sdk-go icon indicating copy to clipboard operation
sdk-go copied to clipboard

URI Validation fails to catch invalid relative `Source` URI

Open embano1 opened this issue 3 years ago • 0 comments

CE SDK Spec for source is defined as:

URI - Absolute uniform resource identifier.

To quote from the RFC:

 A path segment that contains a colon character (e.g., "this:that")
 cannot be used as the first segment of a relative-path reference, as
 it would be mistaken for a scheme name.  Such a segment must be
 preceded by a dot-segment (e.g., "./this:that") to make a relative-
 path reference.

Though this invalid URI passes the SPEC validation in the SDK:

package main

import (
	"fmt"
	"net/url"
)

func main() {
	u, err := url.Parse("this:that")
	if err != nil {
		panic(err.Error())
	}

	fmt.Println(u)
}

// prints this:that

https://github.com/cloudevents/sdk-go/blob/9f80fd3a004fcabea03987db1fdfcb324deef14e/v2/types/uriref_test.go#L17

The CE SDK Meeting on Feb 17 2022 we agreed to open an issue in the Go SDK though the problem seems to be in the underlying net/url std lib.

embano1 avatar Feb 17 '22 18:02 embano1