Skip to content

UUID regex more liberal than spec #2878

@angaz

Description

@angaz

Hi,

The regexes for validating the UUID strings seem to be more liberal than the specification defines.

From the swagger-generated code:

UUIDPattern = `(?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$`

And valid formats in the google UUID package:
github.com/google/uuid/uuid.go

// Parse decodes s into a UUID or returns an error.  Both the standard UUID
// forms of xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded as well as the
// Microsoft encoding {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and the raw hex
// encoding: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

According to the specification, the dashes are required, but we can see the google UUID package also allows without the dashes. The problem is that in the regex, the dashes are independently optional, so it's possible to leave out any dash, and it will pass the format validation, but not pass the uuid.Parse function, meaning that I still have to do validation, and subsequent error handling in my handlers.

Examples:
Valid for generated code and uuid.Parse:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Valid for generated code, but not uuid.Parse (first dash removed):

xxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx

I'm not sure if it was the intention, but I would like to define a stricter validation regex. I can't use custom types on parameters, so would it be possible to change the regex for the generated code, or allow me to define my own regex for the UUID validation?

I can make a PR to change the regex to allow the full 36-character UUID, as well as the 32-character dash-less UUID. But maybe someone is relying on this incorrect validation of the UUID. So I'm not sure if we can/should change it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions