/*
 * Copyright 2025 Richard Hughes <richard@hughsie.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-or-later
 */

#include "config.h"

#include "fwupd-error.h"
#include "fwupd-json-array-private.h"
#include "fwupd-json-node-private.h"
#include "fwupd-json-object-private.h"
#include "fwupd-json-parser.h"

/**
 * FwupdJsonParser:
 *
 * A streaming tokenizer JSON parser that is resistant to malicious input.
 *
 * One item of note is that most of the JSON string methods actually return a #GRefString -- which
 * can be used to avoid lots of tiny memory allocation when parsing JSON into other objects.
 *
 * See also: [struct@FwupdJsonArray] [struct@FwupdJsonObject] [struct@FwupdJsonNode]
 */

struct _FwupdJsonParser {
	GObject parent_instance;
	guint max_depth;
	guint max_items;
	guint max_quoted;
};

G_DEFINE_TYPE(FwupdJsonParser, fwupd_json_parser, G_TYPE_OBJECT)

#define FWUPD_JSON_PARSER_NEWLINE_MAX 5

#define FWUPD_JSON_PARSER_INDENT_MAX 8 /* per depth */

/**
 * fwupd_json_parser_set_max_depth:
 * @self: a #FwupdJsonParser
 * @max_depth: max nesting depth
 *
 * Sets the maximum nesting depth.
 *
 * The default maximum depth is %G_MAXUINT16, but users of #FwupdJsonParser should use this function
 * to set a better limit.
 *
 * Since: 2.1.1
 **/
void
fwupd_json_parser_set_max_depth(FwupdJsonParser *self, guint max_depth)
{
	g_return_if_fail(FWUPD_IS_JSON_PARSER(self));
	self->max_depth = max_depth;
}

/**
 * fwupd_json_parser_set_max_items:
 * @self: a #FwupdJsonParser
 * @max_items: max items
 *
 * Sets the maximum number of items in an array or object.
 *
 * The default maximum items is %G_MAXUINT16, but users of #FwupdJsonParser should use this function
 * to set a better limit.
 *
 * Since: 2.1.1
 **/
void
fwupd_json_parser_set_max_items(FwupdJsonParser *self, guint max_items)
{
	g_return_if_fail(FWUPD_IS_JSON_PARSER(self));
	self->max_items = max_items;
}

/**
 * fwupd_json_parser_set_max_quoted:
 * @self: a #FwupdJsonParser
 * @max_quoted: maximum size of a quoted string
 *
 * Sets the maximum size of a quoted string.
 *
 * The default maximum quoted string length is %G_MAXUINT16, but users of #FwupdJsonParser should
 * use this function to set a better limit.
 *
 * Since: 2.1.1
 **/
void
fwupd_json_parser_set_max_quoted(FwupdJsonParser *self, guint max_quoted)
{
	g_return_if_fail(FWUPD_IS_JSON_PARSER(self));
	self->max_quoted = max_quoted;
}

typedef enum {
	FWUPD_JSON_PARSER_TOKEN_INVALID = 0,
	FWUPD_JSON_PARSER_TOKEN_NULL = '0',
	FWUPD_JSON_PARSER_TOKEN_RAW = 'b',
	FWUPD_JSON_PARSER_TOKEN_STRING = '\"',
	FWUPD_JSON_PARSER_TOKEN_OBJECT_START = '{',
	FWUPD_JSON_PARSER_TOKEN_OBJECT_END = '}',
	FWUPD_JSON_PARSER_TOKEN_OBJECT_DELIM = ':',
	FWUPD_JSON_PARSER_TOKEN_ARRAY_START = '[',
	FWUPD_JSON_PARSER_TOKEN_ARRAY_END = ']',
} FwupdJsonParserToken;

typedef struct {
	FwupdJsonLoadFlags flags;
	GByteArray *buf;
	gsize buf_offset; /* into @buf */
	GInputStream *stream;
	GString *acc;
	guint max_quoted;
	gboolean is_quoted;
	gboolean is_escape;
	guint linecnt;
	guint newlinecnt;
	guint whitespacecnt;
	guint depth;
} FwupdJsonParserHelper;

