bindings/bmff_exclusion_checker.cc

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "bindings/bmff_exclusion_checker.h"

#include <algorithm>

#include "absl/strings/match.h"
#include "absl/strings/string_view.h"
#include "proto/bmff_based_hash_assertion.pb.h"

namespace credentio {

namespace {
// Required exclusions as defined in
// https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html#_exclusion_list_requirements
bool IsRootBox(absl::string_view xpath, absl::string_view box_type) {
  if (xpath.size() < box_type.size() + 1) {
    return false;
  }
  if (xpath[0] != '/') {
    return false;
  }
  if (xpath.substr(1, box_type.size()) != box_type) {
    return false;
  }
  if (xpath.size() == box_type.size() + 1) {
    return true;
  }
  if (xpath[box_type.size() + 1] == '[' && xpath.back() == ']') {
    absl::string_view index_str =
        xpath.substr(box_type.size() + 2, xpath.size() - box_type.size() - 3);
    if (index_str.empty()) {
      return false;
    }
    for (char c : index_str) {
      if (c < '0' || c > '9') {
        return false;
      }
    }
    return true;
  }
  return false;
}

bool IsRequiredExclusion(const BmffRange& exclusion, bool has_merkle_maps) {
  if (IsRootBox(exclusion.xpath(), "ftyp") && exclusion.subsets().empty()) {
    return true;
  }
  if (IsRootBox(exclusion.xpath(), "mfra") && exclusion.subsets().empty()) {
    return true;
  }

  // These exclusion xpaths must match exactly as the additional constraints
  // cannot be applied if the xpath selects a lower level node
  if (IsRootBox(exclusion.xpath(), "uuid") && exclusion.subsets().empty() &&
      exclusion.data_size() == 1 && exclusion.data(0).offset() == 8 &&
      exclusion.data(0).value() ==
          "\330\376\303\326\033\016H<\222\227X(\207~\304\201") {
    return true;
  }
  if (has_merkle_maps && exclusion.xpath() == "/mdat" &&
      exclusion.subsets_size() == 1 && exclusion.subsets(0).offset() == 16 &&
      exclusion.subsets(0).length() == 0) {
    return true;
  }
  return false;
}

// Additional allowed exclusions as defined in
// https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html#_validating_a_bmff_hash
bool IsAllowedExclusion(const BmffRange& exclusion) {
  if (absl::StartsWith(exclusion.xpath(), "/free")) {
    return true;
  }
  if (absl::StartsWith(exclusion.xpath(), "/skip")) {
    return true;
  }
  return false;
}
}  // namespace

bool HasAdditionalExclusions(const BmffBasedHashAssertion& assertion) {
  if (assertion.exclusions().empty()) {
    // No exclusions are specified, so there can't be any additional exclusions.
    return false;
  }

  bool has_merkle_maps = assertion.has_hash() && assertion.merkles_size() > 0;

  return std::any_of(
      assertion.exclusions().begin(), assertion.exclusions().end(),
      [&has_merkle_maps](const BmffRange& exclusion) {
        return !IsRequiredExclusion(exclusion, has_merkle_maps) &&
               !IsAllowedExclusion(exclusion);
      });
}

}  // namespace credentio