cloud_events 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b24efea575e52e5e9290bfba5b64f06cc52145ddc8572153b418c2d29bf8bf2
-  data.tar.gz: dd6f1d1788846857a698c9b5152eaa7294f5d76d653b2e189762ee7ca108a89f
+  metadata.gz: e92a0db6d57da2784f958e81f3416ade3c4c6c1e5e7830571be444c84a1001a0
+  data.tar.gz: e48bad4cf6cf8797c6f5a16817f6951a1c3b2138778fa2e6779b58fd49f28f21
 SHA512:
-  metadata.gz: 66a25968b6662e7603a2bd83b97f0b8390f05baddb36f1a4d26f68351c3ccb35596e12f8b889095186226c09b0d338c059a4d3c6f9035afe1325a8369cc714e1
-  data.tar.gz: ce94d00dde6b272e9c6d7e26a90e923c98cccbb184acf0b4ccc2de3081c20c0ba311080a4529cb2184908ea2aec1318f88c7fc161e1b04f24189a3e6061d7155
+  metadata.gz: 4429473d95e6150514f796a907f74a96741ab9378e2c833ed6945fbe4f5d85fe654d0bb6502960900c349721b167f90fc62994a2525a3fd372bc7ea9468c66f6
+  data.tar.gz: 91f22bf6c0b20357326166d896e0036dd90ae32f66b7c233a63cb3e060abac51827b2a9d560f6324830db2b5240e436d0f942c99a41bf8a1c711a48fe6af8d80

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+### v0.8.0 / 2025-11-04
+
+* BREAKING CHANGE: Raise AttributeError if an illegal attribute name is used
+* ADDED: Require Ruby 2.7 or later
+* FIXED: Improved hashing algorithm for opaque event objects
+* FIXED: Removed dependency on base64 gem
+* FIXED: Raise AttributeError if an illegal attribute name is used
+* DOCS: Add link to the security mailing list
+
 ### v0.7.1 / 2023-10-04
 
 * DOCS: Governance docs per CE PR 1226

data/README.md

@@ -218,6 +218,10 @@ for how PR reviews and approval, and our
 [Code of Conduct](https://github.com/cloudevents/spec/blob/master/community/GOVERNANCE.md#additional-information)
 information.
 
+If there is a security concern with one of the CloudEvents specifications, or
+with one of the project's SDKs, please send an email to
+[cncf-cloudevents-security@lists.cncf.io](mailto:cncf-cloudevents-security@lists.cncf.io).
+
 ## Additional SDK Resources
 
 - [List of current active maintainers](MAINTAINERS.md)

data/lib/cloud_events/content_type.rb

@@ -24,7 +24,7 @@ module CloudEvents
     # @param default_charset [String] Optional. The charset to use if none is
     #     specified. Defaults to `us-ascii`.
     #
-    def initialize string, default_charset: nil
+    def initialize(string, default_charset: nil)
       @string = string.to_s
       @media_type = "text"
       @subtype_base = @subtype = "plain"
@@ -32,9 +32,9 @@ module CloudEvents
       @params = []
       @charset = default_charset || "us-ascii"
       @error_message = nil
-      parse consume_comments @string.strip
+      parse(consume_comments(@string.strip))
       @canonical_string = "#{@media_type}/#{@subtype}" +
-                          @params.map { |k, v| "; #{k}=#{maybe_quote v}" }.join
+                          @params.map { |k, v| "; #{k}=#{maybe_quote(v)}" }.join
       full_freeze
     end
 
@@ -102,13 +102,13 @@ module CloudEvents
     # @param key [String]
     # @return [Array<String>]
     #
-    def param_values key
+    def param_values(key)
       key = key.downcase
       @params.inject([]) { |a, (k, v)| key == k ? a << v : a }
     end
 
