iodef 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec203460113e786d9571db8360e79b7514881fbf38a2af7539813cdf4608069c
-  data.tar.gz: accc3826848d943da9d860d91d7889099fdad3c3141771737d0315c6d9da98af
+  metadata.gz: 7588549cdf3dc70ba42067341ab74cd8e9f9fb7d1ce51614017e9ae6f66d5e5f
+  data.tar.gz: 9154dbeb6a501db304bc654f4b5ae4031c8e8219a14355a1f7a2eaa176ce2a39
 SHA512:
-  metadata.gz: 775da0539aa19b31c1b914ac29e6bd7426cd594dcbcac2ab9c5b0d4a3b74681457d7d9f67cb0cf85e40fddae0121787fb1cc1ce4dd641133139e4b1dbbd42ed8
-  data.tar.gz: b770d06ee184c30f732d6ff69c9b367584915008e3d1cfba2562c8cc9a33a86cdb0a7e4190c910ec26a6c9956572bc517c63293ece3cb98226a5a3e045afefca
+  metadata.gz: 1164739062dfa364d9ce1db9c6e4308d565399942134c63e6c0bbc890d35f40f07009f5d6e772e2ead5faa1d7b133a2f94be8ddfdc82d161a79a4058ca99e900
+  data.tar.gz: 4242987cd5815cf220ee61a9c9d1e77e7f84b15dcd81c93f7ae8982ef3664d59b9356502e3e2d664f4b5b311b5042282692dcd384707315701c7b1066fb2d132

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.1 - 2026-10-12
+
+- Select the correct description language when plain English strings appear with translated text, and inherit document and incident languages for multilingual objects in typed views.
+- Reject malformed processing-instruction targets when parsing XML and serializing XML extensions.
+
+## 0.2.0 - 2026-10-12
+
+- Read and write RFC 7970 XML incident reports with `IODEF.parse_xml` and `Document#to_xml`, including namespace-aware extensions and multilingual text.
+- Bound XML parsing and output, reject DTDs, and report unsupported mappings instead of discarding data.
+- Support CBOR across CRuby, JRuby, and TruffleRuby without a separate `cbor` gem.
+
 ## 0.1.0 - 2026-10-12
 
 Initial release.

data/README.md

@@ -1,25 +1,47 @@
-# IODEF
+<h1 align="center">IODEF</h1>
 
-Read, validate, build, and exchange incident reports using the JSON binding of IODEF v2 ([RFC 8727](https://www.rfc-editor.org/rfc/rfc8727.html), with the information model in [RFC 7970](https://www.rfc-editor.org/rfc/rfc7970.html)).
+<p align="center">Incident reports in JSON, CBOR, and XML.</p>
 
-```ruby
-require "iodef"
+<p align="center">
+  <a href="https://rubygems.org/gems/iodef"><img src="https://img.shields.io/gem/v/iodef" alt="Gem version"></a>
+  <a href="https://github.com/ydah/iodef/actions/workflows/main.yml"><img src="https://github.com/ydah/iodef/actions/workflows/main.yml/badge.svg?branch=main" alt="CI"></a>
+  <a href="https://www.ruby-lang.org/"><img src="https://img.shields.io/badge/Ruby-%3E%3D%203.3-CC342D?logo=ruby&amp;logoColor=white" alt="Ruby 3.3 or later"></a>
+  <a href="LICENSE.txt"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
+</p>
+
+<p align="center">
+  <a href="#installation">Installation</a> &middot;
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#scope">Scope</a> &middot;
+  <a href="#development">Development</a> &middot;
+  <a href="#license">License</a>
+</p>
+
+Read, validate, build, and exchange IODEF v2 incident reports as JSON, CBOR, or XML ([RFC 8727](https://www.rfc-editor.org/rfc/rfc8727.html) and [RFC 7970](https://www.rfc-editor.org/rfc/rfc7970.html)).
+
+## Features
+
+- Build incident reports with typed models and multilingual descriptions.
+- Exchange JSON, built-in CBOR, and namespace-aware RFC 7970 XML.
+- Validate reports with JSON Pointer diagnostics and configurable resource limits.
+
+## Installation
 
-document = IODEF.parse(json)
-incident = document.incidents.first
-incident.incident_id
-incident.contacts.first.role
-incident.description.text("ja")
+Add the gem to your Gemfile:
 
