objectionary / objectionary/lints
`Version.parsed()` incorrectly accepts invalid semver trailing inputs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14
- Forks
- 39
- Avg merge
- 22h 54m
- Merged PRs (30d)
- 90
Description
What happens
Version.parsed() documents a strict major.minor.patch version, and LtSyntaxVersion says non-SemVer values are ignored. But Version.CORE is anchored only at the beginning:
private static final Pattern CORE = Pattern.compile("^(\\d+)\\.(\\d+)\\.(\\d+)");
There is no end condition or validation of what follows the patch component. On current master a same-package harness over the current Version.java gives:
1.2.3 -> Optional[1.2.3]
1.2.3-alpha.1 -> Optional[1.2.3]
1.2.3garbage -> Optional[1.2.3]
1.2.3.4 -> Optional[1.2.3]
999.0.0oops -> Optional[999.0.0]
A valid prerelease is intentionally compared by its numeric core. Arbitrary text and a fourth numeric component are not valid SemVer but are silently accepted as valid versions.
Impact
LtSyntaxVersion uses Version.parsed(declared) to decide whether +syntax requires a newer parser. Thus +syntax 999.0.0oops may produce a false hard error requiring future EO syntax instead of being ignored as malformed/non-SemVer, contradicting the lint's own documented contract.
What should happen
Validate the complete spelling while allowing valid SemVer prerelease/build suffixes to be ignored for numeric comparison. Arbitrary trailing text and extra numeric components should return Optional.empty().
A regression should cover 1.2.3garbage and 1.2.3.4 while preserving 1.2.3-alpha.1.
I searched existing issues for syntax-version garbage suffix, Version parsed trailing garbage, non-SemVer syntax-version accepted, syntax version 1.2.3.4, and syntax-version regex anchored; no duplicate was found.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Version.java, focusing on Version.CORE and Version.parsed(), then check how LtSyntaxVersion consumes the result. Add regression coverage for 1.2.3garbage and 1.2.3.4 while preserving 1.2.3-alpha.1; done means invalid trailing input returns Optional.empty() without changing valid prerelease handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100