all: remove non-fatal UTF-8 validation errors (and non-fatal in general)
Immediately abort (un)marshal operations when encountering invalid UTF-8
data in proto3 strings. No other proto implementation supports non-UTF-8
data in proto3 strings (and many reject it in proto2 strings as well).
Producing invalid output is an interoperability threat (other
implementations won't be able to read it).
The case where existing string data is found to contain non-UTF8 data is
better handled by changing the field to the `bytes` type, which (aside
from UTF-8 validation) is wire-compatible with `string`.
Remove the errors.NonFatal type, since there are no remaining cases
where it is needed. "Non-fatal" errors which produce results and a
non-nil error are problematic because they compose poorly; the better
approach is to take an option like AllowPartial indicating which
conditions to check for.
Change-Id: I9d189ec6ffda7b5d96d094aa1b290af2e3f23736
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/183098
Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
diff --git a/encoding/prototext/decode.go b/encoding/prototext/decode.go
index 2d8f9e1..a7fc2bf 100644
--- a/encoding/prototext/decode.go
+++ b/encoding/prototext/decode.go
@@ -45,8 +45,6 @@
// Unmarshal reads the given []byte and populates the given proto.Message using options in
// UnmarshalOptions object.
func (o UnmarshalOptions) Unmarshal(b []byte, m proto.Message) error {
- var nerr errors.NonFatal
-
// Clear all fields before populating it.
// TODO: Determine if this needs to be consistent with protojson and binary unmarshal where
// behavior is to merge values into existing message. If decision is to not clear the fields
@@ -55,7 +53,7 @@
// Parse into text.Value of message type.
val, err := text.Unmarshal(b)
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
@@ -63,21 +61,18 @@
o.Resolver = protoregistry.GlobalTypes
}
err = o.unmarshalMessage(val.Message(), m.ProtoReflect())
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
- if !o.AllowPartial {
- nerr.Merge(proto.IsInitialized(m))
+ if o.AllowPartial {
+ return nil
}
-
- return nerr.E
+ return proto.IsInitialized(m)
}
// unmarshalMessage unmarshals a [][2]text.Value message into the given protoreflect.Message.
func (o UnmarshalOptions) unmarshalMessage(tmsg [][2]text.Value, m pref.Message) error {
- var nerr errors.NonFatal
-
messageDesc := m.Descriptor()
// Handle expanded Any message.
@@ -141,7 +136,7 @@
}
list := m.Mutable(fd).List()
- if err := o.unmarshalList(items, fd, list); !nerr.Merge(err) {
+ if err := o.unmarshalList(items, fd, list); err != nil {
return err
}
case fd.IsMap():
@@ -154,7 +149,7 @@
}
mmap := m.Mutable(fd).Map()
- if err := o.unmarshalMap(items, fd, mmap); !nerr.Merge(err) {
+ if err := o.unmarshalMap(items, fd, mmap); err != nil {
return err
}
default:
@@ -172,14 +167,14 @@
if seenNums.Has(num) {
return errors.New("non-repeated field %v is repeated", fd.FullName())
}
- if err := o.unmarshalSingular(tval, fd, m); !nerr.Merge(err) {
+ if err := o.unmarshalSingular(tval, fd, m); err != nil {
return err
}
seenNums.Set(num)
}
}
- return nerr.E
+ return nil
}
// findExtension returns protoreflect.ExtensionType from the Resolver if found.
