ajv-validator / ajv-validator/ajv-formats

Duration format accepts invalid component ordering (P1Y2D and PT1H2S should be rejected)

Offen
#116 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
TypeScript
Sterne
228
Forks
42
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

### Description

The current duration regex accepts "P1Y2D" and "PT1H2S" which are invalid per [RFC 3339](https://www.rfc-editor.org/rfc/rfc3339) Appendix A.

## Root Cause

The regex uses independent optional groups: `(\d+Y)?(\d+M)?(\d+D)?`
But RFC 3339 Appendix A defines strict nesting:

- dur-year = 1*DIGIT "Y" [dur-month]
- dur-month = 1*DIGIT "M" [dur-day]

This means day can only appear after month in the chain. "P1Y2D" skips month entirely - the ABNF
does not allow this.

Same issue in time: "PT1H2S" skips minute.

- dur-hour = 1*DIGIT "H" [dur-minute]
- dur-minute = 1*DIGIT "M" [dur-second]

## Reproduction

"P1Y2D" -> passes validation (should fail)
"PT1H2S" -> passes validation (should fail)
"P1Y0M2D" -> passes (correct - month present)
"PT1H0M2S" -> passes (correct - minute present)

## Note

The official JSON Schema Test Suite already tests for this. ajv-formats is failing existing published tests for duration format.

## Corrected Regex

`/^P(?:(?:\d+D|\d+M(?:\d+D)?|\d+Y(?:\d+M(?:\d+D)?)?)(?:T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S))?|T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S)|\d+W)$/`

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.