sdcvalidator 4.5.0__tar.gz → 4.5.2__tar.gz

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.0
+Version: 4.5.2
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
-Author: Semantic Data Charter Foundation
+Author: Axius SDC, Inc.
 License-Expression: Apache-2.0
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/pyproject.toml

@@ -4,16 +4,16 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sdcvalidator"
-version = "4.5.0"
+version = "4.5.2"
 description = "SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema"
 license = "Apache-2.0"
 requires-python = ">=3.10"
 readme = "README.md"
 authors = [
-    {name = "Semantic Data Charter Foundation"},
+    {name = "Axius SDC, Inc."},
 ]
 classifiers = [
-    "Development Status :: 4 - Beta",
+    "Development Status :: 5 - Production/Stable",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.10",

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/src/sdcvalidator/__init__.py

@@ -14,7 +14,7 @@ Thin wrapper over xmlschema with two-tier error classification and the SDC4
 "quarantine-and-tag" recovery pattern (ISO 21090 ExceptionalValues).
 """
 
-__version__ = "4.5.0"
+__version__ = "4.5.2"
 
 # etree_tostring is re-exported from xmlschema so callers can serialize the
 # ElementTree returned by validate_with_recovery() without importing xmlschema

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/src/sdcvalidator/mcp_server.py

@@ -36,7 +36,7 @@ from sdcvalidator.schema_checker import validate_sdc4_schema_compliance
 JSONRPC_VERSION = "2.0"
 MCP_PROTOCOL_VERSION = "2024-11-05"
 SERVER_NAME = "sdcvalidator"
-SERVER_VERSION = "4.2.1"
+SERVER_VERSION = "4.5.2"
 
 # Validator cache: schema_path -> SDC4Validator
 _validators: dict[str, SDC4Validator] = {}
@@ -201,10 +201,24 @@ def _jsonrpc_error(id: Any, code: int, message: str, data: Any = None) -> dict:
     return {"jsonrpc": JSONRPC_VERSION, "id": id, "error": error}
 
 
-def _handle_request(request: dict) -> dict | None:
+def _handle_request(request) -> dict | None:
+    # ★ Attacker-reachable input over stdio with no authentication. A JSON
+    # value that is not an object, or an object whose params is not one,
+    # used to raise AttributeError and kill the server (VSL rollout R9).
+    # Every shape the protocol does not allow is answered with -32600.
+    if not isinstance(request, dict):
+        return _jsonrpc_error(None, -32600, "Invalid Request: a JSON-RPC request is an object")
+    req_id = request.get("id")
+    if not isinstance(req_id, (str, int, type(None))):
+        return _jsonrpc_error(None, -32600, "Invalid Request: id must be a string, a number or null")
     method = request.get("method", "")
+    if not isinstance(method, str):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: method must be a string")
     params = request.get("params", {})
-    req_id = request.get("id")
+    if params is None:
+        params = {}
+    if not isinstance(params, dict):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: params must be an object")
 
     if method == "initialize":
         result = {
@@ -228,6 +242,12 @@ def _handle_request(request: dict) -> dict | None:
     elif method == "tools/call":
         tool_name = params.get("name", "")
         tool_args = params.get("arguments", {})
+        if tool_args is None:
+            tool_args = {}
+        if not isinstance(tool_name, str) or not isinstance(tool_args, dict):
+            return _jsonrpc_error(
+                req_id, -32602, "Invalid params: name must be a string and arguments an object"
+            )
 
         handler = TOOL_HANDLERS.get(tool_name)
         if handler is None:

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/src/sdcvalidator/validator.py

@@ -136,6 +136,51 @@ class SDC4Validator:
         else:
             raise TypeError(f"Unsupported xml_source type: {type(xml_source)}")
 