@@ -199,7 +194,6 @@
// unmarshalSingular unmarshals given text.Value into the non-repeated field.
func (o UnmarshalOptions) unmarshalSingular(input text.Value, fd pref.FieldDescriptor, m pref.Message) error {
- var nerr errors.NonFatal
var val pref.Value
switch fd.Kind() {
case pref.MessageKind, pref.GroupKind:
@@ -207,20 +201,20 @@
return errors.New("%v contains invalid message/group value: %v", fd.FullName(), input)
}
m2 := m.NewMessage(fd)
- if err := o.unmarshalMessage(input.Message(), m2); !nerr.Merge(err) {
+ if err := o.unmarshalMessage(input.Message(), m2); err != nil {
return err
}
val = pref.ValueOf(m2)
default:
var err error
val, err = unmarshalScalar(input, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
}
m.Set(fd, val)
- return nerr.E
+ return nil
}
// unmarshalScalar converts the given text.Value to a scalar/enum protoreflect.Value specified in
@@ -264,9 +258,7 @@
if utf8.ValidString(s) {
return pref.ValueOf(s), nil
}
- var nerr errors.NonFatal
- nerr.AppendInvalidUTF8(string(fd.FullName()))
- return pref.ValueOf(s), nerr.E
+ return pref.Value{}, errors.InvalidUTF8(string(fd.FullName()))
}
case pref.BytesKind:
if input.Type() == text.String {
@@ -292,8 +284,6 @@
// unmarshalList unmarshals given []text.Value into given protoreflect.List.
func (o UnmarshalOptions) unmarshalList(inputList []text.Value, fd pref.FieldDescriptor, list pref.List) error {
- var nerr errors.NonFatal
-
switch fd.Kind() {
case pref.MessageKind, pref.GroupKind:
for _, input := range inputList {
@@ -301,7 +291,7 @@
return errors.New("%v contains invalid message/group value: %v", fd.FullName(), input)
}
m := list.NewMessage()
- if err := o.unmarshalMessage(input.Message(), m); !nerr.Merge(err) {
+ if err := o.unmarshalMessage(input.Message(), m); err != nil {
return err
}
list.Append(pref.ValueOf(m))
@@ -309,20 +299,18 @@
default:
for _, input := range inputList {
val, err := unmarshalScalar(input, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
list.Append(val)
}
}
- return nerr.E
+ return nil
}
// unmarshalMap unmarshals given []text.Value into given protoreflect.Map.
func (o UnmarshalOptions) unmarshalMap(input []text.Value, fd pref.FieldDescriptor, mmap pref.Map) error {
- var nerr errors.NonFatal
-
// Determine ahead whether map entry is a scalar type or a message type in order to call the
// appropriate unmarshalMapValue func inside the for loop below.
unmarshalMapValue := unmarshalMapScalarValue
@@ -336,20 +324,20 @@
return errors.New("%v contains invalid map entry: %v", fd.FullName(), entry)
}
tkey, tval, err := parseMapEntry(entry.Message(), fd.FullName())
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
pkey, err := unmarshalMapKey(tkey, fd.MapKey())
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
err = unmarshalMapValue(tval, pkey, fd.MapValue(), mmap)
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
}
- return nerr.E
+ return nil
}
// parseMapEntry parses [][2]text.Value for field names key and value, and return corresponding
@@ -391,46 +379,43 @@
return fd.Default().MapKey(), nil
}
- var nerr errors.NonFatal
val, err := unmarshalScalar(input, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return pref.MapKey{}, errors.New("%v contains invalid key: %v", fd.FullName(), input)
}
- return val.MapKey(), nerr.E
+ return val.MapKey(), nil
}
// unmarshalMapMessageValue unmarshals given message-type text.Value into a protoreflect.Map for
// the given MapKey.
func (o UnmarshalOptions) unmarshalMapMessageValue(input text.Value, pkey pref.MapKey, _ pref.FieldDescriptor, mmap pref.Map) error {
- var nerr errors.NonFatal
var value [][2]text.Value
if input.Type() != 0 {
value = input.Message()
}
m := mmap.NewMessage()
- if err := o.unmarshalMessage(value, m); !nerr.Merge(err) {
+ if err := o.unmarshalMessage(value, m); err != nil {
return err
}
mmap.Set(pkey, pref.ValueOf(m))
- return nerr.E
+ return nil
}
// unmarshalMapScalarValue unmarshals given scalar-type text.Value into a protoreflect.Map
// for the given MapKey.
