disarm 0.13.0

use unicode_normalization::UnicodeNormalization;

use crate::{confusables, scripts};

/// Check if a bracketed string is a valid IPv6 literal per RFC 3986 §3.2.2.
///
/// Requires: starts with `[`, ends with `]`, content contains `:`,
/// only hex digits / colons / dots / `%` (zone ID), and no more than 7 colons.
fn is_ipv6_literal(normalized: &str) -> bool {
    if !(normalized.starts_with('[') && normalized.ends_with(']')) {
        return false;
    }
    let inner = &normalized[1..normalized.len() - 1];
    if inner.is_empty() || !inner.contains(':') {
        return false;
    }
    // Validate colon count on the address portion (before any zone ID).
    let addr_part = match inner.find('%') {
        Some(pos) => &inner[..pos],
        None => inner,
    };
    let colon_count = addr_part.chars().filter(|&c| c == ':').count();
    if colon_count > 7 {
        return false;
    }
    // A valid literal has at most one zone-ID delimiter (`%`); more than one is
    // malformed. Bounding it keeps a crafted `[::1%a%b...]` from being waved
    // through as an IP and thereby skipping homoglyph analysis. (C5)
    if inner.bytes().filter(|&b| b == b'%').count() > 1 {
        return false;
    }
    inner
        .as_bytes()
        .iter()
        .all(|&b| b.is_ascii_hexdigit() || b == b':' || b == b'.' || b == b'%')
}

/// Findings from a hostname homoglyph analysis.
///
/// Reports factual findings; it claims nothing about absolute safety. A
/// `suspicious == false` result is not a safety certificate (see
/// [`is_suspicious_hostname`]).
#[derive(Clone, Debug, PartialEq, Eq)]
pub(crate) struct HostnameAnalysis {
    /// Whether the hostname is flagged suspicious overall.
    pub(crate) suspicious: bool,
    /// Scripts detected across all labels, in order of first appearance.
    pub(crate) scripts: Vec<String>,
    /// Whether any single label mixes characters from more than one script.
    pub(crate) mixed_script: bool,
    /// Whether any label contains a confusable mapping to a Latin character.
    pub(crate) has_confusables: bool,
    /// Whether the decoded hostname mixes strong LTR and strong RTL characters
    /// (Bidi-reorder / "BiDi Swap" precondition). Folded into `suspicious`.
    pub(crate) bidi_conflict: bool,
    /// Whether the labels span more than one distinct script (Common/Inherited
    /// excluded). Broader than `bidi_conflict`; NOT folded into `suspicious`.
    pub(crate) cross_label_script: bool,
    /// Per-label resolved scripts, left to right (Common/Inherited excluded).
    pub(crate) label_scripts: Vec<Vec<String>>,
    /// Whether any label is a whole-script confusable (#545): single-script,
    /// non-Latin, with a confusable skeleton that is entirely Latin. A graded
    /// SIGNAL, not a verdict — it fires on short non-Latin ccTLDs (`ру`→`py`) and
    /// on real words whose every letter is a confusable (`оса`→`oca`) — so it is
    /// deliberately NOT folded into `suspicious` (see the `is_suspicious_hostname`
    /// docs). The precise caller policy is
    /// `label_whole_script_confusable[non-TLD label] ∧ Latin TLD`.
    pub(crate) whole_script_confusable: bool,
    /// Per-label whole-script-confusable flags, parallel to `label_scripts`.
    pub(crate) label_whole_script_confusable: Vec<bool>,
    /// The Latin-normalized (canonical) form of the hostname.
    pub(crate) canonical: String,
}

