|
| 1 | +/* |
| 2 | + * Copyright 2026 The gRPC Authors |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | + |
| 17 | +package io.grpc.xds.internal.matcher; |
| 18 | + |
| 19 | +import com.google.common.collect.ImmutableSet; |
| 20 | +import dev.cel.common.CelAbstractSyntaxTree; |
| 21 | +import dev.cel.common.CelOptions; |
| 22 | +import dev.cel.common.ast.CelReference; |
| 23 | +import dev.cel.runtime.CelRuntime; |
| 24 | +import dev.cel.runtime.CelRuntimeFactory; |
| 25 | +import dev.cel.runtime.CelStandardFunctions; |
| 26 | +import dev.cel.runtime.CelStandardFunctions.StandardFunction; |
| 27 | +import dev.cel.runtime.standard.AddOperator.AddOverload; |
| 28 | +import java.util.Map; |
| 29 | +import java.util.regex.Pattern; |
| 30 | + |
| 31 | +/** |
| 32 | + * Shared utilities for CEL-based matchers and extractors. |
| 33 | + */ |
| 34 | +final class CelCommon { |
| 35 | + private static final CelOptions CEL_OPTIONS = CelOptions.newBuilder() |
| 36 | + .enableComprehension(false) |
| 37 | + .maxRegexProgramSize(100) |
| 38 | + .build(); |
| 39 | + private static final String REQUEST_VARIABLE = "request"; |
| 40 | + private static final CelStandardFunctions FUNCTIONS = |
| 41 | + CelStandardFunctions.newBuilder() |
| 42 | + .filterFunctions((func, over) -> { |
| 43 | + if (func == StandardFunction.STRING) { |
| 44 | + return false; |
| 45 | + } |
| 46 | + if (func == StandardFunction.ADD) { |
| 47 | + return !over.equals(AddOverload.ADD_STRING) |
| 48 | + && !over.equals(AddOverload.ADD_LIST); |
| 49 | + } |
| 50 | + return true; |
| 51 | + }) |
| 52 | + .build(); |
| 53 | + |
| 54 | + |
| 55 | + |
| 56 | + private static final ImmutableSet<String> ALLOWED_EXACT_OVERLOAD_IDS = ImmutableSet.of( |
| 57 | + "equals", "not_equals", "logical_and", "logical_or", "logical_not"); |
| 58 | + |
| 59 | + /** |
| 60 | + * Regular expression pattern to validate internal CEL overload IDs. |
| 61 | + * |
| 62 | + * <p> |
| 63 | + * Standard CEL operators and conversion functions often have empty names in the |
| 64 | + * AST and are identified solely by their overload IDs (e.g., {@code equals} for |
| 65 | + * {@code ==}, {@code divide_int64} for {@code /}). |
| 66 | + * |
| 67 | + * <p> |
| 68 | + * This pattern matches allowed overload IDs by their prefixes (e.g., |
| 69 | + * {@code divide}, {@code size}), optionally followed by numeric types |
| 70 | + * (e.g., {@code int64}) and type-specific suffixes (e.g., {@code _string}, |
| 71 | + * {@code _int64}). |
| 72 | + */ |
| 73 | + private static final Pattern ALLOWED_OVERLOAD_ID_PREFIX_PATTERN = Pattern.compile( |
| 74 | + "^(size|matches|contains|startsWith|endsWith|starts_with|ends_with|" |
| 75 | + + "timestamp|duration|in|index|has|int|uint|double|string|bytes|bool|" |
| 76 | + + "less|less_equals|greater|greater_equals|" |
| 77 | + + "add|subtract|multiply|divide|modulo|negate)" |
| 78 | + + "[0-9]*(_.*)?$"); |
| 79 | + |
| 80 | + static final CelRuntime RUNTIME = CelRuntimeFactory.standardCelRuntimeBuilder() |
| 81 | + .setStandardEnvironmentEnabled(false) |
| 82 | + .setStandardFunctions(FUNCTIONS) |
| 83 | + .setOptions(CEL_OPTIONS) |
| 84 | + .build(); |
| 85 | + |
| 86 | + private CelCommon() {} |
| 87 | + |
| 88 | + /** |
| 89 | + * Validates that the AST only references the allowed variable ("request") |
| 90 | + * and supported functions as defined in gRFC A106. |
| 91 | + */ |
| 92 | + static void checkAllowedReferences(CelAbstractSyntaxTree ast) { |
| 93 | + for (Map.Entry<Long, CelReference> entry : ast.getReferenceMap().entrySet()) { |
| 94 | + CelReference ref = entry.getValue(); |
| 95 | + |
| 96 | + // Check for variables (where overloadIds is empty) |
| 97 | + if (!ref.value().isPresent() && ref.overloadIds().isEmpty()) { |
| 98 | + if (!REQUEST_VARIABLE.equals(ref.name())) { |
| 99 | + throw new IllegalArgumentException( |
| 100 | + "CEL expression references unknown variable: " + ref.name()); |
| 101 | + } |
| 102 | + } else if (!ref.overloadIds().isEmpty()) { |
| 103 | + String name = ref.name(); |
| 104 | + if (name.isEmpty()) { |
| 105 | + boolean allowed = false; |
| 106 | + for (String id : ref.overloadIds()) { |
| 107 | + if (ALLOWED_EXACT_OVERLOAD_IDS.contains(id) |
| 108 | + || ALLOWED_OVERLOAD_ID_PREFIX_PATTERN.matcher(id).matches()) { |
| 109 | + allowed = true; |
| 110 | + break; |
| 111 | + } |
| 112 | + } |
| 113 | + if (!allowed) { |
| 114 | + throw new IllegalArgumentException( |
| 115 | + "CEL expression references unknown function with overload IDs: " |
| 116 | + + ref.overloadIds()); |
| 117 | + } |
| 118 | + } else { |
| 119 | + throw new IllegalArgumentException( |
| 120 | + "CEL expression references unsupported named function: " + name); |
| 121 | + } |
| 122 | + } |
| 123 | + } |
| 124 | + } |
| 125 | +} |
0 commit comments