v0.1.2: Add XXE protection, disclaimer, and publish metadata

- Add defense-in-depth DOCTYPE/ENTITY rejection (case-insensitive)
  and 50MB input size limit to all parsers
- Add legal disclaimer to all output formats (Table/JSON/SARIF/HTML/CRA)
- Add homepage/documentation to Cargo.toml workspace metadata
- Bump version to 0.1.2
- Add 5 security validation tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kazu11max17

Cargo.lock

@@ -3,10 +3,12 @@ members = ["crates/shieldbom-core", "crates/shieldbom-cli", "crates/shieldbom-se
 resolver = "2"
 
 [workspace.package]
-version = "0.1.1"
+version = "0.1.2"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/kazu11max17/shieldbom"
+homepage = "https://github.com/kazu11max17/shieldbom"
+documentation = "https://docs.rs/shieldbom"
 description = "SBOM management CLI for embedded & IoT — SPDX/CycloneDX parsing, OSV.dev vulnerability scanning, EU CRA compliance"
 
 [workspace.dependencies]

Cargo.toml

@@ -7,7 +7,17 @@ use shieldbom::report::OutputFormat;
 
 /// ShieldBOM - SBOM vulnerability scanner for embedded/IoT software
 #[derive(Parser)]
-#[command(name = "shieldbom", version, about, long_about = None)]
+#[command(
+    name = "shieldbom",
+    version,
+    about,
+    long_about = None,
+    after_help = "\
+EXIT CODES:
+    0    No vulnerabilities or license issues found above threshold
+    1    Vulnerabilities or license issues found above threshold
+    2    Error (invalid input, parse failure, network error)"
+)]
 pub struct Cli {
     #[command(subcommand)]
     pub command: Commands,

crates/shieldbom-cli/src/cli.rs

@@ -160,6 +160,7 @@ pub struct AnalysisReport {
     pub license_issues: Vec<LicenseIssue>,
     pub stats: AnalysisStats,
     pub timestamp: DateTime<Utc>,
+    pub disclaimer: String,
 }
 
 impl AnalysisReport {
@@ -179,6 +180,7 @@ impl AnalysisReport {
             license_issues,
             stats,
             timestamp: Utc::now(),
+            disclaimer: crate::report::DISCLAIMER.to_string(),
         }
     }
 

crates/shieldbom-core/src/models.rs

@@ -56,7 +56,16 @@ struct CdxHash {
     content: Option<String>,
 }
 
+const MAX_SBOM_SIZE: usize = 50 * 1024 * 1024; // 50MB
+
 pub fn parse_json(content: &str) -> Result<ParsedSbom> {
+    if content.len() > MAX_SBOM_SIZE {
+        return Err(crate::errors::ShieldBomError::ParseError(
+            "SBOM file exceeds maximum size of 50MB".to_string(),
+        )
+        .into());
+    }
+
     let doc: CdxDocument = serde_json::from_str(content)
         .map_err(|e| crate::errors::ShieldBomError::ParseError(format!("CycloneDX JSON: {e}")))?;
 
@@ -78,7 +87,34 @@ pub fn parse_json(content: &str) -> Result<ParsedSbom> {
 }
 
 pub fn parse_xml(content: &str) -> Result<ParsedSbom> {
-    // For XML, we use a simplified approach: deserialize via quick-xml
+    // Security: quick-xml 0.36 does not support DTD processing or external entity
+    // expansion, making it inherently safe against XXE and Billion Laughs attacks.
+    // As defense-in-depth we also reject documents containing DOCTYPE declarations
+    // and enforce a maximum input size.
+
+    if content.len() > MAX_SBOM_SIZE {
+        return Err(crate::errors::ShieldBomError::ParseError(
+            "SBOM file exceeds maximum size of 50MB".to_string(),
+        )
+        .into());
+    }
+
+    // Defense-in-depth: reject any input that contains a DOCTYPE or ENTITY declaration.
+    // Even though quick-xml ignores DTDs, blocking them outright prevents future
+    // regressions or parser-swap surprises.
+    fn contains_ci(haystack: &[u8], needle: &[u8]) -> bool {
+        haystack
+            .windows(needle.len())
+            .any(|w| w.eq_ignore_ascii_case(needle))
+    }
+    if contains_ci(content.as_bytes(), b"<!DOCTYPE") || contains_ci(content.as_bytes(), b"<!ENTITY")
+    {
+        return Err(crate::errors::ShieldBomError::ParseError(
+            "XML DOCTYPE/ENTITY declarations are not allowed for security reasons".to_string(),
+        )
+        .into());
+    }
+
     let doc: CdxXmlDocument = quick_xml::de::from_str(content)
         .map_err(|e| crate::errors::ShieldBomError::ParseError(format!("CycloneDX XML: {e}")))?;
 
