camada 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67d03ce5257d9e94c2b52c35d9c612077918e82dbb1ccd81de6399300368773d
-  data.tar.gz: 867e0652bc76b81a367b679b16e52ffa8e8e1248307d0e435d74197224433980
+  metadata.gz: 86d9659607a031e6d4802b62fa614a63c5cf682c8b25ad753e08dad5d5890f04
+  data.tar.gz: 3837b8f2e624efdca08154e3dabe053c4e924af155688be40a2980c59d9370c6
 SHA512:
-  metadata.gz: 61724d07eb1e27c2709f5f56c5e13e82497a1c21896dc57dc434c09b26a40bdc74f7485151b6d4e692dc3c71fae3f6d1ec03ca003fd57877e2b7ca08dd4ff8da
-  data.tar.gz: 3236651e617c201a84d7c68d17c267f564f3ec2519fbe9b20359ff354efa2619bffc891eab86af36205aa2ac5e787ddd9382bd61a52bdd6d2a94521328825508
+  metadata.gz: 4b5eaee46ab80bf9d7b8af4fb2499461c4a2ad3a3ba604f691d77bef227eceb97d9698a1a37688bbc2e87949059f86569103cb43b83e96331012d22bae9bf0ee
+  data.tar.gz: 99709f2521ed91d8be8dd8714396e7184667814581c401031f33ba9d1b55ad5edda46a5d65139f5fdac44cc918974c768f544919e5ecb9f2fceeb6c6cfde8cf3

data/lib/camada/snapshot/parse.rb

@@ -191,10 +191,54 @@ module Camada
 
     # A regex test that never raises: a value in an encoding the pattern cannot read (a binary
     # PATH_INFO with high bytes, say) reads as "no match" rather than an exception on the request path.
-    def self.regex_hit?(rx, value)
-      rx.match?(value)
+    #
+    # `on_error` is what a value the engine cannot read answers. The legacy block-side path regexes
+    # keep false; a custom `matches` rule passes `deny` (regex-cap-sdk v1: an unevaluable value is a
+    # hit for block/challenge/warn and a miss for skip, the same as an over-cap one, camada-all-cwb4).
+    def self.regex_hit?(rx, value, on_error = false)
+      rx.match?(utf8_view(value))
     rescue StandardError
-      false
+      on_error
+    end
+
+    # A value tagged ASCII-8BIT (Rack) whose bytes are valid UTF-8 is read as UTF-8, so a non-ASCII
+    # pattern neither raises nor flips a deny/skip outcome. Genuinely invalid bytes stay as they are
+    # and take the on_error path.
+    def self.utf8_view(v)
+      return v if v.encoding == Encoding::UTF_8
+
+      s = v.dup.force_encoding(Encoding::UTF_8)
+      s.valid_encoding? ? s : v
+    end
+
+    # regex-cap-sdk v1 S1: the longest value a `matches` regex runs on, in UTF-16 code units.
+    MAX_MATCH_INPUT = 2048
+
+    # Length in UTF-16 code units (what edge's `v.length` counts: an astral code point is 2). A String
+    # that is not valid UTF-8 (Rack hands over ASCII-8BIT) counts its bytes.
+    def self.utf16_len(v)
+      s = v.dup.force_encoding(Encoding::UTF_8)
+      return v.bytesize unless s.valid_encoding?
+
+      s.length + s.each_char.count { |c| c.ord > 0xFFFF }
+    end
+
+    def self.over_cap?(v)
+      v.bytesize > MAX_MATCH_INPUT && utf16_len(v) > MAX_MATCH_INPUT
+    end
+
+    # regex-cap-sdk S2: delete [\x00-\x1f\x7f] from a ua/header value before a `matches` regex runs.
+    # Bytewise, so it stays safe on invalid UTF-8.
+    def self.strip_control(v)
+      v.b.delete("\x00-\x1f\x7f").force_encoding(v.encoding)
+    end
+
+    # regex-cap-sdk S3: a raw control character in the raw path form is spelled %xx, as canon_path does.
+    def self.encode_control(p)
+      b = p.b
+      return p unless b.match?(/[\x00-\x1f\x7f]/n)
+
+      b.gsub(/[\x00-\x1f\x7f]/n) { |c| format("%%%02x", c.ord) }.force_encoding(p.encoding)
     end
 
