refactor: consolidate duplicate code across parsers

- Extract common namespace detection to parser/common.rs:
  - extract_ns_local_name() with security validation
  - is_dc_tag(), is_content_tag(), is_media_tag(), is_itunes_tag()
- Enable check_depth() function for all parsers
- Add set_alternate_link() method to FeedMeta and Entry
- Add truncate_to_length() utility to util/text.rs
- Remove duplicate implementations from rss.rs, rss10.rs, atom.rs, json.rs

Eliminates ~200 lines of duplicate code while maintaining security
validation for namespace tag names.

Author: bug-ops

crates/feedparser-rs-core/src/parser/atom.rs

@@ -13,8 +13,8 @@ use crate::{
 use quick_xml::{Reader, events::Event};
 
 use super::common::{
-    EVENT_BUFFER_CAPACITY, FromAttributes, LimitedCollectionExt, bytes_to_string, init_feed,
-    read_text, skip_element, skip_to_end,
+    EVENT_BUFFER_CAPACITY, FromAttributes, LimitedCollectionExt, bytes_to_string, check_depth,
+    init_feed, is_content_tag, is_dc_tag, is_media_tag, read_text, skip_element, skip_to_end,
 };
 
 /// Parse Atom 1.0 feed from raw bytes
@@ -107,12 +107,7 @@ fn parse_feed_element(
                 };
 
                 *depth += 1;
-                if *depth > limits.max_nesting_depth {
-                    return Err(FeedError::InvalidFormat(format!(
-                        "XML nesting depth {depth} exceeds maximum {}",
-                        limits.max_nesting_depth
-                    )));
-                }
+                check_depth(*depth, limits.max_nesting_depth)?;
 
                 let element = e.to_owned();
                 // Use name() instead of local_name() to preserve namespace prefixes
@@ -266,12 +261,7 @@ fn parse_entry(
                 };
 
                 *depth += 1;
-                if *depth > limits.max_nesting_depth {
-                    return Err(FeedError::InvalidFormat(format!(
-                        "XML nesting depth {depth} exceeds maximum {}",
-                        limits.max_nesting_depth
-                    )));
-                }
+                check_depth(*depth, limits.max_nesting_depth)?;
 
                 let element = e.to_owned();
                 // Use name() instead of local_name() to preserve namespace prefixes
@@ -468,12 +458,7 @@ fn parse_person(
         match reader.read_event_into(buf) {
             Ok(Event::Start(e)) => {
                 *depth += 1;
-                if *depth > limits.max_nesting_depth {
-                    return Err(FeedError::InvalidFormat(format!(
-                        "XML nesting depth {} exceeds maximum {}",
-                        depth, limits.max_nesting_depth
-                    )));
-                }
+                check_depth(*depth, limits.max_nesting_depth)?;
 
                 match e.local_name().as_ref() {
                     b"name" => name = Some(read_text(reader, buf, limits)?),
@@ -568,12 +553,7 @@ fn parse_atom_source(
         match reader.read_event_into(buf) {
             Ok(Event::Start(e) | Event::Empty(e)) => {
                 *depth += 1;
-                if *depth > limits.max_nesting_depth {
-                    return Err(FeedError::InvalidFormat(format!(
-                        "XML nesting depth {} exceeds maximum {}",
-                        depth, limits.max_nesting_depth
-                    )));
-                }
+                check_depth(*depth, limits.max_nesting_depth)?;
 
                 let element = e.to_owned();
                 // Use name() instead of local_name() to preserve namespace prefixes
@@ -605,36 +585,6 @@ fn parse_atom_source(
     Ok(Source { title, link, id })
 }
 
