flask-expects-json icon indicating copy to clipboard operation
flask-expects-json copied to clipboard

Date-time format validation fails

Open richgar1982 opened this issue 3 years ago • 4 comments
trafficstars

I am working with Flask and your flask_expects_json plugin. I have the following schema:

    {
        "type": "object",
        "properties": {
            "last_access":{
               "format": "date-time"
             },
            "username":{"type": ["string", "null"]},
            "role": {"type": ["integer", "null"]}
        },
        "required": [ "last_access", "username","role"]
    }

and then I use @expects_json(schema, check_formats=True).

Each time I test the "date-time" format validation, it allows me to pass invalid values using wrong formats and fails with 500 errors due to a SQL error. But if I change the format to ipv4 or email, everything works fine. Am I doing something wrong or this is a bug in the validation date-time format?

richgar1982 avatar Jan 22 '22 03:01 richgar1982

Hi @richgar1982 Have you managed to solve the issue? I think about changing the library for something like cerberus.

urmichm avatar Jul 17 '22 20:07 urmichm

Format checking can be enabled by an argument as documented here: https://github.com/Fischerfredl/flask-expects-json#format-checking

Fischerfredl avatar Jul 18 '22 07:07 Fischerfredl

Hi @Fischerfredl We have seen the README, however, this description is ambiguous

urmichm avatar Jul 18 '22 07:07 urmichm

My bad, i see you have already tried that. I have reproduced the issue.

The python jsonschema library ignores formats, which requirements have not been satified. This is stated here in a note along with the reasoning: https://python-jsonschema.readthedocs.io/en/stable/validate/#validating-formats

If the following packages are not installed when using a checker that requires it, validation will succeed without throwing an error, as specified by the JSON Schema specification.

See the table there for which format requires which package to be installed. After running pip install rfc3339-validator the date-time format validation worked for me.

Fischerfredl avatar Jul 18 '22 07:07 Fischerfredl