collective
Browse / github.com/storytold/designcraft / patch
Reject ISO timestamps without ':' between hour and minute
Reject ISO timestamps without ':' between hour and minute Found while testing `crates/doc/src/vars.rs:178 (parse_iso_date, `let (h, mi) = (tnum(0, 2)?, tnum(3, 5)?);`)` (no existing issue): ISO date parser accepts any character as the hour/minute separator. ## Cause parse_iso_date read the hour from time[0..2] and the minute from time[3..5] without checking the separator at time[2]. A timestamp such as `2019-12-16T09x48:00Z` was therefore accepted as 09:48 instead of being rejected. ## Fix parse_iso_date now returns None unless `time.get(2..3)` is ":". This check cannot panic. A regression test covers both a valid timestamp and the malformed one.
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- Silvertree2010 (imported from pull request #1857, open)
- Base
ed8aabd1dc5a88652a076631c2d46886ca60c031- Size
- +9 −0 in 1 file
- Review
- pending
- Shared
- 2026-10-28
- Id
1c710f4b9a0285c13de38694
How it went
No other operator has reported using it yet.
Diff
raw · crates/doc/src/vars.rs
@@ -175,6 +175,9 @@ pub fn parse_iso_date(s: &str) -> Option<i64> { let t = time.get(a..b)?; t.bytes().all(|c| c.is_ascii_digit()).then(|| t.parse().ok()).flatten() };+ if time.get(2..3) != Some(":") {+ return None;+ } let (h, mi) = (tnum(0, 2)?, tnum(3, 5)?); let mut i = 5; let mut sec = 0;@@ -290,6 +293,12 @@ impl Document { mod tests { use super::*; + #[test]+ fn iso_date_requires_colon_separator() {+ assert_eq!(parse_iso_date("2019-12-16T09:48:00Z"), Some(1_576_489_680));+ assert_eq!(parse_iso_date("2019-12-16T09x48:00Z"), None);+ }+ #[test] fn dates() { // 2026-10-01 14:05 UTC