-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
Hi,
The regexes for validating the UUID strings seem to be more liberal than the specification defines.
From the swagger-generated code:
UUIDPattern = `(?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$`
And valid formats in the google UUID package:
github.com/google/uuid/uuid.go
// Parse decodes s into a UUID or returns an error. Both the standard UUID
// forms of xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded as well as the
// Microsoft encoding {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and the raw hex
// encoding: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
According to the specification, the dashes are required, but we can see the google UUID package also allows without the dashes. The problem is that in the regex, the dashes are independently optional, so it's possible to leave out any dash, and it will pass the format validation, but not pass the uuid.Parse
function, meaning that I still have to do validation, and subsequent error handling in my handlers.
Examples:
Valid for generated code and uuid.Parse
:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid for generated code, but not uuid.Parse
(first dash removed):
xxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
I'm not sure if it was the intention, but I would like to define a stricter validation regex. I can't use custom types on parameters, so would it be possible to change the regex for the generated code, or allow me to define my own regex for the UUID validation?
I can make a PR to change the regex to allow the full 36-character UUID, as well as the 32-character dash-less UUID. But maybe someone is relying on this incorrect validation of the UUID. So I'm not sure if we can/should change it.