/// Detect whether a hostname is *suspicious* for Unicode homoglyph spoofing.
///
/// `xn--` (ACE) labels are decoded to their Unicode form via UTS#46 before
/// analysis, so the on-the-wire IDN homograph attack is examined rather than
/// passed through as inert ASCII (#63). A malformed ACE label is treated as
/// suspicious (fail closed).
///
/// A hostname is flagged **suspicious** if:
/// - Any single label contains characters from more than one script
///   (mixed-script), excluding Common/Inherited (digits, punctuation,
///   combining marks). This is conservative and fails closed (#254): it flags
///   benign combinations (e.g. Latin + CJK) as well as spoofing ones — a caller
///   wanting a more permissive policy can inspect the `mixed_script`/`scripts`
///   fields.
/// - Any label contains a character confusable with a Latin character. This is an
///   *any-character* screen, so it flags essentially every hostname containing a
///   non-Latin letter (the most frequent Cyrillic and Greek letters are TR39
///   confusables) — legitimate ones (`москва.рф`) as well as spoofs. `suspicious`
///   is therefore a **maximally conservative screen**, not a precise verdict.
/// - The decoded hostname mixes strong left-to-right and strong right-to-left
///   characters (`bidi_conflict`, #412) — the "BiDi Swap" reorder precondition,
///   which `mixed_script` misses because the mixing is *across* labels. The
///   broader `cross_label_script` fact is exposed but deliberately NOT folded in
///   (it fires on benign IDN ccTLDs like `google.рф`).
/// - An ACE label fails to decode, or a confusable check errors (fail closed)
///
/// **Whole-script confusables (#545).** `whole_script_confusable` (and the
/// per-label `label_whole_script_confusable`) name the fact that discriminates a
/// whole-script spoof (`аррӏе.com` → skeleton `apple.com`, every letter a
/// confusable) from a genuine non-Latin domain (`москва.рф`, whose `м`/`к`/`в`
/// survive the skeleton). It is a graded **signal, not a verdict**, and is
/// deliberately NOT folded into `suspicious`: on its own it fires on short
/// non-Latin ccTLDs (`ру`→`py`) and on real words that happen to skeleton to Latin
/// (`оса`→`oca`). The precise, low-false-positive policy is caller-side —
/// `label_whole_script_confusable[non-TLD label] ∧ (TLD is Latin/ASCII)` — because
/// separating the last two classes needs registrable-boundary (TLD) context, which
/// this library leaves to the caller, plus a caller-supplied protected-name list
/// for the irreducible `оса`-style case.
///
/// Returns a tuple of (is_suspicious, analysis).
///
/// **A `false` (not-suspicious) result is NOT a safety guarantee.** It means
/// only that no mixed-script label and no confusable *from the bundled TR39
/// table* was found. Confusables outside the bundled table are not detected and
/// will report not-suspicious. Base allow/deny decisions on the granular
/// `scripts` / `mixed_script` / `has_confusables` / `whole_script_confusable`
/// fields plus your own policy — a detector can attest the *presence* of a
/// problem, never the *absence* of all problems.
pub(crate) fn is_suspicious_hostname(hostname: &str) -> (bool, HostnameAnalysis) {
    // 1. NFKC normalize
    let normalized: String = hostname.nfkc().collect();

    // IPv6 literals (e.g. "[::1]", "[2001:db8::1]") are not IDN hostnames and
    // cannot be visually spoofed via homoglyph attacks. Report them as
    // not-suspicious without running the script/confusable analysis.
    if is_ipv6_literal(&normalized) {
        return (
            false,
            HostnameAnalysis {
                suspicious: false,
                scripts: Vec::new(),
                mixed_script: false,
                has_confusables: false,
                bidi_conflict: false,
                cross_label_script: false,
                label_scripts: Vec::new(),
                whole_script_confusable: false,
                label_whole_script_confusable: Vec::new(),
                canonical: normalized,
            },
        );
    }

    // 2. Split on dots to check each label
    let mut suspicious = false;
    let mut all_scripts: Vec<&str> = Vec::new();
    let mut seen_scripts: std::collections::HashSet<&str> = std::collections::HashSet::new();
    let mut has_mixed = false;
    let mut has_confusables = false;
    let mut decoded_labels: Vec<String> = Vec::new();
    let mut per_label_scripts: Vec<Vec<String>> = Vec::new();
    let mut per_label_wsc: Vec<bool> = Vec::new();

    for raw_label in normalized.split('.') {
        // Empty labels arise from leading, trailing, or consecutive dots
        // (e.g. "a..b" or "example.com.").  These are structurally
        // malformed but not a homoglyph attack vector — skip them (but keep a
        // placeholder so the canonical form preserves dot structure).
        if raw_label.is_empty() {
            decoded_labels.push(String::new());
            per_label_scripts.push(Vec::new());
            per_label_wsc.push(false);
            continue;
        }

