Skip to content

Fix validation bugs and add regression test suite#15

Open
ryanmurf wants to merge 1 commit into
CVEProject:devfrom
ryanmurf:fix/validation-bugs-and-tests
Open

Fix validation bugs and add regression test suite#15
ryanmurf wants to merge 1 commit into
CVEProject:devfrom
ryanmurf:fix/validation-bugs-and-tests

Conversation

@ryanmurf

Copy link
Copy Markdown

Fixes six bugs in the validation pipeline and warning registry, and adds a typechecked node:test suite (29 tests) with a dedicated regression test for each fix.

Bug fixes

  1. Invalid datePublic strings produced a misleading errornew Date('garbage').toISOString() threw RangeError: Invalid time value; now reported as a clear rules-validation error (datePublic must be a valid date).
  2. Missing lang crashed the unique-English checkentry.lang.toLowerCase() threw a TypeError when an entry had no lang; non-string values are now skipped (schema validation covers structure).
  3. Timeline validation — the array guard's error message was wrong (Time must be a date string for a non-array), and entries missing time were handled unsafely; both fixed.
  4. ADP containers were skipped by most rules — only timeline was checked under containers.adp.*; descriptions, unique-English, datePublic, and packageURL rules now cover ADP containers for parity with CNA (all fields confirmed present in the bundled 5.2.0 schema).
  5. Warning active window ignored — every registry warning was injected into every Diagnostics regardless of dateStart/dateEnd; warnings are now filtered to the active window.
  6. Failed schema loads were cached forever — a rejected default-validator promise stayed in the static cache, poisoning all later Validate instances; creation is now retried after a failure.

Tests

  • New test/validate.test.ts and test/warnings.test.ts using Node's built-in node:test runner via tsx (29 tests): schema pass/fail, every business rule including all PURL edge cases (version, vers qualifier, encoded colon, empty/./.. subpaths), each ADP-parity path, warning active-window filtering, and the validator-cache retry.
  • Tests are typechecked via a new tsconfig.test.json; npm test now runs typecheck + the suite.
  • scripts/test-local.mjs warning fixture now derives its active window from the current date instead of hardcoded dates that would start failing in 2027.

No public API changes; bundled schemas and dependencies untouched. npm test, npm run build, and node scripts/test-local.mjs all pass.

- Report a clear rules error for invalid datePublic strings instead of
  RangeError('Invalid time value')
- Skip entries with a missing/non-string lang in unique-English check
  instead of throwing TypeError
- Fix timeline array error message and handle entries missing 'time'
- Extend rules to ADP containers for parity with CNA: descriptions,
  unique-English, datePublic, timeline, and packageURL paths
- Honor warning dateStart/dateEnd so only currently-active registry
  warnings surface in diagnostics
- Retry default schema validator creation after a failed load instead
  of caching the rejected promise forever
- Add node:test suite (29 tests) with a dedicated regression test per
  fix; typecheck tests via tsconfig.test.json; make the local smoke
  test's warning window relative to the current date
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant