You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bugs: strings, identifiers and security formats (0.28.1) #35
Defects in the string, identifier and security-format value objects of 0.28.1 (each one reproduced). Fixed by the new strings.py, identifiers.py and security.py families; every item gets a regression test and is ticked when the fix lands.
C19Uuid4 accepts non-v4 UUIDs (v1/v3/v5, nil) and malformed strings: uuid.UUID(s, version=4) overwrites the version instead of checking it.
C20/C42uuid4_test.test_old_uuid_version_raise_error passes only because of the str type check, hiding C19.
X06Uuid4 accepts UUID strings written with non-ASCII digits, which then compare unequal to the ASCII form.
C21/C53Cpe uses invalid escape sequences in a non-raw regex: SyntaxWarning on 3.12+, and import pyvalueobjects fails under -W error.
C22 Every regex VO accepts a trailing newline ('$' anchor with re.match): Cve('CVE-2014-9418\n').
C23Cve, Cpe and Url accept non-ASCII Unicode digits because the patterns use \d (Cve('CVE-٢٠١٤-٩٤١٨')).
C29Cpe rejects common valid CPE 2.2 URIs (empty components, language, short names, percent-encoding) and every CPE 2.3 formatted string.
C30 Equal identifiers compare unequal: case-insensitive or multi-format values (hashes, UUIDs, MACs, CVEs) are stored verbatim without canonicalisation.
Activity