1// Copyright 2019 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package protodesc 6 7import ( 8 "strings" 9 "unicode" 10 11 "google.golang.org/protobuf/encoding/protowire" 12 "google.golang.org/protobuf/internal/errors" 13 "google.golang.org/protobuf/internal/filedesc" 14 "google.golang.org/protobuf/internal/flags" 15 "google.golang.org/protobuf/internal/genid" 16 "google.golang.org/protobuf/internal/strs" 17 "google.golang.org/protobuf/reflect/protoreflect" 18 19 "google.golang.org/protobuf/types/descriptorpb" 20) 21 22func validateEnumDeclarations(es []filedesc.Enum, eds []*descriptorpb.EnumDescriptorProto) error { 23 for i, ed := range eds { 24 e := &es[i] 25 if err := e.L2.ReservedNames.CheckValid(); err != nil { 26 return errors.New("enum %q reserved names has %v", e.FullName(), err) 27 } 28 if err := e.L2.ReservedRanges.CheckValid(); err != nil { 29 return errors.New("enum %q reserved ranges has %v", e.FullName(), err) 30 } 31 if len(ed.GetValue()) == 0 { 32 return errors.New("enum %q must contain at least one value declaration", e.FullName()) 33 } 34 allowAlias := ed.GetOptions().GetAllowAlias() 35 foundAlias := false 36 for i := 0; i < e.Values().Len(); i++ { 37 v1 := e.Values().Get(i) 38 if v2 := e.Values().ByNumber(v1.Number()); v1 != v2 { 39 foundAlias = true 40 if !allowAlias { 41 return errors.New("enum %q has conflicting non-aliased values on number %d: %q with %q", e.FullName(), v1.Number(), v1.Name(), v2.Name()) 42 } 43 } 44 } 45 if allowAlias && !foundAlias { 46 return errors.New("enum %q allows aliases, but none were found", e.FullName()) 47 } 48 if e.Syntax() == protoreflect.Proto3 { 49 if v := e.Values().Get(0); v.Number() != 0 { 50 return errors.New("enum %q using proto3 semantics must have zero number for the first value", v.FullName()) 51 } 52 // Verify that value names in proto3 do not conflict if the 53 // case-insensitive prefix is removed. 54 // See protoc v3.8.0: src/google/protobuf/descriptor.cc:4991-5055 55 names := map[string]protoreflect.EnumValueDescriptor{} 56 prefix := strings.Replace(strings.ToLower(string(e.Name())), "_", "", -1) 57 for i := 0; i < e.Values().Len(); i++ { 58 v1 := e.Values().Get(i) 59 s := strs.EnumValueName(strs.TrimEnumPrefix(string(v1.Name()), prefix)) 60 if v2, ok := names[s]; ok && v1.Number() != v2.Number() { 61 return errors.New("enum %q using proto3 semantics has conflict: %q with %q", e.FullName(), v1.Name(), v2.Name()) 62 } 63 names[s] = v1 64 } 65 } 66 67 for j, vd := range ed.GetValue() { 68 v := &e.L2.Values.List[j] 69 if vd.Number == nil { 70 return errors.New("enum value %q must have a specified number", v.FullName()) 71 } 72 if e.L2.ReservedNames.Has(v.Name()) { 73 return errors.New("enum value %q must not use reserved name", v.FullName()) 74 } 75 if e.L2.ReservedRanges.Has(v.Number()) { 76 return errors.New("enum value %q must not use reserved number %d", v.FullName(), v.Number()) 77 } 78 } 79 } 80 return nil 81} 82 83func validateMessageDeclarations(ms []filedesc.Message, mds []*descriptorpb.DescriptorProto) error { 84 for i, md := range mds { 85 m := &ms[i] 86 87 // Handle the message descriptor itself. 88 isMessageSet := md.GetOptions().GetMessageSetWireFormat() 89 if err := m.L2.ReservedNames.CheckValid(); err != nil { 90 return errors.New("message %q reserved names has %v", m.FullName(), err) 91 } 92 if err := m.L2.ReservedRanges.CheckValid(isMessageSet); err != nil { 93 return errors.New("message %q reserved ranges has %v", m.FullName(), err) 94 } 95 if err := m.L2.ExtensionRanges.CheckValid(isMessageSet); err != nil { 96 return errors.New("message %q extension ranges has %v", m.FullName(), err) 97 } 98 if err := (*filedesc.FieldRanges).CheckOverlap(&m.L2.ReservedRanges, &m.L2.ExtensionRanges); err != nil { 99 return errors.New("message %q reserved and extension ranges has %v", m.FullName(), err) 100 } 101 for i := 0; i < m.Fields().Len(); i++ { 102 f1 := m.Fields().Get(i) 103 if f2 := m.Fields().ByNumber(f1.Number()); f1 != f2 { 104 return errors.New("message %q has conflicting fields: %q with %q", m.FullName(), f1.Name(), f2.Name()) 105 } 106 } 107 if isMessageSet && !flags.ProtoLegacy { 108 return errors.New("message %q is a MessageSet, which is a legacy proto1 feature that is no longer supported", m.FullName()) 109 } 110 if isMessageSet && (m.Syntax() != protoreflect.Proto2 || m.Fields().Len() > 0 || m.ExtensionRanges().Len() == 0) { 111 return errors.New("message %q is an invalid proto1 MessageSet", m.FullName()) 112 } 113 if m.Syntax() == protoreflect.Proto3 { 114 if m.ExtensionRanges().Len() > 0 { 115 return errors.New("message %q using proto3 semantics cannot have extension ranges", m.FullName()) 116 } 117 // Verify that field names in proto3 do not conflict if lowercased 118 // with all underscores removed. 