Description
Problem statement
In a server: When attempting to validate a UUID in client-supplied data, the generated code under restapi/operations
will make a call like
value, err := formats.Parse("uuid", raw)
This will cause the Parse()
function in go-openapi/strfmt/format.go
to be called, which will attempt to validate the format of the client-supplied data by applying the strfmt.UUID.UnmarshalText()
function.
However, the strfmt.UUID.UnmarshalText()
function (defined in go-openapi/strfmt/default.go
) actually accepts any input string and not just those formatted as UUIDs. (There is a comment associated with that function: "validation is performed later on".)
Should validation of UUIDs should actually be performed using strfmt.IsUUID()
?
Environment
swagger version: 0.8.0 (commit: d1a0b6c)
go version: 1.7.4 linux/amd64
OS: Fedora 25