Skip to content

Bugs: strings, identifiers and security formats (0.28.1) #35

Open

Description

@otsobide

Defects in the string, identifier and security-format value objects of 0.28.1 (each one reproduced). Fixed by the new strings.py, identifiers.py and security.py families; every item gets a regression test and is ticked when the fix lands.

  • C19 Uuid4 accepts non-v4 UUIDs (v1/v3/v5, nil) and malformed strings: uuid.UUID(s, version=4) overwrites the version instead of checking it.
  • C20/C42 uuid4_test.test_old_uuid_version_raise_error passes only because of the str type check, hiding C19.
  • X06 Uuid4 accepts UUID strings written with non-ASCII digits, which then compare unequal to the ASCII form.
  • C21/C53 Cpe uses invalid escape sequences in a non-raw regex: SyntaxWarning on 3.12+, and import pyvalueobjects fails under -W error.
  • C22 Every regex VO accepts a trailing newline ('$' anchor with re.match): Cve('CVE-2014-9418\n').
  • C23 Cve, Cpe and Url accept non-ASCII Unicode digits because the patterns use \d (Cve('CVE-٢٠١٤-٩٤١٨')).
  • C29 Cpe rejects common valid CPE 2.2 URIs (empty components, language, short names, percent-encoding) and every CPE 2.3 formatted string.
  • C30 Equal identifiers compare unequal: case-insensitive or multi-format values (hashes, UUIDs, MACs, CVEs) are stored verbatim without canonicalisation.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions