Add AST depth validator.

compiler/BUILD

@@ -27,6 +27,7 @@ cc_library(
         "//checker:validation_result",
         "//parser:options",
         "//parser:parser_interface",
+        "//validator",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings:string_view",
@@ -48,6 +49,7 @@ cc_library(
         "//internal:status_macros",
         "//parser",
         "//parser:parser_interface",
+        "//validator",
         "@com_google_absl//absl/base:nullability",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/status",
@@ -78,6 +80,7 @@ cc_test(
         "//parser:macro",
         "//parser:parser_interface",
         "//testutil:baseline_tests",
+        "//validator:timestamp_literal_validator",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:status_matchers",
         "@com_google_absl//absl/strings",

compiler/compiler.h

@@ -28,6 +28,7 @@
 #include "checker/validation_result.h"
 #include "parser/options.h"
 #include "parser/parser_interface.h"
+#include "validator/validator.h"
 
 namespace cel {
 
@@ -109,6 +110,7 @@ class CompilerBuilder {
 
   virtual TypeCheckerBuilder& GetCheckerBuilder() = 0;
   virtual ParserBuilder& GetParserBuilder() = 0;
+  virtual Validator& GetValidator() = 0;
 
   virtual absl::StatusOr<std::unique_ptr<Compiler>> Build() = 0;
 };
@@ -135,6 +137,9 @@ class Compiler {
 
   // Accessor for the underlying parser.
   virtual const Parser& GetParser() const = 0;
+
+  // Accessor for the underlying validator.
+  virtual const Validator& GetValidator() const = 0;
 };
 
 }  // namespace cel

compiler/compiler_factory.cc

@@ -32,6 +32,7 @@
 #include "internal/status_macros.h"
 #include "parser/parser.h"
 #include "parser/parser_interface.h"
+#include "validator/validator.h"
 #include "google/protobuf/descriptor.h"
 
 namespace cel {
@@ -41,8 +42,12 @@ namespace {
 class CompilerImpl : public Compiler {
  public:
   CompilerImpl(std::unique_ptr<TypeChecker> type_checker,
-               std::unique_ptr<Parser> parser)
-      : type_checker_(std::move(type_checker)), parser_(std::move(parser)) {}
+               std::unique_ptr<Parser> parser,
+               // Copy the validator in case builder is reused.
+               Validator validator)
+      : type_checker_(std::move(type_checker)),
+        parser_(std::move(parser)),
+        validator_(std::move(validator)) {}
 
   absl::StatusOr<ValidationResult> Compile(
       absl::string_view expression,
@@ -54,15 +59,20 @@ class CompilerImpl : public Compiler {
                          type_checker_->Check(std::move(ast)));
 
     result.SetSource(std::move(source));
+    if (!validator_.validations().empty()) {
+      validator_.UpdateValidationResult(result);
+    }
     return result;
   }
 
   const TypeChecker& GetTypeChecker() const override { return *type_checker_; }
   const Parser& GetParser() const override { return *parser_; }
+  const Validator& GetValidator() const override { return validator_; }
 
  private:
   std::unique_ptr<TypeChecker> type_checker_;
   std::unique_ptr<Parser> parser_;
+  Validator validator_;
 };
 
 class CompilerBuilderImpl : public CompilerBuilder {
@@ -126,17 +136,19 @@ class CompilerBuilderImpl : public CompilerBuilder {
   TypeCheckerBuilder& GetCheckerBuilder() override {
     return *type_checker_builder_;
   }
+  Validator& GetValidator() override { return validator_; }
 
   absl::StatusOr<std::unique_ptr<Compiler>> Build() override {
     CEL_ASSIGN_OR_RETURN(auto parser, parser_builder_->Build());
     CEL_ASSIGN_OR_RETURN(auto type_checker, type_checker_builder_->Build());
     return std::make_unique<CompilerImpl>(std::move(type_checker),
-                                          std::move(parser));
+                                          std::move(parser), validator_);
   }
 
  private:
   std::unique_ptr<TypeCheckerBuilder> type_checker_builder_;
   std::unique_ptr<ParserBuilder> parser_builder_;
+  Validator validator_;
 
   absl::flat_hash_set<std::string> library_ids_;
   absl::flat_hash_set<std::string> subsets_;

compiler/compiler_factory_test.cc

@@ -35,6 +35,7 @@
 #include "parser/macro.h"
 #include "parser/parser_interface.h"
 #include "testutil/baseline_tests.h"
+#include "validator/timestamp_literal_validator.h"
 #include "google/protobuf/descriptor.h"
 
 namespace cel {
@@ -287,6 +288,23 @@ TEST(CompilerFactoryTest, DisableStandardMacrosWithStdlib) {
   EXPECT_TRUE(result.IsValid());
 }
 
