castrum 0.9.3 → 0.9.4

package/rust/json/fast_schema/cursor.rs

@@ -0,0 +1,368 @@
+// rust/json/fast_schema/cursor.rs — Byte-level JSON cursor + string/unicode helpers.
+//
+// A `Cursor` walks raw JSON bytes with no allocations. It is used by both the
+// validator (validate.rs) and the structural `skip_value` fast path. The
+// string helpers decode escaped string bodies (only needed for the rare
+// escaped-key path and for counting Unicode scalar values).
+
+use super::errors::MAX_DEPTH;
+
+/// A cursor over raw JSON bytes.
+pub(crate) struct Cursor<'a> {
+    pub(crate) data: &'a [u8],
+    pub(crate) pos: usize,
+}
+
+impl<'a> Cursor<'a> {
+    #[inline]
+    pub(crate) fn new(data: &'a [u8]) -> Self {
+        Self { data, pos: 0 }
+    }
+
+    #[inline]
+    pub(crate) fn skip_ws(&mut self) {
+        while let Some(&b) = self.data.get(self.pos) {
+            match b {
+                b' ' | b'\t' | b'\n' | b'\r' => self.pos += 1,
+                _ => break,
+            }
+        }
+    }
+
+    #[inline]
+    pub(crate) fn peek(&self) -> Option<u8> {
+        self.data.get(self.pos).copied()
+    }
+
+    #[inline]
+    pub(crate) fn eat(&mut self, b: u8) -> bool {
+        if self.peek() == Some(b) {
+            self.pos += 1;
+            true
+        } else {
+            false
+        }
+    }
+
+    #[inline]
+    pub(crate) fn eat_token(&mut self, tok: &[u8]) -> bool {
+        if self.data.get(self.pos..self.pos + tok.len()) == Some(tok) {
+            self.pos += tok.len();
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Parse a JSON string token, returning the raw inner slice (between the
+    /// quotes). Escapes are validated as escape characters and skipped, but
+    /// not decoded. Returns `None` on malformed strings.
+    ///
+    /// RFC-8259 strictness: raw control bytes (`< 0x20`) are invalid inside a
+    /// JSON string (they must be escaped), and sonic's `json_valid_bytes`
+    /// rejects them. This is the ONE strictness gap the fast path closes so a
+    /// fast-path schema can replace the sonic gate — everything else sonic
+    /// rejects (leading zeros, trailing commas, trailing garbage, truncated
+    /// escapes, missing structure) the structural walk already rejects, and
+    /// sonic is lenient on the same things the fast path is (bad `\uXXXX` hex,
+    /// lone surrogates, invalid UTF-8, `1e999` overflow).
+    pub(crate) fn raw_string(&mut self) -> Option<&'a [u8]> {
+        if !self.eat(b'"') {
+            return None;
+        }
+        let start = self.pos;
+        let mut i = self.pos;
+        while i < self.data.len() {
+            // SIMD: find the next `"` or `\` in bulk. A string body is usually
+            // long runs of plain bytes, so memchr2 is much faster than the old
+            // byte-at-a-time loop over every key and string value. `?` returns
+            // None for an unterminated string (no closing quote).
+            let rel = memchr::memchr2(b'"', b'\\', &self.data[i..])?;
+            // Reject raw control bytes (< 0x20) in the plain run — LLVM
+            // auto-vectorizes this comparison, and control bytes are rare in
+            // real JSON so the branch is almost never taken.
+            if self.data[i..i + rel].iter().any(|&b| b < 0x20) {
+                return None;
+            }
+            i += rel;
+            if self.data[i] == b'"' {
+                self.pos = i + 1;
+                return Some(&self.data[start..i]);
+            }
+            // Escape: validate the escape char and skip it.
+            let e = *self.data.get(i + 1)?;
+            if !matches!(
+                e,
+                b'"' | b'\\' | b'/' | b'b' | b'f' | b'n' | b'r' | b't' | b'u'
+            ) {
+                return None;
+            }
+            i += 2;
+        }
+        None
+    }
+
+    /// Parse a JSON number token; returns `(value, integer_syntax)`.
+    pub(crate) fn number(&mut self) -> Option<(f64, bool)> {
+        let start = self.pos;
+        let _ = self.eat(b'-');
+        match self.peek() {
+            Some(b'0') => self.pos += 1,
+            Some(b'1'..=b'9') => {
+                while matches!(self.peek(), Some(b'0'..=b'9')) {
+                    self.pos += 1;
+                }
+            }
+            _ => return None,
+        }
+        let mut is_int = true;
+        if self.peek() == Some(b'.') {
+            is_int = false;
+            self.pos += 1;
+            if !matches!(self.peek(), Some(b'0'..=b'9')) {
+                return None;
+            }
+            while matches!(self.peek(), Some(b'0'..=b'9')) {
+                self.pos += 1;
+            }
+        }
+        if matches!(self.peek(), Some(b'e') | Some(b'E')) {
+            is_int = false;
+            self.pos += 1;
+            if matches!(self.peek(), Some(b'+') | Some(b'-')) {
+                self.pos += 1;
+            }
+            if !matches!(self.peek(), Some(b'0'..=b'9')) {
+                return None;
+            }
+            while matches!(self.peek(), Some(b'0'..=b'9')) {
+                self.pos += 1;
+            }
+        }
+        let tok = &self.data[start..self.pos];
+        let n: f64 = std::str::from_utf8(tok).ok()?.parse().ok()?;
+        Some((n, is_int))
+    }
+
+    /// Skip one complete JSON value (for `true`/`{}`/`additionalProperties: true`).
+    ///
+    /// `depth` is the current nesting depth (bounded by `MAX_DEPTH`) so hostile
+    /// deeply-nested JSON cannot exhaust the native stack through this path
+    /// either (see `Ctx::enter_depth`).
+    pub(crate) fn skip_value(&mut self, depth: u32) -> bool {
+        if depth > MAX_DEPTH {
+            return false;
+        }
+        self.skip_ws();
+        let Some(b) = self.peek() else {
+            return false;
+        };
+        match b {
+            b'{' => {
+                self.pos += 1;
+                self.skip_ws();
+                if self.eat(b'}') {
+                    return true;
+                }
+                loop {
+                    if self.raw_string().is_none() {
+                        return false;
+                    }
+                    self.skip_ws();
+                    if !self.eat(b':') {
+                        return false;
+                    }
+                    if !self.skip_value(depth + 1) {
+                        return false;
+                    }
+                    self.skip_ws();
+                    if self.eat(b'}') {
+                        return true;
+                    }
+                    if !self.eat(b',') {
+                        return false;
+                    }
+                    self.skip_ws();
+                }
+            }
+            b'[' => {
+                self.pos += 1;
+                self.skip_ws();
+                if self.eat(b']') {
+                    return true;
+                }
+                loop {
+                    if !self.skip_value(depth + 1) {
+                        return false;
+                    }
+                    self.skip_ws();
+                    if self.eat(b']') {
+                        return true;
+                    }
+                    if !self.eat(b',') {
+                        return false;
+                    }
+                    self.skip_ws();
+                }
+            }
+            b'"' => self.raw_string().is_some(),
+            b't' => self.eat_token(b"true"),
+            b'f' => self.eat_token(b"false"),
+            b'n' => self.eat_token(b"null"),
+            b'-' | b'0'..=b'9' => self.number().is_some(),
+            _ => false,
+        }
+    }
+}
+
+/// True when every byte is ASCII (< 0x80), checked word-at-a-time.
+#[inline]
+fn is_ascii(bytes: &[u8]) -> bool {
+    let (chunks, remainder) = bytes.as_chunks::<8>();
+    for word in chunks {
+        let w = u64::from_le_bytes(*word);
+        if (w & 0x8080_8080_8080_8080) != 0 {
+            return false;
+        }
+    }
+    remainder.iter().all(|&b| b < 0x80)
+}
+
+/// Count Unicode scalar values (JSON Schema string length) in a raw JSON
+/// string body, handling escapes including surrogate pairs.
+pub(crate) fn count_chars(inner: &[u8]) -> usize {
+    // Fast path: no escape sequences and pure ASCII -> one scalar per byte.
+    // `contains` (memchr) and `is_ascii` (word-at-a-time) are both SIMD, so
+    // the common ASCII name/value case is O(1)-ish instead of byte-at-a-time.
+    if !inner.contains(&b'\\') && is_ascii(inner) {
+        return inner.len();
+    }
+    let mut chars = 0usize;
+    let mut i = 0usize;
+    while i < inner.len() {
+        let b = inner[i];
+        if b == b'\\' {
+            if i + 1 >= inner.len() {
+                break;
+            }
+            if inner[i + 1] == b'u' {
+                chars += 1;
+                i += 6;
+                // High surrogate followed by a low surrogate is ONE scalar value.
+                if i + 6 <= inner.len()
+                    && inner.get(i..i + 2) == Some(b"\\u")
+                    && hex4(inner.get(i - 4..i)).is_some_and(|hi| (0xD800..=0xDBFF).contains(&hi))
+                    && hex4(inner.get(i + 2..i + 6))
+                        .is_some_and(|lo| (0xDC00..=0xDFFF).contains(&lo))
+                {
+                    i += 6;
+                }
+            } else {
+                chars += 1;
+                i += 2;
+            }
+        } else if b < 0x80 {
+            chars += 1;
+            i += 1;
+        } else {
+            chars += 1;
+            i += match b {
+                0xC0..=0xDF => 2,
+                0xE0..=0xEF => 3,
+                0xF0..=0xF7 => 4,
+                _ => 1,
+            };
+        }
+    }
+    chars
+}
+
+fn hex4(hex: Option<&[u8]>) -> Option<u16> {
+    let hex = hex?;
+    if hex.len() != 4 {
+        return None;
+    }
+    let mut v = 0u16;
+    for &c in hex {
+        let d = match c {
+            b'0'..=b'9' => c - b'0',
+            b'a'..=b'f' => c - b'a' + 10,
+            b'A'..=b'F' => c - b'A' + 10,
+            _ => return None,
+        };
+        v = v * 16 + d as u16;
+    }
+    Some(v)
+}
+
+fn push_cp(out: &mut Vec<u8>, cp: u32) {
+    if cp < 0x80 {
+        out.push(cp as u8);
+    } else if cp < 0x800 {
+        out.push(0xC0 | (cp >> 6) as u8);
+        out.push(0x80 | (cp & 0x3F) as u8);
+    } else if cp < 0x10000 {
+        out.push(0xE0 | (cp >> 12) as u8);
+        out.push(0x80 | ((cp >> 6) & 0x3F) as u8);
+        out.push(0x80 | (cp & 0x3F) as u8);
+    } else {
+        out.push(0xF0 | (cp >> 18) as u8);
+        out.push(0x80 | ((cp >> 12) & 0x3F) as u8);
+        out.push(0x80 | ((cp >> 6) & 0x3F) as u8);
+        out.push(0x80 | (cp & 0x3F) as u8);
+    }
+}
+
+/// Decode a raw JSON string body into literal bytes. Only used for object keys
+/// that contain escapes (rare); the common no-escape path is a zero-alloc
+/// slice lookup.
+pub(crate) fn decode_string(inner: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(inner.len());
+    let mut i = 0usize;
+    while i < inner.len() {
+        let b = inner[i];
+        if b == b'\\' && i + 1 < inner.len() {
+            let e = inner[i + 1];
+            i += 2;
+            match e {
+                b'"' => out.push(b'"'),
+                b'\\' => out.push(b'\\'),
+                b'/' => out.push(b'/'),
+                b'b' => out.push(0x08),
+                b'f' => out.push(0x0C),
+                b'n' => out.push(b'\n'),
+                b'r' => out.push(b'\r'),
+                b't' => out.push(b'\t'),
+                b'u' => {
+                    if let Some(h) = hex4(inner.get(i..i + 4)) {
+                        i += 4;
+                        if (0xD800..=0xDBFF).contains(&h) {
+                            let low = inner
+                                .get(i..i + 2)
+                                .filter(|s| **s == *b"\\u")
+                                .and_then(|_| hex4(inner.get(i + 2..i + 6)));
+                            if let Some(l) = low.filter(|l| (0xDC00..=0xDFFF).contains(l)) {
+                                i += 6;
+                                let cp =
+                                    0x10000 + (((h as u32) - 0xD800) << 10) + ((l as u32) - 0xDC00);
+                                push_cp(&mut out, cp);
+                            } else {
+                                // Lone high surrogate: encode as replacement char.