-/// Check if element name matches a Dublin Core namespace tag
-#[inline]
-fn is_dc_tag(name: &[u8]) -> Option<&str> {
-    if name.starts_with(b"dc:") {
-        std::str::from_utf8(&name[3..]).ok()
-    } else {
-        None
-    }
-}
-
-/// Check if element name matches a Content namespace tag
-#[inline]
-fn is_content_tag(name: &[u8]) -> Option<&str> {
-    if name.starts_with(b"content:") {
-        std::str::from_utf8(&name[8..]).ok()
-    } else {
-        None
-    }
-}
-
-/// Check if element name matches a Media RSS namespace tag
-#[inline]
-fn is_media_tag(name: &[u8]) -> Option<&str> {
-    if name.starts_with(b"media:") {
-        std::str::from_utf8(&name[6..]).ok()
-    } else {
-        None
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

crates/feedparser-rs-core/src/parser/common.rs

@@ -145,9 +145,7 @@ pub fn init_feed(version: FeedVersion, max_entries: usize) -> ParsedFeed {
 /// Check nesting depth and return error if exceeded
 ///
 /// This is a standalone helper for parsers that don't use `ParseContext`.
-/// Future use: Will be used when `ParseContext` is adopted project-wide
 #[inline]
-#[allow(dead_code)]
 pub fn check_depth(depth: usize, max_depth: usize) -> Result<()> {
     if depth > max_depth {
         return Err(FeedError::InvalidFormat(format!(
@@ -157,6 +155,95 @@ pub fn check_depth(depth: usize, max_depth: usize) -> Result<()> {
     Ok(())
 }
 
+/// Extract local name from namespaced element if prefix matches
+///
+/// Validates tag name contains only alphanumeric characters and hyphens
+/// to prevent injection attacks.
+///
+/// # Examples
+///
+/// ```ignore
+/// assert_eq!(extract_ns_local_name(b"dc:creator", b"dc:"), Some("creator"));
+/// assert_eq!(extract_ns_local_name(b"dc:creator", b"atom:"), None);
+/// assert_eq!(extract_ns_local_name(b"dc:<script>", b"dc:"), None); // Invalid chars
+/// ```
+#[inline]
+pub fn extract_ns_local_name<'a>(name: &'a [u8], prefix: &[u8]) -> Option<&'a str> {
+    if name.starts_with(prefix) {
+        let tag_name = std::str::from_utf8(&name[prefix.len()..]).ok()?;
+        // Security: validate tag name (alphanumeric + hyphen only)
+        if !tag_name.is_empty() && tag_name.chars().all(|c| c.is_alphanumeric() || c == '-') {
+            Some(tag_name)
+        } else {
+            None
+        }
+    } else {
+        None
+    }
+}
+
+/// Check if element is a Dublin Core namespaced tag
+///
+/// # Examples
+///
+/// ```ignore
+/// assert_eq!(is_dc_tag(b"dc:creator"), Some("creator"));
+/// assert_eq!(is_dc_tag(b"dc:subject"), Some("subject"));
+/// assert_eq!(is_dc_tag(b"content:encoded"), None);
+/// ```
+#[inline]
+pub fn is_dc_tag(name: &[u8]) -> Option<&str> {
+    extract_ns_local_name(name, b"dc:")
+}
+
+/// Check if element is a Content namespaced tag
+///
+/// # Examples
+///
+/// ```ignore
+/// assert_eq!(is_content_tag(b"content:encoded"), Some("encoded"));
+/// assert_eq!(is_content_tag(b"dc:creator"), None);
+/// ```
+#[inline]
+pub fn is_content_tag(name: &[u8]) -> Option<&str> {
+    extract_ns_local_name(name, b"content:")
+}
+
+/// Check if element is a Media RSS namespaced tag
+///
+/// # Examples
+///
+/// ```ignore
+/// assert_eq!(is_media_tag(b"media:thumbnail"), Some("thumbnail"));
+/// assert_eq!(is_media_tag(b"media:content"), Some("content"));
+/// assert_eq!(is_media_tag(b"dc:creator"), None);
+/// ```
+#[inline]
+pub fn is_media_tag(name: &[u8]) -> Option<&str> {
+    extract_ns_local_name(name, b"media:")
+}
+
+/// Check if element matches an iTunes namespace tag
+///
+/// Supports both prefixed (itunes:author) and unprefixed (author) forms
+/// for compatibility with non-compliant feeds.
+///
+/// # Examples
+///
+/// ```ignore
+/// assert!(is_itunes_tag(b"itunes:author", b"author"));
+/// assert!(is_itunes_tag(b"author", b"author")); // Fallback for non-prefixed
+/// assert!(!is_itunes_tag(b"itunes:title", b"author"));
+/// ```
+#[inline]
+pub fn is_itunes_tag(name: &[u8], tag: &[u8]) -> bool {
+    if name.starts_with(b"itunes:") && &name[7..] == tag {
+        return true;
+    }
+    // Fallback for feeds without prefix
+    name == tag
+}
+
 /// Read text content from current XML element (handles text and CDATA)
 pub fn read_text(
     reader: &mut Reader<&[u8]>,

