ajv-validator / ajv-validator/ajv-formats
uuid format incorrectly accepts urn:uuid: prefix
- 主要言語
- TypeScript
- スター
- 228
- フォーク
- 42
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
## Bug Description
`format: uuid` should validate plain UUID strings only,
but ajv-formats currently accepts URN-prefixed UUIDs like `urn:uuid:550e8400-e29b-41d4-a716-446655440000` as valid.
## Root Cause
The regex at `src/formats.ts:73` contains an optional non-capturing group `(?:urn:uuid:)?` that allows the URN prefix:
```ts
uuid: /^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,
```
## Why This Is Wrong
JSON Schema Validation spec §7.3.5 explicitly states:
> "Note also that the 'uuid' format is for plain UUIDs,
> not UUIDs in URNs. For UUIDs as URNs, use the 'uri' format."
The `urn:uuid:` prefix belongs to `format: uri` validation, not `format: uuid`.
## Steps to Reproduce
```js
const Ajv = require("ajv")
const addFormats = require("ajv-formats")
const ajv = new Ajv()
addFormats(ajv)
const validate = ajv.compile({
format: "uuid"
})
// This should be false but returns true
console.log(validate("urn:uuid:550e8400-e29b-41d4-a716-446655440000"))
```
## Expected Behavior
`false` - URN-prefixed UUIDs are not plain UUIDs
## Actual Behavior
`true` - URN prefix is silently accepted
## Fix
Remove the `(?:urn:uuid:)?` group from the regex:
```ts
// Before
uuid: /^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,
// After
uuid: /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,
```
## References
- JSON Schema Validation spec §7.3.5
- RFC 4122 §3 (plain UUID text representation)
- RFC 9562 §4 (same text representation, obsoletes RFC 4122)
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。