+                                push_cp(&mut out, 0xFFFD);
+                            }
+                        } else {
+                            push_cp(&mut out, h as u32);
+                        }
+                    } else {
+                        out.push(b'u');
+                    }
+                }
+                _ => out.push(b),
+            }
+        } else {
+            out.push(b);
+            i += 1;
+        }
+    }
+    out
+}

package/rust/json/fast_schema/email.rs

@@ -0,0 +1,282 @@
+// rust/json/fast_schema/email.rs — Zero-DOM `format: "email"` validator.
+//
+// Byte-parity replica of jsonschema 0.48.5's `keywords::format::is_valid_email`
+// (the default, non-IDN path used by `format: "email"`):
+//
+//   1. structural local-part parse via the SAME `email_address` crate
+//      (`EmailAddress::from_str` — jsonschema's `parse_email(email, None)`),
+//   2. then the domain is either an `[IPv6:]`/`[IPv4]` literal, or an RFC 1034
+//      hostname with RFC 5891 A-label (punycode) + RFC 5892 PVALID/contextual
+//      unicode-label rules.
+//
+// `idna` and `unicode-general-category` are the same crates/versions the
+// jsonschema crate pulls in, so the two can only drift if the pinned
+// `jsonschema` dep is upgraded — in that case re-verify parity here (see
+// `tests.rs` for the parity corpus + property test).
+//
+// NOTE: only `format: "email"` (non-IDN) is supported. `format: "idn-email"`
+// and every other format value keep the DOM fallback (compile returns Err).
+
+use std::net::{Ipv4Addr, Ipv6Addr};
+use std::str::FromStr;
+
+use email_address::EmailAddress;
+use idna::punycode::decode_to_string;
+use unicode_general_category::{get_general_category, GeneralCategory};
+
+/// RFC 1034 hostname chars (`a-zA-Z0-9-`).
+const VALID_HOSTNAME_CHARS: [bool; 256] = {
+    let mut table = [false; 256];
+    let mut byte: u8 = 0;
+    while byte < 255 {
+        table[byte as usize] = matches!(byte, b'a'..=b'z' | b'A'..=b'Z' | b'0'..=b'9' | b'-');
+        byte += 1;
+    }
+    // Handle byte 255 separately to avoid overflow.
+    table[255] = matches!(255u8, b'a'..=b'z' | b'A'..=b'Z' | b'0'..=b'9' | b'-');
+    table
+};
+
+#[inline]
+fn is_punycode_label(label: &[u8]) -> bool {
+    label.len() >= 4 && label[0] == b'x' && label[1] == b'n' && label[2] == b'-' && label[3] == b'-'
+}
+
+#[inline]
+fn validate_hostname_label(label: &[u8]) -> bool {
+    !label.is_empty() && label.len() <= 63 && label[0] != b'-' && *label.last().unwrap() != b'-'
+}
+
+/// RFC 1034 ASCII hostname shape: 1..=253 chars, no trailing dot, each label
+/// non-empty / ≤63 / no leading or trailing hyphen, chars in `a-zA-Z0-9-`.
+fn is_valid_ascii_hostname(hostname: &str) -> bool {
+    let hostname_bytes = hostname.as_bytes();
+    let len = hostname_bytes.len();
+    if len == 0 || len > 253 || hostname_bytes[len - 1] == b'.' {
+        return false;
+    }
+
+    let mut label_start = 0;
+    let mut i = 0;
+    while i < len {
+        if hostname_bytes[i] == b'.' {
+            if !validate_hostname_label(&hostname_bytes[label_start..i]) {
+                return false;
+            }
+            label_start = i + 1;
+        } else if !VALID_HOSTNAME_CHARS[hostname_bytes[i] as usize] {
+            return false;
+        }
+        i += 1;
+    }
+
+    validate_hostname_label(&hostname_bytes[label_start..])
+}
+
+/// RFC 5892 derives the PVALID property primarily from these general categories.
+fn is_idna_pvalid_category(category: GeneralCategory) -> bool {
+    matches!(
+        category,
+        GeneralCategory::UppercaseLetter
+            | GeneralCategory::LowercaseLetter
+            | GeneralCategory::TitlecaseLetter
+            | GeneralCategory::ModifierLetter
+            | GeneralCategory::OtherLetter
+            | GeneralCategory::NonspacingMark
+            | GeneralCategory::SpacingMark
+            | GeneralCategory::DecimalNumber
+    )
+}
+
+/// RFC 5892 §2 context-aware label rules + PVALID check. Replica of
+/// jsonschema 0.48.5 `validate_unicode_label`.
+fn validate_unicode_label(label: &str) -> bool {
+    let mut chars = label.chars().peekable();
+    if let Some(&first) = chars.peek() {
+        let category = get_general_category(first);
+        if matches!(
+            category,
+            GeneralCategory::SpacingMark
+                | GeneralCategory::NonspacingMark
+                | GeneralCategory::EnclosingMark
+        ) {
+            return false;
+        }
+    }
+    let mut previous = None;
+    let mut has_katakana_middle_dot = false;
+    let mut has_hiragana_katakana_han = false;
+    let mut has_arabic_indic_digits = false;
+    let mut has_extended_arabic_indic_digits = false;
+
+    while let Some(current) = chars.next() {
+        match current {
+            // ZERO WIDTH JOINER — allowed only after a virama.
+            '\u{200D}'
+                if !previous.is_some_and(|prev| {
+                    matches!(
+                        prev,
+                        '\u{094D}'
+                            | '\u{09CD}'
+                            | '\u{0A4D}'
+                            | '\u{0ACD}'
+                            | '\u{0B4D}'
+                            | '\u{0BCD}'
+                            | '\u{0C4D}'
+                            | '\u{0CCD}'
+                            | '\u{0D4D}'
+                            | '\u{0DCA}'
+                            | '\u{0E3A}'
+                            | '\u{0F84}'
+                            | '\u{1039}'
+                            | '\u{1714}'
+                            | '\u{1734}'
+                            | '\u{17D2}'
+                            | '\u{1A60}'
+                            | '\u{1B44}'
+                            | '\u{1BAA}'
+                            | '\u{1BF2}'
+                            | '\u{1BF3}'
+                            | '\u{2D7F}'
+                            | '\u{A806}'
+                            | '\u{A8C4}'
+                            | '\u{A953}'
+                            | '\u{ABED}'
+                            | '\u{10A3F}'
+                            | '\u{11046}'
+                            | '\u{1107F}'
+                            | '\u{110B9}'
+                            | '\u{11133}'
+                            | '\u{111C0}'
+                            | '\u{11235}'
+                            | '\u{112EA}'
+                            | '\u{1134D}'
+                            | '\u{11442}'
+                            | '\u{114C2}'
+                            | '\u{115BF}'
+                            | '\u{1163F}'
+                            | '\u{116B6}'
+                            | '\u{1172B}'
+                            | '\u{11839}'
+                            | '\u{119E0}'
+                            | '\u{11A34}'
+                            | '\u{11A47}'
+                            | '\u{11A99}'
+                            | '\u{11C3F}'
+                            | '\u{11D44}'
+                            | '\u{11D45}'
+                            | '\u{11D97}'
+                    )
+                }) =>
+            {
+                return false;
+            }
+            // MIDDLE DOT — must be between 'l' and 'l'.
+            '\u{00B7}' if previous != Some('l') || chars.peek() != Some(&'l') => return false,
+            // Greek KERAIA — must be followed by a Greek char.
+            '\u{0375}'
+                if !chars
+                    .peek()
+                    .is_some_and(|next| ('\u{0370}'..='\u{03FF}').contains(next)) =>
+            {
+                return false;
+            }
+            // Hebrew GERESH / GERSHAYIM — must follow a Hebrew char.
+            '\u{05F3}' | '\u{05F4}'
+                if !previous.is_some_and(|prev| ('\u{0590}'..='\u{05FF}').contains(&prev)) =>
+            {
+                return false;
+            }
+            // KATAKANA MIDDLE DOT.
+            '\u{30FB}' => has_katakana_middle_dot = true,
+            // Hiragana, Katakana, or Han.
+            '\u{3040}'..='\u{309F}' | '\u{30A0}'..='\u{30FF}' | '\u{4E00}'..='\u{9FFF}' => {
+                has_hiragana_katakana_han = true;
+            }
+            // ARABIC-INDIC DIGITS.
+            '\u{0660}'..='\u{0669}' => has_arabic_indic_digits = true,
+            // EXTENDED ARABIC-INDIC DIGITS.
+            '\u{06F0}'..='\u{06F9}' => has_extended_arabic_indic_digits = true,
+            // DISALLOWED.
+            '\u{0640}' | '\u{07FA}' | '\u{302E}' | '\u{302F}' | '\u{3031}' | '\u{3032}'
+            | '\u{3033}' | '\u{3034}' | '\u{3035}' | '\u{303B}' => return false,
+            // Contextual joiners/punctuation already validated above, plus the
+            // RFC 5892 PVALID exceptions whose general category would otherwise
+            // be disallowed.
+            '\u{200C}' | '\u{200D}' | '\u{00B7}' | '\u{0375}' | '\u{05F3}' | '\u{05F4}'
+            | '\u{06FD}' | '\u{06FE}' | '\u{0F0B}' | '\u{3007}' => {}
+            // Per RFC 5892 a code point is PVALID only when it is a letter, a
+            // combining mark, or a decimal digit; any other decoded code point
+            // is disallowed.
+            other if !other.is_ascii() && !is_idna_pvalid_category(get_general_category(other)) => {
+                return false;
+            }
+            _ => {}
+        }
+        previous = Some(current);
+    }
+
+    if (has_katakana_middle_dot && !has_hiragana_katakana_han)
+        || (has_arabic_indic_digits && has_extended_arabic_indic_digits)
+    {
+        return false;
+    }
+
+    true
+}
+
+/// RFC 1034 hostname + RFC 5891 A-label + RFC 5892 unicode-label rules
+/// (non-IDN path — ASCII hostname shape, punycode A-labels decoded + checked).
+fn is_valid_hostname(hostname: &str) -> bool {
+    if !is_valid_ascii_hostname(hostname) {
+        return false;
+    }
+
+    for label in hostname.as_bytes().split(|&b| b == b'.') {
+        // Per RFC 5891, labels with hyphens in 3rd & 4th positions must be
+        // valid A-labels.
+        if label.len() >= 4 && label[2] == b'-' && label[3] == b'-' && !is_punycode_label(label) {
+            return false;
+        }
+
+        if is_punycode_label(label) {
+            // SAFETY: `is_valid_ascii_hostname` already checked the label is
+            // pure `a-zA-Z0-9-` ASCII, so slicing past the `xn--` prefix is
+            // valid UTF-8 (mirrors jsonschema's `.expect`).
+            let payload = std::str::from_utf8(&label[4..]).expect("ASCII label already validated");
+            let Some(decoded) = decode_to_string(payload) else {
+                return false;
+            };
+            if !validate_unicode_label(&decoded) {
+                return false;
+            }
+        }
+    }
+
+    true
+}
+
+/// `[IPv6:...]` / `[IPv4...]` literals, else the hostname rules.
+fn validate_email_domain(domain: &str) -> bool {
+    if let Some(domain) = domain.strip_prefix('[').and_then(|d| d.strip_suffix(']')) {
+        if let Some(domain) = domain.strip_prefix("IPv6:") {
+            domain.parse::<Ipv6Addr>().is_ok()
+        } else {
+            domain.parse::<Ipv4Addr>().is_ok()
+        }
+    } else {
+        is_valid_hostname(domain)
+    }
+}
+
+/// Validate `input` as an RFC 5321/5322 email — byte-parity with jsonschema
+/// 0.48.5 `format: "email"` (default options, non-ASCII local parts rejected).
+pub fn is_valid_email_format(input: &[u8]) -> bool {
+    let Ok(s) = std::str::from_utf8(input) else {
+        return false;
+    };
+    let Ok(parsed) = EmailAddress::from_str(s) else {
+        return false;
+    };
+    validate_email_domain(parsed.domain())
+}