iodef 0.1.0

data/lib/iodef/validator.rb

@@ -0,0 +1,237 @@
+# frozen_string_literal: true
+
+module Iodef
+  class Validator
+    attr_reader :limits
+
+    def initialize(**limits)
+      @limits = Iodef.limits(limits)
+    end
+
+    def validate(value, type: "Document")
+      @violations = []
+      @ids = {}
+      @references = []
+      data = Iodef.copy(value, limits)
+      check_object(data, type, "")
+      if type == "Document"
+        @references.each do |id, path|
+          add(path, "reference", "reference has no matching identifier") unless @ids.key?(id)
+        end
+      end
+      @violations.freeze
+    rescue LimitError
+      raise
+    rescue ValidationError => e
+      [Violation.new(pointer: e.pointer, rule: "json", message: "value is not a finite UTF-8 JSON tree")].freeze
+    end
+
+    private
+
+    def add(path, rule, message)
+      return if @violations.size >= limits[:max_violations]
+
+      @violations << Violation.new(pointer: path.freeze, rule: rule.freeze, message: message.freeze)
+    end
+
+    def check_object(value, type, path)
+      return add(path, type, "expected an object") unless value.is_a?(Hash)
+
+      definition = SCHEMA.fetch(type)
+      definition.fetch("fields").each do |name, descriptor|
+        field_path = Iodef.pointer(path, name)
+        unless value.key?(name)
+          add(field_path, "required", "required property is absent") if descriptor.end_with?("!")
+          next
+        end
+        check_field(value[name], descriptor.delete_suffix("!"), field_path)
+      end
+      check_groups(value, definition, path)
+      check_extensions(value, definition, path)
+      check_semantics(value, type, path)
+    end
+
+    def check_field(value, type, path)
+      if type.end_with?("[]")
+        return add(path, type, "expected a nonempty array") unless value.is_a?(Array) && !value.empty?
+
+        value.each_with_index { |item, index| check_field(item, type.delete_suffix("[]"), Iodef.pointer(path, index)) }
+      elsif type == "mlstring"
+        unless value.is_a?(String)
+          if value.is_a?(Hash)
+            check_object(value, "MLString",
+                         path)
+          else
+            add(path, type, "expected a string or multilingual string object")
+          end
+        end
+      elsif SCHEMA.key?(type)
+        check_object(value, type, path)
+      else
+        add(path, type, "invalid #{type} value") unless Types.valid?(type, value)
+        if type == "binary" && value.is_a?(String) && (value.bytesize / 4 * 3) - value.count("=") > limits[:max_binary_size]
+          raise LimitError.new("binary data exceeds max_binary_size", pointer: path)
+        end
+      end
+    end
+
+    def check_groups(value, definition, path)
+      { "at_least_one" => (1..), "exactly_one" => (1..1), "at_most_one" => (0..1) }.each do |rule, count|
+        fields = definition[rule]
+        next unless fields
+
+        add(path, rule, "invalid combination of #{fields.join(", ")}") unless count.cover?(fields.count { |field| value.key?(field) })
+      end
+    end
+
+    def check_extensions(value, definition, path)
+      definition.fetch("fields").each_key do |name|
+        next unless name.start_with?("ext-")
+
+        original = name.delete_prefix("ext-")
+        # SpecID uses "private" for its extension selector, unlike ordinary enumerations.
+        marker = original == "SpecID" ? "private" : "ext-value"
+        if value[original] == marker
+          unless value[name].is_a?(String) && !value[name].empty?
