hecks 3.6.0 → 3.7.0

data/rust/host/src/secrets.rs

@@ -75,10 +75,54 @@ pub fn extract_field(secret_json: &str, field: &str) -> Result<String, String> {
         .ok_or_else(|| format!("secret's SecretString has no string {field:?} field"))
 }
 
+/// The `postgres://` URL for a database secret.
+///
+/// The user is the secret's `username`, which is `postgres` for RDS's managed master secret and a
+/// client's own role for a database shared with other clients; a secret without one is read as
+/// `postgres`. The port is the secret's `port` when it has one, else 5432. The password goes in
+/// literal, as before: the URL parser downstream never percent-decodes it, so a client's generated
+/// password is letters and digits only.
+pub fn database_url(secret_json: &str, host: &str, database: &str) -> Result<String, String> {
+    let password = extract_field(secret_json, "password")?;
+    let user = extract_field(secret_json, "username").unwrap_or_else(|_| "postgres".to_string());
+    let port = serde_json::from_str::<serde_json::Value>(secret_json)
+        .ok()
+        .and_then(|v| v.get("port").and_then(|p| p.as_u64().or_else(|| p.as_str().and_then(|s| s.parse().ok()))))
+        .unwrap_or(5432);
+    Ok(format!("postgres://{user}:{password}@{host}:{port}/{database}"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_master_secret_logs_in_as_postgres_on_the_default_port() {
+        let json = r#"{"username":"postgres","password":"abc123"}"#;
+        assert_eq!(database_url(json, "db.example", "app").unwrap(), "postgres://postgres:abc123@db.example:5432/app");
+    }
+
+    #[test]
+    fn a_clients_own_secret_logs_in_as_its_role() {
+        let json = r#"{"username":"acme","password":"s3cr3t","host":"db.example","port":5433,"dbname":"acme"}"#;
+        assert_eq!(database_url(json, "db.example", "acme").unwrap(), "postgres://acme:s3cr3t@db.example:5433/acme");
+    }
+
+    #[test]
+    fn a_secret_with_no_username_is_read_as_postgres() {
+        assert_eq!(database_url(r#"{"password":"pw"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:5432/d");
+    }
+
+    #[test]
+    fn a_port_written_as_text_is_read() {
+        assert_eq!(database_url(r#"{"password":"pw","port":"6000"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:6000/d");
+    }
+
+    #[test]
+    fn a_secret_with_no_password_is_refused() {
+        assert!(database_url(r#"{"username":"acme"}"#, "h", "d").is_err());
+    }
+
     #[test]
     fn extracts_the_named_field_from_the_generated_secret_shape() {
         assert_eq!(

data/rust/host/src/server.rs

@@ -276,7 +276,8 @@ fn value_to_response(value: Value) -> Response {
     let Some(status_code) = value.get("statusCode").and_then(|v| v.as_u64()) else {
         return (StatusCode::OK, axum::Json(value)).into_response();
     };
-    let status = StatusCode::from_u16(status_code as u16).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    // `try_from`, not `as u16`: 65736 would wrap to 200 and turn a handler's garbage into a success.
+    let status = u16::try_from(status_code).ok().and_then(|code| StatusCode::from_u16(code).ok()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
 
     let mut headers = HeaderMap::new();
     if let Some(header_obj) = value.get("headers").and_then(|h| h.as_object()) {
@@ -665,3 +666,7 @@ mod tests {
         assert_eq!(version_body("e", "h", Some(""))["build"], env!("CARGO_PKG_VERSION"));
     }
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/server.rs"]
+mod boundary_fuzz;

data/rust/host/src/web.rs

@@ -1607,8 +1607,10 @@ fn percent_decode_impl(s: &str, plus_as_space: bool) -> String {
                 i += 1;
             }
             b'%' if i + 2 < bytes.len() => {
-                if let Ok(byte) = u8::from_str_radix(&s[i + 1..i + 3], 16) {
-                    out.push(byte);
+                // Byte-wise, not `s[i + 1..i + 3]`: that slice panics when it lands inside a
+                // multi-byte character (`%a🍕`), and `from_str_radix` would read a `+` sign as a digit.
+                if let (Some(high), Some(low)) = (hex_digit(bytes[i + 1]), hex_digit(bytes[i + 2])) {
+                    out.push(high << 4 | low);
                     i += 3;
                 } else {
                     out.push(bytes[i]);
@@ -1624,6 +1626,10 @@ fn percent_decode_impl(s: &str, plus_as_space: bool) -> String {
     String::from_utf8_lossy(&out).into_owned()
 }
 