-issues = IODEF.validate(json)
-issues.each { |issue| puts "#{issue.pointer}: #{issue.rule}: #{issue.message}" }
+```ruby
+gem "iodef"
 ```
 
-Install with `gem install iodef`. Ruby 3.3 or newer, JRuby, and TruffleRuby are supported. The only required runtime gem is `json` (2.19.4 or newer, including 3.x); no other gem from this project is required. `IODEF` and `Iodef` refer to the same module.
+Then run `bundle install`.
+
+Ruby 3.3 or newer, JRuby, and TruffleRuby are supported. Runtime dependencies are the Ruby standard libraries `json` (2.19.4 or newer, including 3.x) and `rexml` (3.4.4 or newer, below 4); no other gem from this project is required. `IODEF` and `Iodef` refer to the same module.
 
-## Build and edit a report
+## Quick start
 
 ```ruby
+require "iodef"
+
 document = IODEF::Document.build(lang: "en") do |doc|
   doc.add_incident(purpose: "reporting") do |incident|
     incident.incident_id = { id: "case-24", name: "response.example" }
@@ -33,12 +55,19 @@ document = IODEF::Document.build(lang: "en") do |doc|
 end
 
 json = document.to_json
+copy = IODEF.parse(json)
+copy.incidents.first.incident_id
+copy.incidents.first.contacts.first.role # => "creator"
+copy.incidents.first.description.text("ja") # => "不審な通信"
+IODEF.validate(json) # => []
 ```
 
 Builders require the incident's ID, generation time, and at least one contact. They do not invent reporting identities or timestamps. Known properties use snake_case accessors; wire property names retain their RFC spelling. `Document`, `Incident`, `Contact`, `Assessment`, `EventData`, and `Indicator` have typed views. Other objects are ordinary hashes. Plural conveniences include `incidents`, `contacts`, `assessments`, and `indicators`.
 
 Typed child views update their document. `[]` exposes the underlying value, `[]=` copies the assigned value, and `to_h` returns a detached copy. Symbols in builder hashes become strings. Unknown JSON properties are preserved, including nested values and large integers. Defaults such as restriction levels are not inserted into the source data.
 
+`description.text(language)` selects an exact language match, then a matching language prefix. Plain JSON strings mean English. Multilingual objects without `lang` inherit the incident or document language; an empty `lang` resets that inheritance. With no match or no requested language, the accessor prefers the first plain string or object without an explicit language, then the first entry.
+
 ## Validation and limits
 
 Parsing is strict by default. `IODEF.parse(json, strict: false)` returns a document with a `warnings` array of `Violation` objects. `validate: false` is a compatibility spelling for this inspection mode. `validate!` refreshes diagnostics after edits. Serialization always validates and raises `IODEF::ValidationError` with `violations` and the first JSON `pointer`.
@@ -50,15 +79,15 @@ Required properties, types, nonempty collections, enum values, extension selecto
 | `max_input_size` | 16 MiB of input/output; also bounds copied string data |
 | `max_depth` | 32 nested levels |
 | `max_collection_size` | 10,000 members per array or object |
-| `max_nodes` | 200,000 JSON/CBOR values |
+| `max_nodes` | 200,000 JSON/CBOR values or XML parsing nodes |
 | `max_binary_size` | 1 MiB per decoded binary value |
 | `max_violations` | 1,000 diagnostics |
 
-Pass overrides to `parse`, `validate`, `parse_cbor`, or model constructors. Limits are positive integers. Resource-limit failures raise `LimitError` even in inspection mode. Malformed/duplicate-key JSON raises `ParseError`; cycles, nonfinite numbers, invalid string encodings, and non-JSON Ruby objects are rejected. Diagnostics identify properties and rules without including incident values.
+Pass overrides to `parse`, `validate`, `parse_cbor`, `parse_xml`, or model constructors. Limits are positive integers. Resource-limit failures raise `LimitError` even in inspection mode. Malformed/duplicate-key JSON raises `ParseError`; cycles, nonfinite numbers, invalid string encodings, and non-JSON Ruby objects are rejected. Diagnostics identify properties and rules without including incident values.
 
-## Optional CBOR
+## CBOR
 
-Install the optional `cbor` gem (`~> 0.5.10`), then:
+Load the built-in Ruby codec:
 
 ```ruby
 require "iodef/cbor"
@@ -68,25 +97,46 @@ copy = IODEF.parse_cbor(bytes)
 
 All 207 numeric map keys are supported. The encoder uses date tag 0, base64 byte-string tag 22, hexadecimal byte-string tag 23, and URI tag 32. Dates and URI spelling are preserved. Typed byte content becomes binary; hex output uses uppercase. The decoder also accepts contextually untagged strings/bytes, as used in the RFC's own CBOR examples. Integer bignums are preserved. IODEF real values are encoded as float32; values that would round or overflow raise `ConversionError`. Unknown JSON floats keep their original precision.
 
