validator.js icon indicating copy to clipboard operation
validator.js copied to clipboard

Update isUUID() to fully support the new UUID spec (RFC9562)

Open broofa opened this issue 1 year ago • 4 comments

[Related to #2344.]

Hi, uuid maintainer here. I happened to notice this project while perusing open issues on the DefinitelyTyped project. The UUID spec has been updated for the first time in almost 20 years, which is where the new v7 UUID comes from (support added here in #2344). However, there's more to the new RFC than just version 7. I also noticed a couple other issues while glancing at the isUUID() code here.

Specifically, to be fully RFC9562-compliant will require the following:

  • [ ] Add support for version 6 and version 8 UUIDS. The new UUID RFC (RFC9562) adds two new versions, in addition to version 7 (which this library already supports. Version 6 ("improved version 1 layout") and version 8 ("experimental") are now also valid versions
  • [ ] Enforce variant field for all versions. It's weird that it's only enforced for versions 4, 5, and 7.
  • [ ] Add support for NIL and MAX UUIDs. For completeness, I would expect the uuid regexs to include nil and max patterns.
  • [ ] Use a better regex for all. For example, here's the regex we use for uuid.

broofa avatar Jun 13 '24 13:06 broofa

Thanks for the headsup and detailed analaysis :) will look into it on free time

rubiin avatar Jun 13 '24 14:06 rubiin

@broofa I used the all regex , but this doesnt seem to validate a UUID which was of type v3 https://regex101.com/r/r3roG6/1 image

rubiin avatar Jun 13 '24 14:06 rubiin

@broofa I used the all regex , but this doesnt seem to validate a UUID which was of type v3

@rubin Yeah, several of the "valid" UUIDs in the tests aren't actually valid. They have a bad variant field. (tl;dr: str[19] can only contain an 8, 9, a or b). See the changes I made in the PR I put up. Hopefully that explains what's wrong here.

broofa avatar Jun 13 '24 14:06 broofa

Got it. I have approved the PR

rubiin avatar Jun 13 '24 14:06 rubiin

Can we close this PR? Looks like it's already been addressed by #2421

jonreiland avatar Feb 08 '25 02:02 jonreiland

MSSQL's NEWSEQUENTIALID, Oracle's SYS_GUID and SAP HANA's SYSUUID are not producing standard-compliant UUIDs.

Would have been nice to keep a generic UUID validator so that values generated by those DBs would still work.

alumni avatar Mar 31 '25 17:03 alumni