go-playground / validator

:100:Go Struct and Field validation, including Cross Field, Cross Struct, Map, Slice and Array diving
MIT License
16.07k stars 1.29k forks source link

RFC1035 DNS Labels can be more than 63 characters long #1213

Open KimNorgaard opened 5 months ago

KimNorgaard commented 5 months ago

Package version eg. v9, v10:

v10

Issue, Question or Enhancement:

The current regular expression for evaluating if a DNS label is RFC1035 compliant is:

dnsRegexStringRFC1035Label = "^[a-z]([-a-z0-9]*[a-z0-9]){0,62}$"

The intention is clear (one alpha character followed by 0-62 alphanum-hypen characters followed by one alphanumeric character). However it is flawed since the max and min count accounts for everything within the parentheses. In effect this allows for unlimited length.

Code sample, to showcase or reproduce:

The code at https://go.dev/play/p/N7bXBCE-mvl should return false but returns true.

To test it in the current main branch:

Add the following tests to TestRFC1035LabelFormatValidation in validate_test.go:

{"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk", "dns_rfc1035_label", true},
{"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijkl", "dns_rfc1035_label", false},

Run the tests. The second one will fail. It should not.

Fix

The fix it to amend the regexp and introduce a length check in isDnsRFC1035LabelFormat(). Kubernetes and other projects does this exact same thing.

The regex should be:

^[a-z]([-a-z0-9]*[a-z0-9])?$

I'll submit a PR.