     # The same envelope for the plain string ops: Puma hands every env value to Rack as
@@ -275,7 +319,7 @@ module Camada
       p = strip_query(raw)
       return [p, p, p] if canonical?(p)
 
-      [p, canon_path(p, dots: false), canon_path(p)]
+      [encode_control(p), canon_path(p, dots: false), canon_path(p)]
     end
 
     def self.path_dir(p) = p.end_with?("/") ? p : "#{p}/"
@@ -308,12 +352,14 @@ module Camada
       deny ? (pred.call(forms[0]) || pred.call(forms[1]) || pred.call(forms[2])) : (pred.call(forms[1]) && pred.call(forms[2]))
     end
 
-    # One path condition -> a predicate over a single path form.
-    def self.path_pred(op, values)
+    # One path condition -> a predicate over a single path form. A `matches` form over MAX_MATCH_INPUT
+    # never runs the regex: it answers `deny` (a hit for block/challenge/warn, a miss for skip), and so
+    # does a form the regex engine cannot read.
+    def self.path_pred(op, values, deny = true)
       case op
       when "matches"
         rx = compile_regex(values[0], Regexp::IGNORECASE)
-        ->(p) { !rx.nil? && regex_hit?(rx, p) }
+        ->(p) { !rx.nil? && (over_cap?(p) ? deny : regex_hit?(rx, p, deny)) }
       when "starts_with"
         v = values[0]
         key = v.end_with?("/") ? dir_key(v) : canon_path(v)
@@ -345,7 +391,7 @@ module Camada
       op = c["op"].to_s
       if f == "path" # every path op reads the canonical forms (see "paths" above)
         raw = c["v"]
-        pred = path_pred(op, raw.is_a?(Array) ? raw.map(&:to_s) : [raw.to_s])
+        pred = path_pred(op, raw.is_a?(Array) ? raw.map(&:to_s) : [raw.to_s], deny)
         return ->(r) { path_hit?(r.paths, deny, &pred) }
       end
       negate = op == "is_not" || op == "not_in"
@@ -386,9 +432,20 @@ module Camada
       case op
       when "matches"
         rx = compile_regex(values[0])
+        strip = f == "ua" || f == "header"
         lambda do |r|
           v = read.call(r)
-          !v.nil? && !rx.nil? && regex_hit?(rx, v)
+          next false if v.nil? || rx.nil?
+
+          # The cap comes before regex_hit?, whose rescue would turn an encoding error into a miss.
+          hit = ->(s) { over_cap?(s) ? deny : regex_hit?(rx, s, deny) }
+          next hit.call(v) unless strip
+
+          stripped = strip_control(v) # one scan (S5)
+          next hit.call(v) if stripped.bytesize == v.bytesize
+
+          # S5: control chars never widen a skip and never neuter a deny regex
+          deny && (hit.call(v) || hit.call(stripped))
         end
       when "contains"
         needle = values[0]

data/lib/camada/version.rb

@@ -5,6 +5,6 @@ module Camada
   # source: camada.gemspec reads it at build, and the sibling drift guards (camada-backend,
   # camada-web, camada-mkt) parse this file with /^\s*VERSION = "([^"]+)"/m the way they parse
   # a package.json. Plain X.Y.Z only: the analyst's SDK_RE drops anything else.
-  VERSION = "0.1.4"
+  VERSION = "0.1.5"
   SDK_ID = "@camada/ruby/#{VERSION}".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: camada
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - camada
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies: []
 description: 'camada SDK for Ruby: inline enforcement of your snapshot (ordered custom
   rules, then allow, block, challenge), first-party beacon and proof-of-work challenge,