119 // See protoc v3.8.0: src/google/protobuf/descriptor.cc:5830-5847 120 names := map[string]protoreflect.FieldDescriptor{} 121 for i := 0; i < m.Fields().Len(); i++ { 122 f1 := m.Fields().Get(i) 123 s := strings.Replace(strings.ToLower(string(f1.Name())), "_", "", -1) 124 if f2, ok := names[s]; ok { 125 return errors.New("message %q using proto3 semantics has conflict: %q with %q", m.FullName(), f1.Name(), f2.Name()) 126 } 127 names[s] = f1 128 } 129 } 130 131 for j, fd := range md.GetField() { 132 f := &m.L2.Fields.List[j] 133 if m.L2.ReservedNames.Has(f.Name()) { 134 return errors.New("message field %q must not use reserved name", f.FullName()) 135 } 136 if !f.Number().IsValid() { 137 return errors.New("message field %q has an invalid number: %d", f.FullName(), f.Number()) 138 } 139 if !f.Cardinality().IsValid() { 140 return errors.New("message field %q has an invalid cardinality: %d", f.FullName(), f.Cardinality()) 141 } 142 if m.L2.ReservedRanges.Has(f.Number()) { 143 return errors.New("message field %q must not use reserved number %d", f.FullName(), f.Number()) 144 } 145 if m.L2.ExtensionRanges.Has(f.Number()) { 146 return errors.New("message field %q with number %d in extension range", f.FullName(), f.Number()) 147 } 148 if fd.Extendee != nil { 149 return errors.New("message field %q may not have extendee: %q", f.FullName(), fd.GetExtendee()) 150 } 151 if f.L1.IsProto3Optional { 152 if f.Syntax() != protoreflect.Proto3 { 153 return errors.New("message field %q under proto3 optional semantics must be specified in the proto3 syntax", f.FullName()) 154 } 155 if f.Cardinality() != protoreflect.Optional { 156 return errors.New("message field %q under proto3 optional semantics must have optional cardinality", f.FullName()) 157 } 158 if f.ContainingOneof() != nil && f.ContainingOneof().Fields().Len() != 1 { 159 return errors.New("message field %q under proto3 optional semantics must be within a single element oneof", f.FullName()) 160 } 161 } 162 if f.IsWeak() && !flags.ProtoLegacy { 163 return errors.New("message field %q is a weak field, which is a legacy proto1 feature that is no longer supported", f.FullName()) 164 } 165 if f.IsWeak() && (f.Syntax() != protoreflect.Proto2 || !isOptionalMessage(f) || f.ContainingOneof() != nil) { 166 return errors.New("message field %q may only be weak for an optional message", f.FullName()) 167 } 168 if f.IsPacked() && !isPackable(f) { 169 return errors.New("message field %q is not packable", f.FullName()) 170 } 171 if err := checkValidGroup(f); err != nil { 172 return errors.New("message field %q is an invalid group: %v", f.FullName(), err) 173 } 174 if err := checkValidMap(f); err != nil { 175 return errors.New("message field %q is an invalid map: %v", f.FullName(), err) 176 } 177 if f.Syntax() == protoreflect.Proto3 { 178 if f.Cardinality() == protoreflect.Required { 179 return errors.New("message field %q using proto3 semantics cannot be required", f.FullName()) 180 } 181 if f.Enum() != nil && !f.Enum().IsPlaceholder() && f.Enum().Syntax() != protoreflect.Proto3 { 182 return errors.New("message field %q using proto3 semantics may only depend on a proto3 enum", f.FullName()) 183 } 184 } 185 } 186 seenSynthetic := false // synthetic oneofs for proto3 optional must come after real oneofs 187 for j := range md.GetOneofDecl() { 188 o := &m.L2.Oneofs.List[j] 189 if o.Fields().Len() == 0 { 190 return errors.New("message oneof %q must contain at least one field declaration", o.FullName()) 191 } 192 if n := o.Fields().Len(); n-1 != (o.Fields().Get(n-1).Index() - o.Fields().Get(0).Index()) { 193 return errors.New("message oneof %q must have consecutively declared