fix: harden Metalink parsing and add plugin CI

Merged
MP
4mo ago
+680-228

Summary

  • upgrade quick-xml to 0.41
  • enforce explicit Metalink size, depth, element, attribute and text limits
  • reject malformed CCF and DLC entries without URLs
  • add the pinned reproducible plugin CI and ABI smoke test
  • use upstream Extism 1.30.0 for host-side tests

Validation

  • 63 unit tests, 8 corpus tests and the WASM smoke pass
  • native and WASM Clippy pass with warnings denied
  • release WASM build and cargo audit pass

Linear: MAT-129, MAT-130

Summary by cubic

Hardens Metalink parsing with strict limits and safe text/entity handling (also caps text in ignored nodes), and closes CCF/DLC parsing gaps (reject empty URLs, preserve entity refs/whitespace, omit empty filenames). Adds reproducible plugin CI with pinned verify/release workflows and a WASM ABI smoke test. Addresses Linear: MAT-129, MAT-130.

  • Bug Fixes

    • Enforce Metalink limits with typed errors: input ≤1 MiB, depth ≤64, ≤50k elements, ≤64 attrs/element, text ≤64 KiB.
    • Cap accumulated text in unrecognized elements and across split Text/CDATA/entity refs; normalize attribute and hash type values; clearer XML errors.
    • CCF/DLC: accumulate field text across fragments, trim spaces, reject missing/empty URLs; omit empty DLC filenames; preserve entity refs/spacing.
    • Upgrade quick-xml to 0.41.

  • New Features

    • Pin CI/release to canonical workflows by SHA; restrict releases to repo owner; repin reusable workflows; add release WASM ABI smoke test.
    • Pin dev extism to =1.30.0; add rust-toolchain.toml for reproducible builds; bump crate/plugin to 1.0.1.
    • Document Metalink limits in README.

Summary by CodeRabbit

  • New Features

    • Added safer Metalink XML processing with limits on input size, nesting, elements, attributes, and text nodes.
    • Improved handling of encoded text, references, CDATA, and escaped hash types.
    • Added clearer errors for malformed XML, unsupported references, and exceeded parsing limits.

  • Bug Fixes

    • Empty or whitespace-only file URLs are now correctly rejected.
    • Improved parsing of CCF and DLC metadata fields.

  • Documentation

    • Documented Metalink parsing limits and error behavior.

  • Chores

    • Updated the release version to 1.0.1 and added automated plugin CI checks.