@@ -200,3 +236,51 @@ struct CdxXmlLicense {
     id: Option<String>,
     name: Option<String>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_xml_rejects_doctype() {
+        let xml = r#"<?xml version="1.0"?>
+<!DOCTYPE bom [<!ENTITY xxe "test">]>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4">
+  <components/>
+</bom>"#;
+        let err = parse_xml(xml).unwrap_err();
+        assert!(err.to_string().contains("DOCTYPE/ENTITY"));
+    }
+
+    #[test]
+    fn parse_xml_rejects_entity() {
+        let xml = r#"<?xml version="1.0"?>
+<!ENTITY xxe SYSTEM "file:///etc/passwd">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4">
+  <components/>
+</bom>"#;
+        let err = parse_xml(xml).unwrap_err();
+        assert!(err.to_string().contains("DOCTYPE/ENTITY"));
+    }
+
+    #[test]
+    fn parse_xml_rejects_doctype_mixed_case() {
+        let xml = "<!DocType foo><bom></bom>";
+        let err = parse_xml(xml).unwrap_err();
+        assert!(err.to_string().contains("DOCTYPE/ENTITY"));
+    }
+
+    #[test]
+    fn parse_xml_rejects_oversized_input() {
+        let big = "x".repeat(51 * 1024 * 1024);
+        let err = parse_xml(&big).unwrap_err();
+        assert!(err.to_string().contains("50MB"));
+    }
+
+    #[test]
+    fn parse_json_rejects_oversized_input() {
+        let big = "x".repeat(51 * 1024 * 1024);
+        let err = parse_json(&big).unwrap_err();
+        assert!(err.to_string().contains("50MB"));
+    }
+}

crates/shieldbom-core/src/parser/cyclonedx.rs

@@ -48,7 +48,16 @@ struct SpdxChecksum {
     checksum_value: Option<String>,
 }
 
+const MAX_SBOM_SIZE: usize = 50 * 1024 * 1024; // 50MB
+
 pub fn parse_json(content: &str) -> Result<ParsedSbom> {
+    if content.len() > MAX_SBOM_SIZE {
+        return Err(crate::errors::ShieldBomError::ParseError(
+            "SBOM file exceeds maximum size of 50MB".to_string(),
+        )
+        .into());
+    }
+
     let doc: SpdxDocument = serde_json::from_str(content)
         .map_err(|e| crate::errors::ShieldBomError::ParseError(format!("SPDX JSON: {e}")))?;
 
@@ -100,6 +109,13 @@ pub fn parse_json(content: &str) -> Result<ParsedSbom> {
 }
 
 pub fn parse_tag_value(content: &str) -> Result<ParsedSbom> {
+    if content.len() > MAX_SBOM_SIZE {
+        return Err(crate::errors::ShieldBomError::ParseError(
+            "SBOM file exceeds maximum size of 50MB".to_string(),
+        )
+        .into());
+    }
+
     let mut components = Vec::new();
     let mut current: Option<TagValueBuilder> = None;
 

crates/shieldbom-core/src/parser/spdx.rs

@@ -466,7 +466,7 @@ mod tests {
         let html = render_cra(&report).unwrap();
 
         assert!(html.contains("Generated by ShieldBOM"));
-        assert!(html.contains("does not constitute legal advice"));
+        assert!(html.contains("does not constitute a complete security assessment, legal advice"));
     }
 
     #[test]

crates/shieldbom-core/src/report/cra.rs

@@ -415,10 +415,7 @@ <h2><span class="section-num">6</span> Technical Documentation Reference</h2>
   <footer>
     Generated by ShieldBOM v{{ version }} &mdash; {{ timestamp }}
     <div class="disclaimer">
-      This report is generated automatically based on SBOM analysis and vulnerability scanning.
-      It is intended to support EU CRA compliance efforts but does not constitute legal advice.
-      Conformity assessment items marked N/A require manual verification by the manufacturer.
-      Consult qualified legal counsel for binding interpretations of CRA obligations.
+      DISCLAIMER: This report is provided "AS IS" without warranty of any kind. Vulnerability results are based on publicly available data sources (e.g., OSV.dev, NVD) which may be incomplete or delayed. The absence of reported vulnerabilities does not guarantee that the software is free of security issues. This tool assists with security analysis but does not constitute a complete security assessment, legal advice, or certification of regulatory compliance (including EU CRA conformity). Users are solely responsible for their own compliance determinations. Always perform additional security assessments as appropriate.
     </div>
   </footer>
 

crates/shieldbom-core/src/report/cra_template.html

@@ -7,6 +7,9 @@ use colored::Colorize;
 
 use crate::models::{AnalysisReport, Severity};
 
+/// Disclaimer text included in all output formats.
+pub const DISCLAIMER: &str = "DISCLAIMER: This report is provided \"AS IS\" without warranty of any kind. Vulnerability results are based on publicly available data sources (e.g., OSV.dev, NVD) which may be incomplete or delayed. The absence of reported vulnerabilities does not guarantee that the software is free of security issues. This tool assists with security analysis but does not constitute a complete security assessment, legal advice, or certification of regulatory compliance (including EU CRA conformity). Users are solely responsible for their own compliance determinations. Always perform additional security assessments as appropriate.";
+
 /// Truncate a string at a safe UTF-8 char boundary.
 fn truncate_str(s: &str, max_chars: usize) -> String {
     let mut chars = s.chars();
@@ -49,7 +52,18 @@ pub fn render(report: &AnalysisReport, format: OutputFormat) -> Result<()> {
             println!("{output}");
             Ok(())
         }
+    }?;
+
+    // Print disclaimer to stderr for all formats.
+    // For structured outputs (JSON, SARIF) this avoids corrupting stdout.
+    // For table output, render_table already prints it, so we skip.
+    // For HTML/CRA, the disclaimer is embedded in the template footer AND printed to stderr.
+    match format {
+        OutputFormat::Table => {} // already printed inside render_table
+        _ => eprintln!("\n{}", report.disclaimer),
     }
+
+    Ok(())
 }
 
 fn render_table(report: &AnalysisReport) -> Result<()> {
@@ -119,6 +133,8 @@ fn render_table(report: &AnalysisReport) -> Result<()> {
         println!("{}", "No issues found.".green().bold());
     }
 
+    eprintln!("\n{DISCLAIMER}");
+
     Ok(())
 }
 

crates/shieldbom-core/src/report/mod.rs

@@ -52,6 +52,15 @@ struct SarifRun {
     #[serde(skip_serializing_if = "Vec::is_empty")]
     artifacts: Vec<SarifArtifact>,
     results: Vec<SarifResult>,
+    /// Run-level properties (disclaimer, etc.)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    properties: Option<SarifRunPropertyBag>,
+}
+
+/// Property bag for run-level metadata.
+#[derive(Debug, Serialize, PartialEq)]
+struct SarifRunPropertyBag {
+    disclaimer: String,
 }
 
 #[derive(Debug, Serialize, PartialEq)]
@@ -274,6 +283,9 @@ impl SarifLog {
                 },
                 artifacts,
                 results,
+                properties: Some(SarifRunPropertyBag {
+                    disclaimer: report.disclaimer.clone(),
+                }),
             }],
         }
     }