-Unknown CBOR tags, unassigned integer keys, and opaque byte strings without an IODEF type cannot be represented unambiguously in JSON and raise `ConversionError`. Duplicate/colliding keys, excessive nesting, large collections, and trailing data are rejected before native decoding. The optional native backend is tested on CRuby 3.3–4.0 and TruffleRuby. JRuby and CRuby 4.1 development builds support the JSON API; the current `cbor` extension uses a C API removed in CRuby 4.1 and cannot be built there.
+Unknown CBOR tags, unassigned integer keys, and opaque byte strings without an IODEF type cannot be represented unambiguously in JSON and raise `ConversionError`. Duplicate/colliding keys, invalid UTF-8, excessive nesting, large collections, and trailing data are rejected during bounded decoding. JSON and CBOR are tested on CRuby, JRuby, and TruffleRuby, including CRuby development builds. No separate CBOR gem is required.
+
+## XML
+
+```ruby
+require "iodef/xml"
+
+document = IODEF.parse_xml(xml)
+json = document.to_json
+xml = IODEF.parse(json).to_xml
+```
+
+XML conversion accepts UTF-8 input and uses the RFC 7970 namespace `urn:ietf:params:xml:ns:iodef-2.0`. It maps attributes, element text, repeated children, and the wrapper elements removed by the JSON binding. Namespace prefixes are resolved by URI. Inherited `xml:lang` and multilingual text are preserved; unqualified JSON multilingual strings mean English. XML output uses version `2.00`, including when the input JSON uses `2.0`.
+
+`parse_xml` accepts the same `strict: false` and `validate: false` inspection options as JSON parsing. Serialization validates again. Input size, depth, node count, and collection limits apply during XML parsing; serialized output is also bounded. DTDs and entity declarations are rejected, and no external resource is loaded.
+
+Round trips preserve supported IODEF data, not XML formatting, namespace prefix choices, comments, or the original grouping of wrapper elements. XML-valued extensions preserve their namespace-qualified content, but their XML strings and base64-encoded XML bytes may be reserialized. `RawData` supports an embedded XML document with `dtype="xml"`; attributes without a JSON counterpart and other raw encodings cannot be converted. XML Signature/X509 structures and unknown JSON properties without an unambiguous XML mapping raise `ConversionError`. Conversion does not verify or preserve digital signatures.
+
+Structured-information `Reference` values are not converted because RFC 7203 references the IODEF v1 XML namespace, while this API exchanges IODEF v2. An `AttackPattern` containing `Scoring` is also rejected because that child is not permitted by RFC 7203. These values remain available in JSON and CBOR.
+
+Numeric literals use Ruby integers and floats. Other consumers that apply XML Schema validation may round fields defined as `xs:float`.
 
 ## Scope
 
-| Supported in 0.1.0 | Outside 0.1.0 |
+| Supported | Outside this release |
 | --- | --- |
-| JSON binding, all RFC 8727 class/property definitions | RFC 7970 XML import/export |
+| JSON binding, all RFC 8727 class/property definitions | Ambiguous binary XML structures and vendor extension semantics |
 | Typed core models, multilingual text, builders | RID or other exchange transports |
-| IODEF enum extensions and preserved unknown JSON fields | Vendor extension semantics |
-| Optional CBOR, numeric keys, typed binary values | Signing, encryption, threat correlation |
+| RFC 7970 XML conversion and IODEF enum extensions | XML Schema validation and XML Signature conversion |
+| Preserved unknown JSON fields in JSON/CBOR | Automatic XML mapping of unknown JSON fields |
+| CBOR, numeric keys, typed binary values | Signing, encryption, threat correlation |
 | RBS signatures and bounded validation | Authenticating senders or verifying referenced evidence |
 
-The implementation has independent, MIT-licensed property metadata in `data/`. It does not embed CDDL, JSON Schema, RFC examples, IANA source downloads, or third-party implementation code. CDDL is a development-only conformance oracle fetched into ignored `tmp/`; it is not a runtime dependency.
+The property metadata in `data/` describes the RFC field names, types, cardinalities, and protocol identifiers. CDDL, JSON Schema, RFC examples, and IANA source downloads are not embedded in the package. Tests inspect the downloaded CDDL as reference data; no third-party CDDL or CBOR implementation is loaded.
 
 ### Specification differences
 
-RFC 8727's CDDL has a verified missing-brace correction ([erratum 7334](https://www.rfc-editor.org/errata/eid7334)). The generated test oracle applies it. Its section 4.2 JSON example needs presentation-wrapped strings joined; the original text is retained beside the corrected fixture. Both complete JSON and CBOR examples are tested.
+RFC 8727's CDDL has a verified missing-brace correction ([erratum 7334](https://www.rfc-editor.org/errata/eid7334)). The temporary reference schema applies it. Its section 4.2 JSON example needs presentation-wrapped strings joined; the original text is retained beside the corrected fixture. Both complete JSON and CBOR examples are tested.
 
-The JSON examples use version `2.0`; the XML information model uses `2.00`. Both spellings are accepted and preserved. Required nonempty child groups and conditional values follow RFC 7970: nonnumeric `Confidence` omits `value`, numeric confidence requires it; a node can include both addresses and domain data; `HashData` supports `ext-scope`. `RelatedActivity.Description` accepts multilingual strings. These constraints are not all accurately expressed in the RFC 8727 CDDL. The section 2.2.5 illustration uses a CWE `SpecID` absent from its normative enum: use `private` with `ext-SpecID` for that extension.
+The JSON examples use version `2.0`; the XML information model uses `2.00`. JSON and CBOR accept and preserve both spellings; XML output uses `2.00`. Required nonempty child groups and conditional values follow RFC 7970: nonnumeric `Confidence` omits `value`, numeric confidence requires it; a node can include both addresses and domain data; `HashData` supports `ext-scope`. `RelatedActivity.Description` accepts multilingual strings. These constraints are not all accurately expressed in the RFC 8727 CDDL. The section 2.2.5 illustration uses a CWE `SpecID` absent from its normative enum: use `private` with `ext-SpecID` for that extension.
 
 The pinned IANA registry and RFC have differing spellings for `breach-propietary` / `breach-proprietary`, `anonymization` / `anomyzation`, and `ntp-stamp` / `ntpstamp`; both are accepted. RFC 8727 additionally defines the `json` extension data type. This library validates format and structure, not whether a reported address, software identifier, or incident fact is authentic.
 
@@ -96,16 +146,18 @@ The pinned IANA registry and RFC have differing spellings for `breach-propietary
 bundle install
 bundle exec rake test
 COVERAGE=1 bundle exec rake test
-bundle exec rubocop
 bundle exec rbs -I sig validate
-bundle exec ruby script/interop.rb
 bundle exec ruby script/benchmark.rb 5000
 ```
 
-The fixture task verifies SHA-256-pinned RFC/IANA sources, retains source notices, and regenerates examples under ignored `tmp/rfc/`. Interoperability checks validate the two complete examples against downloaded CDDL and exchange CBOR with a pinned Python `cbor2` implementation, also kept under ignored `tmp/` with its license. The property table is checked against every CDDL object definition, and tests cover malformed values, enum extensions, limits, randomized round trips, and numeric precision.
+The fixture task verifies SHA-256-pinned RFC/IANA sources, retains source notices, and regenerates examples under ignored `tmp/rfc/`. Tests check both complete RFC JSON and CBOR examples, both complete RFC 7970 XML documents, every CDDL object property, and the numeric map assignments. The printed XML campaign example uses the unregistered `fqdn` value; its derived fixture uses `domain-name` as described in [reported erratum 6163](https://www.rfc-editor.org/errata/eid6163), while the original remains a negative test. Original wire-format tests cover integer widths, floating-point precision, UTF-8 chunk boundaries, duplicate keys, tags, malformed values, limits, and randomized round trips. XML tests cover namespaces, language inheritance, escaping, DTD rejection, and bounded parsing. Reference data keeps its own license and notices even though it is not distributed with the gem.
 
 `script/update_registry.rb` audits the pinned IANA metadata. `--refresh` downloads the current registry, rejects unexplained differences, and updates its checksum only after the audit succeeds. Review RFC errata and registry changes before refreshing. No downloaded reference material is tracked or included in the gem.
 
+## Contributing
+
+Bug reports and pull requests are welcome on [GitHub](https://github.com/ydah/iodef/issues). See [Development](#development) for the checks to run before submitting a change. Report security vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
 ## License
 
-MIT. See [LICENSE.txt](LICENSE.txt). Optional dependencies and temporary development references retain their own licenses.
+Project code is MIT licensed; see [LICENSE.txt](LICENSE.txt). Added library dependencies are limited to MIT-licensed libraries. Ruby implementations and standard/default libraries (including JSON and REXML) are exceptions and retain their own licenses. Downloaded standards material is test reference data under its source terms and is neither committed nor packaged. These statements do not relicense third-party material.

data/SECURITY.md

@@ -4,4 +4,4 @@ Report suspected vulnerabilities privately through [GitHub's vulnerability repor
 
 IODEF documents contain untrusted, potentially sensitive content. This library validates representation and selected information-model rules; it does not authenticate reports or enforce disclosure restrictions. Apply authorization, transport encryption, retention policies, and trusted source selection in the calling application. Do not execute embedded scripts, XML, regexes, or extension payloads. The library itself never fetches document-supplied URLs or schemas.
 
-Size, depth, node, collection, binary, and diagnostic limits apply by default. Increase them only for known workloads. The optional native CBOR backend should be kept updated; only the IODEF tag set is allowed before it receives input. Invalid or ambiguous CBOR values fail instead of silently dropping information.
+Size, depth, node, collection, binary, and diagnostic limits apply by default. Increase them only for known workloads. The Ruby CBOR decoder checks bounds while reading and accepts only the IODEF tag set. It never evaluates tags as application code. Invalid or ambiguous CBOR values fail instead of silently dropping information.

data/data/enums.yml

@@ -1,4 +1,4 @@
-# Protocol identifiers, maintained independently from RFC source code and schemas.
+# Protocol identifiers used by the information model.
 restriction: [public, partner, need-to-know, private, default, white, green, amber, red, ext-value]
 purpose: [traceback, mitigation, reporting, watch, other, ext-value]
 status: [new, in-progress, forwarded, resolved, future, ext-value]

data/data/types.yml

@@ -1,4 +1,4 @@
-# Independently maintained implementation metadata. Sections refer to RFC 7970;
+# Implementation metadata. Sections refer to RFC 7970;
 # JSON cardinalities and property spellings follow RFC 8727 sections 2 and 3.
 # A trailing ! requires a property; [] denotes a nonempty list when present.
 groups:

data/lib/iodef/binary_cbor.rb

@@ -0,0 +1,285 @@
+# frozen_string_literal: true
+
+module Iodef
