PureXML/Sources/Validation/DTDValidationHelpers.swift
Mihaela Mihaljevic 7f1aada240 feat(dtd): conditional sections, notations, NDATA, external parameter entities
Deepen DTD processing in the doctype scanner:

- Conditional sections are processed, not skipped: INCLUDE sections have
  their declarations scanned, IGNORE sections are discarded, the keyword
  may be a parameter-entity reference, and nested sections are handled.
- <!NOTATION> declarations are parsed and stored on DocumentType.
- Unparsed entities (<!ENTITY ... NDATA n>) are parsed and stored with
  their notation, distinct from general entities.
- External parameter entities are loaded through the injected resolver so
  their declarations expand; the default refusing resolver loads nothing,
  keeping XXE closed.
- NOTATION attributes are a distinct type, validated against the declared
  notations (value must be listed and the notation declared).

Tracking unparsed entities also lets ENTITY/ENTITIES attribute values be
validated against the declared NDATA entities, closing the gap left when
#73 could only check name syntax.

Closes #72
2026-06-08 14:39:42 +02:00

213 lines
9.1 KiB
Swift

extension PureXML.Validation.DTD {
// MARK: Content models
static func contentViolations(_ element: DTDElement, model: PureXML.Validation.ContentModel, at path: DTDPath) -> [DTDFailure] {
let name = element.name.description
let content = childContent(of: element)
switch model {
case .empty:
return content.names.isEmpty && !content.hasText
? []
: [DTDFailure(reason: "element <\(name)> is declared EMPTY but has content", at: path)]
case .any:
return []
case .pcdata:
return content.names.isEmpty
? []
: [DTDFailure(reason: "element <\(name)> is declared (#PCDATA) but has child elements", at: path)]
case let .mixed(allowed):
return content.names
.filter { !allowed.contains($0) }
.map { DTDFailure(reason: "element <\($0)> is not allowed in the mixed content of <\(name)>", at: path) }
case let .children(particle):
return childrenViolations(name: name, particle: particle, content: content, at: path)
}
}
private static func childrenViolations(
name: String,
particle: PureXML.Validation.Particle,
content: (names: [String], hasText: Bool),
at path: DTDPath,
) -> [DTDFailure] {
var result: [DTDFailure] = []
if content.hasText {
result.append(DTDFailure(reason: "element <\(name)> has element content but contains character data", at: path))
}
if !PureXML.Validation.ContentModelMatcher.matchesChildren(particle, content.names) {
result.append(DTDFailure(reason: "the children of <\(name)> do not match its content model", at: path))
}
return result
}
private static func childContent(of element: DTDElement) -> (names: [String], hasText: Bool) {
var names: [String] = []
var hasText = false
for child in element.children {
switch child {
case let .element(inner):
names.append(inner.name.description)
case let .text(value), let .cdata(value):
if value.contains(where: { !$0.isWhitespace }) { hasText = true }
default:
break
}
}
return (names, hasText)
}
// MARK: Attributes
static func attributeViolations(
_ declaration: PureXML.Validation.AttributeDeclaration,
on element: DTDElement,
schema: PureXML.Validation.DTDSchema,
at path: DTDPath,
) -> [DTDFailure] {
let name = element.name.description
let value = element.attributes.first {
$0.name.description == declaration.name || $0.name.localName == declaration.name
}?.value
guard let value else {
return declaration.defaultDecl == .required
? [DTDFailure(reason: "required attribute '\(declaration.name)' is missing on <\(name)>", at: path)]
: []
}
var result: [DTDFailure] = []
if case let .fixed(fixedValue) = declaration.defaultDecl, value != fixedValue {
result.append(DTDFailure(reason: "attribute '\(declaration.name)' on <\(name)> is #FIXED and must be \"\(fixedValue)\"", at: path))
}
if case let .enumeration(allowed) = declaration.type, !allowed.contains(value) {
result.append(DTDFailure(reason: "attribute '\(declaration.name)' on <\(name)> has a value outside its enumeration", at: path))
}
if let tokenError = tokenizedTypeError(declaration, value: value, on: name, entities: schema.unparsedEntities, at: path) {
result.append(tokenError)
}
if let notationError = notationError(declaration, value: value, on: name, notations: schema.notations, at: path) {
result.append(notationError)
}
return result
}
/// The error when a `NOTATION` attribute value is not one of the names its
/// declaration lists, or names a notation that is not declared with
/// `<!NOTATION>`. Returns nil for any other attribute type.
static func notationError(
_ declaration: PureXML.Validation.AttributeDeclaration,
value: String,
on element: String,
notations: Set<String>,
at path: DTDPath,
) -> DTDFailure? {
guard case let .notation(allowed) = declaration.type else { return nil }
if !allowed.contains(value) {
return DTDFailure(reason: "attribute '\(declaration.name)' on <\(element)> has a value outside its NOTATION list", at: path)
}
if !notations.contains(value) {
return DTDFailure(reason: "attribute '\(declaration.name)' on <\(element)> names undeclared notation '\(value)'", at: path)
}
return nil
}
/// The error when a tokenized attribute value does not match its declared
/// lexical form: `NMTOKEN(S)` must be name token(s), and `ENTITY`/`ENTITIES`
/// must name declared unparsed (`NDATA`) entities. The ID family is checked
/// separately for cross-reference integrity.
static func tokenizedTypeError(
_ declaration: PureXML.Validation.AttributeDeclaration,
value: String,
on element: String,
entities: Set<String>,
at path: DTDPath,
) -> DTDFailure? {
let isNmtoken = PureXML.Parsing.XMLCharacter.isNmtoken
let isEntity = { (token: String) in PureXML.Parsing.XMLCharacter.isValidName(token) && entities.contains(token) }
let tokens = value.split(whereSeparator: \.isWhitespace).map(String.init)
let valid: Bool
switch declaration.type {
case .nmToken: valid = isNmtoken(value)
case .nmTokens: valid = !tokens.isEmpty && tokens.allSatisfy(isNmtoken)
case .entity: valid = isEntity(value)
case .entities: valid = !tokens.isEmpty && tokens.allSatisfy(isEntity)
case .cdata, .enumeration, .notation, .id, .idReference, .idReferences: return nil
}
guard !valid else { return nil }
return DTDFailure(reason: "attribute '\(declaration.name)' on <\(element)> is not a valid \(typeName(declaration.type))", at: path)
}
private static func typeName(_ type: PureXML.Validation.AttributeType) -> String {
switch type {
case .nmToken: "NMTOKEN"
case .nmTokens: "NMTOKENS"
case .entity: "ENTITY"
case .entities: "ENTITIES"
default: "value"
}
}
// MARK: ID / IDREF integrity
static func identifierErrors(_ node: PureXML.Model.Node, schema: PureXML.Validation.DTDSchema, at path: DTDPath) -> [DTDFailure] {
var counts: [String: Int] = [:]
var references: [(value: String, element: String)] = []
collect(node, schema: schema, counts: &counts, references: &references)
var errors: [DTDFailure] = []
for (value, count) in counts where count > 1 {
errors.append(DTDFailure(reason: "duplicate ID '\(value)' (declared \(count) times)", at: path))
}
for reference in references where counts[reference.value] == nil {
errors.append(DTDFailure(reason: "IDREF '\(reference.value)' on <\(reference.element)> matches no ID", at: path))
}
return errors
}
private static func collect(
_ node: PureXML.Model.Node,
schema: PureXML.Validation.DTDSchema,
counts: inout [String: Int],
references: inout [(value: String, element: String)],
) {
switch node {
case let .document(children):
for child in children {
collect(child, schema: schema, counts: &counts, references: &references)
}
case let .element(element):
collectIdentifiers(element, schema: schema, counts: &counts, references: &references)
for child in element.children {
collect(child, schema: schema, counts: &counts, references: &references)
}
case .text, .cdata, .comment, .processingInstruction:
break
}
}
private static func collectIdentifiers(
_ element: DTDElement,
schema: PureXML.Validation.DTDSchema,
counts: inout [String: Int],
references: inout [(value: String, element: String)],
) {
let name = element.name.description
guard let declarations = schema.attributes[name] else { return }
for declaration in declarations {
guard let value = element.attributes.first(where: {
$0.name.description == declaration.name || $0.name.localName == declaration.name
})?.value else { continue }
switch declaration.type {
case .id:
counts[value, default: 0] += 1
case .idReference:
references.append((value, name))
case .idReferences:
for token in value.split(whereSeparator: { $0.isWhitespace }) {
references.append((String(token), name))
}
case .cdata, .enumeration, .notation, .nmToken, .nmTokens, .entity, .entities:
break
}
}
}
}