fields", o.FullName()) 194 } 195 196 if o.IsSynthetic() { 197 seenSynthetic = true 198 continue 199 } 200 if !o.IsSynthetic() && seenSynthetic { 201 return errors.New("message oneof %q must be declared before synthetic oneofs", o.FullName()) 202 } 203 204 for i := 0; i < o.Fields().Len(); i++ { 205 f := o.Fields().Get(i) 206 if f.Cardinality() != protoreflect.Optional { 207 return errors.New("message field %q belongs in a oneof and must be optional", f.FullName()) 208 } 209 if f.IsWeak() { 210 return errors.New("message field %q belongs in a oneof and must not be a weak reference", f.FullName()) 211 } 212 } 213 } 214 215 if err := validateEnumDeclarations(m.L1.Enums.List, md.GetEnumType()); err != nil { 216 return err 217 } 218 if err := validateMessageDeclarations(m.L1.Messages.List, md.GetNestedType()); err != nil { 219 return err 220 } 221 if err := validateExtensionDeclarations(m.L1.Extensions.List, md.GetExtension()); err != nil { 222 return err 223 } 224 } 225 return nil 226} 227 228func validateExtensionDeclarations(xs []filedesc.Extension, xds []*descriptorpb.FieldDescriptorProto) error { 229 for i, xd := range xds { 230 x := &xs[i] 231 // NOTE: Avoid using the IsValid method since extensions to MessageSet 232 // may have a field number higher than normal. This check only verifies 233 // that the number is not negative or reserved. We check again later 234 // if we know that the extendee is definitely not a MessageSet. 235 if n := x.Number(); n < 0 || (protowire.FirstReservedNumber <= n && n <= protowire.LastReservedNumber) { 236 return errors.New("extension field %q has an invalid number: %d", x.FullName(), x.Number()) 237 } 238 if !x.Cardinality().IsValid() || x.Cardinality() == protoreflect.Required { 239 return errors.New("extension field %q has an invalid cardinality: %d", x.FullName(), x.Cardinality()) 240 } 241 if xd.JsonName != nil { 242 // A bug in older versions of protoc would always populate the 243 // "json_name" option for extensions when it is meaningless. 244 // When it did so, it would always use the camel-cased field name. 245 if xd.GetJsonName() != strs.JSONCamelCase(string(x.Name())) { 246 return errors.New("extension field %q may not have an explicitly set JSON name: %q", x.FullName(), xd.GetJsonName()) 247 } 248 } 249 if xd.OneofIndex != nil { 250 return errors.New("extension field %q may not be part of a oneof", x.FullName()) 251 } 252 if md := x.ContainingMessage(); !md.IsPlaceholder() { 253 if !md.ExtensionRanges().Has(x.Number()) { 254 return errors.New("extension field %q extends %q with non-extension field number: %d", x.FullName(), md.FullName(), x.Number()) 255 } 256 isMessageSet := md.Options().(*descriptorpb.MessageOptions).GetMessageSetWireFormat() 257 if isMessageSet && !isOptionalMessage(x) { 258 return errors.New("extension field %q extends MessageSet and must be an optional message", x.FullName()) 259 } 260 if !isMessageSet && !x.Number().IsValid() { 261 return errors.New("extension field %q has an invalid number: %d", x.FullName(), x.Number()) 262 } 263 } 264 if xd.GetOptions().GetWeak() { 265 return errors.New("extension field %q cannot be a weak reference", x.FullName()) 266 } 267 if x.IsPacked() && !isPackable(x) { 268 return errors.New("extension field %q is not packable", x.FullName()) 269 } 270 if err := checkValidGroup(x); err != nil { 271 return errors.New("extension field %q is an invalid group: %v", x.FullName(), err) 272 } 273 if md := x.Message(); md != nil && md.IsMapEntry() { 274 return errors.New("extension field %q cannot be a map entry", x.FullName()) 275 } 276 if x.Syntax() == protoreflect.Proto3 { 277 switch x.ContainingMessage().FullName() { 278 case (*descriptorpb.FileOptions)(nil).ProtoReflect().Descriptor().FullName(): 279 case (*descriptorpb.EnumOptions)(nil).ProtoReflect().Descriptor().FullName(): 280 case (*descriptorpb.EnumValueOptions)(nil).ProtoReflect().Descriptor().FullName(): 281 case (*descriptorpb.MessageOptions)(nil).ProtoReflect().Descriptor().FullName(): 282 case (*descriptorpb.FieldOptions)(nil).ProtoReflect().Descriptor().FullName(): 283 case (*descriptorpb.OneofOptions)(nil).ProtoReflect().Descriptor().FullName(): 284 case (*descriptorpb.ExtensionRangeOptions)(nil).ProtoReflect().Descriptor().FullName(): 285 case (*descriptorpb.ServiceOptions)(nil).ProtoReflect().Descriptor().FullName(): 286 case (*descriptorpb.MethodOptions)(nil).ProtoReflect().Descriptor().FullName(): 287 default: 288 return errors.New("extension field %q cannot be declared in proto3 unless extended descriptor options", x.FullName()) 289 } 290 } 291 } 292 return nil 293} 294 295// isOptionalMessage reports whether this is an optional message. 