     ## @private
-    def == other
+    def ==(other)
       other.is_a?(ContentType) && canonical_string == other.canonical_string
     end
     alias eql? ==
@@ -124,16 +124,16 @@ module CloudEvents
 
     private
 
-    def parse str
-      @media_type, str = consume_token str, downcase: true, error_message: "Failed to parse media type"
-      str = consume_special str, "/"
-      @subtype, str = consume_token str, downcase: true, error_message: "Failed to parse subtype"
-      @subtype_base, @subtype_format = @subtype.split "+", 2
+    def parse(str)
+      @media_type, str = consume_token(str, downcase: true, error_message: "Failed to parse media type")
+      str = consume_special(str, "/")
+      @subtype, str = consume_token(str, downcase: true, error_message: "Failed to parse subtype")
+      @subtype_base, @subtype_format = @subtype.split("+", 2)
       until str.empty?
-        str = consume_special str, ";"
-        name, str = consume_token str, downcase: true, error_message: "Faled to parse attribute name"
-        str = consume_special str, "=", error_message: "Failed to find value for attribute #{name}"
-        val, str = consume_token_or_quoted str, error_message: "Failed to parse value for attribute #{name}"
+        str = consume_special(str, ";")
+        name, str = consume_token(str, downcase: true, error_message: "Faled to parse attribute name")
+        str = consume_special(str, "=", error_message: "Failed to find value for attribute #{name}")
+        val, str = consume_token_or_quoted(str, error_message: "Failed to parse value for attribute #{name}")
         @params << [name, val]
         @charset = val if name == "charset"
       end
@@ -141,34 +141,34 @@ module CloudEvents
       @error_message = e.message
     end
 
-    def consume_token str, downcase: false, error_message: nil
-      match = /^([\w!#$%&'*+.\^`{|}-]+)(.*)$/.match str
-      raise ParseError, error_message || "Expected token" unless match
+    def consume_token(str, downcase: false, error_message: nil)
+      match = /^([\w!#$%&'*+.\^`{|}-]+)(.*)$/.match(str)
+      raise(ParseError, error_message || "Expected token") unless match
       token = match[1]
       token.downcase! if downcase
-      str = consume_comments match[2].strip
+      str = consume_comments(match[2].strip)
       [token, str]
     end
 
-    def consume_special str, expected, error_message: nil
-      raise ParseError, error_message || "Expected #{expected.inspect}" unless str.start_with? expected
-      consume_comments str[1..-1].strip
+    def consume_special(str, expected, error_message: nil)
+      raise(ParseError, error_message || "Expected #{expected.inspect}") unless str.start_with?(expected)
+      consume_comments(str[1..].strip)
     end
 
-    def consume_token_or_quoted str, error_message: nil
-      return consume_token str unless str.start_with? '"'
+    def consume_token_or_quoted(str, error_message: nil)
+      return consume_token(str) unless str.start_with?('"')
       arr = []
       index = 1
       loop do
         char = str[index]
         case char
         when nil
-          raise ParseError, error_message || "Quoted-string never finished"
+          raise(ParseError, error_message || "Quoted-string never finished")
         when "\""
           break
         when "\\"
           char = str[index + 1]
-          raise ParseError, error_message || "Quoted-string never finished" unless char
+          raise(ParseError, error_message || "Quoted-string never finished") unless char
           arr << char
           index += 2
         else
@@ -177,34 +177,34 @@ module CloudEvents
         end
       end
       index += 1
-      str = consume_comments str[index..-1].strip
+      str = consume_comments(str[index..].strip)
       [arr.join, str]
     end
 
-    def consume_comments str
-      return str unless str.start_with? "("
+    def consume_comments(str)
+      return str unless str.start_with?("(")
       index = 1
       loop do
         char = str[index]
         case char
         when nil
-          raise ParseError, "Comment never finished"
+          raise(ParseError, "Comment never finished")
         when ")"
           break
         when "\\"
           index += 2
         when "("
-          str = consume_comments str[index..-1]
+          str = consume_comments(str[index..])
           index = 0
         else
           index += 1
         end
       end
       index += 1
-      consume_comments str[index..-1].strip
+      consume_comments(str[index..].strip)
     end
 
