-
Notifications
You must be signed in to change notification settings - Fork 407
Open
Description
I was reading through the code for Parse and I noticed that there is no validation on the first and last characters of the uuid-to-parse when the length of the input is 38 characters:
Lines 38 to 61 in 16ca3ea
| // Parse decodes s into a UUID or returns an error. Both the standard UUID | |
| // forms of xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and | |
| // urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded as well as the | |
| // Microsoft encoding {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and the raw hex | |
| // encoding: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. | |
| func Parse(s string) (UUID, error) { | |
| var uuid UUID | |
| switch len(s) { | |
| // xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx | |
| case 36: | |
| // urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx | |
| case 36 + 9: | |
| if strings.ToLower(s[:9]) != "urn:uuid:" { | |
| return uuid, fmt.Errorf("invalid urn prefix: %q", s[:9]) | |
| } | |
| s = s[9:] | |
| // {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} | |
| case 36 + 2: | |
| s = s[1:] | |
| // xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | |
| case 32: |
I would expect there to be a check that s[0] == '{' && s[37] == '}' rather than simply ignoring those two characters. I am happy to send a PR if requested, it's a simple change. I am just verifying that this loose behavior is not actually desired.
(fwiw, it means that parsing something like a01234567-abcd-cdef-abcd-012345678901a would be parsed without an error, even though it has extra characters at the beginning and end. That's quite unexpected IMO.)
Metadata
Metadata
Assignees
Labels
No labels