fix: harden research input manifest timestamps - #273
Conversation
Co-Authored-By: Codex <noreply@openai.com>
|
@codex review Exact head: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2532a5caa5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Codex <noreply@openai.com>
|
@codex review Final exact head after the single authorized remediation: |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 90f4516db4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "path": { | ||
| "type": "string", | ||
| "minLength": 1, | ||
| "pattern": "^(?=[\\s\\S]*\\S)(?!/)(?![\\s\\S]*//)(?![\\s\\S]*/$)(?![\\s\\S]*\\\\)(?![\\s\\S]*\\u0000)(?![\\s\\S]*(?:^|/)\\.{1,2}(?:/|$))[\\s\\S]+$" |
There was a problem hiding this comment.
When a schema-only producer uses draft-2020-12's ECMAScript regex semantics, a member path consisting only of U+0085 or U+001C–U+001F passes this newly added \S lookahead, while _member_path calls _nonempty and Python strip() rejects it; conversely, U+FEFF is rejected by the schema although the runtime accepts it. Fresh evidence in the final head is that the regression test evaluates the pattern with Python re.fullmatch, so it cannot detect this regex-engine difference and schema/runtime parity remains broken for Unicode whitespace.
Useful? React with 👍 / 👎.
| _COMMIT_PATTERN = _re.compile(r"[0-9a-f]{40}") | ||
| _SHA256_PATTERN = _re.compile(r"[0-9a-f]{64}") | ||
| _DATE_PATTERN = _re.compile(r"\d{4}-\d{2}-\d{2}") | ||
| _TIMESTAMP_PATTERN = _re.compile( |
There was a problem hiding this comment.
When a timestamp contains an offset such as +00:60 or +01:99, this pattern accepts it and datetime.fromisoformat silently normalizes it (for example, +00:60 becomes +01:00) rather than raising. The validator therefore accepts and canonically preserves malformed ISO-8601 text while using the normalized instant for ordering, so evidence can disagree with schema validators and consumers; explicitly constrain the offset hour and minute ranges before conversion.
Useful? React with 👍 / 👎.
1 participant
Scope
Validation
No dependency, public API, intended schema semantics, permission, or Python support-matrix changes.