-    def maybe_quote str
+    def maybe_quote(str)
       return str if /^[\w!#$%&'*+.\^`{|}-]+$/ =~ str
       str = str.gsub("\\", "\\\\\\\\").gsub("\"", "\\\\\"")
       "\"#{str}\""

data/lib/cloud_events/event/field_interpreter.rb

@@ -9,60 +9,61 @@ module CloudEvents
     # @private
     #
     class FieldInterpreter
-      def initialize args
-        @args = Utils.keys_to_strings args
+      def initialize(args)
+        @args = Utils.keys_to_strings(args)
         @attributes = {}
       end
 
-      def finish_attributes
+      def finish_attributes(requires_lc_start: false)
         @args.each do |key, value|
+          check_attribute_name(key, requires_lc_start)
           @attributes[key.freeze] = value.to_s.freeze unless value.nil?
         end
         @args = {}
         @attributes.freeze
       end
 
-      def string keys, required: false, allow_empty: false
-        object keys, required: required do |value|
+      def string(keys, required: false, allow_empty: false)
+        object(keys, required: required) do |value|
           case value
           when ::String
-            raise AttributeError, "The #{keys.first} field cannot be empty" if value.empty? && !allow_empty
+            raise(AttributeError, "The #{keys.first} field cannot be empty") if value.empty? && !allow_empty
             value.freeze
             [value, value]
           else
-            raise AttributeError, "Illegal type for #{keys.first}:" \
-                                  " String expected but #{value.class} found"
+            raise(AttributeError, "Illegal type for #{keys.first}: " \
+                                  "String expected but #{value.class} found")
           end
         end
       end
 
-      def uri keys, required: false
-        object keys, required: required do |value|
+      def uri(keys, required: false)
+        object(keys, required: required) do |value|
           case value
           when ::String
-            raise AttributeError, "The #{keys.first} field cannot be empty" if value.empty?
+            raise(AttributeError, "The #{keys.first} field cannot be empty") if value.empty?
             begin
               [Utils.deep_freeze(::URI.parse(value)), value.freeze]
             rescue ::URI::InvalidURIError => e
-              raise AttributeError, "Illegal format for #{keys.first}: #{e.message}"
+              raise(AttributeError, "Illegal format for #{keys.first}: #{e.message}")
             end
           when ::URI::Generic
             [Utils.deep_freeze(value), value.to_s.freeze]
           else
-            raise AttributeError, "Illegal type for #{keys.first}:" \
-                                  " String or URI expected but #{value.class} found"
+            raise(AttributeError, "Illegal type for #{keys.first}: " \
+                                  "String or URI expected but #{value.class} found")
           end
         end
       end
 
-      def rfc3339_date_time keys, required: false
-        object keys, required: required do |value|
+      def rfc3339_date_time(keys, required: false)
+        object(keys, required: required) do |value|
           case value
           when ::String
             begin
               [Utils.deep_freeze(::DateTime.rfc3339(value)), value.freeze]
             rescue ::Date::Error => e
-              raise AttributeError, "Illegal format for #{keys.first}: #{e.message}"
+              raise(AttributeError, "Illegal format for #{keys.first}: #{e.message}")
             end
           when ::DateTime
             [Utils.deep_freeze(value), value.rfc3339.freeze]
@@ -70,44 +71,44 @@ module CloudEvents
             value = value.to_datetime
             [Utils.deep_freeze(value), value.rfc3339.freeze]
           else
-            raise AttributeError, "Illegal type for #{keys.first}:" \
-                                  " String, Time, or DateTime expected but #{value.class} found"
+            raise(AttributeError, "Illegal type for #{keys.first}: " \
+                                  "String, Time, or DateTime expected but #{value.class} found")
           end
         end
       end
 
-      def content_type keys, required: false
-        object keys, required: required do |value|
+      def content_type(keys, required: false)
+        object(keys, required: required) do |value|
           case value
           when ::String
-            raise AttributeError, "The #{keys.first} field cannot be empty" if value.empty?
+            raise(AttributeError, "The #{keys.first} field cannot be empty") if value.empty?
             [ContentType.new(value), value.freeze]
           when ContentType
             [value, value.to_s]
           else
-            raise AttributeError, "Illegal type for #{keys.first}:" \
-                                  " String, or ContentType expected but #{value.class} found"
+            raise(AttributeError, "Illegal type for #{keys.first}: " \
+                                  "String, or ContentType expected but #{value.class} found")
           end
         end
       end
 
