Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Form] fail reverse transforming invalid RFC 3339 dates #28466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 22, 2018
Merged

[Form] fail reverse transforming invalid RFC 3339 dates #28466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions src/Symfony/Component/Form/Extension/Core/DataTransformer/DateTimeToRfc3339Transformer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ public function reverseTransform($rfc3339)
return;
}

if (!preg_match('/^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}(?::\d{2})?(?:\.\d)?(?:Z|(?:(?:\+|-)\d{2}:\d{2}))$/', $rfc3339, $matches)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a possibility this stricter regexp could be a BC break? What would be the downside of keeping the previous regexp?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In theory, if someone doesn't use their browser but submits dates manually that could indeed feel like a BC break to them. But since #28372 this transformer isn't used anymore by any of the built-in form types. So yes, maybe we should relax this pattern here and in DateTimeToHtml5LocalDateTimeTransformer a bit. The question then is, how much relaxation should we do and when is a failure acceptable?

Copy link
Member

@nicolas-grekas nicolas-grekas Sep 19, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just keeping the previous one? '/(\d{4})-(\d{2})-(\d{2})/'? (should be also applied to DateTimeToHtml5LocalDateTimeTransformer) - or at least put the added trailing patterns in a (?:...)? to make them optional?

Copy link
Member

@javiereguiluz javiereguiluz Sep 21, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand this. If we're implementing RFC 339, we can't discuss about the regexp, right? We should use the one defined in that RFC. Since we're fixing a bug, BC breaks are not considered. Strictly speaking, all bug fixes are BC breaks because we're changing the previous behaviour.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Javier has a valid point here. Let's just keep it the way it is.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've not checked, but is usage like #28703 supposed to work? I mean, it worked before... by accident, right? Not saying we should not fix the BC break of course.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using relative date formats was never supposed to work. It used to work accidentally like many invalid dates too. If we are really to make that supported, that will means that we have to abstain completely from detecting invalid input.

Copy link
Member

@nicolas-grekas nicolas-grekas Oct 3, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We were accepting any parseable date, with the format allowed by the date parser of PHP. That's a working validation strategy to me also.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The date parser accepts way too much input (see #28455 for such an example). I don't see how that is better.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I won't argue about how being stricter can be better (or not, e.g. for accessibility) - but this is still a regression.

throw new TransformationFailedException(sprintf('The date "%s" is not a valid date.', $rfc3339));
}

try {
$dateTime = new \DateTime($rfc3339);
} catch (\Exception $e) {
Expand All @@ -79,10 +83,8 @@ public function reverseTransform($rfc3339)
$dateTime->setTimezone(new \DateTimeZone($this->inputTimezone));
}

if (preg_match('/(\d{4})-(\d{2})-(\d{2})/', $rfc3339, $matches)) {
if (!checkdate($matches[2], $matches[3], $matches[1])) {
throw new TransformationFailedException(sprintf('The date "%s-%s-%s" is not a valid date.', $matches[1], $matches[2], $matches[3]));
}
if (!checkdate($matches[2], $matches[3], $matches[1])) {
throw new TransformationFailedException(sprintf('The date "%s-%s-%s" is not a valid date.', $matches[1], $matches[2], $matches[3]));
}

return $dateTime;
Expand Down
17 changes: 15 additions & 2 deletions .../Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToRfc3339TransformerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,12 +134,25 @@ public function testReverseTransformWithNonExistingDate()
}

/**
* @dataProvider invalidDateStringProvider
* @expectedException \Symfony\Component\Form\Exception\TransformationFailedException
*/
public function testReverseTransformExpectsValidDateString()
public function testReverseTransformExpectsValidDateString($date)
{
$transformer = new DateTimeToRfc3339Transformer('UTC', 'UTC');

$transformer->reverseTransform('2010-2010-2010');
$transformer->reverseTransform($date);
}

public function invalidDateStringProvider()
{
return array(
'invalid month' => array('2010-2010-01'),
'invalid day' => array('2010-10-2010'),
'no date' => array('x'),
'cookie format' => array('Saturday, 01-May-2010 04:05:00 Z'),
'RFC 822 format' => array('Sat, 01 May 10 04:05:00 +0000'),
'RSS format' => array('Sat, 01 May 2010 04:05:00 +0000'),
);
}
}