+            add(Iodef.pointer(path, name), "extension",
+                "extension selector requires its companion property")
+          end
+        elsif value.key?(name)
+          add(Iodef.pointer(path, name), "extension", "extension property requires the extension selector")
+        end
+      end
+    end
+
+    def check_semantics(value, type, path)
+      register_identifiers(value, type, path)
+      case type
+      when "Document"
+        require_field(value, "private-enum-name", path) if value.key?("private-enum-id")
+      when "SoftwareReference"
+        require_field(value, "dtype", path) if value["spec-name"] == "custom"
+        check_typed_content(value, path)
+      when "Extension" then check_typed_content(value, path)
+      when "Confidence"
+        if value["rating"] == "numeric"
+          require_field(value, "value", path)
+        elsif value.key?("value")
+          add(Iodef.pointer(path, "value"), "confidence", "value is only allowed for a numeric rating")
+        end
+      when "HistoryItem", "Expectation"
+        require_field(value, "DefinedCOA", path) if value["action"] == "defined-coa"
+      when "NameServers" then check_name_server_addresses(value, path)
+      when "Service" then check_service(value, path)
+      when "EmailData" then check_headers(value, "EmailHeaderField", path, string: true)
+      when "HashData" then check_hash_data(value, path)
+      when "BulkObservable"
+        if value["type"] == "file-hash" && !value["BulkObservableFormat"].is_a?(Hash)
+          require_field(value, "BulkObservableFormat", path)
+        elsif value["type"] == "file-hash" && !value["BulkObservableFormat"].key?("Hash")
+          add("#{path}/BulkObservableFormat/Hash", "required", "file hashes require a hash description")
+        end
+      when "IndicatorExpression"
+        operands = %w[IndicatorExpression Observable uid-ref IndicatorReference].sum { |key| value[key].is_a?(Array) ? value[key].size : 0 }
+        add(path, "operator", "negation requires exactly one operand") if value["operator"] == "not" && operands != 1
+      end
+    end
+
+    def register_identifiers(value, type, path)
+      fields = SCHEMA.fetch(type).fetch("fields").key?("observable-id") ? ["observable-id"] : []
+      fields << "id" if type == "IndicatorID"
+      fields.each do |field|
+        next unless value[field].is_a?(String)
+
+        location = Iodef.pointer(path, field)
+        add(location, "identifier", "identifier is already defined") if @ids.key?(value[field]) && field == "observable-id"
+        @ids[value[field]] = location
+      end
+      refs = value["uid-ref"] if SCHEMA.fetch(type).fetch("fields").key?("uid-ref")
+      (refs.is_a?(Array) ? refs : [refs]).each_with_index do |id, index|
+        @references << [id, refs.is_a?(Array) ? Iodef.pointer(Iodef.pointer(path, "uid-ref"), index) : Iodef.pointer(path, "uid-ref")] if id.is_a?(String)
+      end
+    end
+
+    def require_field(value, name, path)
+      add(Iodef.pointer(path, name), "required", "required property is absent") unless value.key?(name)
+    end
+
+    def check_name_server_addresses(value, path)
+      return unless value["Address"].is_a?(Array)
+
+      value["Address"].each_with_index do |address, index|
+        next unless address.is_a?(Hash)
+        next if %w[ipv4-addr ipv6-addr].include?(address["category"])
+
+        add("#{path}/Address/#{index}/category", "address", "name servers require an IP address")
+      end
+    end
+
+    def check_service(value, path)
+      require_field(value, "ip-protocol", path) if %w[Port Portlist ProtoCode ProtoType ProtoField].any? { |key| value.key?(key) }
+      { "Port" => 65_535, "ip-protocol" => 255, "ProtoCode" => 255, "ProtoType" => 255 }.each do |field, maximum|
+        item = value[field]
+        add(Iodef.pointer(path, field), "range", "protocol number is outside its wire range") if item.is_a?(Integer) && !item.between?(0, maximum)
+      end
+      check_headers(value, "ApplicationHeaderField", path)
+    end
+
+    def check_headers(value, field, path, string: false)
+      return unless value[field].is_a?(Array)
+
+      value[field].each_with_index do |header, index|
+        next unless header.is_a?(Hash)
+
+        header_path = "#{path}/#{field}/#{index}"
+        require_field(header, "name", header_path)
+        add("#{header_path}/dtype", "header", "email header data must use the string data type") if string && header["dtype"] != "string"
+      end
+    end
+
+    def check_hash_data(value, path)
+      require_field(value, "HashTargetID", path) if %w[file-pe-section file-pe-resource file-pdf-object].include?(value["scope"])
+      return unless value["scope"] == "file-pe-iat"
+
+      hashes = [*value["Hash"], *value["FuzzyHash"]]
+      return if hashes.any? { |item| item.is_a?(Hash) && item.key?("Application") }
+
+      add(path, "hash", "import table hashing requires the tool in Application")
+    end
+
+    def check_typed_content(value, path)
+      content = value["value"]
+      return unless content.is_a?(String)
+
+      valid = case value["dtype"]
+              when "byte", "file" then Types.binary?(content)
+              when "bytes", "frame", "packet", "ipv4-packet", "ipv6-packet" then content.match?(/\A(?:[0-9A-Fa-f]{2})*\z/)
+              when "boolean" then %w[true false 0 1].include?(content)
+              when "integer" then content.match?(/\A[+-]?\d+\z/)
+              when "real" then content.match?(/\A[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?\z/)
+              when "date-time", "ntpstamp", "ntp-stamp" then Types.datetime?(content)
+              when "portlist" then Types.portlist?(content)
+              when "url" then Types.uri?(content)
+              when "character" then content.length == 1
+              when "json" then json_content?(content)
+              else true
+              end
+      add(Iodef.pointer(path, "value"), "dtype", "content does not match the declared data type") unless valid
+      binary_size = if %w[byte file].include?(value["dtype"])
+                      (content.bytesize / 4 * 3) - content.count("=")
+                    elsif %w[bytes frame packet ipv4-packet ipv6-packet].include?(value["dtype"])
+                      content.bytesize / 2
+                    end
+      raise LimitError.new("binary data exceeds max_binary_size", pointer: "#{path}/value") if binary_size && binary_size > limits[:max_binary_size]
+
+      return unless value["dtype"] == "byte" && valid && content.unpack1("m0").bytesize != 1
+
+      add("#{path}/value", "dtype", "byte content must encode exactly one octet")
+    end
+
+    def json_content?(content)
+      JSON.parse(content, allow_duplicate_key: false, max_nesting: limits[:max_depth])
+      true
+    rescue JSON::ParserError
+      false
+    end
+  end
+end

data/lib/iodef/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Iodef
+  VERSION = "0.1.0"
+end

data/lib/iodef.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "json"
+require "yaml"
+require "date"
+require "uri"
+require_relative "iodef/version"
+require_relative "iodef/errors"
+require_relative "iodef/types"
+require_relative "iodef/validator"
+require_relative "iodef/model"
+
+IODEF = Iodef unless defined?(IODEF)
+
+module Iodef
+  class << self
+    # Reads one JSON IODEF document; unknown properties survive round trips.
+    def parse(source, strict: true, validate: true, **limits)
+      options = self.limits(limits)
+      raise ParseError, "JSON input must be a String" unless source.is_a?(String)
+      raise LimitError, "input exceeds max_input_size" if source.bytesize > options[:max_input_size]
+
+      value = JSON.parse(source, allow_duplicate_key: false, max_nesting: options[:max_depth])
+      Document.new(value, strict: strict && validate, **options)
+    rescue JSON::NestingError
+      raise LimitError, "input exceeds max_depth"
+    rescue JSON::ParserError, EncodingError
+      raise ParseError, "invalid JSON input"
+    end
+
+    # Returns all bounded diagnostics, without embedding confidential input values.
