iodef 0.1.0

data/lib/iodef/cbor_guard.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+module Iodef
+  # Bounds allocations and rejects duplicate keys before the native decoder builds objects.
+  class CBORGuard
+    def initialize(bytes, limits)
+      @bytes = bytes
+      @limits = limits
+      @offset = 0
+      @nodes = 0
+      @preserved_tags = []
+    end
+
+    def validate!
+      item(0)
+      raise ParseError, "trailing CBOR input" unless @offset == @bytes.bytesize
+
+      # Preserve URI spelling and avoid backend-specific bignum conversion.
+      @preserved_tags.reverse_each.with_object(@bytes.dup) do |(offset, size, tag), bytes|
+        bytes[offset, size] = [0xd8, tag].pack("C*")
+      end
+    end
+
+    private
+
+    def byte
+      result = @bytes.getbyte(@offset)
+      raise ParseError, "truncated CBOR input" unless result
+
+      @offset += 1
+      result
+    end
+
+    def take(length)
+      raise ParseError, "truncated CBOR input" if length > @bytes.bytesize - @offset
+
+      start = @offset
+      @offset += length
+      @bytes.byteslice(start, length)
+    end
+
+    def argument(info)
+      return info if info < 24
+      return nil if info == 31
+
+      width = { 24 => 1, 25 => 2, 26 => 4, 27 => 8 }[info]
+      raise ParseError, "reserved CBOR additional information" unless width
+
+      take(width).unpack1({ 1 => "C", 2 => "n", 4 => "N", 8 => "Q>" }.fetch(width))
+    end
+
+    def item(depth)
+      @nodes += 1
+      raise LimitError, "CBOR exceeds max_nodes" if @nodes > @limits[:max_nodes]
+      raise LimitError, "CBOR exceeds max_depth" if depth > @limits[:max_depth]
+
+      start = @offset
+      initial = byte
+      major = initial >> 5
+      info = initial & 31
+      length = argument(info)
+      case major
+      when 0, 1
+        raise ParseError, "indefinite CBOR integer" unless length
+      when 2, 3 then string(major, length, depth)
+      when 4, 5 then collection(major, length, depth)
+      when 6
+        raise ParseError, "indefinite CBOR tag" unless length
+        raise ConversionError, "unsupported CBOR tag" unless [0, 2, 3, 22, 23, 32].include?(length)
+
+        @preserved_tags << [start, @offset - start, { 2 => 253, 3 => 254, 32 => 255 }.fetch(length)] if [2, 3, 32].include?(length)
+        item(depth + 1)
+      when 7
+        raise ParseError, "unexpected CBOR break" if info == 31
+      end
+    end
+
+    def string(major, length, depth)
+      if length
+        take(length)
+        raise LimitError, "binary exceeds max_binary_size" if major == 2 && length > @limits[:max_binary_size]
+
+        length
+      else
+        total = 0
+        until @bytes.getbyte(@offset) == 255
+          initial = @bytes.getbyte(@offset)
+          raise ParseError, "invalid indefinite CBOR string chunk" unless initial && (initial >> 5) == major && (initial & 31) < 28
+
+          total += item(depth + 1)
+          raise LimitError, "binary exceeds max_binary_size" if major == 2 && total > @limits[:max_binary_size]
+        end
+        byte
+        total
+      end
+    end
+
+    def collection(major, length, depth)
+      raise LimitError, "CBOR exceeds max_collection_size" if length && length > @limits[:max_collection_size]
+
+      count = 0
+      keys = {}
+      until length ? count == length : @bytes.getbyte(@offset) == 255
+        count += 1
+        raise LimitError, "CBOR exceeds max_collection_size" if count > @limits[:max_collection_size]
+
+        if major == 5
+          start = @offset
+          initial = @bytes.getbyte(start)
+          raise ConversionError, "CBOR map keys must be text or integers" unless initial && [0, 1, 3].include?(initial >> 5)
+
+          item(depth + 1)
+          key = CBOR.decode(@bytes.byteslice(start, @offset - start))
+          raise ParseError, "duplicate CBOR map key" if keys.key?(key)
+
+          keys[key] = true
+        end
+        item(depth + 1)
+      end
+      byte unless length
+    end
+  end
+end

data/lib/iodef/errors.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Iodef
+  Violation = Data.define(:pointer, :rule, :message)
+
+  class Error < StandardError; end
+  class ParseError < Error; end
+  class ConversionError < Error; end
+
+  class ValidationError < Error
+    attr_reader :violations, :pointer
+
+    def initialize(message = "invalid IODEF document", pointer: "", violations: [])
+      @violations = violations.freeze
+      @pointer = violations.first&.pointer || pointer
+      super("#{message} at #{@pointer.empty? ? "/" : @pointer}")
+    end
+  end
+
+  class LimitError < ValidationError; end
+end

data/lib/iodef/model.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+module Iodef
+  # Mutable typed views share their document; exported hashes are independent copies.
+  class Model
+    attr_reader :limits, :warnings
+
+    def self.schema_type
+      name.split("::").last
+    end
+
+    def initialize(data = {}, strict: true, **limits)
+      @limits = Iodef.limits(limits)
+      @data = Iodef.copy(data, @limits)
+      raise ValidationError, "model must be an object" unless @data.is_a?(Hash)
+
+      @warnings = Validator.new(**@limits).validate(@data, type: self.class.schema_type)
+      validate! if strict && !@warnings.empty?
+    end
+
+    def self.view(data, limits)
+      allocate.tap do |model|
+        model.instance_variable_set(:@data, data)
+        model.instance_variable_set(:@limits, limits)
+        model.instance_variable_set(:@warnings, [].freeze)
+      end
+    end
+
+    def [](key)
+      @data[key.to_s]
+    end
+
+    def []=(key, value)
+      @data[key.to_s] = Iodef.copy(value, limits)
+    end
+
+    def delete(key)
+      @data.delete(key.to_s)
+    end
+
+    def to_h
+      Iodef.copy(@data, limits)
+    end
+
+    def validate!
+      @warnings = Validator.new(**limits).validate(@data, type: self.class.schema_type)
+      raise ValidationError.new(violations: @warnings) unless @warnings.empty?
+
+      self
+    end
+
+    def to_json(options = nil)
+      validate!
+      json = Iodef.generate_json(@data, options)
+      raise LimitError, "output exceeds max_input_size" if json.bytesize > limits[:max_input_size]
+
+      json
+    end
+
+    def description
+      MultilingualText.new(@data.fetch("Description", []), lang: @data["lang"])
+    end
+
+    def description=(value)
+      self["Description"] = value
+    end
+
+    def self.accessors
+      SCHEMA.fetch(schema_type).fetch("fields").each do |field, descriptor|
+        method = field.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').gsub(/([a-z\d])([A-Z])/, '\1_\2').tr("-", "_").downcase
+        next if method == "description"
+
+        define_method(method) { read_field(field, descriptor.delete_suffix("!")) }
+        define_method("#{method}=") { |value| self[field] = value }
+      end
+    end
+
+    private
+
+    def read_field(field, descriptor)
+      value = @data[field]
+      return value unless value
+
+      if descriptor.end_with?("[]") && value.is_a?(Array)
+        value.map { |item| wrap(item, descriptor.delete_suffix("[]")) }
+      else
+        wrap(value, descriptor)
+      end
+    end
+
+    def wrap(value, type)
+      klass = TYPED[type]
+      klass && value.is_a?(Hash) ? klass.view(value, limits) : value
+    end
+  end
+
+  class Document < Model
+    def self.build(lang: nil, **limits)
+      data = { "version" => "2.0", "Incident" => [] }
+      data["lang"] = lang if lang
+      document = new(data, strict: false, **limits)
+      yield document
+      document.validate!
+    end
+
+    def incidents
+      read_field("Incident", "Incident[]") || []
+    end
+
+    def add_incident(purpose:, **attributes)
+      value = { "purpose" => purpose }.merge(attributes.transform_keys(&:to_s))
+      incident = Incident.view(Iodef.copy(value, limits), limits)
+      yield incident if block_given?
+      @data["Incident"] ||= []
+      @data["Incident"] << incident.instance_variable_get(:@data)
+      incident
+    end
+  end
+
+  class Incident < Model
+    def contacts
+      read_field("Contact", "Contact[]") || []
+    end
+
+    def assessments
+      read_field("Assessment", "Assessment[]") || []
+    end
+
+    def indicators
+      read_field("Indicator", "Indicator[]") || []
+    end
+
+    def add_contact(role:, type:, **attributes)
+      value = { "role" => role, "type" => type }.merge(attributes.transform_keys(&:to_s))
+      contact = Contact.view(Iodef.copy(value, limits), limits)
+      yield contact if block_given?
+      @data["Contact"] ||= []
+      @data["Contact"] << contact.instance_variable_get(:@data)
+      contact
+    end
+  end
+
+  class Contact < Model; end
+  class Assessment < Model; end
+  class EventData < Model; end
+  class Indicator < Model; end
+
+  TYPED = [Document, Incident, Contact, Assessment, EventData, Indicator].to_h { |klass| [klass.schema_type, klass] }.freeze
+  TYPED.each_value(&:accessors)
+
+  class MultilingualText
+    include Enumerable
+
+    def initialize(values, lang: nil)
+      @values = values.is_a?(Array) ? values : [values]
+      @lang = lang
+    end
+
+    def each(&)
+      @values.each(&)
+    end
+
+    # Exact matches win; a language prefix and then an unlabelled value are fallbacks.
+    def text(language = nil)
+      values = @values.map { |value| value.is_a?(String) ? { "value" => value, "lang" => @lang } : value }
+      language = language&.downcase
+      selected = values.find { |value| value["lang"]&.downcase == language } if language
+      selected ||= values.find { |value| value["lang"].to_s.downcase.split("-").first == language.split("-").first } if language
+      selected ||= values.find { |value| value["lang"].nil? || value["lang"].empty? }
+      (selected || values.first)&.fetch("value", nil)
+    end
+
+    def to_a
+      Iodef.copy(@values)
+    end
+  end
+end

data/lib/iodef/types.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+module Iodef
+  DEFAULT_LIMITS = { max_input_size: 16 * 1024 * 1024, max_depth: 32, max_collection_size: 10_000,
+                     max_nodes: 200_000, max_binary_size: 1024 * 1024, max_violations: 1000 }.freeze
+
+  class << self
+    def limits(options)
+      unknown = options.keys - DEFAULT_LIMITS.keys
+      raise ArgumentError, "unknown limits: #{unknown.join(", ")}" unless unknown.empty?
+
+      DEFAULT_LIMITS.merge(options).tap do |result|
+        result.each_value { |value| raise ArgumentError, "limits must be positive integers" unless value.is_a?(Integer) && value.positive? }
+      end.freeze
+    end
+
+    def pointer(parent, key)
+      "#{parent}/#{key.to_s.gsub("~", "~0").gsub("/", "~1")}"
+    end
+
+    def freeze_tree(value)
+      case value
+      when Hash then value.each do |key, item|
+        freeze_tree(key)
+        freeze_tree(item)
+      end
+      when Array then value.each { |item| freeze_tree(item) }
+      end
+      value.freeze
+    end
+
+    def copy(value, options = DEFAULT_LIMITS, depth: 0, path: "", ancestors: [], budget: [0, 0])
+      budget[0] += 1
+      raise LimitError.new("value exceeds max_nodes", pointer: path) if budget[0] > options[:max_nodes]
+
+      value = value.to_h if value.is_a?(Model)
+      case value
+      when Hash, Array
+        raise LimitError.new("value exceeds max_depth", pointer: path) if depth >= options[:max_depth]
+        raise LimitError.new("collection exceeds max_collection_size", pointer: path) if value.size > options[:max_collection_size]
+        raise ValidationError.new("cyclic input", pointer: path) if ancestors.include?(value.object_id)
+
+        nested = { depth: depth + 1, ancestors: ancestors + [value.object_id], budget: budget }
+        if value.is_a?(Array)
+          value.each_with_index.map { |item, index| copy(item, options, path: pointer(path, index), **nested) }
+        else
+          value.each_with_object({}) do |(key, item), result|
+            unless (key.is_a?(String) || key.is_a?(Symbol)) && Types.string?(key.to_s)
+              raise ValidationError.new("object keys must be UTF-8 strings", pointer: path)
+            end
+
+            key = key.to_s
+            budget[1] += key.bytesize
+            raise LimitError.new("value exceeds max_input_size", pointer: path) if budget[1] > options[:max_input_size]
+
+            location = pointer(path, key)
+            raise ValidationError.new("duplicate object key", pointer: location) if result.key?(key)
+
+            result[key.dup.force_encoding(Encoding::UTF_8)] = copy(item, options, path: location, **nested)
+          end
+        end
+      when String
+        budget[1] += value.bytesize
+        raise LimitError.new("value exceeds max_input_size", pointer: path) if budget[1] > options[:max_input_size]
+        raise ValidationError.new("invalid UTF-8 string", pointer: path) unless Types.string?(value)
+
+        value.dup.force_encoding(Encoding::UTF_8)
+      when Float
+        raise ValidationError.new("non-finite number", pointer: path) unless value.finite?
