framework icon indicating copy to clipboard operation
framework copied to clipboard

Absolute or relative path in `image` should not pass validation

Open peterdesmet opened this issue 2 years ago • 1 comments

The data package property image is defined as a url-or-path, where:

Absolute paths (/) and relative parent paths (…/) MUST NOT be used, and implementations SHOULD NOT support these path types.

Frictionless Framework currently does not raise a validation error for:

"image": "../a/relative/path"
or
"image": "/an/absolute/path"

I think it should, just as with contributor.path, license.path, although I noticed that validation sometimes skips those as well. E.g. the following datapackage.json should raise 3 such errors:

{
  "profile": "tabular-data-package",
  "resources": [
    {
      "name": "individuals",
      "profile": "tabular-data-resource",
      "schema": {
        "fields": [
          {
            "name": "id",
             "type": "integer"
          },
          {
            "name": "individualName",
            "type": "string"
          },
          {
            "name": "scientificName",
            "type": "string"
          }
        ]
      },
      "data": [
        {
          "id": 1,
          "individualName": "Reinaert",
          "scientificName": "Vulpes vulpes"
        }
      ]
    }
  ],
  "image": "/absolute.path",
  "contributors": [
    {
      "title": "John Doe",
      "role": "contributor",
      "path": "/absolute.path"
    }
  ],
  "licenses": [
    {
      "path": "/absolute.path"
    }
  ]
}

peterdesmet avatar Sep 19 '23 07:09 peterdesmet

Thanks! I agree

roll avatar Nov 22 '23 10:11 roll