Skip to content

test(format/uri): add strict anchoring, spacing, and delimiter validation cases#955

Open
AcEKaycgR wants to merge 1 commit into
json-schema-org:mainfrom
AcEKaycgR:uri-anchoring-delimiters
Open

test(format/uri): add strict anchoring, spacing, and delimiter validation cases#955
AcEKaycgR wants to merge 1 commit into
json-schema-org:mainfrom
AcEKaycgR:uri-anchoring-delimiters

Conversation

@AcEKaycgR

Copy link
Copy Markdown
Contributor

Applies to: draft-v1, draft-04, draft-06, draft-07, draft/2019-09, draft/2020-12

Adds 9 new cases validating strict string anchoring constraints, disallowed whitespace characters (newlines, spaces), and invalid path/authority delimiters for the uri format.

Added:

  • Trailing newline after valid URI (invalid)
  • Embedded newline inside URI (invalid)
  • Space inside query (invalid)
  • Space inside fragment (invalid)
  • Close brace } inside path (invalid)
  • Raw non-ASCII emoji inside path (invalid)
  • Open brace { inside query (invalid)
  • Open brace { inside fragment (invalid)
  • Multiple @ signs in authority (invalid)

Ecosystem Impact (Triangulation):

Under Bowtie verification against 8 active implementations, these cases successfully caught live compliance issues:

  1. PHP Bug Caught: php-opis-json-schema incorrectly accepts trailing newlines ("http://a.com\n") and embedded newlines ("http://a\n.com") as valid.
  2. Go Bug Caught: go-gojsonschema incorrectly accepts spaces in query ("?a b") and fragment ("#a b").
  3. Go Bug Caught: go-gojsonschema incorrectly accepts invalid braces ({ and }) in path, query, and fragment.
  4. Go Bug Caught: go-gojsonschema incorrectly accepts multiple @ signs in authority ("http://user@pass@a.com").

@jviotti @jdesrosiers @karenetheridge Ready for review.

@AcEKaycgR AcEKaycgR requested a review from a team as a code owner June 27, 2026 06:33
@AcEKaycgR AcEKaycgR force-pushed the uri-anchoring-delimiters branch 2 times, most recently from ea3badc to 8b782fa Compare June 27, 2026 06:39
},
{
"description": "close brace is invalid in path",
"data": "http://a.com/}",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems very similar to the one in line 165?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch and thank you I've removed the redundant "close brace is invalid in path" test case since it is already covered by the existing {} test on line 165.

@jviotti jviotti left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, though there is one test I commented on that I think is already well covered by the rest?

@AcEKaycgR AcEKaycgR force-pushed the uri-anchoring-delimiters branch from 8b782fa to 3c99b30 Compare July 1, 2026 05:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants