Thursday, 20 June 2013

isValid(). Groan

Some things (OKOK, most things...) just piss me off.

This came up on Twitter today. See this code:

<cfoutput>#isValid("numeric", "5A")#</cfoutput>

Without cheating, what does it return? It returns "false" (OK, this is CF, so it's "NO") right? Because "5a" is not numeric. It's easy to tell that because numeric values comprise of numbers. And "a" is not  a number. So "5a" is not a number. It's not numeric.

Well... no. Not to ColdFusion. To ColdFusion, this is numeric, so that code outputs "YES".

You might be clever and go "ah, but CF is treating it as hex, ie: it's 90 in decimal". Nope, that's not it.

Check out this code:

<cfset string = "5a">
string:    #string#<br>
IsValid("numeric", "#string#"):    #isValid("numeric", string)#<br>
string*1:    #string*1#<br>

And its output:

string:    5a
IsValid("numeric", "5a"):    YES
string*1:    0.208333333332

The "multiply by 1" thing is just to force it to be this number that apparently it is. 0.208333333332? Huh?

Then I had a flash...

<cfset time = createTime(5,0,0)>
time: #time#<br>
time*1: #time*1#<br>

time: {ts '1899-12-30 05:00:00'}
time*1: 0.208333333332

Right. So to be very clear about this, ColdFusion is taking "5A", and trying to force it to be numeric, so in doing this, it's saying "oh right, well "5A" means the time "5am on Saturday December 30, 1899" (of course it does), and a time can be forced to a numeric easy...

[despairing eyeroll]

Guys @ Adobe... it's  "isValid()" does not mean "canItBeMadeToBe()". Those are two different things. isValid() should not be doing any type conversion. It should be going "that exact value you gave me, does that conform to [some rules that define the validation]". And "5A" is not numeric.

Actually, I can demonstrate this even with ColdFusion (David Boyer put me on to this, he was part of the Twitter discussion about all this):

isValid(): #isValid("numeric", "5A")#<br>
isNumeric(): #isNumeric("5A")#<br>

This outputs... wait for it...

isValid(): YES
isNumeric(): NO

Come on then, Adobe: which is it? Sort yer bleedin' act out, will ya?

There's a bug for this: 3042202. This is "Closed / Deferred", with a substatus of "NotEnoughTime". Make time, chaps. You've had almost three years (according to the bug tracker).

I've also confirmed that "5A" passes CF's validation for numeric argument types (David's raised a bug for this: 3042477. This is also closed/deferred due to "not enough time"). And also the <cfparam> tag's numeric validation too.


NOTE: none of this nonsense applies to Railo. It gets it right. As one would expect.