+    def validate(source, **limits)
+      return parse(source, strict: false, **limits).warnings if source.is_a?(String)
+
+      Validator.new(**limits).validate(source.is_a?(Model) ? source.to_h : source)
+    rescue ParseError => e
+      [Violation.new(pointer: "", rule: "json", message: e.message)]
+    end
+  end
+end

data/sig/iodef.rbs

@@ -0,0 +1,278 @@
+module Iodef
+  VERSION: String
+  DEFAULT_LIMITS: Hash[Symbol, Integer]
+  SCHEMA: Hash[String, untyped]
+  ENUMS: Hash[String, Array[String]]
+  MAPKEYS: Hash[String, Integer]
+  KEYNAMES: Hash[Integer, String]
+
+  def self.parse: (String source, ?strict: bool, ?validate: bool, **Integer limits) -> Document
+  def self.parse_cbor: (String source, ?strict: bool, ?validate: bool, **Integer limits) -> Document
+  def self.validate: (untyped source, **Integer limits) -> Array[Violation]
+  def self.generate_json: (untyped value, ?untyped options) -> String
+  def self.pointer: (String parent, untyped key) -> String
+
+  class Violation
+    attr_reader pointer: String
+    attr_reader rule: String
+    attr_reader message: String
+    def self.new: (pointer: String, rule: String, message: String) -> instance
+  end
+  class Error < StandardError
+  end
+  class ParseError < Error
+  end
+  class ConversionError < Error
+  end
+  class ValidationError < Error
+    attr_reader pointer: String
+    attr_reader violations: Array[Violation]
+    def initialize: (?String message, ?pointer: String, ?violations: Array[Violation]) -> void
+  end
+  class LimitError < ValidationError
+  end
+  class Validator
+    attr_reader limits: Hash[Symbol, Integer]
+    def initialize: (**Integer limits) -> void
+    def validate: (untyped value, ?type: String) -> Array[Violation]
+  end
+  class Model
+    attr_reader limits: Hash[Symbol, Integer]
+    attr_reader warnings: Array[Violation]
+    def initialize: (?Hash[untyped, untyped] data, ?strict: bool, **Integer limits) -> void
+    def []: (String | Symbol key) -> untyped
+    def []=: (String | Symbol key, untyped value) -> untyped
+    def delete: (String | Symbol key) -> untyped
+    def to_h: () -> Hash[String, untyped]
+    def to_json: (?untyped options) -> String
+    def validate!: () -> self
+    def description: () -> MultilingualText
+    def description=: (Array[untyped] value) -> untyped
+  end
+  class MultilingualText
+    include Enumerable[untyped]
+    def initialize: (untyped values, ?lang: String?) -> void
+    def each: () { (untyped) -> untyped } -> Array[untyped]
+            | () -> Enumerator[untyped, Array[untyped]]
+    def text: (?String? language) -> String?
+    def to_a: () -> Array[untyped]
+  end
+  class Document < Model
+    def self.build: (?lang: String?, **Integer limits) { (Document) -> untyped } -> Document
+    def incidents: () -> Array[Incident]
+    def add_incident: (purpose: String, **untyped attributes) ?{ (Incident) -> untyped } -> Incident
+    def to_cbor: () -> String
+  end
+  class Incident < Model
+    def contacts: () -> Array[Contact]
+    def assessments: () -> Array[Assessment]
+    def indicators: () -> Array[Indicator]
+    def add_contact: (role: String, type: String, **untyped attributes) ?{ (Contact) -> untyped } -> Contact
+  end
+  class Contact < Model
+  end
+  class Assessment < Model
+  end
+  class EventData < Model
+  end
+  class Indicator < Model
+  end
+end
+module IODEF = Iodef
+
+module Iodef
+  class Document < Model
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def version: () -> (String)?
+    def version=: (untyped value) -> untyped
+    def lang: () -> (String)?
+    def lang=: (untyped value) -> untyped
+    def format_id: () -> (String)?
+    def format_id=: (untyped value) -> untyped
+    def private_enum_name: () -> (String)?
+    def private_enum_name=: (untyped value) -> untyped
+    def private_enum_id: () -> (String)?
+    def private_enum_id=: (untyped value) -> untyped
+    def incident: () -> (Array[Incident])?
+    def incident=: (untyped value) -> untyped
+  end
+  class Incident < Model
+    def restriction: () -> (String)?
+    def restriction=: (untyped value) -> untyped
+    def ext_restriction: () -> (String)?
+    def ext_restriction=: (untyped value) -> untyped
+    def observable_id: () -> (String)?
+    def observable_id=: (untyped value) -> untyped
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def detect_time: () -> (String)?
+    def detect_time=: (untyped value) -> untyped
+    def start_time: () -> (String)?
+    def start_time=: (untyped value) -> untyped
+    def end_time: () -> (String)?
+    def end_time=: (untyped value) -> untyped
+    def recovery_time: () -> (String)?
+    def recovery_time=: (untyped value) -> untyped
+    def report_time: () -> (String)?
+    def report_time=: (untyped value) -> untyped
+    def purpose: () -> (String)?
+    def purpose=: (untyped value) -> untyped
+    def ext_purpose: () -> (String)?
+    def ext_purpose=: (untyped value) -> untyped
+    def status: () -> (String)?
+    def status=: (untyped value) -> untyped
+    def ext_status: () -> (String)?
+    def ext_status=: (untyped value) -> untyped
+    def lang: () -> (String)?
+    def lang=: (untyped value) -> untyped
+    def incident_id: () -> (Hash[String, untyped])?
+    def incident_id=: (untyped value) -> untyped
+    def alternative_id: () -> (Hash[String, untyped])?
+    def alternative_id=: (untyped value) -> untyped
+    def related_activity: () -> (Array[Hash[String, untyped]])?
+    def related_activity=: (untyped value) -> untyped
+    def generation_time: () -> (String)?
+    def generation_time=: (untyped value) -> untyped
+    def discovery: () -> (Array[Hash[String, untyped]])?
+    def discovery=: (untyped value) -> untyped
+    def assessment: () -> (Array[Assessment])?
+    def assessment=: (untyped value) -> untyped
+    def method: () -> (Array[Hash[String, untyped]])?
+    def method=: (untyped value) -> untyped
+    def contact: () -> (Array[Contact])?
+    def contact=: (untyped value) -> untyped
+    def event_data: () -> (Array[EventData])?
+    def event_data=: (untyped value) -> untyped
+    def indicator: () -> (Array[Indicator])?
+    def indicator=: (untyped value) -> untyped
+    def history: () -> (Hash[String, untyped])?
+    def history=: (untyped value) -> untyped
+  end
+  class Contact < Model
+    def restriction: () -> (String)?
+    def restriction=: (untyped value) -> untyped
+    def ext_restriction: () -> (String)?
+    def ext_restriction=: (untyped value) -> untyped
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def role: () -> (String)?
+    def role=: (untyped value) -> untyped
+    def ext_role: () -> (String)?
+    def ext_role=: (untyped value) -> untyped
+    def type: () -> (String)?
+    def type=: (untyped value) -> untyped
+    def ext_type: () -> (String)?
+    def ext_type=: (untyped value) -> untyped
+    def contact_name: () -> (Array[String | Hash[String, untyped]])?
+    def contact_name=: (untyped value) -> untyped
+    def contact_title: () -> (Array[String | Hash[String, untyped]])?
+    def contact_title=: (untyped value) -> untyped
+    def registry_handle: () -> (Array[Hash[String, untyped]])?
+    def registry_handle=: (untyped value) -> untyped
+    def postal_address: () -> (Array[Hash[String, untyped]])?
+    def postal_address=: (untyped value) -> untyped
+    def email: () -> (Array[Hash[String, untyped]])?
+    def email=: (untyped value) -> untyped
+    def telephone: () -> (Array[Hash[String, untyped]])?
+    def telephone=: (untyped value) -> untyped
+    def timezone: () -> (String)?
+    def timezone=: (untyped value) -> untyped
+    def contact: () -> (Array[Contact])?
+    def contact=: (untyped value) -> untyped
+  end
+  class Assessment < Model
+    def restriction: () -> (String)?
+    def restriction=: (untyped value) -> untyped
+    def ext_restriction: () -> (String)?
+    def ext_restriction=: (untyped value) -> untyped
+    def observable_id: () -> (String)?
+    def observable_id=: (untyped value) -> untyped
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def occurrence: () -> (String)?
+    def occurrence=: (untyped value) -> untyped
+    def incident_category: () -> (Array[String | Hash[String, untyped]])?
+    def incident_category=: (untyped value) -> untyped
+    def impact: () -> (Array[Hash[String, untyped]])?
+    def impact=: (untyped value) -> untyped
+    def counter: () -> (Array[Hash[String, untyped]])?
+    def counter=: (untyped value) -> untyped
+    def mitigating_factor: () -> (Array[String | Hash[String, untyped]])?
+    def mitigating_factor=: (untyped value) -> untyped
+    def cause: () -> (Array[String | Hash[String, untyped]])?
+    def cause=: (untyped value) -> untyped
+    def confidence: () -> (Hash[String, untyped])?
+    def confidence=: (untyped value) -> untyped
+  end
+  class EventData < Model
+    def restriction: () -> (String)?
+    def restriction=: (untyped value) -> untyped
+    def ext_restriction: () -> (String)?
+    def ext_restriction=: (untyped value) -> untyped
+    def observable_id: () -> (String)?
+    def observable_id=: (untyped value) -> untyped
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def detect_time: () -> (String)?
+    def detect_time=: (untyped value) -> untyped
+    def start_time: () -> (String)?
+    def start_time=: (untyped value) -> untyped
+    def end_time: () -> (String)?
+    def end_time=: (untyped value) -> untyped
+    def recovery_time: () -> (String)?
+    def recovery_time=: (untyped value) -> untyped
+    def report_time: () -> (String)?
+    def report_time=: (untyped value) -> untyped
+    def contact: () -> (Array[Contact])?
+    def contact=: (untyped value) -> untyped
+    def discovery: () -> (Array[Hash[String, untyped]])?
+    def discovery=: (untyped value) -> untyped
+    def assessment: () -> (Assessment)?
+    def assessment=: (untyped value) -> untyped
+    def method: () -> (Array[Hash[String, untyped]])?
+    def method=: (untyped value) -> untyped
+    def system: () -> (Array[Hash[String, untyped]])?
+    def system=: (untyped value) -> untyped
+    def expectation: () -> (Array[Hash[String, untyped]])?
+    def expectation=: (untyped value) -> untyped
+    def record_data: () -> (Array[Hash[String, untyped]])?
+    def record_data=: (untyped value) -> untyped
+    def event_data: () -> (Array[EventData])?
+    def event_data=: (untyped value) -> untyped
+  end
+  class Indicator < Model
+    def restriction: () -> (String)?
+    def restriction=: (untyped value) -> untyped
+    def ext_restriction: () -> (String)?
+    def ext_restriction=: (untyped value) -> untyped
+    def additional_data: () -> (Array[Hash[String, untyped]])?
+    def additional_data=: (untyped value) -> untyped
+    def indicator_id: () -> (Hash[String, untyped])?
+    def indicator_id=: (untyped value) -> untyped
+    def alternative_indicator_id: () -> (Array[Hash[String, untyped]])?
+    def alternative_indicator_id=: (untyped value) -> untyped
+    def start_time: () -> (String)?
+    def start_time=: (untyped value) -> untyped
+    def end_time: () -> (String)?
+    def end_time=: (untyped value) -> untyped
+    def confidence: () -> (Hash[String, untyped])?
+    def confidence=: (untyped value) -> untyped
+    def contact: () -> (Array[Contact])?
+    def contact=: (untyped value) -> untyped
+    def observable: () -> (Hash[String, untyped])?
+    def observable=: (untyped value) -> untyped
+    def uid_ref: () -> (String)?
+    def uid_ref=: (untyped value) -> untyped
+    def indicator_expression: () -> (Hash[String, untyped])?
+    def indicator_expression=: (untyped value) -> untyped
+    def indicator_reference: () -> (Hash[String, untyped])?
+    def indicator_reference=: (untyped value) -> untyped
+    def node_role: () -> (Array[Hash[String, untyped]])?
+    def node_role=: (untyped value) -> untyped
+    def attack_phase: () -> (Array[Hash[String, untyped]])?
+    def attack_phase=: (untyped value) -> untyped
+    def reference: () -> (Array[Hash[String, untyped]])?
+    def reference=: (untyped value) -> untyped
+  end
+end

metadata

@@ -0,0 +1,81 @@
+--- !ruby/object:Gem::Specification
+name: iodef
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yudai Takada
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.4
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.4
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+description: RFC 8727 JSON incident reports, typed IODEF v2 models, validation, and
+  optional CBOR conversion.
+email:
+- t.yudai92@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- SECURITY.md
+- data/enums.yml
+- data/mapkeys.yml
+- data/types.yml
+- lib/iodef.rb
+- lib/iodef/cbor.rb
+- lib/iodef/cbor_guard.rb
+- lib/iodef/errors.rb
+- lib/iodef/model.rb
+- lib/iodef/types.rb
+- lib/iodef/validator.rb
+- lib/iodef/version.rb
+- sig/iodef.rbs
+homepage: https://github.com/ydah/iodef
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/ydah/iodef
+  changelog_uri: https://github.com/ydah/iodef/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Read, validate, and build IODEF incident reports
+test_files: []