+
+        value
+      when Integer, TrueClass, FalseClass, NilClass then value
+      else raise ValidationError.new("non-JSON value", pointer: path)
+      end
+    end
+
+    def generate_json(value, options = nil)
+      value = precise_floats(value) if RUBY_ENGINE == "truffleruby"
+      JSON.generate(value, options)
+    end
+
+    # TruffleRuby's Float#to_s may discard digits needed for a lossless JSON round trip.
+    def precise_floats(value)
+      case value
+      when Hash then value.transform_values { |item| precise_floats(item) }
+      when Array then value.map { |item| precise_floats(item) }
+      when Float
+        number = format("%.17g", value)
+        number += ".0" unless number.match?(/[.eE]/)
+        JSON::Fragment.new(number)
+      else value
+      end
+    end
+    private :precise_floats
+  end
+
+  schema = YAML.safe_load_file(File.expand_path("../../data/types.yml", __dir__))
+  SCHEMA = freeze_tree(schema.fetch("types").transform_values do |definition|
+    fields = definition.fetch("groups", []).each_with_object({}) { |group, result| result.merge!(schema.fetch("groups").fetch(group)) }
+    definition.merge("fields" => fields.merge(definition.fetch("fields")))
+  end)
+  ENUMS = freeze_tree(YAML.safe_load_file(File.expand_path("../../data/enums.yml", __dir__)))
+  map = YAML.safe_load_file(File.expand_path("../../data/mapkeys.yml", __dir__))
+  MAPKEYS = freeze_tree(map.fetch("names").split.each_with_index.to_h { |name, index| [name, index + map.fetch("first")] })
+  KEYNAMES = MAPKEYS.invert.freeze
+
+  module Types
+    module_function
+
+    def string?(value)
+      value.is_a?(String) && value.valid_encoding? && (value.encoding == Encoding::UTF_8 || value.ascii_only?)
+    end
+
+    def datetime?(value)
+      return false unless string?(value)
+
+      match = /\A(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?([Zz]|[+-]\d{2}:\d{2})\z/.match(value)
+      return false unless match
+
+      year, month, day, hour, minute, second = match.captures.first(6).map(&:to_i)
+      zone = match[7]
+      Date.valid_date?(year, month, day, Date::GREGORIAN) && hour < 24 && minute < 60 && second <= 60 &&
+        (zone.match?(/\A[zZ]\z/) || (zone[1, 2].to_i < 24 && zone[4, 2].to_i < 60))
+    end
+
+    def uri?(value)
+      string?(value) && value.ascii_only? && !value.match?(/%(?![0-9a-fA-F]{2})/) && !URI.parse(value).scheme.nil?
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def binary?(value)
+      string?(value) && value.match?(%r{\A(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?\z}) &&
+        [value.unpack1("m0")].pack("m0") == value
+    rescue ArgumentError
+      false
+    end
+
+    def portlist?(value)
+      return false unless string?(value) && value.match?(/\A\d+(?:-\d+)?(?:,\d+(?:-\d+)?)*\z/)
+
+      value.split(",").all? do |range|
+        ports = range.split("-").map(&:to_i)
+        ports.all? { |port| port <= 65_535 } && ports.first <= ports.last
+      end
+    end
+
+    def valid?(type, value)
+      return ENUMS.fetch(type).include?(value) if ENUMS.key?(type)
+
+      case type
+      when "string" then string?(value)
+      when "integer" then value.is_a?(Integer)
+      when "number" then value.is_a?(Numeric) && (!value.is_a?(Float) || value.finite?)
+      when "positive" then valid?("number", value) && value.positive?
+      when "id" then string?(value) && value.match?(/\A[A-Za-z_][A-Za-z0-9_.-]*\z/)
+      when "language" then string?(value) && (value.empty? || value.match?(/\A[A-Za-z]{1,8}(?:-[A-Za-z0-9]{1,8})*\z/))
+      when "timezone" then string?(value) && value.match?(/\A(?:Z|[+-](?:0\d|1[0-4]):[0-5]\d)\z/)
+      when "version" then %w[2.0 2.00].include?(value)
+      when "datetime" then datetime?(value)
+      when "uri" then uri?(value)
+      when "binary" then binary?(value)
+      when "portlist" then portlist?(value)
+      else false
+      end
+    end
+  end
+end