+fn hex_digit(byte: u8) -> Option<u8> {
+    (byte as char).to_digit(16).map(|digit| digit as u8)
+}
+
 const B64: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 // pub(crate) so server.rs's own Function URL response handling can
@@ -2982,3 +2988,7 @@ mod tests {
     }
 
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/web.rs"]
+mod boundary_fuzz;

data/rust/parser/fuzz/.gitignore

@@ -0,0 +1,4 @@
+target/
+corpus/
+artifacts/
+coverage/

data/rust/parser/fuzz/Cargo.lock

@@ -0,0 +1,89 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "cc"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "hecks_parse_fuzz"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

data/rust/parser/fuzz/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "hecks_parse_fuzz"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+# Own workspace root, so neither `rust/parser` nor `rust` adopts this crate and its dependency.
+[workspace]
+
+# The one dependency in the parser tree, and it lives only here: coverage-guided fuzzing needs
+# libFuzzer's instrumentation, and nothing ships from this crate (ADR 0012).
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[[bin]]
+name = "chapter"
+path = "fuzz_targets/chapter.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "resolve"
+path = "fuzz_targets/resolve.rs"
+test = false
+doc = false
+bench = false

data/rust/parser/fuzz/README.md

@@ -0,0 +1,19 @@
+# Coverage-guided fuzzing for hecks-parse
+
+Opt-in. The parser stays dependency-free (ADR 0012); `libfuzzer-sys` lives only in this crate,
+which is its own workspace and is never built by `cargo build` or `cargo test` in `rust/parser`.
+
+```sh
+rustup toolchain install nightly
+cargo install cargo-fuzz
+cd rust/parser
+cargo +nightly fuzz run chapter -- -max_total_time=60   # bluebook parse + determinism
+cargo +nightly fuzz run resolve -- -max_total_time=60   # hecksagon `attaches` resolution
+```
+
+Seed a run from the fixtures: `cargo +nightly fuzz run chapter ../tests/fixtures`. A crash lands
+in `fuzz/artifacts/`; copy it to a `.bluebook` and run `hecks-parse chapter --chapter Fuzzed
+<file>` to reproduce it.
+
+The seeded harness in `tests/fuzz.rs` is what CI runs; this directory is for longer
+coverage-guided hunts.

data/rust/parser/fuzz/fuzz_targets/chapter.rs

@@ -0,0 +1,50 @@
+//! Coverage-guided target for `parse::chapter::parse_chapter`.
+//!
+//! The parser is a binary crate, so this target includes its modules by path and declares them at
+//! its own crate root, which is where their `crate::` references resolve.
+//!
+//! Run from `rust/parser` with a nightly toolchain: `cargo +nightly fuzz run chapter`.
+#![no_main]
+#![allow(dead_code)]
+
+#[path = "../../src/build/mod.rs"]
+mod build;
+#[path = "../../src/canonical.rs"]
+mod canonical;
+#[path = "../../src/diag.rs"]
+mod diag;
+#[path = "../../src/emit.rs"]
+mod emit;
+#[path = "../../src/expr/mod.rs"]
+mod expr;
+#[path = "../../src/ir.rs"]
+mod ir;
+#[path = "../../src/keywords.rs"]
+mod keywords;
+#[path = "../../src/lex.rs"]
+mod lex;
+#[path = "../../src/parse/mod.rs"]
+mod parse;
+#[path = "../../src/ruby_value.rs"]
+mod ruby_value;
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    // Invalid UTF-8 never reaches the parser: the binary rejects it when it reads the file.
+    let Ok(source) = std::str::from_utf8(data) else {
+        return;
+    };
+    let files = [("fuzz.bluebook".to_string(), source.to_string())];
+    // A refusal is a normal answer; only a panic or a hang is a finding.
+    if let Ok(bluebook) = parse::chapter::parse_chapter("Fuzzed", &files) {
+        let first = emit::write(&emit::bluebook_json(&bluebook));
+        let again = parse::chapter::parse_chapter("Fuzzed", &files)
+            .map(|b| emit::write(&emit::bluebook_json(&b)));
+        assert_eq!(
+            Ok(first),
+            again.map_err(|_| ()),
+            "parse is not deterministic"
+        );
+    }
+});

data/rust/parser/fuzz/fuzz_targets/resolve.rs

@@ -0,0 +1,35 @@
+//! Coverage-guided target for `parse::chapter::resolve_hecksagon_dependencies`.
+//!
+//! Run from `rust/parser` with a nightly toolchain: `cargo +nightly fuzz run resolve`.
+#![no_main]
+#![allow(dead_code)]
+
+#[path = "../../src/build/mod.rs"]
+mod build;
+#[path = "../../src/canonical.rs"]
+mod canonical;
+#[path = "../../src/diag.rs"]
+mod diag;
+#[path = "../../src/emit.rs"]
+mod emit;
+#[path = "../../src/expr/mod.rs"]
+mod expr;
+#[path = "../../src/ir.rs"]
+mod ir;
+#[path = "../../src/keywords.rs"]
+mod keywords;
+#[path = "../../src/lex.rs"]
+mod lex;
+#[path = "../../src/parse/mod.rs"]
+mod parse;
+#[path = "../../src/ruby_value.rs"]
+mod ruby_value;
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(source) = std::str::from_utf8(data) else {
+        return;
+    };
+    let _ = parse::chapter::resolve_hecksagon_dependencies("Fuzzed", "fuzz.hecksagon", source);
+});

data/rust/parser/src/parse/command.rs

@@ -171,10 +171,22 @@ pub fn parse_body(
 
         match gated.row.word {
             "role" => {
-                command.role = Some(super::positional_text(file, line, "role", &gated.args, 1)?)
+                command.role = Some(super::positional_literal_text(
+                    file,
+                    line,
+                    "role",
+                    &gated.args,
+                    1,
+                )?)
             }
             "goal" => {
-                command.goal = Some(super::positional_text(file, line, "goal", &gated.args, 1)?)
+                command.goal = Some(super::positional_literal_text(
+                    file,
+                    line,
+                    "goal",
+                    &gated.args,
+                    1,
+                )?)
             }
             // A synthesized inline `one_of(...)` closed set is dropped; `CommandBuilder#build`
             // ignores it.

data/rust/parser/src/parse/mod.rs

@@ -743,6 +743,31 @@ pub(crate) fn positional_text(
     })
 }
 
+/// Like `positional_text`, but the argument must be a literal. Ruby evaluates what follows
+/// `role` or `goal`, so a bare word or a call there (`role sets :name`) is an expression this
+/// parser cannot evaluate, and reading its source text as the value would invent one.
+pub(crate) fn positional_literal_text(
+    file: &str,
+    line: usize,
+    word: &str,
+    args: &ArgumentGateResult,
+    at: usize,
+) -> ParseResult<String> {
+    let raw = positional_raw(file, line, word, args, at)?;
+    match ruby_value::read(raw) {
+        ruby_value::Value::Bare(_) => Err(Diagnostic::new(
+            file,
+            line,
+            format!(
+                "'{word}'s positional argument {at} ('{}') is not a literal",
+                raw.trim()
+            ),
+        )),
+        ruby_value::Value::Str(s) => Ok(s),
+        literal => Ok(ruby_value::to_s(&literal)),
+    }
+}
+
 /// A required symbol positional without its colon (`attribute :name`), bare or quoted (`:"a.b"`).
 /// The quoted form spells dotted paths, e.g. `correlates_by :"reference.value"`.
 pub(crate) fn positional_symbol(

data/rust/parser/src/ruby_value.rs

@@ -192,21 +192,97 @@ fn unquote(raw: &str) -> String {
     unescape_double_quoted_inner(&raw[1..raw.len() - 1])
 }
 
+/// Unescapes a Ruby double-quoted body: `\n`, `\t`, `\e` and the other single-letter escapes,
+/// octal `\NNN`, `\xHH`, `\uHHHH` and `\u{H H ...}`, and `\<newline>` as nothing. Any other
+/// escaped character stands for itself, as in Ruby. `\c`, `\C-` and `\M-` control and meta
+/// escapes are left as the bare letter, since no bluebook spells them.
 fn unescape_double_quoted_inner(inner: &str) -> String {
     let mut out = String::with_capacity(inner.len());
-    let mut chars = inner.chars();
+    let mut chars = inner.chars().peekable();
     while let Some(ch) = chars.next() {
-        if ch == '\\' {
-            if let Some(next) = chars.next() {
-                out.push(next);
-            }
-        } else {
+        if ch != '\\' {
             out.push(ch);
+            continue;
+        }
+        let Some(next) = chars.next() else {
+            continue;
+        };
+        match next {
+            'a' => out.push('\u{7}'),
+            'b' => out.push('\u{8}'),
+            'e' => out.push('\u{1b}'),
+            'f' => out.push('\u{c}'),
+            'n' => out.push('\n'),
+            'r' => out.push('\r'),
+            's' => out.push(' '),
+            't' => out.push('\t'),
+            'v' => out.push('\u{b}'),
+            '\n' => {}
+            '0'..='7' => out.push(read_octal_escape(next, &mut chars)),
+            'x' => match read_hex_digits(&mut chars, 2) {
+                Some(code) => out.push(char::from_u32(code).unwrap_or('\u{fffd}')),
+                None => out.push('x'),
+            },
+            'u' => read_unicode_escape(&mut chars, &mut out),
+            other => out.push(other),
         }
     }
     out
 }
 
+/// Up to three octal digits starting with `first`, as one character.
+fn read_octal_escape(first: char, chars: &mut std::iter::Peekable<std::str::Chars>) -> char {
+    let mut code = first.to_digit(8).unwrap_or(0);
+    for _ in 0..2 {
+        match chars.peek().and_then(|c| c.to_digit(8)) {
+            Some(digit) => {
+                code = code * 8 + digit;
+                chars.next();
+            }
+            None => break,
+        }
+    }
+    char::from_u32(code & 0xff).unwrap_or('\u{fffd}')
+}
+
+/// Between one and `max` hex digits, or `None` when the next character is not one.
+fn read_hex_digits(chars: &mut std::iter::Peekable<std::str::Chars>, max: usize) -> Option<u32> {
+    let mut code: Option<u32> = None;
+    for _ in 0..max {
+        match chars.peek().and_then(|c| c.to_digit(16)) {
+            Some(digit) => {
+                code = Some(code.unwrap_or(0) * 16 + digit);
+                chars.next();
+            }
+            None => break,
+        }
+    }
+    code
+}
+
+/// `\uHHHH` (exactly four digits) or `\u{H H ...}` (one or more codepoints), after the `u`.
+fn read_unicode_escape(chars: &mut std::iter::Peekable<std::str::Chars>, out: &mut String) {
+    if chars.peek() == Some(&'{') {
+        chars.next();
+        loop {
+            while chars.peek().is_some_and(|c| *c == ' ') {
+                chars.next();
+            }
+            match read_hex_digits(chars, 6) {
+                Some(code) => out.push(char::from_u32(code).unwrap_or('\u{fffd}')),
+                None => break,
+            }
+        }
+        if chars.peek() == Some(&'}') {
+            chars.next();
+        }
+    } else if let Some(code) = read_hex_digits(chars, 4) {
+        out.push(char::from_u32(code).unwrap_or('\u{fffd}'));
+    } else {
+        out.push('u');
+    }
+}
+
 /// Scans adjacent quoted literals (either quote style, whitespace-separated) from index 0.
 /// Returns their unescaped concatenation and the chars consumed, or `None` if `raw` does not
 /// start with a closed literal. Callers compare `consumed` to the full length to tell a whole
@@ -408,6 +484,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn double_quoted_escapes_read_as_ruby_reads_them() {
+        assert_eq!(read(r#""a\tb\nc""#), Value::Str("a\tb\nc".to_string()));
+        assert_eq!(read(r#""\e\s\a\0""#), Value::Str("\u{1b} \u{7}\0".to_string()));
+        assert_eq!(
+            read(r#""\x41\101é\u{1F4A5 41}""#),
+            Value::Str("AA\u{e9}\u{1F4A5}A".to_string())
+        );
+        assert_eq!(read(r#""q\q\"\\""#), Value::Str("qq\"\\".to_string()));
+        assert_eq!(read("\"a\\\nb\""), Value::Str("ab".to_string()));
+        assert_eq!(read(r#""\xZ""#), Value::Str("xZ".to_string()));
+    }
+
     #[test]
     fn concatenates_three_adjacent_literals_mixing_quote_styles() {
         assert_eq!(read("\"a\" 'b' \"c\""), Value::Str("abc".to_string()));

