Invalid Base62 string parses and validates

[idleberg]

I was surprised that the following example doesn't return false. Actually, I'd expected the parser to throw an error first.

const invalidBase62 = '@@@@@@@@@@@@@@@@@@@@@@@@@@@';
const parsedKsuid = KSUID.parse(invalidBase62);

KSUID.isValid(parseKSUID.raw); // true

Is this my misconception about the library, or is it a bug?

[novemberborn]

Interesting question! There is no validation in KSUID.parse() that the string contains Base62 characters. Looking through the original Golang library I don't see this kind of validation either.

Arguably this is meant to follow the Golang implementation, in which case it's by design. I can also see how that validation incurs a runtime cost and the more likely issue is that the string is the wrong length, rather than the wrong characters.

OTOH, this has surprised users of the Golang library (segmentio/ksuid#74) and validating whether the characters are in range shouldn't be that arduous.

So… PR welcome? Though this library probably needs a bit of maintenance too before any new version can be shipped.

[idleberg]

Thanks for clarifying. I think it's a valid argument that this library is meant to compatible with the Go implementation, but also think this is probably a bug (or an oversight) on their end. How would you feel about updating the documentation for the current version that mentions this as a gotcha.

I'm currently using this workaround:

const BASE62_REGEX = /^[A-Za-z0-9+/]{27}$/;
const isValid = BASE62_REGEX.test(value) && KSUID.isValid("aWgEPTl1tmebfsQzFP4bxwgy80V");

[novemberborn]

A documentation update would be the quickest change. Making code changes requires a bit more maintenance since the last release was nearly four years ago.