search

riboseinc / uri_format_validator

Validate URL for Rails
MIT License
3 stars 2 forks source link

Schemes list is very incomplete #62

Open skalee opened 6 years ago

skalee commented 6 years ago

By default, the validator allows http and https URI schemes only. However, that can be overriden by setting option :scheme:

Post.validates :url, uri_format: { scheme: /some|schemes|regexp/ }
Post.validates :url, uri_format: { scheme: :all }

The value :all stands for a predefined list of popular schemes: https://github.com/riboseinc/uri_format_validator/blob/605d8968bea58714f627f43548d9de4e02aba5d0/lib/uri_format_validator/validators/uri_format_validator.rb#L16-L25

However, this list isn't complete. For instance, it lacks ssh URI scheme (ssh://git@github.com:riboseinc/uri_format_validator.git). And I'm worried it's not the only missing one. Any good reason to maintain the schemes list at all, @ronaldtse?

ronaldtse commented 6 years ago

Originally the scheme list came from the authoritative list of schemes at IANA: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml

I agree that scheme checks may be an overkill but non-IANA registered schemes are technically invalid on the Internet. This would also allow us the opportunity to particularly address validity of a single scheme better.

What do you think @skalee? Provide an override to this?

skalee commented 6 years ago

@ronaldtse If it's an authoritative source, then IMHO the option should be named accordingly. Not {scheme: :all}, but maybe {scheme: :iana}, or {scheme: :permanent}, as in example below:

validates :uri, uri_format: {scheme: :iana}

The option {scheme: :all} should allow all schemes, registered or not.

On the other hand, such authoritative list is another thing to maintain. It needs to be updated from time to time. And I see some pretty recent entries (with provisional status) like spotify:// or steam://. I'm bit worried about this burden. But maybe there's some gem which already maintains such list? I'll look for it later.

Also, I see ssh is present on that authoritative list, it has provisional (not permanent) status, that probably explain why it's missing on our short list of schemes with permanent status.