static FwupdJsonParserHelper *
fwupd_json_parser_helper_new(FwupdJsonParser *self)
{
	FwupdJsonParserHelper *helper = g_new0(FwupdJsonParserHelper, 1);
	helper->max_quoted = self->max_quoted;
	helper->linecnt = 1;
	helper->buf = g_byte_array_new();
	helper->acc = g_string_sized_new(128);
	helper->buf_offset = G_MAXSIZE;
	g_byte_array_set_size(helper->buf, 32 * 1024);
	return helper;
}

static void
fwupd_json_parser_helper_free(FwupdJsonParserHelper *helper)
{
	if (helper->stream != NULL)
		g_object_unref(helper->stream);
	g_byte_array_unref(helper->buf);
	g_string_free(helper->acc, TRUE);
	g_free(helper);
}

G_DEFINE_AUTOPTR_CLEANUP_FUNC(FwupdJsonParserHelper, fwupd_json_parser_helper_free)

static void
fwupd_json_parser_helper_dump_acc(FwupdJsonParserHelper *helper,
				  FwupdJsonParserToken *token,
				  GRefString **str)
{
	if (helper->is_quoted) {
		*token = FWUPD_JSON_PARSER_TOKEN_STRING;
		if (str != NULL)
			*str = g_ref_string_new_len(helper->acc->str, helper->acc->len);
	} else {
		if (helper->acc->len == 0)
			return;
		if (g_ascii_strncasecmp(helper->acc->str, "null", helper->acc->len) == 0) {
			*token = FWUPD_JSON_PARSER_TOKEN_NULL;
		} else {
			*token = FWUPD_JSON_PARSER_TOKEN_RAW;
			if (str != NULL)
				*str = g_ref_string_new_len(helper->acc->str, helper->acc->len);
		}
	}
	g_string_truncate(helper->acc, 0);
}

static gboolean
fwupd_json_parser_helper_slurp(FwupdJsonParserHelper *helper, GError **error)
{
	gssize rc;

	rc = g_input_stream_read(helper->stream, helper->buf->data, helper->buf->len, NULL, error);
	if (rc < 0) {
		fwupd_error_convert(error);
		return FALSE;
	}
	if (rc == 0) {
		g_set_error_literal(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "incomplete data from stream");
		return FALSE;
	}
	g_byte_array_set_size(helper->buf, rc);

	/* success */
	helper->buf_offset = 0;
	return TRUE;
}

static gchar
fwupd_json_parser_unescape_char(gchar data)
{
	if (data == 'n')
		return '\n';
	if (data == 't')
		return '\t';
	if (data == '\\')
		return '\\';
	if (data == '\"')
		return '\"';
	return 0;
}

static gboolean
fwupd_json_parser_helper_get_next_token_chunk(FwupdJsonParserHelper *helper,
					      FwupdJsonParserToken *token,
					      GRefString **str,
					      gboolean *buf_offset_enable,
					      GError **error)
{
	gchar data;

	/* need more data */
	if (G_UNLIKELY(helper->buf_offset >= helper->buf->len)) {
		if (!fwupd_json_parser_helper_slurp(helper, error))
			return FALSE;
	}
	data = helper->buf->data[helper->buf_offset];

	/* quotes */
	if (!helper->is_escape && data == '"') {
		if (helper->is_quoted) {
			fwupd_json_parser_helper_dump_acc(helper, token, str);
			helper->is_quoted = FALSE;
			return TRUE;
		}
		helper->is_quoted = TRUE;
		helper->newlinecnt = 0;
		helper->whitespacecnt = 0;
		return TRUE;
	}
	if (helper->is_quoted) {
		/* escape char */
		if (!helper->is_escape && data == '\\') {
			helper->is_escape = TRUE;
			helper->newlinecnt = 0;
			return TRUE;
		}
		if (G_UNLIKELY(helper->is_escape)) {
			data = fwupd_json_parser_unescape_char(data);
			if (G_UNLIKELY(data == 0)) {
				g_set_error(error,
					    FWUPD_ERROR,
					    FWUPD_ERROR_INVALID_DATA,
					    "invalid escape char '%c'",
					    data);
				return FALSE;
			}
			helper->is_escape = FALSE;
		}