func unmarshalMapScalarValue(input text.Value, pkey pref.MapKey, fd pref.FieldDescriptor, mmap pref.Map) error {
- var nerr errors.NonFatal
var val pref.Value
if input.Type() == 0 {
val = fd.Default()
} else {
var err error
val, err = unmarshalScalar(input, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
}
mmap.Set(pkey, val)
- return nerr.E
+ return nil
}
// isExpandedAny returns true if given [][2]text.Value may be an expanded Any that contains only one
@@ -447,19 +432,17 @@
// unmarshalAny unmarshals an expanded Any textproto. This method assumes that the given
// tfield has key type of text.String and value type of text.Message.
func (o UnmarshalOptions) unmarshalAny(tfield [2]text.Value, m pref.Message) error {
- var nerr errors.NonFatal
-
typeURL := tfield[0].String()
value := tfield[1].Message()
mt, err := o.Resolver.FindMessageByURL(typeURL)
- if !nerr.Merge(err) {
+ if err != nil {
return errors.New("unable to resolve message [%v]: %v", typeURL, err)
}
// Create new message for the embedded message type and unmarshal the
// value into it.
m2 := mt.New()
- if err := o.unmarshalMessage(value, m2); !nerr.Merge(err) {
+ if err := o.unmarshalMessage(value, m2); err != nil {
return err
}
// Serialize the embedded message and assign the resulting bytes to the value field.
@@ -467,7 +450,7 @@
AllowPartial: true, // never check required fields inside an Any
Deterministic: true,
}.Marshal(m2.Interface())
- if !nerr.Merge(err) {
+ if err != nil {
return err
}
@@ -478,5 +461,5 @@
m.Set(fdType, pref.ValueOf(typeURL))
m.Set(fdValue, pref.ValueOf(b))
- return nerr.E
+ return nil
}
diff --git a/encoding/prototext/decode_test.go b/encoding/prototext/decode_test.go
index c681591..32d9be8 100644
--- a/encoding/prototext/decode_test.go
+++ b/encoding/prototext/decode_test.go
@@ -10,7 +10,6 @@
protoV1 "github.com/golang/protobuf/proto"
"google.golang.org/protobuf/encoding/prototext"
- "google.golang.org/protobuf/internal/errors"
pimpl "google.golang.org/protobuf/internal/impl"
"google.golang.org/protobuf/internal/scalar"
"google.golang.org/protobuf/proto"
@@ -157,10 +156,7 @@
desc: "string with invalid UTF-8",
inputMessage: &pb3.Scalars{},
inputText: `s_string: "abc\xff"`,
- wantMessage: &pb3.Scalars{
- SString: "abc\xff",
- },
- wantErr: true,
+ wantErr: true,
}, {
desc: "proto2 message contains unknown field",
inputMessage: &pb2.Scalars{},
@@ -459,11 +455,6 @@
s_string: "abc\xff"
}
`,
- wantMessage: &pb3.Nests{
- SNested: &pb3.Nested{
- SString: "abc\xff",
- },
- },
wantErr: true,
}, {
desc: "oneof set to empty string",
@@ -556,10 +547,7 @@
desc: "repeated contains invalid UTF-8",
inputMessage: &pb2.Repeats{},
inputText: `rpt_string: "abc\xff"`,
- wantMessage: &pb2.Repeats{
- RptString: []string{"abc\xff"},
- },
- wantErr: true,
+ wantErr: true,
}, {
desc: "repeated enums",
inputMessage: &pb2.Enums{},
@@ -878,11 +866,6 @@
value: "abc\xff"
}
`,
- wantMessage: &pb3.Maps{
- Int32ToStr: map[int32]string{
- 101: "abc\xff",
- },
- },
wantErr: true,
}, {
desc: "map field key contains invalid UTF-8",
@@ -892,11 +875,6 @@
value: {}
}
`,
