree.
+
+The stdlib parser rejects external entities but expands internal ones, so a DTD
+can smuggle a billion-laughs DoS. datoon may process untrusted payloads, so DTDs
+are refused outright. ``<!DOCTYPE`` is a fixed XML token (no internal
+whitespace), so a literal scan reliably catches every declaration expat would
+process.
+"""
 
 from __future__ import annotations
 
+import re
 import xml.etree.ElementTree as ET
 from typing import Any
 
 from datoon.readers._coerce import coerce_scalar as _coerce
 
+_DOCTYPE_RE = re.compile(r"<!DOCTYPE", re.IGNORECASE)
+
 
 def read_xml(text: str) -> list[dict[str, Any]]:
     """Parse XML into a list of row dicts from the dominant repeated child element."""
+    if _DOCTYPE_RE.search(text):
+        raise ValueError(
+            "XML with a DOCTYPE/DTD is not allowed (entity-expansion risk)."
+        )
+
     try:
         root = ET.fromstring(text)
     except ET.ParseError as exc:

{datoon-1.7.2 → datoon-1.7.4}/src/datoon.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datoon
-Version: 1.7.2
+Version: 1.7.4
 Summary: Smart structured-data-to-TOON gateway with pragmatic auto-gating for LLM prompts.
 Author-email: Andrii Suruhov <andrii.suruhov@gmail.com>
 License: MIT License

{datoon-1.7.2 → datoon-1.7.4}/src/datoon.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "1.7.2",
+  "tag": "1.7.4",
   "distance": 0,
-  "node": "ga011eb92d6c550e4d87db4ebdd3b5efe9cb4f533",
+  "node": "g9c10177027b097628e6bb075bb54501482175b78",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-07-07"

{datoon-1.7.2 → datoon-1.7.4}/tests/unit/test_converter_policy.py

@@ -28,6 +28,13 @@ def test_convert_json_for_llm_rejects_invalid_json() -> None:
         convert_json_for_llm("{bad json", ConversionConfig())
 
 
+@pytest.mark.parametrize("literal", ["Infinity", "-Infinity", "NaN"])
+def test_convert_json_for_llm_rejects_non_finite_constants(literal: str) -> None:
+    """Non-finite constants are invalid JSON per spec and must fail loudly."""
+    with pytest.raises(DatoonError, match="non-finite"):
+        convert_json_for_llm(f'{{"x": {literal}}}', ConversionConfig())
+
+
 def test_policy_skips_non_uniform_arrays(monkeypatch: pytest.MonkeyPatch) -> None:
     """Non-uniform arrays should skip conversion before CLI invocation."""
     called = {"value": False}

{datoon-1.7.2 → datoon-1.7.4}/tests/unit/test_readers.py

@@ -250,6 +250,26 @@ def test_read_xml_rejects_non_finite() -> None:
     assert rows[1]["v"] == "nan"
 
 
+def test_read_xml_rejects_dtd_billion_laughs() -> None:
+    # Internal entity expansion (billion laughs) is a DoS vector; DTDs are refused.
+    payload = (
+        '<!DOCTYPE lolz [<!ENTITY lol "lol">'
+        '<!ENTITY lol2 "&lol;&lol;&lol;">]>'
+        "<rows><r>&lol2;</r></rows>"
+    )
+    with pytest.raises(ValueError, match="DOCTYPE"):
+        read_xml(payload)
+
+
+def test_read_xml_rejects_external_entity_dtd() -> None:
+    payload = (
+        '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'
+        "<rows><r>&xxe;</r></rows>"
+    )
+    with pytest.raises(ValueError, match="DOCTYPE"):
+        read_xml(payload)
+
+
 def test_read_xml_invalid_raises() -> None:
     with pytest.raises(ValueError, match="Invalid XML"):
         read_xml("<not closed>")