		/* save acc */
		helper->newlinecnt = 0;
		helper->whitespacecnt = 0;
		g_string_append_c(helper->acc, data);
		if (G_UNLIKELY(helper->max_quoted > 0 && helper->acc->len > helper->max_quoted)) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "token too long, limit was %u",
				    helper->max_quoted);
			return FALSE;
		}
		return TRUE;
	}

	/* newline, for error messages */
	if (data == '\n') {
		helper->linecnt++;
		if (helper->newlinecnt++ > FWUPD_JSON_PARSER_NEWLINE_MAX) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "too many newlines, limit was %u",
				    (guint)FWUPD_JSON_PARSER_NEWLINE_MAX);
			return FALSE;
		}
		fwupd_json_parser_helper_dump_acc(helper, token, str);
		return TRUE;
	}
	helper->newlinecnt = 0;

	/* split */
	if (data == ',') {
		fwupd_json_parser_helper_dump_acc(helper, token, str);
		return TRUE;
	}

	/* control token */
	if (data == FWUPD_JSON_PARSER_TOKEN_ARRAY_START ||
	    data == FWUPD_JSON_PARSER_TOKEN_ARRAY_END ||
	    data == FWUPD_JSON_PARSER_TOKEN_OBJECT_START ||
	    data == FWUPD_JSON_PARSER_TOKEN_OBJECT_DELIM ||
	    data == FWUPD_JSON_PARSER_TOKEN_OBJECT_END) {
		fwupd_json_parser_helper_dump_acc(helper, token, str);
		if (*token != FWUPD_JSON_PARSER_TOKEN_INVALID) {
			*buf_offset_enable = FALSE;
			return TRUE;
		}
		*token = data;
		helper->newlinecnt = 0;
		helper->whitespacecnt = 0;
		return TRUE;
	}

	/* whitespace */
	if (g_ascii_isspace(data)) {
		guint whitespace_max = FWUPD_JSON_PARSER_INDENT_MAX * (helper->depth + 1);
		if (helper->whitespacecnt++ >= whitespace_max) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "too much whitespace, limit was %u",
				    whitespace_max);
			return FALSE;
		}
		return TRUE;
	}

	/* strip control chars */
	if (g_ascii_iscntrl(data)) {
		g_set_error(error,
			    FWUPD_ERROR,
			    FWUPD_ERROR_INVALID_DATA,
			    "ASCII control character detected 0x%x",
			    (guint)data);
		return FALSE;
	}

	/* save acc */
	g_string_append_c(helper->acc, data);
	helper->whitespacecnt = 0;
	return TRUE;
}

static gboolean
fwupd_json_parser_helper_get_next_token(FwupdJsonParserHelper *helper,
					FwupdJsonParserToken *token,
					GRefString **str,
					GError **error)
{
	/* process each byte until we get a token */
	while (*token == FWUPD_JSON_PARSER_TOKEN_INVALID) {
		gboolean buf_offset_enable = TRUE;
		if (!fwupd_json_parser_helper_get_next_token_chunk(helper,
								   token,
								   str,
								   &buf_offset_enable,
								   error))
			return FALSE;
		if (buf_offset_enable)
			helper->buf_offset++;
	}

	/* success */
	return TRUE;
}

static gboolean
fwupd_json_parser_helper_check_depth(FwupdJsonParser *self, guint depth, GError **error)
{
	if (self->max_depth > 0 && depth > self->max_depth) {
		g_set_error(error,
			    FWUPD_ERROR,
			    FWUPD_ERROR_INVALID_DATA,
			    "structure too deep, limit was %u",
			    depth);
		return FALSE;
	}
	return TRUE;
}

static FwupdJsonObject *
fwupd_json_parser_load_object(FwupdJsonParser *self, FwupdJsonParserHelper *helper, GError **error);

static FwupdJsonArray *
fwupd_json_parser_load_array(FwupdJsonParser *self, FwupdJsonParserHelper *helper, GError **error)
{
	g_autoptr(FwupdJsonArray) json_arr = fwupd_json_array_new();

