open_rosa 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 504ec17fd100ce2f925c14cc5fc1ba091e5e90bc7a8487daa78796957d4145fd
-  data.tar.gz: a4988b15ca00e7ca7b607528d0737fb7e0bbfafd4189a0bab13b7ad5e262e577
+  metadata.gz: fa8424798700327f78994c65dd41b610a16f546c274687304ebf8fc1302010b4
+  data.tar.gz: 1e3b616ba25ed4d94aeabaf30ca7b17f3bb7845b7ceefc9025adf0203c995ae6
 SHA512:
-  metadata.gz: '09b9bc3f1d10416d78d9549d7a0508e4cade415824ba4c08c8092fc513aee9348e8fa4c686f111c59cfdc617d27b3627406a4bf809dc479a794dd696f819a503'
-  data.tar.gz: 5be9e04f1daa8cdb68b7cafff2d263fac64827a5956f57488abe277540c391ac4ecf061f69f3a17991a9eafff1250b55dd8d4f1fdafb24dc6a3f867c83503747
+  metadata.gz: 50134a6ecccde9da4f9c863739eac0c56e7ba0319dc028f822ecdfec23a85224ce4dbd79243ffe08c00ad577ca8a79c5498cbecd0d537f751c11d39b1a83171c
+  data.tar.gz: fbf37c1061b1be0b5df045981a1e7f75e938e5f4f0be777838637e848ceb627b832fa0524057ed3c19df0cfa82f5595a382cb6567c04d789ba7b6de6deb2f057

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-03-09
+
+### Added
+
+- Validate `regex()` constraint expressions at form definition time — rejects patterns with unescaped quotes (which break XPath parsing on the device) and patterns that don't compile as valid regular expressions
+
 ## [0.2.0] - 2026-03-09
 
 ### Added

data/lib/open_rosa/fields/input.rb

@@ -11,6 +11,10 @@ module OpenRosa
         geopoint geotrace geoshape barcode binary intent
       ].freeze
 
+      # Matches regex() calls with single- or double-quoted patterns
+      REGEX_CALL = /regex\s*\(/
+      REGEX_WITH_PATTERN = /regex\s*\(\s*[^,]+,\s*(?:'((?:[^'\\]|\\.)*)'|"((?:[^"\\]|\\.)*)")\s*\)/
+
       def initialize(name, options = {})
         super
         @type = options.fetch(:type, :string)
@@ -23,10 +27,42 @@ module OpenRosa
       private
 
       def validate!
+        validate_type!
+        validate_constraint! if @constraint
+      end
+
+      def validate_type!
         return if VALID_TYPES.include?(@type)
 
         raise ArgumentError, "type must be one of: #{VALID_TYPES.join(", ")}"
       end
+
+      def validate_constraint!
+        # Extract and validate regex patterns from expressions like: regex(., 'pattern')
+        # Patterns are inside quotes in the XPath expression — an unescaped quote
+        # breaks the XPath parser on the device. We also verify patterns compile.
+        # Ruby's Oniguruma engine is a superset of Java's java.util.regex.Pattern,
+        # so a pattern that fails here will also fail on the device.
+        matched_patterns = @constraint.scan(REGEX_WITH_PATTERN)
+        matched_patterns.each do |single_quoted, double_quoted|
+          validate_regex_pattern!(single_quoted || double_quoted)
+        end
+
+        # If there are more regex() calls than we could parse, a quote is broken
+        regex_call_count = @constraint.scan(REGEX_CALL).length
+        return unless regex_call_count > matched_patterns.length
+
+        raise ArgumentError,
+              "constraint for '#{name}' contains a regex() with an invalid or " \
+              "unquoted pattern — check for unescaped quotes"
+      end
+
+      def validate_regex_pattern!(pattern)
+        Regexp.new(pattern)
+      rescue RegexpError => e
+        raise ArgumentError,
+              "constraint regex for '#{name}' is not a valid regular expression: #{e.message}"
+      end
     end
   end
 end

data/lib/open_rosa/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenRosa
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: open_rosa
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Alex Watt