-      def spec_version keys, accept:
-        object keys, required: true do |value|
+      def spec_version(keys, accept:)
+        object(keys, required: true) do |value|
           case value
           when ::String
-            raise SpecVersionError, "Unrecognized specversion: #{value}" unless accept =~ value
+            raise(SpecVersionError, "Unrecognized specversion: #{value}") unless accept =~ value
             value.freeze
             [value, value]
           else
-            raise AttributeError, "Illegal type for #{keys.first}:" \
-                                  " String expected but #{value.class} found"
+            raise(AttributeError, "Illegal type for #{keys.first}: " \
+                                  "String expected but #{value.class} found")
           end
         end
       end
 
-      def data_object keys, required: false
-        object keys, required: required, allow_nil: true do |value|
-          Utils.deep_freeze value
+      def data_object(keys, required: false)
+        object(keys, required: required, allow_nil: true) do |value|
+          Utils.deep_freeze(value)
           [value, value]
         end
       end
@@ -116,21 +117,28 @@ module CloudEvents
 
       private
 
-      def object keys, required: false, allow_nil: false
+      def object(keys, required: false, allow_nil: false)
         value = UNDEFINED
         keys.each do |key|
-          key_present = @args.key? key
-          val = @args.delete key
-          value = val if allow_nil && key_present || !allow_nil && !val.nil?
+          key_present = @args.key?(key)
+          val = @args.delete(key)
+          value = val if (allow_nil && key_present) || (!allow_nil && !val.nil?)
         end
         if value == UNDEFINED
-          raise AttributeError, "The #{keys.first} field is required" if required
+          raise(AttributeError, "The #{keys.first} field is required") if required
           return allow_nil ? UNDEFINED : nil
         end
-        converted, raw = yield value
+        converted, raw = yield(value)
         @attributes[keys.first.freeze] = raw
         converted
       end
+
+      def check_attribute_name(key, requires_lc_start)
+        regex = requires_lc_start ? /^[a-z][a-z0-9]*$/ : /^[a-z0-9]+$/
+        unless regex.match?(key)
+          raise(AttributeError, "Illegal key: #{key.inspect} must consist only of digits and lower-case letters")
+        end
+      end
     end
   end
 end

data/lib/cloud_events/event/opaque.rb

@@ -24,7 +24,7 @@ module CloudEvents
       #     or not provided, the value will be inferred from the content type
       #     if possible, or otherwise set to `nil` indicating not known.
       #
-      def initialize content, content_type, batch: nil
+      def initialize(content, content_type, batch: nil)
         @content = content.freeze
         @content_type = content_type
         if batch.nil? && content_type&.media_type == "application"
@@ -63,7 +63,7 @@ module CloudEvents
       end
 
       ## @private
-      def == other
+      def ==(other)
         Opaque === other &&
           @content == other.content &&
           @content_type == other.content_type &&
@@ -73,7 +73,7 @@ module CloudEvents
 
       ## @private
       def hash
-        @content.hash ^ @content_type.hash ^ @batch.hash
+        [@content, @content_type, @batch].hash
       end
     end
   end

data/lib/cloud_events/event/utils.rb

@@ -8,37 +8,37 @@ module CloudEvents
     #
     module Utils
       class << self
-        def deep_freeze obj
+        def deep_freeze(obj)
           case obj
           when ::Hash
             obj.each do |key, val|
-              deep_freeze key
-              deep_freeze val
+              deep_freeze(key)
+              deep_freeze(val)
             end
           when ::Array
             obj.each do |val|
-              deep_freeze val
+              deep_freeze(val)
             end
           else
             obj.instance_variables.each do |iv|
-              deep_freeze obj.instance_variable_get iv
+              deep_freeze(obj.instance_variable_get(iv))
             end
           end
           obj.freeze
         end
 
