Skip to content

fix: add missing throws parameter to golang validator [closes #87] - #88

Open
jdalton wants to merge 1 commit into
masterfrom
jdalton/fix-87
Open

fix: add missing throws parameter to golang validator [closes #87]#88
jdalton wants to merge 1 commit into
masterfrom
jdalton/fix-87

Conversation

@jdalton

@jdalton jdalton commented Oct 4, 2025

Copy link
Copy Markdown
Collaborator

Parsing certain Go package URLs crashes instead of validating them. The golang validator refers to a variable named throws that was never declared in its signature, so as soon as that branch is reached Node raises ReferenceError: throws is not defined — a hard crash from inside a library whose whole job is to parse untrusted strings safely.

Adding the missing throws parameter, which every other type validator already takes, restores the intended behavior: an invalid version is reported the normal way instead of taking the caller down with it.

Closes #87.

What the tests pin — the crash case, plus the three shapes that must keep parsing

A new golang describe block covers both directions, so the fix cannot regress into over-rejecting:

Case Expected
v1.0.invalid throws, with the "must be followed by a valid semver version" message
v1.0.0 accepted
v0.0.0-20210922020428-25de7278fc84 (pseudo-version) accepted
version with no v prefix accepted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

error parsing pkg:golang/github.com/aws/secrets-store-csi-driver-provider-aws@v1.0.0d2b28f2-2025

2 participants