v0.12.0

Added

• saveTo() writes a package to an open stream, which need not be seekable, so
  a download no longer needs a temporary file and its first bytes leave
  immediately. Sending a package with a 64 MiB part through a pipe takes about
  21 ms against about 55 ms for writing a temporary file and copying it out, and
  its first byte arrives at once rather than after about 30 ms; composer benchmark-stream-save reports both. An entry whose size is unknown in advance
  carries a trailing descriptor when the destination cannot seek; a seekable
  destination still patches the local header, so saving to a file produces the
  same archive it did before. PackageInterface declares saveTo() alongside
  save() and saveAs(), so a caller typed against the interface reaches it.

Fixed

• A DTD in package XML or in an EncryptionInfo stream is refused whatever the
  document's encoding. The check scanned the raw bytes for <!DOCTYPE, which a
  UTF-16 document hides behind a high byte after every character, so such a
  package was accepted and its internal entities substituted into attribute and
  element values. Known XML byte encodings are checked before parsing, and the
  parsed document is still asked for its doctype as defence in depth. This avoids
  spending CPU and memory on internal entity substitution before rejection. Reading
  external entities and expanding entities beyond libxml's own amplification
  limit were already refused, so no file disclosure or expansion attack was
  reachable through the original encoding gap. Package XML and EncryptionInfo
  written in EBCDIC are refused outright: libxml decodes that encoding, but it
  is neither ASCII-compatible nor zero-padded, so no byte signature can see a
  DTD through it, and no OPC package uses it. Rejecting an 8.6 MiB document of
  three million entity references costs 0.1 ms and no measurable memory, against
  0.4 seconds and 300 MiB spent expanding it before the parsed document was
  asked for its doctype.