        // Decode `xn--` ACE labels to their Unicode form (UTS#46, #63) so the
        // on-the-wire IDN homograph attack is analysed instead of passing as
        // inert ASCII. A malformed ACE label cannot be verified → fail closed.
        // `raw_label` here is *not yet known* to be ACE — it may be a non-ASCII
        // Unicode label — so a byte slice `raw_label[..4]` could fall mid-codepoint
        // and panic; the byte-prefix compare never can, and real ACE labels are
        // pure ASCII so it matches exactly. `>= 4` (not `> 4`) keeps a bare,
        // malformed `"xn--"` recognised as ACE and routed through the fail-closed
        // decode below rather than slipping past as an inert ASCII label.
        let is_ace =
            raw_label.len() >= 4 && raw_label.as_bytes()[..4].eq_ignore_ascii_case(b"xn--");
        let label: String = if is_ace {
            let (unicode, result) = idna::domain_to_unicode(raw_label);
            if result.is_err() {
                suspicious = true;
            }
            unicode.nfkc().collect()
        } else {
            raw_label.to_string()
        };
        decoded_labels.push(label.clone());

        // Check scripts in this (decoded) label
        let label_scripts = scripts::detect_scripts(&label);
        per_label_scripts.push(label_scripts.iter().map(|s| (*s).to_string()).collect());

        // Whole-script-confusable for this label (#545): single-script, non-Latin,
        // and the confusable skeleton is entirely Latin. `detect_scripts` already
        // drops Common/Inherited (digits, hyphen, combining marks), so a skeleton
        // resolving to exactly `["Latin"]` means every non-neutral character folded
        // to Latin. This is a graded SIGNAL, deliberately NOT folded into
        // `suspicious` — it fires on short non-Latin ccTLDs (`ру`→`py`) and on real
        // words whose every letter is a confusable (`оса`→`oca`). See the fn docs
        // for the precise `wsc(non-TLD) ∧ Latin-TLD` caller policy.
        let label_wsc = label_scripts.len() == 1 && label_scripts[0] != "Latin" && {
            let skeleton = confusables::normalize_confusables(&label, "latin")
                .unwrap_or_else(|_| label.clone());
            matches!(scripts::detect_scripts(&skeleton).as_slice(), ["Latin"])
        };
        per_label_wsc.push(label_wsc);

        // Track all scripts seen (O(1) dedup via HashSet)
        for s in &label_scripts {
            if seen_scripts.insert(s) {
                all_scripts.push(s);
            }
        }

        // Mixed-script within a single label is suspicious. Conservative policy
        // (#254): any label drawing on two or more scripts is flagged. The
        // former rule only flagged the four Latin-paired high-risk combinations
        // (Cyrillic/Greek/Armenian/Cherokee + Latin), so a label mixing *two
        // non-Latin* scripts with no Latin confusable mapping — e.g. Greek +
        // Cyrillic — set `mixed_script = true` yet was reported not-suspicious.
        // That contradicted this function's documented "flag anything
        // suspicious" contract and failed open on a real spoofing vector.
        // Callers needing a more permissive policy (e.g. allowing Latin + CJK)
        // can read the `mixed_script` and `scripts` fields and decide for
        // themselves; the boolean here fails closed.
        if label_scripts.len() > 1 {
            has_mixed = true;
            suspicious = true;
        }

        // Check confusables in this label. Fail CLOSED (#67.1): if the check
        // errors we cannot prove the label clean, so flag it as suspicious
        // rather than silently degrading to "not confusable". The target
        // ("latin") is a fixed, always-supported script, so the underlying
        // Result is in practice always `Ok`; the `Err` arm is defensive.
        match confusables::is_confusable(&label, "latin") {
            Ok(true) => {
                has_confusables = true;
                suspicious = true;
            }
            Ok(false) => {}
            Err(_) => {
                suspicious = true;
            }
        }
    }

    // Generate canonical Latin form from the decoded labels.
    let decoded_hostname = decoded_labels.join(".");

