FieldSanitizer output can fail validateSubset: only [_-] is stripped
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
Research direction
The issue is in the FieldSanitizer's stripCharsRegex in registry/conventions/sanitization.jsonld. Compare its current stripping of only [_-] with the validator's pattern ^[a-zA-Z0-9]+$ in validateSubset. Look at the sanitizeNameUnique and sanitizeAnswerCode functions. The fix likely involves expanding the regex to strip non-alphanumeric characters and possibly adding transliteration for umlauts and ß. Test by running the existing sanitizer on the examples in the table and verifying the output against the validator.
Written by the indexing model from the issue text.
Description
FieldSanitizer strips only [_-] (stripCharsRegex in registry/conventions/sanitization.jsonld), but validateSubset requires names and answer codes to match ^[a-zA-Z0-9]+$. So a sanitized name or code can still be rejected by the validator from the same registry.
v0.1.2 (sanitization.jsonld unchanged on main):
| input | sanitizeNameUnique / sanitizeAnswerCode |
matches ^[a-zA-Z0-9]+$ |
|---|---|---|
name aktivitätshäufigkeit |
aktivitätshäufigkeit |
no |
name job satisfaction |
job satisfaction |
no |
name größe |
größe |
no |
name q.1 |
q.1 |
no |
code täglich |
tägli |
no |
code sehr gut |
sehr |
no |
code ja/nein |
ja/ne |
no |
How it showed up: formulaid sanitizes generated questionnaires with FieldSanitizer before validating them (formulaid#17). In a real run, a German model produced aktivitätshäufigkeit and täglich. Both passed through the sanitizer, failed the validator, and sent the run into repair rounds that didn't fix them. formulaid now transliterates to ASCII before calling the sanitizer (formulaid 0ba209e), but the converters use the same sanitizer and have the same gap.
Expected: the sanitizer's output always satisfies the validator's pattern. For example, transliterate umlauts and ß (ä→ae, ß→ss), then strip everything outside [a-zA-Z0-9], not just [_-].
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- Avg merge
- 8m
- Merged PRs (30d)
- 23
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
bug(cli): hapi doctor inline-media prints a fabricated B:\ helper-script path in packaged installs Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Crush Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
catppuccin/catppuccin#3125 ·
-
Add a SECURITY.md Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
ElementsProject/cln-application#167 · 1 comment · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Quantco/pnpm-licenses#17 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100