iodef 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: abb43889b6b8b21b5b16be80fd2ed74c92042692b725fce72e60e7ec3f6c8628
-  data.tar.gz: 96c490a291b68bfbf8d527eba06c6b6f528600e797ac05372750fe29f6258c68
+  metadata.gz: 7588549cdf3dc70ba42067341ab74cd8e9f9fb7d1ce51614017e9ae6f66d5e5f
+  data.tar.gz: 9154dbeb6a501db304bc654f4b5ae4031c8e8219a14355a1f7a2eaa176ce2a39
 SHA512:
-  metadata.gz: cd6942a46620066e97795ce412dde97d7c41cf278c81eacd971c357b1f99b0b131020d01ddac53e8d7f09800149c0d349a8c0256316c0cd94ab84a862444a37c
-  data.tar.gz: fa4ffc07109c725c824cff336e86cc86321746472e5d9e1116dbaea15483b44e40485904612a975bc2e43969d04ae32545f26d153bc5fd689d46f4b76b10522f
+  metadata.gz: 1164739062dfa364d9ce1db9c6e4308d565399942134c63e6c0bbc890d35f40f07009f5d6e772e2ead5faa1d7b133a2f94be8ddfdc82d161a79a4058ca99e900
+  data.tar.gz: 4242987cd5815cf220ee61a9c9d1e77e7f84b15dcd81c93f7ae8982ef3664d59b9356502e3e2d664f4b5b311b5042282692dcd384707315701c7b1066fb2d132

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.1 - 2026-10-12
+
+- Select the correct description language when plain English strings appear with translated text, and inherit document and incident languages for multilingual objects in typed views.
+- Reject malformed processing-instruction targets when parsing XML and serializing XML extensions.
+
 ## 0.2.0 - 2026-10-12
 
 - Read and write RFC 7970 XML incident reports with `IODEF.parse_xml` and `Document#to_xml`, including namespace-aware extensions and multilingual text.

data/README.md

@@ -1,25 +1,47 @@
-# IODEF
+<h1 align="center">IODEF</h1>
+
+<p align="center">Incident reports in JSON, CBOR, and XML.</p>
+
+<p align="center">
+  <a href="https://rubygems.org/gems/iodef"><img src="https://img.shields.io/gem/v/iodef" alt="Gem version"></a>
+  <a href="https://github.com/ydah/iodef/actions/workflows/main.yml"><img src="https://github.com/ydah/iodef/actions/workflows/main.yml/badge.svg?branch=main" alt="CI"></a>
+  <a href="https://www.ruby-lang.org/"><img src="https://img.shields.io/badge/Ruby-%3E%3D%203.3-CC342D?logo=ruby&amp;logoColor=white" alt="Ruby 3.3 or later"></a>
+  <a href="LICENSE.txt"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
+</p>
+
+<p align="center">
+  <a href="#installation">Installation</a> &middot;
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#scope">Scope</a> &middot;
+  <a href="#development">Development</a> &middot;
+  <a href="#license">License</a>
+</p>
 
 Read, validate, build, and exchange IODEF v2 incident reports as JSON, CBOR, or XML ([RFC 8727](https://www.rfc-editor.org/rfc/rfc8727.html) and [RFC 7970](https://www.rfc-editor.org/rfc/rfc7970.html)).
 
-```ruby
-require "iodef"
+## Features
+
+- Build incident reports with typed models and multilingual descriptions.
+- Exchange JSON, built-in CBOR, and namespace-aware RFC 7970 XML.
+- Validate reports with JSON Pointer diagnostics and configurable resource limits.
+
+## Installation
 
-document = IODEF.parse(json)
-incident = document.incidents.first
-incident.incident_id
-incident.contacts.first.role
-incident.description.text("ja")
+Add the gem to your Gemfile:
 
-issues = IODEF.validate(json)
-issues.each { |issue| puts "#{issue.pointer}: #{issue.rule}: #{issue.message}" }
+```ruby
+gem "iodef"
 ```
 
-Install with `gem install iodef`. Ruby 3.3 or newer, JRuby, and TruffleRuby are supported. Runtime dependencies are the Ruby standard libraries `json` (2.19.4 or newer, including 3.x) and `rexml` (3.4.4 or newer, below 4); no other gem from this project is required. `IODEF` and `Iodef` refer to the same module.
+Then run `bundle install`.
+
+Ruby 3.3 or newer, JRuby, and TruffleRuby are supported. Runtime dependencies are the Ruby standard libraries `json` (2.19.4 or newer, including 3.x) and `rexml` (3.4.4 or newer, below 4); no other gem from this project is required. `IODEF` and `Iodef` refer to the same module.
 
-## Build and edit a report
+## Quick start
 
 ```ruby
+require "iodef"
+
 document = IODEF::Document.build(lang: "en") do |doc|
   doc.add_incident(purpose: "reporting") do |incident|
     incident.incident_id = { id: "case-24", name: "response.example" }
@@ -33,12 +55,19 @@ document = IODEF::Document.build(lang: "en") do |doc|
 end
 
 json = document.to_json
+copy = IODEF.parse(json)
+copy.incidents.first.incident_id
+copy.incidents.first.contacts.first.role # => "creator"
+copy.incidents.first.description.text("ja") # => "不審な通信"
+IODEF.validate(json) # => []
 ```
 
 Builders require the incident's ID, generation time, and at least one contact. They do not invent reporting identities or timestamps. Known properties use snake_case accessors; wire property names retain their RFC spelling. `Document`, `Incident`, `Contact`, `Assessment`, `EventData`, and `Indicator` have typed views. Other objects are ordinary hashes. Plural conveniences include `incidents`, `contacts`, `assessments`, and `indicators`.
 
 Typed child views update their document. `[]` exposes the underlying value, `[]=` copies the assigned value, and `to_h` returns a detached copy. Symbols in builder hashes become strings. Unknown JSON properties are preserved, including nested values and large integers. Defaults such as restriction levels are not inserted into the source data.
 
+`description.text(language)` selects an exact language match, then a matching language prefix. Plain JSON strings mean English. Multilingual objects without `lang` inherit the incident or document language; an empty `lang` resets that inheritance. With no match or no requested language, the accessor prefers the first plain string or object without an explicit language, then the first entry.
+
 ## Validation and limits
 
 Parsing is strict by default. `IODEF.parse(json, strict: false)` returns a document with a `warnings` array of `Violation` objects. `validate: false` is a compatibility spelling for this inspection mode. `validate!` refreshes diagnostics after edits. Serialization always validates and raises `IODEF::ValidationError` with `violations` and the first JSON `pointer`.
@@ -92,7 +121,7 @@ Numeric literals use Ruby integers and floats. Other consumers that apply XML Sc
 
 ## Scope
 
-| Supported in 0.2.0 | Outside 0.2.0 |
+| Supported | Outside this release |
 | --- | --- |
 | JSON binding, all RFC 8727 class/property definitions | Ambiguous binary XML structures and vendor extension semantics |
 | Typed core models, multilingual text, builders | RID or other exchange transports |
@@ -125,6 +154,10 @@ The fixture task verifies SHA-256-pinned RFC/IANA sources, retains source notice
 
 `script/update_registry.rb` audits the pinned IANA metadata. `--refresh` downloads the current registry, rejects unexplained differences, and updates its checksum only after the audit succeeds. Review RFC errata and registry changes before refreshing. No downloaded reference material is tracked or included in the gem.
 
+## Contributing
+
+Bug reports and pull requests are welcome on [GitHub](https://github.com/ydah/iodef/issues). See [Development](#development) for the checks to run before submitting a change. Report security vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
 ## License
 
 Project code is MIT licensed; see [LICENSE.txt](LICENSE.txt). Added library dependencies are limited to MIT-licensed libraries. Ruby implementations and standard/default libraries (including JSON and REXML) are exceptions and retain their own licenses. Downloaded standards material is test reference data under its source terms and is neither committed nor packaged. These statements do not relicense third-party material.

data/lib/iodef/model.rb

@@ -18,10 +18,11 @@ module Iodef
       validate! if strict && !@warnings.empty?
     end
 
-    def self.view(data, limits)
+    def self.view(data, limits, parent: nil)
       allocate.tap do |model|
         model.instance_variable_set(:@data, data)
         model.instance_variable_set(:@limits, limits)
+        model.instance_variable_set(:@parent, parent)
         model.instance_variable_set(:@warnings, [].freeze)
       end
     end
@@ -58,7 +59,7 @@ module Iodef
     end
 
     def description
-      MultilingualText.new(@data.fetch("Description", []), lang: @data["lang"])
+      MultilingualText.new(@data.fetch("Description", []), lang: effective_language)
     end
 
     def description=(value)
@@ -75,6 +76,12 @@ module Iodef
       end
     end
 
+    protected
+
+    def effective_language
+      @data.fetch("lang") { @parent&.effective_language }
+    end
+
     private
 
     def read_field(field, descriptor)
@@ -90,7 +97,7 @@ module Iodef
 
     def wrap(value, type)
       klass = TYPED[type]
-      klass && value.is_a?(Hash) ? klass.view(value, limits) : value
+      klass && value.is_a?(Hash) ? klass.view(value, limits, parent: self) : value
     end
   end
 
@@ -109,7 +116,7 @@ module Iodef
 
     def add_incident(purpose:, **attributes)
       value = { "purpose" => purpose }.merge(attributes.transform_keys(&:to_s))
-      incident = Incident.view(Iodef.copy(value, limits), limits)
+      incident = Incident.view(Iodef.copy(value, limits), limits, parent: self)
       yield incident if block_given?
       @data["Incident"] ||= []
       @data["Incident"] << incident.instance_variable_get(:@data)
@@ -132,7 +139,7 @@ module Iodef
 
     def add_contact(role:, type:, **attributes)
       value = { "role" => role, "type" => type }.merge(attributes.transform_keys(&:to_s))
-      contact = Contact.view(Iodef.copy(value, limits), limits)
+      contact = Contact.view(Iodef.copy(value, limits), limits, parent: self)
       yield contact if block_given?
       @data["Contact"] ||= []
       @data["Contact"] << contact.instance_variable_get(:@data)
@@ -162,11 +169,12 @@ module Iodef
 
     # Exact matches win; a language prefix and then an unlabelled value are fallbacks.
     def text(language = nil)
-      values = @values.map { |value| value.is_a?(String) ? { "value" => value, "lang" => @lang } : value }
+      values = @values.map { |value| value.is_a?(String) ? { "value" => value, "lang" => "en" } : value.merge("lang" => value.fetch("lang", @lang)) }
       language = language&.downcase
       selected = values.find { |value| value["lang"]&.downcase == language } if language
       selected ||= values.find { |value| value["lang"].to_s.downcase.split("-").first == language.split("-").first } if language
-      selected ||= values.find { |value| value["lang"].nil? || value["lang"].empty? }
+      fallback = @values.index { |value| value.is_a?(String) || value["lang"].nil? || value["lang"].empty? }
+      selected ||= values[fallback] if fallback
       (selected || values.first)&.fetch("value", nil)
     end
 

data/lib/iodef/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Iodef
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

data/lib/iodef/xml/tree.rb

@@ -8,6 +8,7 @@ module Iodef
     Node = Data.define(:name, :uri, :local, :attributes, :namespaces, :parts, :lang)
     Markup = Data.define(:kind, :value)
     ENTITIES = { "amp" => "&", "lt" => "<", "gt" => ">", "quot" => '"', "apos" => "'" }.freeze
+    PI_TARGET = /\A#{REXML::XMLTokens::NCNAME_STR}\z/u.freeze
 
     def initialize(limits)
       @limits = limits
@@ -91,6 +92,7 @@ module Iodef
         when :comment
           append(stack.last, Markup.new(:comment, event[0])) unless stack.empty?
         when :processing_instruction
+          raise ParseError, "invalid XML processing instruction target" unless PI_TARGET.match?(event[0])
           raise ParseError, "reserved XML processing instruction" if event[0].downcase == "xml"
 
           append(stack.last, Markup.new(:instruction, [event[0], event[1]].join(" "))) unless stack.empty?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: iodef
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Yudai Takada