- wantMessage: &pb3.Maps{
- StrToNested: map[string]*pb3.Nested{
- "abc\xff": {},
- },
- },
wantErr: true,
}, {
desc: "map contains unknown field",
@@ -1196,12 +1174,7 @@
desc: "extension field contains invalid UTF-8",
inputMessage: &pb2.Extensions{},
inputText: `[pb2.opt_ext_string]: "abc\xff"`,
- wantMessage: func() proto.Message {
- m := &pb2.Extensions{}
- setExtension(m, pb2.E_OptExtString, "abc\xff")
- return m
- }(),
- wantErr: true,
+ wantErr: true,
}, {
desc: "extensions of repeated fields",
inputMessage: &pb2.Extensions{},
@@ -1466,20 +1439,6 @@
s_string: "abc\xff"
}
`,
- wantMessage: func() proto.Message {
- m := &pb3.Nested{
- SString: "abc\xff",
- }
- var nerr errors.NonFatal
- b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
- if !nerr.Merge(err) {
- t.Fatalf("error in binary marshaling message for Any.value: %v", err)
- }
- return &anypb.Any{
- TypeUrl: string(m.ProtoReflect().Descriptor().FullName()),
- Value: b,
- }
- }(),
wantErr: true,
}, {
desc: "Any expanded with unregistered type",
diff --git a/encoding/prototext/encode.go b/encoding/prototext/encode.go
index f3aba56..4d73041 100644
--- a/encoding/prototext/encode.go
+++ b/encoding/prototext/encode.go
@@ -53,38 +53,35 @@
o.Resolver = protoregistry.GlobalTypes
}
- var nerr errors.NonFatal
v, err := o.marshalMessage(m.ProtoReflect())
- if !nerr.Merge(err) {
+ if err != nil {
return nil, err
}
delims := [2]byte{'{', '}'}
const outputASCII = false
b, err := text.Marshal(v, o.Indent, delims, outputASCII)
- if !nerr.Merge(err) {
+ if err != nil {
return nil, err
}
- if !o.AllowPartial {
- nerr.Merge(proto.IsInitialized(m))
+ if o.AllowPartial {
+ return b, nil
}
- return b, nerr.E
+ return b, proto.IsInitialized(m)
}
// marshalMessage converts a protoreflect.Message to a text.Value.
func (o MarshalOptions) marshalMessage(m pref.Message) (text.Value, error) {
- var nerr errors.NonFatal
var msgFields [][2]text.Value
messageDesc := m.Descriptor()
// Handle Any expansion.
if messageDesc.FullName() == "google.protobuf.Any" {
- msg, err := o.marshalAny(m)
- if err == nil || nerr.Merge(err) {
- // Return as is for nil or non-fatal error.
- return msg, nerr.E
+ if msg, err := o.marshalAny(m); err == nil {
+ // Return as is if no error.
+ return msg, nil
}
- // For other errors, continue on to marshal Any as a regular message.
+ // Otherwise continue on to marshal Any as a regular message.
}
// Handle known fields.
@@ -104,7 +101,7 @@
pval := m.Get(fd)
var err error
msgFields, err = o.appendField(msgFields, name, pval, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return text.Value{}, err
}
}
@@ -112,7 +109,7 @@
// Handle extensions.
var err error
msgFields, err = o.appendExtensions(msgFields, m)
- if !nerr.Merge(err) {
+ if err != nil {
return text.Value{}, err
}
@@ -120,17 +117,15 @@
// TODO: Provide option to exclude or include unknown fields.
msgFields = appendUnknown(msgFields, m.GetUnknown())
- return text.ValueOf(msgFields), nerr.E
+ return text.ValueOf(msgFields), nil
}
// appendField marshals a protoreflect.Value and appends it to the given [][2]text.Value.