data/rust/src/kernel/json.rs

@@ -346,7 +346,7 @@ impl Json {
     }
 
     pub fn parse(input: &str) -> Result<Json, String> {
-        let mut parser = Parser { chars: input.chars().peekable() };
+        let mut parser = Parser { chars: input.chars().peekable(), depth: 0 };
         let value = parser.parse_value()?;
         parser.skip_ws();
         Ok(value)
@@ -611,8 +611,14 @@ fn write_escaped_string(s: &str, out: &mut String) {
 // Recursive descent over chars; the input is a valid `&str`, so no UTF-8 byte handling is needed.
 struct Parser<'a> {
     chars: std::iter::Peekable<std::str::Chars<'a>>,
+    depth: usize,
 }
 
+/// How deeply arrays and objects may nest before `parse` refuses. Each level is a recursive call,
+/// so an unbounded document (`[[[[...`) overflows the stack, which aborts the process rather than
+/// refusing. 128 is `serde_json`'s own recursion limit, so the host and this parser refuse alike.
+const MAX_DEPTH: usize = 128;
+
 impl<'a> Parser<'a> {
     fn skip_ws(&mut self) {
         while matches!(self.chars.peek(), Some(c) if c.is_whitespace()) {
@@ -651,7 +657,26 @@ impl<'a> Parser<'a> {
         }
     }
 
+    // Counts one level of nesting for the duration of `body`; refuses past `MAX_DEPTH`.
+    fn nested(&mut self, body: impl FnOnce(&mut Self) -> Result<Json, String>) -> Result<Json, String> {
+        if self.depth >= MAX_DEPTH {
+            return Err(format!("JSON nests deeper than {MAX_DEPTH} levels"));
+        }
+        self.depth += 1;
+        let result = body(self);
+        self.depth -= 1;
+        result
+    }
+
     fn parse_object(&mut self) -> Result<Json, String> {
+        self.nested(Self::parse_object_body)
+    }
+
+    fn parse_array(&mut self) -> Result<Json, String> {
+        self.nested(Self::parse_array_body)
+    }
+
+    fn parse_object_body(&mut self) -> Result<Json, String> {
         self.expect('{')?;
         let mut fields = Vec::new();
         self.skip_ws();
@@ -676,7 +701,7 @@ impl<'a> Parser<'a> {
         Ok(Json::Object(fields))
     }
 
-    fn parse_array(&mut self) -> Result<Json, String> {
+    fn parse_array_body(&mut self) -> Result<Json, String> {
         self.expect('[')?;
         let mut items = Vec::new();
         self.skip_ws();
@@ -773,7 +798,13 @@ impl<'a> Parser<'a> {
         // A literal with a `.`/exponent is a genuine `Float`, and Ruby's `Float` is the same
         // `f64` Rust's is, so there is nothing to preserve there.
         let is_plain_integer = !s.contains('.') && !s.contains(['e', 'E']);
-        let raw = if is_plain_integer && canonical_integer_digits(value) != s { Some(s) } else { None };
+        let keeps_source = is_plain_integer && canonical_integer_digits(value) != s;
+        // `1e999` parses to infinity with no source text kept, and `write` would print it as `inf`:
+        // not JSON, so refuse it. A plain integer keeps its digits, which `write` re-emits as-is.
+        if !value.is_finite() && !keeps_source {
+            return Err(format!("number {s:?} is out of range"));
+        }
+        let raw = keeps_source.then_some(s);
         Ok(Json::Num(value, raw))
     }
 }