    // Direction conflict (#412): the decoded hostname mixes strong-LTR and
    // strong-RTL characters — the "BiDi Swap" precondition. Computed on the same
    // decoded codepoints, with no U+202x override involved. Fold it into the
    // verdict (it is precise and rare in legitimate hostnames). `cross_label_script`
    // (more than one script across labels) is the broader, noisier fact — it
    // fires on benign IDN ccTLDs (`google.рф`), so it is exposed but NOT folded.
    let bidi_conflict = scripts::has_bidi_conflict(&decoded_hostname);
    let cross_label_script = all_scripts.len() > 1;
    if bidi_conflict {
        suspicious = true;
    }

    let canonical =
        confusables::normalize_confusables(&decoded_hostname, "latin").unwrap_or(decoded_hostname);

    // Aggregate: any label is a whole-script confusable. Graded signal (§545 §5.1);
    // NOT folded into `suspicious`.
    let whole_script_confusable = per_label_wsc.iter().any(|&b| b);

    (
        suspicious,
        HostnameAnalysis {
            suspicious,
            scripts: all_scripts.into_iter().map(String::from).collect(),
            mixed_script: has_mixed,
            has_confusables,
            bidi_conflict,
            cross_label_script,
            label_scripts: per_label_scripts,
            whole_script_confusable,
            label_whole_script_confusable: per_label_wsc,
            canonical,
        },
    )
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_clean_hostname_not_suspicious() {
        let (suspicious, details) = is_suspicious_hostname("paypal.com");
        assert!(!suspicious);
        assert!(!details.has_confusables);
        assert!(!details.mixed_script);
    }

    #[test]
    fn test_cyrillic_spoof() {
        // Cyrillic а and р mixed with Latin
        let (suspicious, details) = is_suspicious_hostname("\u{0440}\u{0430}ypal.com");
        assert!(suspicious);
        assert!(details.has_confusables);
        assert!(details.mixed_script);
        assert_eq!(details.canonical, "paypal.com");
    }

    #[test]
    fn test_full_cyrillic_domain() {
        // Fully Cyrillic domain (Yandex): not mixed-script. `suspicious` is true only
        // via the any-character confusable screen (#545), not a real spoof — so the
        // verdict is no longer discarded, it is explained by the whole-script signal.
        let (_, d) = is_suspicious_hostname("яндекс.ру");
        assert!(!d.mixed_script);
        // Known graded-signal FP: the `яндекс` label is NOT whole-script-confusable
        // (я, д survive the skeleton), but the short Cyrillic ccTLD `ру` skeletons to
        // Latin `py`, so it IS — and the top-level (any-label) bool therefore fires.
        // The caller's `wsc(non-TLD) ∧ latin-TLD` policy clears it: the only wsc label
        // is the TLD, and the TLD is Cyrillic, not Latin.
        assert_eq!(d.label_whole_script_confusable, vec![false, true]);
        assert!(
            d.whole_script_confusable,
            "top-level bool over-fires on the `ру` ccTLD — the documented graded-signal FP"
        );
    }

    #[test]
    fn test_whole_script_confusable_attack() {
        // аррӏе.com: an all-Cyrillic label whose every letter is a confusable — the
        // skeleton is `apple`. The non-TLD label is whole-script-confusable and the
        // TLD is Latin, so both the field and the caller policy flag it.
        let (_, d) = is_suspicious_hostname("\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}.com");
        assert!(d.whole_script_confusable);
        assert_eq!(d.label_whole_script_confusable, vec![true, false]);
        assert_eq!(d.canonical, "apple.com");
    }

