Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ambiguous-parsing-semantics

AntiPattern

Ambiguous Parsing Semantics

ambiguous-parsing-semantics

Numeric and string formatting/parsing breaks when representations and delimiters are underspecified: floating-point tie-breaking varies, SQL numeric formatting truncates expected punctuation, and regex/path segments fail to split consistently, producing mismatched results.

Node Details

Public graph metadata

Updated7/22/2026

Connections

30 linked nodes

MATCHESSolution

Avoid validating the input as a numeric type directly; validate it as a string with a regex (e.g., `z.string().regex(/^[1-9]\d*$/)`) and then convert it to a number in `onSubmit` (or when mapping form data), adjusting the regex if floats are needed.

MATCHESSolution

Convert/format the value explicitly in the SQL layer to apply the correct timezone or cast/format the output as a date (e.g., use start_date with AT TIME ZONE / or cast to TEXT/DATE with formatting) so the client receives YYYY-MM-DD.

MATCHESSolution

Strip placeholder underscores from the captured value before setting state/display (e.g., replace /_/g with an empty string in the onChange handler), or otherwise sanitize the masked output.

MATCHESSolution

Use regex extraction and cast matched numbers to NUMERIC for ordering

MATCHESSolution

source is MongoDB and target is Redshift. Tension: I am unable to get the correct query. Outcome: tried using the regex to remove the string part in the format1.

MATCHESSolution

Use string splitting for the space-delimited parts (split_part) and a regex to strip the surrounding square brackets from the bracketed token (regexp_replace).

MATCHESSolution

You use two consecutive percentages to produce a percentage after formatting — class FormatPhoneNumber(Func):. Tension: template = "%(function)s('(%s) %s-%s', SUBSTRING(%(expressions)s,3,3), SUBSTRING(%(expressions)s,6,3), SUBSTRING(%(expressions)s,9,4))". Outcome: template = "%(function)s('(%%s) %%s-%%s', SUBSTRING(%(expressions)s,3,3), SUBSTRING(%(expressions)s,6,3), SUBSTRING(%(expressions)s,9,4))".

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

you're going to need to define your syntax very strictly, implement your own parser then hand off the final expression to eval. — if you allow anything which is not an arithmentic operator or a number to be 'eval'ed. Tension: the code is exploitable. Outcome: hand off the final expression to eval.

MATCHESSolution

Avoid using `undefined` for absent values in args; use a serializable sentinel like `null` (or empty string/number) and adjust the prop/arg union types accordingly so the story file and URL can be merged without breaking the type invariant.

MATCHESSolution

Fix the regex escaping in importOrder (e.g., use \.(css|scss) correctly within strings) and adjust rule order so the non-relative .css/.scss matcher is applied to those imports last (e.g., exclude/route .*\.(css|scss)$ after the broader patterns).

MATCHESSolution

you get the same exception that you would get if the parser encountered unsupported syntax — After reading the files, do some heuristics where you remove any `create function` or similar statement. Tension: I cannot modify these DDL files. Outcome: A pragmatic solution here is to match `create( or replace)? function.*?\\$\\$.*?\\$\\$.*?;` or similar.

MATCHESSolution

The Java specification requires a troublesome double rounding in this situation. Tension: the fewest number of decimal digits such that converting the `double` to decimal with that many digits and then converting back to `double` yields the original value.

MATCHESSolution

the string representation of the datetime has missing the fractional seconds — when I save a datetime which its fractional seconds are `.000`. Tension: my datetime parse breaks because it expects the fractional part. Outcome: cast a datetime to a string in your SQL query before it is returned in the result set.

MATCHESSolution

Instead of splitting you could also match the parts that you want using an alternation — where the alternative starts with `\S` to start the match with a non whitespace character. Tension: to prevent matching empty strings. Outcome: \d+(?:\.\d+)?\h*[DC]R|\S.*?(?=\h*\d+(?:\.\d+)?\h*[DC]R).

MATCHESSolution

You are missing another position to split on, which is the space at the end of `(FEES) ` — Instead of using a capture group `(DR|CR)` you can use a character class `[DC]R`. Tension: you can assert a digit to the right. Outcome: you can use a character class `[DC]R` and in the lookbehind you don't have to match 1 or more digits `\d{1,}` but just matching a digit `\d` would also suffice.

MATCHESSolution

Use regex boundaries that split before CREATE and after END; when procedures end with END;

MATCHESSolution

An example is the single-precision value `2097152.25`. — The shortest round-trip representations are `2097152.2` and `2097152.3`. Tension: The former is chosen because `2` is even. Outcome: The former is chosen because `2` is even.

MATCHESSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

MATCHESSolution

The vulnerability requires validating that function definition variables contain ONLY a valid function definition. — Bash 4.4+ includes a proper fix by validating function definitions during the parsing phase. Tension: The parser was modified to reject function definitions that have trailing code after the closing brace.

MATCHESSolution

Use safe overflow-checked arithmetic for the intermediate size calculation and reject unreasonable bounds values.

MATCHESSolution

Strips parenthetical aliases and keeps the longer form. Tension: "Model Context Protocol (MCP)" and "MCP (Model Context Protocol)" both produce "model context protocol". Outcome: Also strips leading articles and truncates sentence-length descriptions (>60 chars).

MATCHESSolution

The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. — reencode_escapes() (lines 406-449): two-pass size calculation with int arithmetic. Tension: The two-pass algorithm uses char_needs_escaping() which is context-sensitive. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

MATCHESSolution

The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character — The fix (commit ed0c7c7e) defines allowed = "-_.!~*'();:&=+$," and scans each character. Tension: This correctly treats ';' as valid userinfo without treating it as a terminator. Outcome: Fix is always component-specific grammar validation, not a combined strpbrk over all component terminators.

MATCHESSolution

"Omit if uncertain" rules are interpreted as permission to skip — Models (especially in batch mode where they're trying to be efficient) treat optional node types as low-priority. Outcome: Models match format much more reliably than they follow abstract rules.

MATCHESSolution

Later code at lines 273-274 attempts to write to regarray->start[i] for i >= 1, causing overflow — In regexp.c lines 265-267 within match_regex. Tension: Only allocates 1 element. Outcome: regsize can reach 16 (when max_id is 15).

MATCHESSolution

Refuse to dispatch OSC 83 by default — Mitigation/patch in src/ansi.c StringEnd(). Tension: the payload after the semicolon is parsed by Parse() and dispatched directly to DoCommand(). Outcome: only enter the typ==83 branch when explicitly enabled.

MATCHESSolution

Fix 1: In parser.c xmlParseCharData, change `int nbchar` to `ptrdiff_t nbchar`. Tension: to prevent truncation of large pointer differences.

MATCHESSolution

deduplicated stream-json final result text. Tension: schema drift is scored instead of discarded. Outcome: added a Markdown fallback parser for `<finding>` blocks.

MATCHESSolution

Three techniques applied together: — any enforcement module (DOM assertion, CSP checker, sanitizer) that must reference the same patterns its surrounding CI gate scans for. Tension: split the forbidden literal at any point that breaks the contiguous match without altering the runtime string value.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata