Opened 6 years ago
Closed 5 years ago
#12253 closed Bugs (fixed)
UUID Valid String Semantics are Erratic
Reported by: | Owned by: | James E. King, III | |
---|---|---|---|
Milestone: | Boost 1.66.0 | Component: | uuid |
Version: | Boost 1.60.0 | Severity: | Problem |
Keywords: | Cc: | dartme18@… |
Description
In boost/uuid/string_generator.hpp unsigned char get_value(char c) const, the hex characters [0123456789abcdefABCDEF] are handled explicitly, and any other character is treated as 0xFF (255). However, from line 89 (within operator()), if there is a dash in the ninth character, but not in the fourteenth, etc., throw_invalid is called. That means that the uuid "Have a great big roast-beef sandwich!" will not throw, but "01234567-89abcdef-0123-456789abcdef" will.
Instead of allowing most invalid characters (excepting dashes and lack of braces in certain positions), we should disallow anything but the standard hex digits as digits. Besides the brace and dash handling as it currently is, only [0123456789abcdefABCDEF] should be allowed.
Change History (7)
comment:1 by , 6 years ago
Component: | None → uuid |
---|---|
Owner: | set to |
comment:2 by , 5 years ago
comment:3 by , 5 years ago
A fix for this can be found in PR https://github.com/boostorg/uuid/pull/17/files
comment:4 by , 5 years ago
Milestone: | Boost 1.61.0 → To Be Determined |
---|
I changed the milestone from 1.61.0 to "To Be Determined" because it wasn't fixed in 1.61.0
comment:5 by , 5 years ago
Owner: | changed from | to
---|
comment:6 by , 5 years ago
Milestone: | To Be Determined → Boost 1.66.0 |
---|
comment:7 by , 5 years ago
Resolution: | → fixed |
---|---|
Status: | new → closed |
I can confirm this behavior in boost 1.62 as well:
Sitting in the debugger, we see I passed in an invalid uuid string but I got back a GUID that has FFFF in place of the "zzzz" I put in there:
I would also like to see the parser here changed to be much more strict.