	if (G_UNLIKELY(!fwupd_json_parser_helper_check_depth(self, ++helper->depth, error)))
		return NULL;
	while (TRUE) {
		g_autoptr(GRefString) str = NULL;
		FwupdJsonParserToken token = FWUPD_JSON_PARSER_TOKEN_INVALID;

		if (!fwupd_json_parser_helper_get_next_token(helper, &token, &str, error))
			return NULL;
		if (token == FWUPD_JSON_PARSER_TOKEN_ARRAY_END)
			break;
		if (token == FWUPD_JSON_PARSER_TOKEN_OBJECT_START) {
			g_autoptr(FwupdJsonObject) json_obj =
			    fwupd_json_parser_load_object(self, helper, error);
			if (G_UNLIKELY(json_obj == NULL))
				return NULL;
			fwupd_json_array_add_object(json_arr, json_obj);
		} else if (token == FWUPD_JSON_PARSER_TOKEN_ARRAY_START) {
			g_autoptr(FwupdJsonArray) json_array2 =
			    fwupd_json_parser_load_array(self, helper, error);
			if (G_UNLIKELY(json_array2 == NULL))
				return NULL;
			fwupd_json_array_add_array(json_arr, json_array2);
		} else if (token == FWUPD_JSON_PARSER_TOKEN_STRING) {
			fwupd_json_array_add_string_internal(json_arr, str);
		} else if (token == FWUPD_JSON_PARSER_TOKEN_RAW) {
			if (G_UNLIKELY(str == NULL)) {
				g_set_error(error,
					    FWUPD_ERROR,
					    FWUPD_ERROR_INVALID_DATA,
					    "no raw data on line %u",
					    helper->linecnt);
				return NULL;
			}
			fwupd_json_array_add_raw_internal(json_arr, str);
		} else {
			g_set_error_literal(error,
					    FWUPD_ERROR,
					    FWUPD_ERROR_INVALID_DATA,
					    "object delimiter not expected in array");
			return NULL;
		}
		if (G_UNLIKELY(self->max_items > 0 &&
			       fwupd_json_array_get_size(json_arr) > self->max_items)) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "too many items in array, limit was %u",
				    self->max_items);
			return NULL;
		}
	}
	helper->depth--;

	/* success */
	return g_steal_pointer(&json_arr);
}

static FwupdJsonObject *
fwupd_json_parser_load_object(FwupdJsonParser *self, FwupdJsonParserHelper *helper, GError **error)
{
	g_autoptr(FwupdJsonObject) json_obj = fwupd_json_object_new();

	if (!fwupd_json_parser_helper_check_depth(self, ++helper->depth, error))
		return NULL;
	while (TRUE) {
		FwupdJsonParserToken token1 = FWUPD_JSON_PARSER_TOKEN_INVALID;
		FwupdJsonParserToken token2 = FWUPD_JSON_PARSER_TOKEN_INVALID;
		FwupdJsonParserToken token3 = FWUPD_JSON_PARSER_TOKEN_INVALID;
		g_autoptr(GRefString) key = NULL;
		g_autoptr(GRefString) val = NULL;

		/* "key" : value */
		if (!fwupd_json_parser_helper_get_next_token(helper, &token1, &key, error))
			return NULL;
		if (token1 == FWUPD_JSON_PARSER_TOKEN_OBJECT_END)
			break;
		if (G_UNLIKELY(token1 != FWUPD_JSON_PARSER_TOKEN_STRING)) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "object key '%s' must be quoted on line %u",
				    key,
				    helper->linecnt);
			return NULL;
		}
		if (!fwupd_json_parser_helper_get_next_token(helper, &token2, NULL, error))
			return NULL;
		if (token2 != FWUPD_JSON_PARSER_TOKEN_OBJECT_DELIM) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "did not find object delimiter on line %u",
				    helper->linecnt);
			return NULL;
		}
		if (!fwupd_json_parser_helper_get_next_token(helper, &token3, &val, error))
			return NULL;