    #[test]
    fn test_whole_script_confusable_legit_domains_not_flagged() {
        // Genuine non-Latin domains: at least one letter in every label survives the
        // Latin skeleton, so NO label is whole-script-confusable. (Cyrillic, Greek,
        // Hebrew, and mixed Han+Hiragana all covered.)
        for host in [
            "\u{043C}\u{043E}\u{0441}\u{043A}\u{0432}\u{0430}.\u{0440}\u{0444}", // москва.рф
            "\u{043F}\u{043E}\u{0447}\u{0442}\u{0430}.\u{0440}\u{0444}",         // почта.рф
            "\u{03B1}\u{03B8}\u{03AE}\u{03BD}\u{03B1}.gr", // αθήνα.gr (ή survives)
            "\u{05D0}\u{05EA}\u{05E8}.\u{05E7}\u{05D5}\u{05DD}", // אתר.קום
            "\u{4F8B}\u{3048}.jp",                         // 例え.jp (mixed-script label)
        ] {
            let (_, d) = is_suspicious_hostname(host);
            assert!(
                !d.whole_script_confusable,
                "{host:?} must not be whole-script-confusable, got {:?}",
                d.label_whole_script_confusable
            );
        }
    }

    #[test]
    fn test_whole_script_confusable_known_fp_osa() {
        // оса.рф ("wasp"): the `оса` label skeletons to Latin `oca`, so it IS
        // whole-script-confusable — an IRREDUCIBLE false positive at the label level
        // (signal-identical to а spoof; only a caller-supplied protected-name list can
        // separate them). Pinned deliberately. The caller's `wsc(non-TLD) ∧ latin-TLD`
        // policy still clears the full domain because the `.рф` TLD is Cyrillic.
        let (_, d) = is_suspicious_hostname("\u{043E}\u{0441}\u{0430}.\u{0440}\u{0444}");
        assert_eq!(d.label_whole_script_confusable, vec![true, false]);
        assert!(d.whole_script_confusable);
        assert!(!d.mixed_script);
    }

    #[test]
    fn test_whole_script_confusable_spoof_under_cyrillic_tld() {
        // аррӏе.рф: a Cyrillic spoof label under a Cyrillic ccTLD. The label IS
        // whole-script-confusable, but the documented caller policy `wsc(non-TLD) ∧
        // latin-TLD` does NOT flag it — correctly, since it is not claiming to be a
        // Latin-web brand. A documented policy choice, verified here.
        let (_, d) =
            is_suspicious_hostname("\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}.\u{0440}\u{0444}");
        assert!(d.label_whole_script_confusable[0]);
        // The TLD label `рф` is not Latin, so a `wsc(non-TLD) ∧ latin-TLD` caller
        // policy evaluates false even though the field is set.
        assert_ne!(d.label_scripts.last().unwrap(), &vec!["Latin".to_string()]);
    }

    #[test]
    fn test_mixed_non_latin_scripts_suspicious() {
        // #254: a label mixing two *non-Latin* scripts (Cyrillic я + Greek ψ)
        // with no Latin confusable mapping used to set mixed_script=true yet
        // report not-suspicious, because the old rule only flagged Latin-paired
        // high-risk combinations. The conservative policy now flags any
        // mixed-script label as suspicious.
        let (suspicious, details) = is_suspicious_hostname("\u{044F}\u{03C8}.com");
        assert!(suspicious, "mixed Cyrillic+Greek label must be suspicious");
        assert!(details.mixed_script);
        // The mixed-script rule — not the confusable check — is what catches
        // this: neither character maps to a Latin confusable.
        assert!(
            !details.has_confusables,
            "neither я nor ψ is a Latin confusable; the mixed-script rule must \
             be what flags this label"
        );
        assert!(details.scripts.iter().any(|s| s == "Cyrillic"));
        assert!(details.scripts.iter().any(|s| s == "Greek"));
    }

    #[test]
    fn test_punycode_non_homograph_not_suspicious() {
        // xn--n3h.com decodes to ☃.com (a snowman) — a single-script non-Latin
        // label, not a homoglyph spoof, so it is correctly reported
        // not-suspicious. The point of #63 is that the label is now *decoded and
        // analysed*, not that every xn-- label is flagged.
        let (suspicious, _) = is_suspicious_hostname("xn--n3h.com");
        assert!(!suspicious);
    }

    #[test]
    fn test_punycode_homograph_suspicious() {
        // #63: the on-the-wire ACE form of a Cyrillic homograph must be decoded
        // and flagged. Build the xn-- form of a Cyrillic "apple" spoof, then
        // assert is_suspicious_hostname flags it (it used to pass as safe ASCII).
        let spoof = "\u{0430}\u{0440}\u{0440}\u{04CF}\u{0435}"; // аррӏе (Cyrillic)
        let ace = idna::domain_to_ascii(spoof).expect("encode Cyrillic spoof to ACE");
        assert!(
            ace.starts_with("xn--"),
            "expected an xn-- label, got {ace:?}"
        );
        let hostname = format!("{ace}.com");
        let (suspicious, details) = is_suspicious_hostname(&hostname);
        assert!(
            suspicious,
            "Cyrillic homograph in ACE form {hostname:?} must be suspicious"
        );
        assert!(details.has_confusables);
    }

    #[test]
    fn test_ipv6_loopback_not_suspicious() {
        let (suspicious, details) = is_suspicious_hostname("[::1]");
        assert!(!suspicious);
        assert!(!details.mixed_script);
        assert!(!details.has_confusables);
    }

    #[test]
    fn test_ipv6_full_not_suspicious() {
        let (suspicious, details) = is_suspicious_hostname("[2001:db8::1]");
        assert!(!suspicious);
        assert!(details.scripts.is_empty());
    }

    // ── #412: bidi-direction conflict ────────────────────────────────────────

    #[test]
    fn test_bidi_swap_hostname_flags_direction_conflict() {
        // "varonis.com.ו.קום": Latin subdomain stacked on a Hebrew (RTL) domain —
        // the BiDi-Swap shape. mixed_script stays false (each label is single
        // script), but bidi_conflict fires and drives suspicious=true.
        let (suspicious, d) =
            is_suspicious_hostname("varonis.com.\u{05D5}.\u{05E7}\u{05D5}\u{05DD}");
        assert!(suspicious);
        assert!(
            d.bidi_conflict,
            "LTR+RTL across labels must set bidi_conflict"
        );
        assert!(d.cross_label_script);
        assert!(!d.mixed_script, "no single label is mixed-script");
        assert_eq!(d.label_scripts.len(), 4);
        assert_eq!(d.label_scripts[0], vec!["Latin".to_string()]);
        assert_eq!(d.label_scripts[3], vec!["Hebrew".to_string()]);
    }

    #[test]
    fn test_bidi_conflict_intra_label() {
        // The intra-label case: "varonisו.com" — one label mixes Latin + Hebrew.
        let (suspicious, d) = is_suspicious_hostname("varonis\u{05D5}.com");
        assert!(suspicious);
        assert!(d.bidi_conflict);
    }

    #[test]
    fn test_benign_idn_cctld_no_direction_conflict() {
        // "google.рф": Latin label under a Cyrillic ccTLD. Both scripts are LTR,
        // so there is NO direction conflict (cross_label_script is true but does
        // not flip suspicious on its own).
        let (_, d) = is_suspicious_hostname("google.\u{0440}\u{0444}");
        assert!(!d.bidi_conflict);
        assert!(d.cross_label_script);
    }

    #[test]
    fn test_all_rtl_hostname_no_direction_conflict() {
        // "אתר.קום": a legitimately all-Hebrew domain — single direction (RTL),
        // so bidi_conflict is false and cross_label_script is false.
        let (_, d) = is_suspicious_hostname("\u{05D0}\u{05EA}\u{05E8}.\u{05E7}\u{05D5}\u{05DD}");
        assert!(!d.bidi_conflict);
        assert!(!d.cross_label_script);
    }

    #[test]
    fn test_ascii_hostname_no_new_signals() {
        let (suspicious, d) = is_suspicious_hostname("example.com");
        assert!(!suspicious);
        assert!(!d.bidi_conflict);
        assert!(!d.cross_label_script);
        assert_eq!(
            d.label_scripts,
            vec![vec!["Latin".to_string()], vec!["Latin".to_string()]]
        );
    }

    #[test]
    fn test_bidi_conflict_on_decoded_punycode() {
        // xn--9db.xn--9dbq2a decodes to Hebrew ו.קום — all-RTL after decode, so
        // bidi_conflict is false, exactly as for the literal Hebrew form.
        let (_, d) = is_suspicious_hostname("xn--9db.xn--9dbq2a");
        assert!(!d.bidi_conflict);
    }
}