296// If the kind is unknown, it is assumed to be a message. 297func isOptionalMessage(fd protoreflect.FieldDescriptor) bool { 298 return (fd.Kind() == 0 || fd.Kind() == protoreflect.MessageKind) && fd.Cardinality() == protoreflect.Optional 299} 300 301// isPackable checks whether the pack option can be specified. 302func isPackable(fd protoreflect.FieldDescriptor) bool { 303 switch fd.Kind() { 304 case protoreflect.StringKind, protoreflect.BytesKind, protoreflect.MessageKind, protoreflect.GroupKind: 305 return false 306 } 307 return fd.IsList() 308} 309 310// checkValidGroup reports whether fd is a valid group according to the same 311// rules that protoc imposes. 312func checkValidGroup(fd protoreflect.FieldDescriptor) error { 313 md := fd.Message() 314 switch { 315 case fd.Kind() != protoreflect.GroupKind: 316 return nil 317 case fd.Syntax() != protoreflect.Proto2: 318 return errors.New("invalid under proto2 semantics") 319 case md == nil || md.IsPlaceholder(): 320 return errors.New("message must be resolvable") 321 case fd.FullName().Parent() != md.FullName().Parent(): 322 return errors.New("message and field must be declared in the same scope") 323 case !unicode.IsUpper(rune(md.Name()[0])): 324 return errors.New("message name must start with an uppercase") 325 case fd.Name() != protoreflect.Name(strings.ToLower(string(md.Name()))): 326 return errors.New("field name must be lowercased form of the message name") 327 } 328 return nil 329} 330 331// checkValidMap checks whether the field is a valid map according to the same 332// rules that protoc imposes. 333// See protoc v3.8.0: src/google/protobuf/descriptor.cc:6045-6115 334func checkValidMap(fd protoreflect.FieldDescriptor) error { 335 md := fd.Message() 336 switch { 337 case md == nil || !md.IsMapEntry(): 338 return nil 339 case fd.FullName().Parent() != md.FullName().Parent(): 340 return errors.New("message and field must be declared in the same scope") 341 case md.Name() != protoreflect.Name(strs.MapEntryName(string(fd.Name()))): 342 return errors.New("incorrect implicit map entry name") 343 case fd.Cardinality() != protoreflect.Repeated: 344 return errors.New("field must be repeated") 345 case md.Fields().Len() != 2: 346 return errors.New("message must have exactly two fields") 347 case md.ExtensionRanges().Len() > 0: 348 return errors.New("message must not have any extension ranges") 349 case md.Enums().Len()+md.Messages().Len()+md.Extensions().Len() > 0: 350 return errors.New("message must not have any nested declarations") 351 } 352 kf := md.Fields().Get(0) 353 vf := md.Fields().Get(1) 354 switch { 355 case kf.Name() != genid.MapEntry_Key_field_name || kf.Number() != genid.MapEntry_Key_field_number || kf.Cardinality() != protoreflect.Optional || kf.ContainingOneof() != nil || kf.HasDefault(): 356 return errors.New("invalid key field") 357 case vf.Name() != genid.MapEntry_Value_field_name || vf.Number() != genid.MapEntry_Value_field_number || vf.Cardinality() != protoreflect.Optional || vf.ContainingOneof() != nil || vf.HasDefault(): 358 return errors.New("invalid value field") 359 } 360 switch kf.Kind() { 361 case protoreflect.BoolKind: // bool 362 case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind: // int32 363 case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind: // int64 364 case protoreflect.Uint32Kind, protoreflect.Fixed32Kind: // uint32 365 case protoreflect.Uint64Kind, protoreflect.Fixed64Kind: // uint64 366 case protoreflect.StringKind: // string 367 default: 368 return errors.New("invalid key kind: %v", kf.Kind()) 369 } 370 if e := vf.Enum(); e != nil && e.Values().Len() > 0 && e.Values().Get(0).Number() != 0 { 371 return errors.New("map enum value must have zero number for the first value") 372 } 373 return nil 374} 375