crates/feedparser-rs-core/src/parser/json.rs

@@ -9,7 +9,7 @@ use crate::{
         Content, Enclosure, Entry, FeedMeta, FeedVersion, Image, LimitedCollectionExt, Link,
         ParseFrom, ParsedFeed, Person, Tag, TextConstruct,
     },
-    util::date::parse_date,
+    util::{date::parse_date, text::truncate_to_length},
 };
 use serde_json::Value;
 
@@ -76,7 +76,7 @@ pub fn parse_json_feed_with_limits(data: &[u8], limits: ParserLimits) -> Result<
 
 fn parse_feed_metadata(json: &Value, feed: &mut FeedMeta, limits: &ParserLimits) {
     if let Some(title) = json.get("title").and_then(|v| v.as_str()) {
-        let truncated = truncate_text(title, limits.max_text_length);
+        let truncated = truncate_to_length(title, limits.max_text_length);
         feed.set_title(TextConstruct::text(&truncated));
     }
 
@@ -94,7 +94,7 @@ fn parse_feed_metadata(json: &Value, feed: &mut FeedMeta, limits: &ParserLimits)
     }
 
     if let Some(description) = json.get("description").and_then(|v| v.as_str()) {
-        let truncated = truncate_text(description, limits.max_text_length);
+        let truncated = truncate_to_length(description, limits.max_text_length);
         feed.subtitle_detail = Some(TextConstruct::text(&truncated));
         feed.subtitle = Some(truncated);
     }
@@ -160,26 +160,26 @@ fn parse_item(json: &Value, limits: &ParserLimits) -> Entry {
     }
 
     if let Some(title) = json.get("title").and_then(|v| v.as_str()) {
-        let truncated = truncate_text(title, limits.max_text_length);
+        let truncated = truncate_to_length(title, limits.max_text_length);
         entry.set_title(TextConstruct::text(&truncated));
     }
 
     if let Some(content_html) = json.get("content_html").and_then(|v| v.as_str()) {
-        let text = truncate_text(content_html, limits.max_text_length);
+        let text = truncate_to_length(content_html, limits.max_text_length);
         let _ = entry
             .content
             .try_push_limited(Content::html(text), limits.max_entries);
     }
 
     if let Some(content_text) = json.get("content_text").and_then(|v| v.as_str()) {
-        let text = truncate_text(content_text, limits.max_text_length);
+        let text = truncate_to_length(content_text, limits.max_text_length);
         let _ = entry
             .content
             .try_push_limited(Content::plain(text), limits.max_entries);
     }
 
     if let Some(summary) = json.get("summary").and_then(|v| v.as_str()) {
-        let truncated = truncate_text(summary, limits.max_text_length);
+        let truncated = truncate_to_length(summary, limits.max_text_length);
         entry.set_summary(TextConstruct::text(&truncated));
     }
 
@@ -265,15 +265,6 @@ fn parse_authors(
     }
 }
 
-/// Truncate text to maximum length
-fn truncate_text(text: &str, max_length: usize) -> String {
-    if text.len() <= max_length {
-        text.to_string()
-    } else {
-        text.chars().take(max_length).collect()
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -496,9 +487,9 @@ mod tests {
     }
 
     #[test]
-    fn test_truncate_text() {
-        assert_eq!(truncate_text("hello", 10), "hello");
-        assert_eq!(truncate_text("hello world", 5), "hello");
-        assert_eq!(truncate_text("", 10), "");
+    fn test_truncate_to_length() {
+        assert_eq!(truncate_to_length("hello", 10), "hello");
+        assert_eq!(truncate_to_length("hello world", 5), "hello");
+        assert_eq!(truncate_to_length("", 10), "");
     }
 }