+TEST(CompilerFactoryTest, AddValidator) {
+  ASSERT_OK_AND_ASSIGN(
+      auto builder,
+      NewCompilerBuilder(cel::internal::GetSharedTestingDescriptorPool()));
+
+  ASSERT_THAT(builder->AddLibrary(StandardCompilerLibrary()), IsOk());
+  builder->GetValidator().AddValidation(TimestampLiteralValidator());
+
+  ASSERT_OK_AND_ASSIGN(auto compiler, builder->Build());
+  ASSERT_OK_AND_ASSIGN(ValidationResult result,
+                       compiler->Compile("timestamp('invalid')"));
+  EXPECT_FALSE(result.IsValid());
+  ASSERT_OK_AND_ASSIGN(result,
+                       compiler->Compile("timestamp('2024-01-01T00:00:00Z')"));
+  EXPECT_TRUE(result.IsValid());
+}
+
 TEST(CompilerFactoryTest, FailsIfLibraryAddedTwice) {
   ASSERT_OK_AND_ASSIGN(
       auto builder,

validator/BUILD

@@ -0,0 +1,115 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_test.bzl", "cc_test")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "validator",
+    srcs = ["validator.cc"],
+    hdrs = ["validator.h"],
+    deps = [
+        "//checker:type_check_issue",
+        "//checker:validation_result",
+        "//common:ast",
+        "//common:navigable_ast",
+        "//common:source",
+        "@com_google_absl//absl/base:core_headers",
+        "@com_google_absl//absl/functional:any_invocable",
+        "@com_google_absl//absl/log:absl_check",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/types:span",
+    ],
+)
+
+cc_test(
+    name = "validator_test",
+    srcs = ["validator_test.cc"],
+    deps = [
+        ":validator",
+        "//checker:type_check_issue",
+        "//common:ast",
+        "//common:expr",
+        "//common:source",
+        "//internal:testing",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)
+
+cc_test(
+    name = "timestamp_literal_validator_test",
+    srcs = ["timestamp_literal_validator_test.cc"],
+    deps = [
+        ":timestamp_literal_validator",
+        ":validator",
+        "//checker:validation_result",
+        "//compiler",
+        "//compiler:compiler_factory",
+        "//compiler:standard_library",
+        "//internal:testing",
+        "//internal:testing_descriptor_pool",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)
+
+cc_library(
+    name = "timestamp_literal_validator",
+    srcs = ["timestamp_literal_validator.cc"],
+    hdrs = ["timestamp_literal_validator.h"],
+    deps = [
+        ":validator",
+        "//common:constant",
+        "//common:navigable_ast",
+        "//common:standard_definitions",
+        "//internal:time",
+        "//tools:navigable_ast",
+        "@com_google_absl//absl/base:no_destructor",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
+    ],
+)
+
+cc_library(
+    name = "ast_depth_validator",
+    srcs = ["ast_depth_validator.cc"],
+    hdrs = ["ast_depth_validator.h"],
+    deps = [
+        ":validator",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_test(
+    name = "ast_depth_validator_test",
+    srcs = ["ast_depth_validator_test.cc"],
+    deps = [
+        ":ast_depth_validator",
+        ":validator",
+        "//checker:type_check_issue",
+        "//compiler",
+        "//compiler:compiler_factory",
+        "//compiler:standard_library",
+        "//internal:testing",
+        "//internal:testing_descriptor_pool",
+        "@com_google_absl//absl/log:absl_check",
+    ],
+)
+
+licenses(["notice"])

validator/ast_depth_validator.cc

@@ -0,0 +1,34 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "validator/ast_depth_validator.h"
+
+#include "absl/strings/str_cat.h"
+#include "validator/validator.h"
+
+namespace cel {
+
+Validation AstDepthValidator(int max_depth) {
+  return Validation([max_depth](ValidationContext& context) {
+    int height = context.navigable_ast().Root().height();
+    if (height > max_depth) {
+      context.ReportError(absl::StrCat("AST depth ", height,
+                                       " exceeds maximum of ", max_depth));
+      return false;
+    }
+    return true;
+  });
+}
+
+}  // namespace cel

validator/ast_depth_validator.h

@@ -0,0 +1,27 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef THIRD_PARTY_CEL_CPP_VALIDATOR_AST_DEPTH_VALIDATOR_H_
+#define THIRD_PARTY_CEL_CPP_VALIDATOR_AST_DEPTH_VALIDATOR_H_
+#include "validator/validator.h"
+
+namespace cel {
+
+// Returns a `Validation` that checks the AST depth is less than or equal to
+// max_depth.
+Validation AstDepthValidator(int max_depth);
+
+}  // namespace cel
+
+#endif  // THIRD_PARTY_CEL_CPP_VALIDATOR_AST_DEPTH_VALIDATOR_H_