argotorg / argotorg/solidity

SemVer parser allows invalid range constraint

Open
#14,153 1 comment 0 reactions 0 assignees View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

## Description

The SemVer parser allows the following constraint to go through:

```solidity
pragma solidity 0.8.19 .0;
```

But as far as I can tell this is not valid SemVer syntax, as can be cross referenced here: https://jubianchi.github.io/semver-check/#/constraint/0.8.19%20.0

I also don't see this form tested in the vectors for [SemVerMatcher.cpp](https://github.com/ethereum/solidity/blob/develop/test/libsolidity/SemVerMatcher.cpp#L201) so I assume it's a parsing oversight?

From the AST, the compiler seems to treat this as a range constraint of sorts:

```
{
"id":1,
"literals":[
"solidity",
"0.8",
".19",
".0"
],
"nodeType":"PragmaDirective",
"src":"35:26:4"
},
```

This is a hard "violation" to catch with regex because spaces are allowed in SemVer normally, so would be best to remove this so that people do not use it as it ends up requiring a lot of extra code outside of the usual semver libs to process this nonstandard form.

## Environment

- Compiler version: 0.8.19
- Target EVM version (as per compiler settings): paris
- Framework/IDE (e.g. Truffle or Remix): N/A
- EVM execution environment / backend / blockchain client: N/A
- Operating system: linux/amd64

## Steps to Reproduce

Compile the following contract:

```solidity
pragma solidity 0.8.19 .0;

contract Test {}
```

With:

```
solc Test.sol
```

Expected result would be `Error: Invalid version pragma.`, but the contract compiles without error.

Contributor guide

Open the contributing guide

Research direction

Start with the SemVerMatcher.cpp test vectors mentioned in the issue and compile the provided Test.sol reproduction with solc. Add coverage for `pragma solidity 0.8.19 .0;` and verify that compilation reports `Invalid version pragma` rather than accepting the constraint.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.