+    def _namespaces(
+        self, xml_source: Union[str, Path, ET.Element, XMLResource]
+    ) -> Optional[Dict[str, str]]:
+        """
+        The prefix map declared in the source, or None when it is not known.
+
+        ``_to_tree`` normalises every source into a stdlib ElementTree, which
+        resolves prefixes to Clark notation and discards the declarations. A
+        prefixed QName that appears as *content* rather than as a tag, which
+        is what ``xsi:type="sdc4:XdOrdinalType"`` is, can then no longer be
+        resolved and xmlschema raises ``XMLSchemaKeyError`` instead of
+        validating. The reference model relies on ``xsi:type`` wherever an
+        abstract element is filled by a concrete type, so an instance that is
+        valid against the reference model failed here before 4.5.1.
+
+        A path or an XMLResource still carries the declarations, so they are
+        read back and handed to xmlschema. A bare ``ET.Element`` has already
+        lost them; callers validating such an instance should pass the path
+        or an ``XMLResource`` instead.
+        """
+        if isinstance(xml_source, XMLResource):
+            return xml_source.get_namespaces(root_only=False)
+        if isinstance(xml_source, (str, Path)):
+            return XMLResource(str(xml_source)).get_namespaces(root_only=False)
+        return None
+
+    def _schema_errors(
+        self,
+        tree: ET.ElementTree,
+        xml_source: Union[str, Path, ET.Element, XMLResource],
+    ) -> Iterator[XMLSchemaValidationError]:
+        """
+        xmlschema's errors over ``tree``, with the source's prefix map.
+
+        The map is for resolving prefixed QNames in content during validation.
+        It is removed from each error afterwards so ``error.path`` keeps its
+        Clark form (``/{uri}local/...``): the recovery step locates elements by
+        that form, and every report has always carried it.
+        """
+        namespaces = self._namespaces(xml_source)
+        for error in self.schema.iter_errors(tree, namespaces=namespaces):
+            error.namespaces = None
+            error._path = None
+            yield error
+
     # ------------------------------------------------------------------ #
     # Classification-only validation (no modification)
     # ------------------------------------------------------------------ #
@@ -150,7 +195,7 @@ class SDC4Validator:
             ValidationResult with is_valid, structural_errors, semantic_errors.
         """
         tree = self._to_tree(xml_source)
-        errors = list(self.schema.iter_errors(tree))
+        errors = list(self._schema_errors(tree, xml_source))
 
         classified = self.classifier.classify_all(errors)
 
@@ -170,7 +215,7 @@ class SDC4Validator:
             List of structural errors. Empty list means structure is valid.
         """
         tree = self._to_tree(xml_source)
-        errors = list(self.schema.iter_errors(tree))
+        errors = list(self._schema_errors(tree, xml_source))
         return [e for e in errors if self.classifier.is_structural_error(e)]
 
     def iter_errors(
@@ -183,7 +228,7 @@ class SDC4Validator:
             List of error summary dictionaries (structural and semantic).
         """
         tree = self._to_tree(xml_source)
-        errors = list(self.schema.iter_errors(tree))
+        errors = list(self._schema_errors(tree, xml_source))
         return [self.classifier.get_error_summary(e) for e in errors]
 
     def iter_errors_with_mapping(
@@ -198,7 +243,7 @@ class SDC4Validator:
             Dictionaries containing error details and the mapped EV type.
         """
         tree = self._to_tree(xml_source)
-        for error in self.schema.iter_errors(tree):
+        for error in self._schema_errors(tree, xml_source):
             ev_type = self.error_mapper.map_error(error)
             if ev_type is None:
                 continue
@@ -286,7 +331,7 @@ class SDC4Validator:
         if remove_existing_ev:
             self.instance_modifier.remove_existing_exceptional_values(root)
 
-        errors = list(self.schema.iter_errors(tree))
+        errors = list(self._schema_errors(tree, xml_source))
 
         structural_errors = []
         semantic_errors = []

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/src/sdcvalidator.egg-info/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.0
+Version: 4.5.2
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
-Author: Semantic Data Charter Foundation
+Author: Axius SDC, Inc.
 License-Expression: Apache-2.0
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/src/sdcvalidator.egg-info/SOURCES.txt

@@ -27,4 +27,5 @@ tests/test_mcp_server.py
 tests/test_recovery.py
 tests/test_schema_checker.py
 tests/test_validator.py
-tests/test_xsd11_restriction.py
+tests/test_xsd11_restriction.py
+tests/test_xsi_type.py

{sdcvalidator-4.5.0 → sdcvalidator-4.5.2}/tests/test_mcp_server.py

@@ -137,3 +137,55 @@ class TestConsistentSerialization:
             assert content[0]["type"] == "text"
             parsed = json.loads(content[0]["text"])
             assert parsed is not None
+
+class TestMalformedRequestsDoNotKillTheServer:
+    """
+    VSL rollout inventory R9. Six inputs that are valid JSON but not a
+    JSON-RPC request raised AttributeError in _handle_request and ended the
+    process. Each is now answered with -32600 (or -32602 for bad tool params)
+    and the loop keeps reading.
+    """
+
+    @pytest.mark.parametrize("payload", [[], ["tools/list"], "tools/list", 7, None, True])
+    def test_a_non_object_request_is_invalid_request(self, payload):
+        response = _handle_request(payload)
+        assert response["error"]["code"] == -32600
+        assert response["id"] is None
+
+    @pytest.mark.parametrize("params", [[], "x", 3, True])
+    def test_non_object_params_are_invalid_request(self, params):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": params})
+        assert response["error"]["code"] == -32600
+        assert response["id"] == 1
+
+    def test_null_params_are_treated_as_empty(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": None})
+        assert "result" in response
+
+    def test_a_non_string_method_is_invalid_request(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": ["tools/list"]})
+        assert response["error"]["code"] == -32600
+
+    @pytest.mark.parametrize("arguments", [[], "x", 3])
+    def test_non_object_tool_arguments_are_invalid_params(self, arguments):
+        response = _handle_request({
+            "jsonrpc": "2.0", "id": 1, "method": "tools/call",
+            "params": {"name": list(TOOL_HANDLERS)[0], "arguments": arguments},
+        })
+        assert response["error"]["code"] == -32602
+
+    def test_the_stdio_loop_survives_every_one_of_them(self, monkeypatch, capsys):
+        import io
+        import sys
+
+        from sdcvalidator.mcp_server import run_stdio
+
+        lines = ["[]", "\"tools/list\"", "7", "null",
+                 json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": []}),
+                 json.dumps({"jsonrpc": "2.0", "id": 2, "method": "ping"})]
+        monkeypatch.setattr(sys, "stdin", io.StringIO("\n".join(lines) + "\n"))
+        run_stdio()
+        out = [json.loads(l) for l in capsys.readouterr().out.strip().splitlines()]
+        assert len(out) == 6
+        assert [o.get("error", {}).get("code") for o in out[:5]] == [-32600] * 5
+        assert out[5] == {"jsonrpc": "2.0", "id": 2, "result": {}}

sdcvalidator-4.5.2/tests/test_xsi_type.py

@@ -0,0 +1,60 @@
+"""
+Instances that fill a declared type through ``xsi:type``.
+
+The SDC4 reference model declares ``sdc4:XdOrdinal`` and its siblings
+abstract, so a schema-valid instance fills them with a concrete type through
+``xsi:type="sdc4:XdOrdinalType"``. Before 4.5.1 every input was normalised
+into a stdlib ElementTree, which drops the namespace prefix declarations;
+the prefixed QName in ``xsi:type`` then could not be resolved and xmlschema
+raised ``XMLSchemaKeyError`` instead of validating. A path or an XMLResource
+carries the declarations and must validate.
+"""
+
+import io
+import unittest
+from pathlib import Path
+
+from xmlschema import XMLResource
+
+from sdcvalidator.validator import SDC4Validator
+
+DATA = Path(__file__).parent / "test_data"
+SCHEMA = DATA / "xsi_type_schema.xsd"
+VALID = DATA / "xsi_type_instance.xml"
+INVALID = DATA / "xsi_type_instance_invalid.xml"
+
+
+class TestXsiTypeResolution(unittest.TestCase):
+    def setUp(self):
+        self.validator = SDC4Validator(SCHEMA, check_sdc4_compliance=False)
+
+    def test_a_path_validates(self):
+        result = self.validator.validate(str(VALID))
+        self.assertTrue(result.is_valid, result.structural_errors + result.semantic_errors)
+
+    def test_a_pathlib_path_validates(self):
+        self.assertTrue(self.validator.validate(VALID).is_valid)
+
+    def test_an_xmlresource_over_bytes_validates(self):
+        resource = XMLResource(io.BytesIO(VALID.read_bytes()))
+        self.assertTrue(self.validator.validate(resource).is_valid)
+
+    def test_the_report_and_recovery_paths_resolve_the_type_too(self):
+        report = self.validator.validate_and_report(str(VALID))
+        self.assertTrue(report["valid"], report)
+        self.assertEqual(report["error_count"], 0)
+        self.validator.validate_with_recovery(str(VALID), save=False)
+        self.assertEqual(self.validator.validate_structure(str(VALID)), [])
+        self.assertEqual(self.validator.iter_errors(str(VALID)), [])
+
+    def test_a_type_that_resolves_is_still_checked(self):
+        """Resolving the type must not mean skipping it: a bad ordinal is caught."""
+        result = self.validator.validate(str(INVALID))
+        self.assertFalse(result.is_valid)
+        self.assertEqual(result.error_count, 1)
+        report = self.validator.validate_and_report(XMLResource(io.BytesIO(INVALID.read_bytes())))
+        self.assertEqual(report["error_count"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()