-        def deep_dup obj
+        def deep_dup(obj)
           case obj
           when ::Hash
-            obj.each_with_object({}) { |(key, val), hash| hash[deep_dup key] = deep_dup val }
+            obj.each_with_object({}) { |(key, val), hash| hash[deep_dup(key)] = deep_dup(val) }
           when ::Array
-            obj.map { |val| deep_dup val }
+            obj.map { |val| deep_dup(val) }
           else
             obj.dup
           end
         end
 
-        def keys_to_strings hash
+        def keys_to_strings(hash)
           result = {}
           hash.each do |key, val|
             result[key.to_s] = val

data/lib/cloud_events/event/v0.rb

@@ -75,20 +75,20 @@ module CloudEvents
       #     (Also available using the deprecated keyword `attributes`.)
       # @param args [keywords] The data and attributes, as keyword arguments.
       #
-      def initialize set_attributes: nil, attributes: nil, **args
-        interpreter = FieldInterpreter.new set_attributes || attributes || args
-        @spec_version = interpreter.spec_version ["specversion", "spec_version"], accept: /^0\.3$/
-        @id = interpreter.string ["id"], required: true
-        @source = interpreter.uri ["source"], required: true
-        @type = interpreter.string ["type"], required: true
-        @data = interpreter.data_object ["data"]
+      def initialize(set_attributes: nil, attributes: nil, **args)
+        interpreter = FieldInterpreter.new(set_attributes || attributes || args)
+        @spec_version = interpreter.spec_version(["specversion", "spec_version"], accept: /^0\.3$/)
+        @id = interpreter.string(["id"], required: true)
+        @source = interpreter.uri(["source"], required: true)
+        @type = interpreter.string(["type"], required: true)
+        @data = interpreter.data_object(["data"])
         @data = nil if @data == FieldInterpreter::UNDEFINED
-        @data_content_encoding = interpreter.string ["datacontentencoding", "data_content_encoding"]
-        @data_content_type = interpreter.content_type ["datacontenttype", "data_content_type"]
-        @schema_url = interpreter.uri ["schemaurl", "schema_url"]
-        @subject = interpreter.string ["subject"]
-        @time = interpreter.rfc3339_date_time ["time"]
-        @attributes = interpreter.finish_attributes
+        @data_content_encoding = interpreter.string(["datacontentencoding", "data_content_encoding"])
+        @data_content_type = interpreter.content_type(["datacontenttype", "data_content_type"])
+        @schema_url = interpreter.uri(["schemaurl", "schema_url"])
+        @subject = interpreter.string(["subject"])
+        @time = interpreter.rfc3339_date_time(["time"])
+        @attributes = interpreter.finish_attributes(requires_lc_start: true)
         freeze
       end
 
@@ -101,9 +101,9 @@ module CloudEvents
       # @param changes [keywords] See {#initialize} for a list of arguments.
       # @return [FunctionFramework::CloudEvents::Event]
       #
-      def with **changes
-        attributes = @attributes.merge changes
-        V0.new set_attributes: attributes
+      def with(**changes)
+        attributes = @attributes.merge(changes)
+        V0.new(set_attributes: attributes)
       end
 
       ##
@@ -125,7 +125,7 @@ module CloudEvents
       # @param key [String,Symbol] The attribute name.
       # @return [String,nil]
       #
-      def [] key
+      def [](key)
         @attributes[key.to_s]
       end
 
@@ -136,7 +136,7 @@ module CloudEvents
       # @return [Hash]
       #
       def to_h
-        Utils.deep_dup @attributes
+        Utils.deep_dup(@attributes)
       end
 
       ##
@@ -225,7 +225,7 @@ module CloudEvents
       attr_reader :time
 
       ## @private
-      def == other
+      def ==(other)
         other.is_a?(V0) && @attributes == other.instance_variable_get(:@attributes)
       end
       alias eql? ==

data/lib/cloud_events/event/v1.rb

@@ -136,24 +136,24 @@ module CloudEvents
       #     (Also available using the deprecated keyword `attributes`.)
       # @param args [keywords] The data and attributes, as keyword arguments.
       #
-      def initialize set_attributes: nil, attributes: nil, **args
-        interpreter = FieldInterpreter.new set_attributes || attributes || args
-        @spec_version = interpreter.spec_version ["specversion", "spec_version"], accept: /^1(\.|$)/
-        @id = interpreter.string ["id"], required: true
-        @source = interpreter.uri ["source"], required: true
-        @type = interpreter.string ["type"], required: true
-        @data_encoded = interpreter.string ["data_encoded"], allow_empty: true
-        @data = interpreter.data_object ["data"]
+      def initialize(set_attributes: nil, attributes: nil, **args)
+        interpreter = FieldInterpreter.new(set_attributes || attributes || args)
+        @spec_version = interpreter.spec_version(["specversion", "spec_version"], accept: /^1(\.|$)/)
+        @id = interpreter.string(["id"], required: true)
+        @source = interpreter.uri(["source"], required: true)
+        @type = interpreter.string(["type"], required: true)
+        @data_encoded = interpreter.string(["data_encoded"], allow_empty: true)
+        @data = interpreter.data_object(["data"])
         if @data == FieldInterpreter::UNDEFINED
           @data = @data_encoded
           @data_decoded = false
         else
           @data_decoded = true
         end
-        @data_content_type = interpreter.content_type ["datacontenttype", "data_content_type"]
-        @data_schema = interpreter.uri ["dataschema", "data_schema"]
-        @subject = interpreter.string ["subject"]
-        @time = interpreter.rfc3339_date_time ["time"]
+        @data_content_type = interpreter.content_type(["datacontenttype", "data_content_type"])
+        @data_schema = interpreter.uri(["dataschema", "data_schema"])
+        @subject = interpreter.string(["subject"])
+        @time = interpreter.rfc3339_date_time(["time"])
         @attributes = interpreter.finish_attributes
         freeze
       end
@@ -167,15 +167,15 @@ module CloudEvents
       # @param changes [keywords] See {#initialize} for a list of arguments.
       # @return [FunctionFramework::CloudEvents::Event]
       #
-      def with **changes
-        changes = Utils.keys_to_strings changes
+      def with(**changes)
+        changes = Utils.keys_to_strings(changes)
         attributes = @attributes.dup
         if changes.key?("data") || changes.key?("data_encoded")
-          attributes.delete "data"
-          attributes.delete "data_encoded"
+          attributes.delete("data")
+          attributes.delete("data_encoded")
         end
-        attributes.merge! changes
-        V1.new set_attributes: attributes
+        attributes.merge!(changes)
+        V1.new(set_attributes: attributes)
       end
 
       ##
@@ -197,7 +197,7 @@ module CloudEvents
       # @param key [String,Symbol] The attribute name.
       # @return [String,nil]
       #
-      def [] key
+      def [](key)
         @attributes[key.to_s]
       end
 
@@ -208,7 +208,7 @@ module CloudEvents
       # @return [Hash]
       #
       def to_h
-        Utils.deep_dup @attributes
+        Utils.deep_dup(@attributes)
       end
 
       ##
@@ -330,7 +330,7 @@ module CloudEvents
       attr_reader :time
 
       ## @private
-      def == other
+      def ==(other)
         other.is_a?(V1) && @attributes == other.instance_variable_get(:@attributes)
       end
       alias eql? ==

data/lib/cloud_events/event.rb

@@ -58,14 +58,14 @@ module CloudEvents
       # @param spec_version [String] The required `specversion` field.
       # @param kwargs [keywords] Additional parameters for the event.
       #
-      def create spec_version:, **kwargs
+      def create(spec_version:, **kwargs)
         case spec_version
         when "0.3"
-          V0.new spec_version: spec_version, **kwargs
+          V0.new(spec_version: spec_version, **kwargs)
         when /^1(\.|$)/
-          V1.new spec_version: spec_version, **kwargs
+          V1.new(spec_version: spec_version, **kwargs)
         else
-          raise SpecVersionError, "Unrecognized specversion: #{spec_version}"
+          raise(SpecVersionError, "Unrecognized specversion: #{spec_version}")
         end
       end
       alias new create