ddn.data.cf

CF - Configuration File Format Parser and Writer

This module provides a complete implementation of CF v1.0 specification, including a lexer, parser, and writer. The parser produces CdmDocument from the CDM (Configuration Data Model) for full roundtrip fidelity.

CF is a human-friendly configuration format that supports:

• Objects with key-value pairs using = or : separators
• Arrays with [...] syntax
• Strings: double, single, triple-quoted, and raw
• Numbers: integers - decimal, hex, octal, binary - and floats
• Booleans: true and false
• Null: null
• Special floats: inf, -inf, nan
• Temporal types: dates, times, datetimes
• Comments: hash, double-slash, and block comments
• Include directive for file inclusion
• Environment variable substitution

Example:

import ddn.data.cf;

// Parse CF source
auto doc = parseCf(`
  name = "myapp"
  version = 1
  server {
     host = "localhost"
     port = 8080
  }
`);

// Access values via CDM
assert(doc.root["name"].as!string == "myapp");

// Write back to CF
string output = toCf(doc);

Security_Considerations: The CF parser includes features that can have security implications:

• By default, enableIncludes is false to prevent unintended file access.
• When enabled, you MUST provide a fileReader delegate that controls

  which files can be read.

• Path traversal attacks are mitigated by normalizing paths before validation

  and rejecting `..` sequences when allowParentTraversal is false (default).

• Absolute paths are rejected by default (allowAbsolutePaths = false).
• Circular includes are detected and rejected.
• Include depth is limited to MAX_INCLUDE_DEPTH (32) to prevent stack overflow.

• By default, enableEnvSubstitution is true but requires an envReader

  delegate to actually resolve variables.

• Environment variable expansion is limited to MAX_ENV_EXPANSION_SIZE bytes

  to prevent denial-of-service via large expansions.

• Without an envReader, ${VAR} references resolve to empty strings.

CfParserConfig cfg;
cfg.enableIncludes = false;  // Disable unless needed
cfg.enableEnvSubstitution = false;  // Disable unless needed
auto doc = parseCf(untrustedInput, "input.cf", cfg);