+  # Internal wire codec. RFC 8949 sections 3.1–3.4 define the byte format;
+  # application-specific tag meanings belong to the caller.
+  module BinaryCBOR
+    class Error < StandardError; end
+    class LimitError < Error; end
+    class UnsupportedError < Error; end
+    Tagged = Struct.new(:tag, :value)
+    Simple = Struct.new(:value)
+    Float32 = Struct.new(:value)
+
+    def self.decode(bytes, **options)
+      Decoder.new(bytes, **options).read
+    end
+
+    def self.encode(value, **options)
+      Encoder.new(**options).write(value)
+    end
+
+    class Decoder
+      DEFAULTS = { max_input_size: 16_777_216, max_depth: 32, max_nodes: 1_000_000, max_collection_size: 200_000,
+                   max_string_size: 16_777_216, max_binary_size: 16_777_216, allowed_tags: nil, allow_indefinite_strings: true,
+                   max_records: nil, max_record_bytes: nil }.freeze
+
+      def initialize(bytes, **options)
+        @limits = DEFAULTS.merge(options)
+        raise Error, "CBOR input must be a String" unless bytes.is_a?(String)
+        raise LimitError, "CBOR exceeds max_input_size" if bytes.bytesize > @limits[:max_input_size]
+
+        @bytes = bytes
+        @offset = 0
+        @nodes = 0
+      end
+
+      def read
+        value = read_value(0)
+        raise Error, "trailing CBOR input" unless @offset == @bytes.bytesize
+
+        value
+      end
+
+      private
+
+      def take(size)
+        raise Error, "truncated CBOR input" if size > @bytes.bytesize - @offset
+        if @record_start && @limits[:max_record_bytes] && @offset + size - @record_start > @limits[:max_record_bytes]
+          raise LimitError, "CBOR record exceeds max_record_bytes"
+        end
+
+        result = @bytes.byteslice(@offset, size)
+        @offset += size
+        result
+      end
+
+      def argument(info)
+        return info if info < 24
+        return nil if info == 31
+
+        format = { 24 => [1, "C"], 25 => [2, "n"], 26 => [4, "N"], 27 => [8, "Q>"] }[info]
+        raise Error, "reserved CBOR additional information" unless format
+
+        take(format[0]).unpack1(format[1])
+      end
+
+      def read_value(depth)
+        @nodes += 1
+        raise LimitError, "CBOR exceeds max_nodes" if @nodes > @limits[:max_nodes]
+        raise LimitError, "CBOR exceeds max_depth" if depth > @limits[:max_depth]
+
+        initial = take(1).getbyte(0)
+        major, info = initial.divmod(32)
+        return read_simple(info) if major == 7
+
+        size = argument(info)
+        raise Error, "indefinite CBOR integer or tag" if size.nil? && [0, 1, 6].include?(major)
+
+        case major
+        when 0 then size
+        when 1 then -1 - size
+        when 2, 3 then read_string(major, size, depth)
+        when 4, 5 then read_collection(major, size, depth)
+        when 6
+          raise UnsupportedError, "unsupported CBOR tag" if @limits[:allowed_tags] && !@limits[:allowed_tags].include?(size)
+
+          Tagged.new(size, read_value(depth + 1))
+        end
+      end
+
+      def read_string(major, size, depth)
+        limit = @limits[:max_string_size]
+        limit = [limit, @limits[:max_binary_size]].min if major == 2
+        if size
+          raise LimitError, "CBOR string exceeds #{major == 2 ? "max_binary_size" : "max_string_size"}" if size > limit
+
+          value = take(size).dup
+          value.force_encoding(major == 2 ? Encoding::BINARY : Encoding::UTF_8)
+          raise Error, "invalid CBOR UTF-8 text" unless value.valid_encoding?
+
+          return value
+        end
+        raise Error, "CBOR strings must have definite length" unless @limits[:allow_indefinite_strings]
+
+        result = String.new(encoding: major == 2 ? Encoding::BINARY : Encoding::UTF_8)
+        until @bytes.getbyte(@offset) == 255
+          initial = @bytes.getbyte(@offset)
+          raise Error, "invalid indefinite CBOR string chunk" unless initial && initial.div(32) == major && (initial & 31) < 28
+
+          chunk = read_value(depth + 1)
+          raise LimitError, "CBOR string exceeds byte limit" if result.bytesize + chunk.bytesize > limit
+
+          result << chunk
+        end
+        take(1)
+        result
+      end
+
+      def read_collection(major, size, depth)
+        limit = @limits[:max_collection_size]
+        limit = [limit, @limits[:max_records]].min if depth.zero? && @limits[:max_records]
+        raise LimitError, "CBOR exceeds collection limit" if size && size > limit
+
+        result = major == 4 ? [] : {}
+        count = 0
+        until size ? count == size : @bytes.getbyte(@offset) == 255
+          raise LimitError, "CBOR exceeds collection limit" if count >= limit
+
+          @record_start = @offset if depth.zero? && @limits[:max_record_bytes]
+          if major == 4
+            result << read_value(depth + 1)
+          else
+            key = read_value(depth + 1)
+            unless key.is_a?(Integer) || (key.is_a?(String) && key.encoding == Encoding::UTF_8)
