add new validation type not_contains

Makefile

@@ -57,9 +57,11 @@ vendor:
 lint:
 	# lints the package for common code smells
 	which golint || go get -u golang.org/x/lint/golint
+	which shadow || go get -u golang.org/x/tools/go/analysis/passes/shadow/cmd/shadow
 	test -z "$(gofmt -d -s ./*.go)" || (gofmt -d -s ./*.go && exit 1)
 	# golint -set_exit_status
-	go tool vet -all -shadow -shadowstrict *.go
+	# check for variable shadowing
+	go vet -vettool=$(which shadow) *.go
 
 gogofast:
 	go build -o $@ vendor/github.com/gogo/protobuf/protoc-gen-gogofast/main.go

README.md

@@ -335,7 +335,7 @@ Check the [constraint rule comparison matrix](rule_comparison.md) for language-s
   string x = 1 [(validate.rules).string.pattern = "(?i)^[0-9a-f]+$"];
   ```
 
-- **prefix/suffix/contains**: the field must contain the specified substring in an optionally explicit location.
+- **prefix/suffix/contains/not_contains**: the field must contain the specified substring in an optionally explicit location, or not contain the specified substring.
 
   ```protobuf
   // x must begin with "foo"
@@ -346,6 +346,9 @@ Check the [constraint rule comparison matrix](rule_comparison.md) for language-s
 
   // x must contain "baz" anywhere inside it
   string x = 1 [(validate.rules).string.contains = "baz"];
+
+  // x cannot contain "baz" anywhere inside it
+  string x = 1 [(validate.rules).string.not_contains = "baz"];
 
   // x must begin with "fizz" and end with "buzz"
   string x = 1 [(validate.rules).string = {prefix: "fizz", suffix: "buzz"}];

java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/StringValidation.java

@@ -88,6 +88,13 @@ public static void contains(String field, String value, String contains) throws
         }
     }
 
+    public static void notContains(String field, String value, String contains) throws ValidationException {
+        if (value.contains(contains)) {
+            throw new ValidationException(field, enquote(value), "should not contain " + contains);
+        }
+    }
+
+
     public static void suffix(String field, String value, String suffix) throws ValidationException {
         if (!value.endsWith(suffix)) {
             throw new ValidationException(field, enquote(value), "should end with " + suffix);

java/pgv-java-stub/src/test/java/io/envoyproxy/pgv/StringValidationTest.java

@@ -124,6 +124,14 @@ public void containsWorks() throws ValidationException {
         assertThatThrownBy(() -> StringValidation.contains("x", "Hello World", "Bananas")).isInstanceOf(ValidationException.class);
     }
 
+    @Test
+    public void notContainsWorks() throws ValidationException {
+        // Match
+        StringValidation.notContains("x", "Hello World", "Bananas");
+        // No Match
+        assertThatThrownBy(() -> StringValidation.notContains("x", "Hello World", "o W")).isInstanceOf(ValidationException.class);
+    }
+
     @Test
     public void suffixWorks() throws ValidationException {
         // Match

rule_comparison.md

@@ -24,6 +24,7 @@
 | min\_bytes/max\_bytes  |✅|✅|✅|✅|✅|
 | pattern                |✅|✅|❌|✅|✅|
 | prefix/suffix/contains |✅|✅|✅|✅|✅|
+| contains/not_contains  |✅|✅|✅|✅|✅|
 | in/not_in              |✅|✅|✅|✅|✅|
 | email                  |✅|✅|❌|✅|✅|
 | hostname               |✅|✅|✅|✅|✅|

templates/cc/string.go

@@ -96,6 +96,14 @@ const strTpl = `
 			{{ err . "value does not contain substring " (lit $r.GetContains) }}
 		}
 	}
+        {{ end }}
+
+	{{ if $r.NotContains }}
+	{
+		if (pgv::Contains({{ accessor . }}, {{ lit $r.GetNotContains }})) {
+			{{ err . "value contains substring " (lit $r.GetNotContains) }}
+		}
+	}
 	{{ end }}
 
 	{{ if $r.GetIp }}

templates/goshared/string.go

@@ -74,6 +74,12 @@ const strTpl = `
 		}
 	{{ end }}
 
+	{{ if $r.NotContains }}
+		if strings.Contains({{ accessor . }}, {{ lit $r.GetNotContains }}) {
+			return {{ err . "value contains substring " (lit $r.GetNotContains) }}
+		}
+	{{ end }}
+
 	{{ if $r.GetIp }}
 		if ip := net.ParseIP({{ accessor . }}); ip == nil {
 			return {{ err . "value must be a valid IP address" }}

templates/java/string.go

@@ -56,6 +56,9 @@ const stringTpl = `{{ $f := .Field }}{{ $r := .Rules -}}
 {{- if $r.Contains }}
 			io.envoyproxy.pgv.StringValidation.contains("{{ $f.FullyQualifiedName }}", {{ accessor . }}, "{{ $r.GetContains }}");
 {{- end -}}
+{{- if $r.NotContains }}
+			io.envoyproxy.pgv.StringValidation.notContains("{{ $f.FullyQualifiedName }}", {{ accessor . }}, "{{ $r.GetNotContains }}");
+{{- end -}}
 {{- if $r.Suffix }}
 			io.envoyproxy.pgv.StringValidation.suffix("{{ $f.FullyQualifiedName }}", {{ accessor . }}, "{{ $r.GetSuffix }}");
 {{- end -}}

tests/harness/cases/strings.proto

@@ -23,6 +23,7 @@ message StringPattern        { string val = 1 [(validate.rules).string.pattern =
 message StringPatternEscapes { string val = 1 [(validate.rules).string.pattern = "\\* \\\\ \\w"]; }
 message StringPrefix         { string val = 1 [(validate.rules).string.prefix = "foo"]; }
 message StringContains       { string val = 1 [(validate.rules).string.contains = "bar"]; }
+message StringNotContains    { string val = 1 [(validate.rules).string.not_contains = "bar"]; }
 message StringSuffix         { string val = 1 [(validate.rules).string.suffix = "baz"]; }
 message StringEmail          { string val = 1 [(validate.rules).string.email = true]; }
 message StringAddress        { string val = 1 [(validate.rules).string.address = true]; }

tests/harness/executor/cases.go

@@ -785,6 +785,11 @@ var stringCases = []TestCase{
 	{"string - contains - invalid", &cases.StringContains{Val: "candy bazs"}, false},
 	{"string - contains - invalid (case-sensitive)", &cases.StringContains{Val: "Candy Bars"}, false},
 
+	{"string - not contains - valid", &cases.StringNotContains{Val: "candy bazs"}, true},
+	{"string - not contains - valid (case-sensitive)", &cases.StringNotContains{Val: "Candy Bars"}, true},
+	{"string - not contains - invalid", &cases.StringNotContains{Val: "candy bars"}, false},
+	{"string - not contains - invalid (equal)", &cases.StringNotContains{Val: "bar"}, false},
+
 	{"string - suffix - valid", &cases.StringSuffix{Val: "foobaz"}, true},
 	{"string - suffix - valid (only)", &cases.StringSuffix{Val: "baz"}, true},
 	{"string - suffix - invalid", &cases.StringSuffix{Val: "foobar"}, false},

validate/validate.h

@@ -87,6 +87,11 @@ static inline bool Contains(const string& search_in, const string& to_find)
   return search_in.find(to_find) != string::npos;
 }
 
+static inline bool NotContains(const string& search_in, const string& to_find)
+{
+  return not Contains(search_in, to_find);
+}
+
 static inline bool IsIpv4(const string& to_validate) {
 	struct sockaddr_in sa;
 	return !(inet_pton(AF_INET, to_validate.c_str(), &sa.sin_addr) < 1);