		if (token3 == FWUPD_JSON_PARSER_TOKEN_OBJECT_START) {
			g_autoptr(FwupdJsonObject) json_obj2 =
			    fwupd_json_parser_load_object(self, helper, error);
			if (G_UNLIKELY(json_obj2 == NULL))
				return NULL;
			fwupd_json_object_add_object_internal(json_obj, key, json_obj2);
		} else if (token3 == FWUPD_JSON_PARSER_TOKEN_ARRAY_START) {
			g_autoptr(FwupdJsonArray) json_array2 =
			    fwupd_json_parser_load_array(self, helper, error);
			if (G_UNLIKELY(json_array2 == NULL))
				return NULL;
			fwupd_json_object_add_array_internal(json_obj, key, json_array2);
		} else if (token3 == FWUPD_JSON_PARSER_TOKEN_STRING) {
			fwupd_json_object_add_string_internal(json_obj, key, val, helper->flags);
		} else if (token3 == FWUPD_JSON_PARSER_TOKEN_NULL) {
			fwupd_json_object_add_null_internal(json_obj, key, helper->flags);
		} else {
			if (G_UNLIKELY(val == NULL)) {
				g_set_error(error,
					    FWUPD_ERROR,
					    FWUPD_ERROR_INVALID_DATA,
					    "did not find raw value on line %u",
					    helper->linecnt);
				return NULL;
			}
			fwupd_json_object_add_raw_internal(json_obj, key, val, helper->flags);
		}
		if (G_UNLIKELY(self->max_items > 0 &&
			       fwupd_json_object_get_size(json_obj) > self->max_items)) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "too many items in object, limit was %u",
				    self->max_items);
			return NULL;
		}
	}
	helper->depth--;

	/* success */
	return g_steal_pointer(&json_obj);
}

static FwupdJsonNode *
fwupd_json_parser_load_from_stream_internal(FwupdJsonParser *self,
					    FwupdJsonParserHelper *helper,
					    GError **error)
{
	FwupdJsonParserToken token = FWUPD_JSON_PARSER_TOKEN_INVALID;
	g_autoptr(GRefString) str = NULL;

#ifndef SUPPORTED_BUILD
	/* runtime warnings */
	if (self->max_depth == G_MAXUINT16)
		g_warning("using the default max depth; use fwupd_json_parser_set_max_depth()");
	if (self->max_items == G_MAXUINT16)
		g_warning("using the default max items; use fwupd_json_parser_set_max_items()");
	if (self->max_quoted == G_MAXUINT16)
		g_warning("using the default max quoted; use fwupd_json_parser_set_max_quoted()");
#endif

	if (!fwupd_json_parser_helper_get_next_token(helper, &token, &str, error))
		return NULL;
	if (token == FWUPD_JSON_PARSER_TOKEN_OBJECT_START) {
		g_autoptr(FwupdJsonObject) json_obj = NULL;
		json_obj = fwupd_json_parser_load_object(self, helper, error);
		if (json_obj == NULL)
			return NULL;
		return fwupd_json_node_new_object(json_obj);
	}
	if (token == FWUPD_JSON_PARSER_TOKEN_ARRAY_START) {
		g_autoptr(FwupdJsonArray) json_arr = NULL;
		json_arr = fwupd_json_parser_load_array(self, helper, error);
		if (json_arr == NULL)
			return NULL;
		return fwupd_json_node_new_array(json_arr);
	}
	if (token == FWUPD_JSON_PARSER_TOKEN_STRING)
		return fwupd_json_node_new_string_internal(str);
	if (token == FWUPD_JSON_PARSER_TOKEN_RAW)
		return fwupd_json_node_new_raw_internal(str);

	/* failed */
	g_set_error_literal(error,
			    FWUPD_ERROR,
			    FWUPD_ERROR_INVALID_DATA,
			    "invalid JSON; token was not object, array, string or raw");
	return NULL;
}

/**
 * fwupd_json_parser_load_from_bytes: (skip):
 * @self: a #FwupdJsonParser
 * @blob: a #GBytes
 * @flags: a #FwupdJsonLoadFlags
 * @error: (nullable): optional return location for an error
 *
 * Loads JSON from a string.
 *
 * Returns: (transfer full): a #FwupdJsonNode, or %NULL for error
 *
 * Since: 2.1.1
 **/
FwupdJsonNode *
fwupd_json_parser_load_from_bytes(FwupdJsonParser *self,
				  GBytes *blob,
				  FwupdJsonLoadFlags flags,
				  GError **error)
{
	g_autoptr(FwupdJsonParserHelper) helper = fwupd_json_parser_helper_new(self);

	g_return_val_if_fail(FWUPD_IS_JSON_PARSER(self), NULL);
	g_return_val_if_fail(blob != NULL, NULL);
	g_return_val_if_fail(error == NULL || *error == NULL, NULL);

	helper->flags = flags;
	helper->stream = g_memory_input_stream_new_from_bytes(blob);
	return fwupd_json_parser_load_from_stream_internal(self, helper, error);
}

/**
 * fwupd_json_parser_load_from_data: (skip):
 * @self: a #FwupdJsonParser
 * @text: a string
 * @flags: a #FwupdJsonLoadFlags
 * @error: (nullable): optional return location for an error
 *
 * Loads JSON from a string.
 *
 * Returns: (transfer full): a #FwupdJsonNode, or %NULL for error
 *
 * Since: 2.1.1
 **/
FwupdJsonNode *
fwupd_json_parser_load_from_data(FwupdJsonParser *self,
				 const gchar *text,
				 FwupdJsonLoadFlags flags,
				 GError **error)
{
	g_autoptr(FwupdJsonParserHelper) helper = fwupd_json_parser_helper_new(self);

	g_return_val_if_fail(FWUPD_IS_JSON_PARSER(self), NULL);
	g_return_val_if_fail(text != NULL, NULL);
	g_return_val_if_fail(error == NULL || *error == NULL, NULL);

	helper->flags = flags;
	helper->stream = g_memory_input_stream_new_from_data(text, strlen(text), NULL);
	return fwupd_json_parser_load_from_stream_internal(self, helper, error);
}

/**
 * fwupd_json_parser_load_from_stream: (skip):
 * @self: a #FwupdJsonParser
 * @stream: a #GInputStream
 * @flags: a #FwupdJsonLoadFlags
 * @error: (nullable): optional return location for an error
 *
 * Loads JSON from a stream.
 *
 * Returns: (transfer full): a #FwupdJsonNode, or %NULL for error
 *
 * Since: 2.1.1
 **/
FwupdJsonNode *
fwupd_json_parser_load_from_stream(FwupdJsonParser *self,
				   GInputStream *stream,
				   FwupdJsonLoadFlags flags,
				   GError **error)
{
	g_autoptr(FwupdJsonParserHelper) helper = fwupd_json_parser_helper_new(self);

	g_return_val_if_fail(FWUPD_IS_JSON_PARSER(self), NULL);
	g_return_val_if_fail(G_IS_INPUT_STREAM(stream), NULL);
	g_return_val_if_fail(error == NULL || *error == NULL, NULL);

	/* seek to start if possible */
	if (G_IS_SEEKABLE(stream) && g_seekable_can_seek(G_SEEKABLE(stream))) {
		if (!g_seekable_seek(G_SEEKABLE(stream), 0x0, G_SEEK_SET, NULL, error)) {
			fwupd_error_convert(error);
			return NULL;
		}
	}
	helper->stream = g_object_ref(stream);
	helper->flags = flags;
	return fwupd_json_parser_load_from_stream_internal(self, helper, error);
}

static void
fwupd_json_parser_class_init(FwupdJsonParserClass *klass)
{
}

static void
fwupd_json_parser_init(FwupdJsonParser *self)
{
	self->max_depth = G_MAXUINT16;
	self->max_items = G_MAXUINT16;
	self->max_quoted = G_MAXUINT16;
}

/**
 * fwupd_json_parser_new:
 *
 * Returns: (transfer full): a #FwupdJsonParser
 *
 * Since: 2.1.1
 **/
FwupdJsonParser *
fwupd_json_parser_new(void)
{
	return g_object_new(FWUPD_TYPE_JSON_PARSER, NULL);
}