+              raise UnsupportedError, "CBOR map keys must be text or integers"
+            end
+            raise Error, "duplicate CBOR map key" if result.key?(key)
+
+            result[key] = read_value(depth + 1)
+          end
+          @record_start = nil if depth.zero?
+          count += 1
+        end
+        take(1) unless size
+        result
+      end
+
+      def read_simple(info)
+        case info
+        when 20 then false
+        when 21 then true
+        when 22 then nil
+        when 0..19, 23 then Simple.new(info)
+        when 24
+          value = take(1).getbyte(0)
+          raise Error, "reserved CBOR simple value" if value < 32
+
+          Simple.new(value)
+        when 25 then half(take(2).unpack1("n"))
+        when 26 then take(4).unpack1("g")
+        when 27 then take(8).unpack1("G")
+        else raise Error, "reserved CBOR value or unexpected break"
+        end
+      end
+
+      def half(bits)
+        exponent = (bits >> 10) & 31
+        fraction = bits & 1023
+        magnitude = if exponent == 31
+                      fraction.zero? ? Float::INFINITY : Float::NAN
+                    elsif exponent.zero?
+                      Math.ldexp(fraction.to_f, -24)
+                    else
+                      Math.ldexp((1024 + fraction).to_f, exponent - 25)
+                    end
+        bits[15].zero? ? magnitude : -magnitude
+      end
+    end
+
+    class Encoder
+      def initialize(max_output_size: 16_777_216, max_depth: 128)
+        @max_output_size = max_output_size
+        @max_depth = max_depth
+        @buffer = String.new(encoding: Encoding::BINARY)
+      end
+
+      def write(value)
+        append_value(value, 0)
+        @buffer
+      end
+
+      private
+
+      def append(bytes)
+        raise LimitError, "CBOR output exceeds max_input_size" if @buffer.bytesize + bytes.bytesize > @max_output_size
+
+        @buffer << bytes.b
+      end
+
+      def header(major, number)
+        raise Error, "CBOR argument outside unsigned 64-bit range" unless number.is_a?(Integer) && number.between?(0, (2**64) - 1)
+
+        case number
+        when 0...24 then append([(major << 5) | number].pack("C"))
+        when 24..255 then append([(major << 5) | 24, number].pack("CC"))
+        when 256..65_535 then append([(major << 5) | 25, number].pack("Cn"))
+        when 65_536..4_294_967_295 then append([(major << 5) | 26, number].pack("CN"))
+        else append([(major << 5) | 27, number].pack("CQ>"))
+        end
+      end
+
+      def append_value(value, depth)
+        raise LimitError, "CBOR output exceeds max_depth" if depth > @max_depth
+
+        case value
+        when Integer then append_integer(value)
+        when Float then append_float(value)
+        when Float32 then append("\xfa".b + [value.value].pack("g"))
+        when String then append_string(value)
+        when Array
+          header(4, value.length)
+          value.each { |item| append_value(item, depth + 1) }
+        when Hash
+          header(5, value.length)
+          value.each { |key, item| append_value(key, depth + 1); append_value(item, depth + 1) }
+        when Tagged
+          header(6, value.tag)
+          append_value(value.value, depth + 1)
+        when Simple
+          raise Error, "invalid CBOR simple value" unless value.value.is_a?(Integer) && (value.value.between?(0, 23) || value.value.between?(32, 255))
+
+          header(7, value.value)
+        when TrueClass then append("\xf5".b)
+        when FalseClass then append("\xf4".b)
+        when NilClass then append("\xf6".b)
+        else raise Error, "unsupported CBOR value type"
+        end
+      end
+
+      def append_integer(value)
+        magnitude = value.negative? ? -1 - value : value
+        return header(value.negative? ? 1 : 0, magnitude) if magnitude < 2**64
+
+        header(6, value.negative? ? 3 : 2)
+        hex = magnitude.to_s(16)
+        hex = "0#{hex}" if hex.length.odd?
+        append_string([hex].pack("H*"))
+      end
+
+      def append_float(value)
+        half = half_bits(value)
+        return append("\xf9".b + [half].pack("n")) if half
+
+        single = [value].pack("g")
+        append(single.unpack1("g") == value ? "\xfa".b + single : "\xfb".b + [value].pack("G"))
+      end
+
+      def half_bits(value)
+        return 0x7e00 if value.nan?
+
+        sign = value.negative? || (value.zero? && (1.0 / value).negative?) ? 0x8000 : 0
+        return sign | 0x7c00 if value.infinite?
+        return sign if value.zero?
+
+        significand, exponent = Math.frexp(value.abs)
+        if exponent < -13
+          fraction = Math.ldexp(value.abs, 24)
+          return sign | fraction.to_i if fraction == fraction.to_i
+        elsif exponent <= 16
+          fraction = significand * 2048 - 1024
+          return sign | ((exponent + 14) << 10) | fraction.to_i if fraction == fraction.to_i
+        end
+        nil
+      end
+
+      def append_string(value)
+        binary = value.encoding == Encoding::BINARY
+        raise Error, "invalid CBOR UTF-8 text" unless binary || (value.valid_encoding? && (value.encoding == Encoding::UTF_8 || value.ascii_only?))
+
+        header(binary ? 2 : 3, value.bytesize)
+        append(value)
+      end
+    end
+  end
+end

data/lib/iodef/cbor.rb

@@ -1,21 +1,13 @@
 # frozen_string_literal: true
 
 require "iodef"
-require "cbor"
+require_relative "binary_cbor"
 require_relative "cbor_guard"
 
 module Iodef
   module CBORCodec
     module_function
 
-    Float32 = Struct.new(:value) do
-      def to_cbor(packer)
-        packer.buffer.write("\xfa".b + [value].pack("g"))
-        packer
-      end
-    end
-    private_constant :Float32
-
     def encode(value, type = "Document")
       return value.map { |item| encode(item, type.delete_suffix("[]")) } if type.end_with?("[]")
 
@@ -28,16 +20,16 @@ module Iodef
         end
       end
       return value.map { |item| encode(item, "any") } if value.is_a?(Array)
-      return CBOR::Tagged.new(22, value.unpack1("m0").b) if type == "binary"
-      return CBOR::Tagged.new(23, [value].pack("H*").b) if type == "hex"
-      return CBOR::Tagged.new(0, value) if type == "datetime"
-      return CBOR::Tagged.new(32, value) if type == "uri"
+      return BinaryCBOR::Tagged.new(22, value.unpack1("m0").b) if type == "binary"
+      return BinaryCBOR::Tagged.new(23, [value].pack("H*").b) if type == "hex"
+      return BinaryCBOR::Tagged.new(0, value) if type == "datetime"
+      return BinaryCBOR::Tagged.new(32, value) if type == "uri"
 
       if %w[number positive].include?(type)
         rounded = [value].pack("g").unpack1("g")
         raise ConversionError, "IODEF CBOR real values must be exactly representable as float32" unless rounded.finite? && rounded == value
 
-        return Float32.new(rounded)
+        return BinaryCBOR::Float32.new(rounded)
       end
       value
     end
@@ -49,11 +41,11 @@ module Iodef
       return decode_object(value, type, path) if value.is_a?(Hash)
       return value.each_with_index.map { |item, index| decode(item, "any", Iodef.pointer(path, index)) } if value.is_a?(Array)
 
-      if value.is_a?(CBOR::Tagged) && [253, 254].include?(value.tag)
+      if value.is_a?(BinaryCBOR::Tagged) && [2, 3].include?(value.tag)
         raise ConversionError, "bignum tag requires a byte string at #{path}" unless value.value.is_a?(String) && value.value.encoding == Encoding::BINARY
 
         magnitude = value.value.empty? ? 0 : value.value.unpack1("H*").to_i(16)
-        value = value.tag == 254 ? -1 - magnitude : magnitude
+        value = value.tag == 3 ? -1 - magnitude : magnitude
       end
       case type
       when "binary" then decode_tag(value, 22, path) { |bytes| [bytes].pack("m0") }
@@ -61,7 +53,7 @@ module Iodef
       when "datetime" then decode_tag(value, 0, path) { |text| text }
       when "uri" then decode_tag(value, 32, path) { |text| text }
       else
-        if value.is_a?(CBOR::Tagged) || value.is_a?(CBOR::Simple) || (value.is_a?(String) && value.encoding == Encoding::BINARY)
+        if value.is_a?(BinaryCBOR::Tagged) || value.is_a?(BinaryCBOR::Simple) || (value.is_a?(String) && value.encoding == Encoding::BINARY)
           raise ConversionError, "CBOR value has no unambiguous JSON representation at #{path}"
         end
 
@@ -97,7 +89,7 @@ module Iodef
       binary = [22, 23].include?(tag)
       return yield(value) if value.is_a?(String) && (value.encoding == Encoding::BINARY) == binary
 
-      valid = value.is_a?(CBOR::Tagged) && value.tag == (tag == 32 ? 255 : tag) && value.value.is_a?(String)
+      valid = value.is_a?(BinaryCBOR::Tagged) && value.tag == tag && value.value.is_a?(String)
       valid &&= (value.value.encoding == Encoding::BINARY) == [22, 23].include?(tag)
       raise ConversionError, "expected CBOR tag #{tag} at #{path}" unless valid
 
@@ -111,21 +103,22 @@ module Iodef
       raise ParseError, "CBOR input must be a String" unless bytes.is_a?(String)
       raise LimitError, "input exceeds max_input_size" if bytes.bytesize > options[:max_input_size]
 
-      guarded = CBORGuard.new(bytes, options).validate!
-      data = CBORCodec.decode(CBOR.decode(guarded))
+      data = CBORCodec.decode(CBORGuard.new(bytes, options).validate!)
       Document.new(data, strict: strict && validate, **options)
-    rescue CBOR::UnpackError, CBOR::TypeError, EOFError, EncodingError
-      raise ParseError, "invalid CBOR input"
     end
   end
 
   class Document
     def to_cbor
       validate!
-      bytes = CBOR.encode(CBORCodec.encode(to_h))
+      bytes = BinaryCBOR.encode(CBORCodec.encode(to_h), max_output_size: limits[:max_input_size])
       raise LimitError, "output exceeds max_input_size" if bytes.bytesize > limits[:max_input_size]
 
       bytes
+    rescue BinaryCBOR::LimitError => e
+      raise LimitError, e.message
+    rescue BinaryCBOR::Error => e
+      raise ConversionError, e.message
     end
   end
 end