Skip to content

reject non-canonical UUID strings in UUIDConverter#409

Closed
rootvector2 wants to merge 1 commit into
apache:masterfrom
rootvector2:uuid-canonical-strictness
Closed

reject non-canonical UUID strings in UUIDConverter#409
rootvector2 wants to merge 1 commit into
apache:masterfrom
rootvector2:uuid-canonical-strictness

Conversation

@rootvector2

Copy link
Copy Markdown
Contributor

UUID.fromString accepts abbreviated groups like 1-1-1-1-1 and silently canonicalizes them to 00000001-0001-0001-0001-000000000001, so UUIDConverter converts strings that are not the canonical 8-4-4-4-12 form; found while auditing the converters that delegate straight to a lenient JDK parse, and fixed by rejecting any input that does not round-trip to its canonical string (upper case still converts).

  • Read the contribution guidelines for this project.
  • Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
  • I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
  • Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
  • Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

@garydgregory

garydgregory commented Jul 2, 2026

Copy link
Copy Markdown
Member

Hello @rootvector2
-1 unless you can convince us otherwise. This class reflects what Java's own UUID class provides through java.util.UUID.fromString(String).
It seems to me that this PR would narrow what the JRE provides out of the box.

One could argue that java.util.UUID.fromString(String) is lenient by accepting input with leading '0's in its compoenents but that's not something we can change.

Where did you get the requirement that the String form of a UUID or a Converter output in general must roundtrip with its String inout? Maybe I missed it.

I've updated the Javadoc which might give readers better expectations.

@rootvector2

Copy link
Copy Markdown
Contributor Author

Fair enough. I was treating a canonical round-trip as an implicit expectation, but you're right that there's no spec backing it and the converter should mirror UUID.fromString rather than narrow what the JRE accepts. The leading-0 leniency is the JDK's call, not ours. Withdrawing this one, and thanks for the Javadoc clarification.

@rootvector2

Copy link
Copy Markdown
Contributor Author

Closing per the discussion above.

@rootvector2 rootvector2 closed this Jul 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants