objectionary / objectionary/lints

`Version.parsed()` incorrectly accepts invalid semver trailing inputs

Open Beginner friendly
#1,450 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug good-title
Dominant language
Java
Stars
14
Forks
39
Avg merge
22h 54m
Merged PRs (30d)
90

Description

What happens

Version.parsed() documents a strict major.minor.patch version, and LtSyntaxVersion says non-SemVer values are ignored. But Version.CORE is anchored only at the beginning:

private static final Pattern CORE = Pattern.compile("^(\\d+)\\.(\\d+)\\.(\\d+)");

There is no end condition or validation of what follows the patch component. On current master a same-package harness over the current Version.java gives:

1.2.3 -> Optional[1.2.3]
1.2.3-alpha.1 -> Optional[1.2.3]
1.2.3garbage -> Optional[1.2.3]
1.2.3.4 -> Optional[1.2.3]
999.0.0oops -> Optional[999.0.0]

A valid prerelease is intentionally compared by its numeric core. Arbitrary text and a fourth numeric component are not valid SemVer but are silently accepted as valid versions.

Impact

LtSyntaxVersion uses Version.parsed(declared) to decide whether +syntax requires a newer parser. Thus +syntax 999.0.0oops may produce a false hard error requiring future EO syntax instead of being ignored as malformed/non-SemVer, contradicting the lint's own documented contract.

What should happen

Validate the complete spelling while allowing valid SemVer prerelease/build suffixes to be ignored for numeric comparison. Arbitrary trailing text and extra numeric components should return Optional.empty().

A regression should cover 1.2.3garbage and 1.2.3.4 while preserving 1.2.3-alpha.1.

I searched existing issues for syntax-version garbage suffix, Version parsed trailing garbage, non-SemVer syntax-version accepted, syntax version 1.2.3.4, and syntax-version regex anchored; no duplicate was found.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Version.java, focusing on Version.CORE and Version.parsed(), then check how LtSyntaxVersion consumes the result. Add regression coverage for 1.2.3garbage and 1.2.3.4 while preserving 1.2.3-alpha.1; done means invalid trailing input returns Optional.empty() without changing valid prerelease handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.