librus-python-api 1.6.2__py3-none-any.whl → 1.6.4__py3-none-any.whl

librus_python_api/__init__.py

@@ -138,7 +138,7 @@ from librus_python_api.models import (
 from librus_python_api.sending import SendAttempt
 from librus_python_api.service import AccountClient, LibrusService
 
-__version__ = "1.6.2"
+__version__ = "1.6.4"
 
 __all__ = [
     "ArchiveAbsences",

librus_python_api/modern_body.py

@@ -11,11 +11,8 @@ from librus_python_api.exceptions import ErrorKind, LibrusError
 from librus_python_api.markup import text
 from librus_python_api.parsers import parse_html_document
 
-_XML_PREFIX = re.compile(
-    r"\s*(?:(?:<!--.*?-->|<\?(?!xml\b).*?\?>)\s*)*"
-    r"(?:<\?xml\b|<Message(?=[\s/>]))",
-    re.DOTALL,
-)
+_XML_START = re.compile(r"<\?xml\b|<Message(?=[\s/>])")
+_XML_DECLARATION = re.compile(r"<\?xml\b")
 
 
 def render_body(encoded: str) -> str:
@@ -34,7 +31,7 @@ def render_body(encoded: str) -> str:
     decoded = decoded.removeprefix("\ufeff")
     # XML comments/PIs and a UTF-8 BOM must not route a Message wrapper through
     # the permissive HTML renderer, losing CDATA or bypassing Content checks.
-    if _XML_PREFIX.match(decoded):
+    if _xml_prefixed(decoded):
         decoded = _xml_content(decoded)
     if not decoded:
         return ""
@@ -47,6 +44,36 @@ def render_body(encoded: str) -> str:
     )
 
 
+def _xml_prefixed(decoded: str) -> bool:
+    """Whether whitespace, comments and non-declaration PIs precede an XML start.
+
+    A comment or PI may end at any later terminator, as the lazy pattern this
+    replaces allowed, but one left-to-right pass decides it: once an item has
+    opened, every later terminator closes it. A regex backtracks exponentially
+    over a run of items with no XML start after it.
+    """
+    starts = bytearray(len(decoded) + 1)
+    starts[0] = 1
+    comment_from = pi_from = len(decoded) + 1
+    for index, char in enumerate(decoded):
+        if starts[index]:
+            if char.isspace():
+                starts[index + 1] = 1
+            elif _XML_START.match(decoded, index):
+                return True
+            elif decoded.startswith("<!--", index):
+                comment_from = min(comment_from, index + 4)
+            elif decoded.startswith("<?", index) and not _XML_DECLARATION.match(
+                decoded, index
+            ):
+                pi_from = min(pi_from, index + 2)
+        if index >= comment_from and decoded.startswith("-->", index):
+            starts[index + 3] = 1
+        if index >= pi_from and decoded.startswith("?>", index):
+            starts[index + 2] = 1
+    return False
+
+
 def _xml_content(decoded: str) -> str:
     parser = etree.XMLParser(
         no_network=True,

{librus_python_api-1.6.2.dist-info → librus_python_api-1.6.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: librus-python-api
-Version: 1.6.2
+Version: 1.6.4
 Summary: Independent bounded async Librus Synergia client
 Project-URL: Repository, https://github.com/krzysztofbury/librus-python-api
 Project-URL: Issues, https://github.com/krzysztofbury/librus-python-api/issues
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Typing :: Typed
 Requires-Python: >=3.13
-Requires-Dist: aiohttp<4,>=3.14.2
+Requires-Dist: aiohttp<4,>=3.14.4
 Requires-Dist: lxml<7,>=6.1
 Requires-Dist: pydantic<3,>=2.12
 Requires-Dist: pywin32<400,>=312; sys_platform == 'win32'
@@ -42,8 +42,9 @@ private ACLs. Windows installations include `pywin32` and `tzdata` automatically
 Network paths, reparse-point paths and unsafe storage permissions fail closed.
 See [platform requirements](contracts/persistence.md#windows-disk-boundary-25).
 
-**Status:** `1.6.2` accepts more completed-lesson and grade layouts, including
-behaviour points, which are validated and not reported as grades.
+**Status:** `1.6.4` renders message bodies in linear time, so a crafted body can
+no longer stall a client, and keeps the 1.6.2 completed-lesson and grade layouts,
+including behaviour points, which are validated and not reported as grades.
 Class free days, typed capability outcomes and the live-check freshness watchdog
 remain available. See [verification](VERIFICATION.md).
 The stable 1.x API does not guarantee every school layout. School features depend
@@ -55,7 +56,7 @@ See [limitations](#supported-features-and-limitations) below.
 Install the exact release from PyPI after its gated publication completes:
 
 ```sh
-python -m pip install librus-python-api==1.6.2
+python -m pip install librus-python-api==1.6.4
 ```
 
 Pin the exact version qualified by your application. Before publication, use a
@@ -71,7 +72,7 @@ python -m pip install .
 To install a locally built wheel instead:
 
 ```sh
-python -m pip install ./dist/librus_python_api-1.6.2-py3-none-any.whl
+python -m pip install ./dist/librus_python_api-1.6.4-py3-none-any.whl
 ```
 
 No CLI or background process is installed: import the library in your own program.
@@ -250,7 +251,7 @@ Completed lessons may be disabled by the school. Behaviour notes are not
 implemented. Some recipient, archive and receipt layouts remain
 unqualified; backend acceptance is not proof of delivery. Tests cover supported
 contracts, not every school or role. Detailed coverage is in the
-[verification log][verification] and [roadmap][roadmap].
+[verification log][verification]; open work is tracked in [issues][issues].
 
 ## Development and support
 
@@ -265,7 +266,6 @@ MIT licensed. See [LICENSE][license].
 [api]: https://github.com/krzysztofbury/librus-python-api/blob/main/API.md
 [upgrade]: https://github.com/krzysztofbury/librus-python-api/blob/main/contracts/account-context.md
 [verification]: https://github.com/krzysztofbury/librus-python-api/blob/main/VERIFICATION.md
-[roadmap]: https://github.com/krzysztofbury/librus-python-api/blob/main/TODO.md
 [contributing]: https://github.com/krzysztofbury/librus-python-api/blob/main/CONTRIBUTING.md
 [issues]: https://github.com/krzysztofbury/librus-python-api/issues
 [security]: https://github.com/krzysztofbury/librus-python-api/blob/main/SECURITY.md

{librus_python_api-1.6.2.dist-info → librus_python_api-1.6.4.dist-info}/RECORD

@@ -1,4 +1,4 @@
-librus_python_api/__init__.py,sha256=ZLWweFJqQFf-SdkQ7pHclXOKI0b-bfqNbNN1u14333w,6513
+librus_python_api/__init__.py,sha256=g55dpGqZUadHtjcfKr1_1nW8ESiC38xEDw2ZNqhr4fw,6513
 librus_python_api/_notification_bootstrap.py,sha256=18nzH0doXBNaZXCz-_ckIvRrlHTWV5Mm1t5m2-5eYGI,4669
 librus_python_api/_notification_codec.py,sha256=hU6G3zGJ5fR8wfPC6fV2OqBKs-7XpT9eRnKO3FGsTzY,13451
 librus_python_api/_storage.py,sha256=M_6ZAzN4zs7laOdKJBRH1I2rvy3pgqYgC_MZtsd2xtM,15893
@@ -26,7 +26,7 @@ librus_python_api/markup.py,sha256=vd483NSUQbVYvSV2IaUmsyGcRhpWtbyDHMeEhbc7siA,5
 librus_python_api/message_content.py,sha256=v_qoEAoaYS0_9MQBaj57i5XnC7pzv_HHWefgTt4CNyM,9043
 librus_python_api/messages.py,sha256=K9F8XVs1SojfFpdxxLV8gx9E0g81YxEHjigDzLHmDCg,10230
 librus_python_api/models.py,sha256=Z6eV-ftjaN8YGUW8SntVTLjGCqe1EWRpd0P1Va8EwDs,40991
-librus_python_api/modern_body.py,sha256=3L4P_cIrHdIxZqiinFSQrDMhG6iklT1GoA-VEWMJUiI,2682
+librus_python_api/modern_body.py,sha256=SocXJTyGm1Q_2owzh1PE1zcCB2kqZTz1KPJ2R4yMyoc,3895
 librus_python_api/modern_mailbox.py,sha256=2jF9UnJZ5AF6dip-GrMcv_z2kSLpp87dIpVeXk9jMzA,20600
 librus_python_api/modern_messages.py,sha256=qt2CXtrxCZQ-jTt0aQCD6ZaPAJQZXf0BxmvacPo9B0w,10653
 librus_python_api/notification_models.py,sha256=4eLTAE9JzHhveoaWtZQwGBolmb87QUP5kOSW7Jjt7J0,4199
@@ -45,7 +45,7 @@ librus_python_api/sending.py,sha256=Nvvk2r-6D6Us53a2fH5GW9PcA6bWEfuOvy6c3M5QVcE,
 librus_python_api/service.py,sha256=7ioLx-8C-I0Qla8YUyu5UqhjBPlcUvEFpQSYH-9yjzs,96232
 librus_python_api/timetable.py,sha256=tX1QK9fQABxzfLaHHqTe8e6rAgdOkCoTOfAHdPwNmLE,9836
 librus_python_api/transport.py,sha256=VslHio0FrOiTkISfLNDlGVV_MeGAYidHDKZnoVUIwrI,34310
-librus_python_api-1.6.2.dist-info/METADATA,sha256=l317hh6HLcjPf2_EHZN2pVOMuoJvBNqaU8RcBtdhaaU,12070
-librus_python_api-1.6.2.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-librus_python_api-1.6.2.dist-info/licenses/LICENSE,sha256=IuerLb3cnZCsaB23znydjjvKqP-LmSJd3syKa9NGUts,1071
-librus_python_api-1.6.2.dist-info/RECORD,,
+librus_python_api-1.6.4.dist-info/METADATA,sha256=1FRSc28E3rv-XOlguzKk2FTBstg_DnhKN2lqZw1CLZw,12103
+librus_python_api-1.6.4.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+librus_python_api-1.6.4.dist-info/licenses/LICENSE,sha256=IuerLb3cnZCsaB23znydjjvKqP-LmSJd3syKa9NGUts,1071
+librus_python_api-1.6.4.dist-info/RECORD,,