Cysharp / Ulid

Fast .NET C# Implementation of ULID for .NET and Unity.
MIT License
1.29k stars 58 forks source link

TryParse/Parse does not detect invalid string content #74

Open lassevk opened 3 months ago

lassevk commented 3 months ago

According to the "canonical spec":

Technically, a 26-character Base32 encoded string can contain 130 bits of information, whereas a ULID must only contain 128 bits. Therefore, the largest valid ULID encoded in Base32 is 7ZZZZZZZZZZZZZZZZZZZZZZZZZ, which corresponds to an epoch time of 281474976710655 or 2 ^ 48 - 1.

Any attempt to decode or encode a ULID larger than this should be rejected by all implementations, to prevent overflow bugs.

However, parsing 26 Z's succeeds, even though it clamps the value to the maximum possible value.

Furthermore, parsing any string consisting of 26 characters succeeds, regardless of the characters, whereas only a subset of all possible 26-character strings are valid Ulids.

Example:

Console.WriteLine(Ulid.TryParse(",,,,,,,,,,,,,,,,,,,,,,,,,,", out Ulid u));

outputs:

True