ajv-validator / ajv-validator/ajv-formats
Duration format accepts invalid component ordering (P1Y2D and PT1H2S should be rejected)
- Vorherrschende Sprache
- TypeScript
- Sterne
- 228
- Forks
- 42
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
### Description
The current duration regex accepts "P1Y2D" and "PT1H2S" which are invalid per [RFC 3339](https://www.rfc-editor.org/rfc/rfc3339) Appendix A.
## Root Cause
The regex uses independent optional groups: `(\d+Y)?(\d+M)?(\d+D)?`
But RFC 3339 Appendix A defines strict nesting:
- dur-year = 1*DIGIT "Y" [dur-month]
- dur-month = 1*DIGIT "M" [dur-day]
This means day can only appear after month in the chain. "P1Y2D" skips month entirely - the ABNF
does not allow this.
Same issue in time: "PT1H2S" skips minute.
- dur-hour = 1*DIGIT "H" [dur-minute]
- dur-minute = 1*DIGIT "M" [dur-second]
## Reproduction
"P1Y2D" -> passes validation (should fail)
"PT1H2S" -> passes validation (should fail)
"P1Y0M2D" -> passes (correct - month present)
"PT1H0M2S" -> passes (correct - minute present)
## Note
The official JSON Schema Test Suite already tests for this. ajv-formats is failing existing published tests for duration format.
## Corrected Regex
`/^P(?:(?:\d+D|\d+M(?:\d+D)?|\d+Y(?:\d+M(?:\d+D)?)?)(?:T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S))?|T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S)|\d+W)$/`
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Bewertung
Dieses Issue wurde noch nicht bewertet.