func (o MarshalOptions) appendField(msgFields [][2]text.Value, name text.Value, pval pref.Value, fd pref.FieldDescriptor) ([][2]text.Value, error) {
- var nerr errors.NonFatal
-
switch {
case fd.IsList():
items, err := o.marshalList(pval.List(), fd)
- if !nerr.Merge(err) {
+ if err != nil {
return msgFields, err
}
@@ -139,7 +134,7 @@
}
case fd.IsMap():
items, err := o.marshalMap(pval.Map(), fd)
- if !nerr.Merge(err) {
+ if err != nil {
return msgFields, err
}
@@ -148,13 +143,13 @@
}
default:
tval, err := o.marshalSingular(pval, fd)
- if !nerr.Merge(err) {
+ if err != nil {
return msgFields, err
}
msgFields = append(msgFields, [2]text.Value{name, tval})
}
- return msgFields, nerr.E
+ return msgFields, nil
}
// marshalSingular converts a non-repeated field value to text.Value.
@@ -173,12 +168,10 @@
case pref.StringKind:
s := val.String()
- if utf8.ValidString(s) {
- return text.ValueOf(s), nil
+ if !utf8.ValidString(s) {
+ return text.Value{}, errors.InvalidUTF8(string(fd.FullName()))
}
- var nerr errors.NonFatal
- nerr.AppendInvalidUTF8(string(fd.FullName()))
- return text.ValueOf(s), nerr.E
+ return text.ValueOf(s), nil
case pref.EnumKind:
num := val.Enum()
@@ -197,21 +190,20 @@
// marshalList converts a protoreflect.List to []text.Value.
func (o MarshalOptions) marshalList(list pref.List, fd pref.FieldDescriptor) ([]text.Value, error) {
- var nerr errors.NonFatal
size := list.Len()
values := make([]text.Value, 0, size)
for i := 0; i < size; i++ {
item := list.Get(i)
val, err := o.marshalSingular(item, fd)
- if !nerr.Merge(err) {
+ if err != nil {
// Return already marshaled values.
return values, err
}
values = append(values, val)
}
- return values, nerr.E
+ return values, nil
}
var (
@@ -221,7 +213,6 @@
// marshalMap converts a protoreflect.Map to []text.Value.
func (o MarshalOptions) marshalMap(mmap pref.Map, fd pref.FieldDescriptor) ([]text.Value, error) {
- var nerr errors.NonFatal
// values is a list of messages.
values := make([]text.Value, 0, mmap.Len())
@@ -229,12 +220,12 @@
mapsort.Range(mmap, fd.MapKey().Kind(), func(key pref.MapKey, val pref.Value) bool {
var keyTxtVal text.Value
keyTxtVal, err = o.marshalSingular(key.Value(), fd.MapKey())
- if !nerr.Merge(err) {
+ if err != nil {
return false
}
var valTxtVal text.Value
valTxtVal, err = o.marshalSingular(val, fd.MapValue())
- if !nerr.Merge(err) {
+ if err != nil {
return false
}
// Map entry (message) contains 2 fields, first field for key and second field for value.
@@ -250,12 +241,11 @@
return nil, err
}
- return values, nerr.E
+ return values, nil
}
// appendExtensions marshals extension fields and appends them to the given [][2]text.Value.
func (o MarshalOptions) appendExtensions(msgFields [][2]text.Value, m pref.Message) ([][2]text.Value, error) {
- var nerr errors.NonFatal
var err error
var entries [][2]text.Value
m.Range(func(fd pref.FieldDescriptor, v pref.Value) bool {
@@ -273,7 +263,7 @@
// Use string type to produce [name] format.
tname := text.ValueOf(string(name))
entries, err = o.appendField(entries, tname, v, xt)
- if !nerr.Merge(err) {
+ if err != nil {
return false
}
err = nil
@@ -287,7 +277,7 @@
sort.SliceStable(entries, func(i, j int) bool {
return entries[i][0].String() < entries[j][0].String()
})
- return append(msgFields, entries...), nerr.E
+ return append(msgFields, entries...), nil
}
// isMessageSetExtension reports whether extension extends a message set.
@@ -348,9 +338,8 @@
typeURL := m.Get(fdType).String()
value := m.Get(fdValue)
- var nerr errors.NonFatal
emt, err := o.Resolver.FindMessageByURL(typeURL)
- if !nerr.Merge(err) {
+ if err != nil {
return text.Value{}, err
}
em := emt.New().Interface()
@@ -358,12 +347,12 @@
AllowPartial: true,
Resolver: o.Resolver,
}.Unmarshal(value.Bytes(), em)
- if !nerr.Merge(err) {
+ if err != nil {
return text.Value{}, err
}
msg, err := o.marshalMessage(em.ProtoReflect())
- if !nerr.Merge(err) {
+ if err != nil {
return text.Value{}, err
}
// Expanded Any field value contains only a single field with the type_url field value as the
@@ -374,5 +363,5 @@
msg,
},
}
- return text.ValueOf(msgFields), nerr.E
+ return text.ValueOf(msgFields), nil
}
diff --git a/encoding/prototext/encode_test.go b/encoding/prototext/encode_test.go
index ea97c89..42f4e98 100644
--- a/encoding/prototext/encode_test.go
+++ b/encoding/prototext/encode_test.go
@@ -5,7 +5,6 @@
package prototext_test
import (
- "bytes"
"encoding/hex"
"math"
"testing"
@@ -162,8 +161,6 @@
input: &pb3.Scalars{
SString: "abc\xff",
},
- want: `s_string: "abc\xff"
-`,
wantErr: true,
}, {
desc: "float nan",
@@ -366,10 +363,6 @@
SString: "abc\xff",
},
},
- want: `s_nested: {
- s_string: "abc\xff"
-}
-`,
wantErr: true,
}, {
desc: "oneof not set",
@@ -485,8 +478,6 @@
input: &pb2.Repeats{
RptString: []string{"abc\xff"},
},
- want: `rpt_string: "abc\xff"
-`,
wantErr: true,
}, {
desc: "repeated enums",
@@ -693,11 +684,6 @@
101: "abc\xff",
},
},
- want: `int32_to_str: {
- key: 101
- value: "abc\xff"
-}
-`,
wantErr: true,
}, {
desc: "map field key contains invalid UTF-8",
@@ -706,11 +692,6 @@
"abc\xff": {},
},
},
- want: `str_to_nested: {
- key: "abc\xff"
- value: {}
-}
-`,
wantErr: true,
}, {
desc: "map field contains nil value",
@@ -967,8 +948,6 @@
setExtension(m, pb2.E_OptExtString, "abc\xff")
return m
}(),
- want: `[pb2.opt_ext_string]: "abc\xff"
-`,
wantErr: true,
}, {
desc: "extension partial returns error",
@@ -1221,29 +1200,6 @@
}
`,
}, {
- desc: "Any with invalid UTF-8",
- mo: prototext.MarshalOptions{
- Resolver: preg.NewTypes(pimpl.Export{}.MessageTypeOf(&pb3.Nested{})),
- },
- input: func() proto.Message {
- m := &pb3.Nested{
- SString: "abcd",
- }
- b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
- if err != nil {
- t.Fatalf("error in binary marshaling message for Any.value: %v", err)
- }
- return &anypb.Any{
- TypeUrl: string(m.ProtoReflect().Descriptor().FullName()),
- Value: bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
- }
- }(),
- want: `[pb3.Nested]: {
- s_string: "abc\xff"
-}
-`,
- wantErr: true,
- }, {
desc: "Any with invalid value",
mo: prototext.MarshalOptions{
Resolver: preg.NewTypes(pimpl.Export{}.MessageTypeOf(&pb2.Nested{})),