dateutils icon indicating copy to clipboard operation
dateutils copied to clipboard

dadd does not properly validate the time zone

Open rdiez opened this issue 2 years ago • 6 comments
trafficstars

The following command "succeeds" without any hint about the erroneous time zone:

dateutils.dadd --zone=NonExistingTimeZone now +2h

The same applies to option "--from-zone".

Such a lack of validation is generally bad practice, but this is especially risky, because the time zone designations may vary from system to system. Most time zone designations are pretty stable and will usually work, but one day one will fail, and that error will probably go unnoticed.

This problem was mentioned in passing in #97.

rdiez avatar Apr 16 '23 19:04 rdiez

Hi, thank you for the report. A proposed fix is in a844d56df.

hroptatyr avatar Apr 18 '23 09:04 hroptatyr

First of all, thanks for your effort.

I wouldn't warn though, I would fail. Otherwise, automated scripts will never realise that the date calculations are wrong. Even human users may be reading the result at the end and miss any warnings above.

If you only want to warn, I would document that, in order to assure reliability, the caller should check that nothing gets written to stderr. Because warnings go to stderr, don't they?

Another alternative would be adding a command-line option named "--strict", "--reliable" or "--consider-warnings-as-failures".

rdiez avatar Apr 18 '23 09:04 rdiez

No you're right, it's no good having low-level code interact with the user somehow. 461a944e1 lifts the check and handling into the tools, and makes an illegal zone a fatal error.

hroptatyr avatar Apr 20 '23 08:04 hroptatyr

The new patch seems fine to me.

One minor thing though: I wouldn't use the backtick character ` around %s in error strings like: Error: cannot find zone specified in --from-zone: `%s' I would use the standard ASCII apostrophe ' on both sides of %s .

rdiez avatar Apr 20 '23 09:04 rdiez

Errors of the form `%s' are needed to allow locales to pick the right quoting character. Currently, dateutils isn't gettextised but I want to keep this option open.

hroptatyr avatar Apr 28 '23 09:04 hroptatyr

OK, then the patch is fine!

rdiez avatar Apr 28 '23 09:04 rdiez