Skip to content

gh-152212: Reject a POSIX TZ footer with a missing std offset in pure-Python zoneinfo#152213

Merged
StanFromIreland merged 2 commits into
python:mainfrom
tonghuaroot:fix-gh-152212-zoneinfo-std-offset
Jun 27, 2026
Merged

gh-152212: Reject a POSIX TZ footer with a missing std offset in pure-Python zoneinfo#152213
StanFromIreland merged 2 commits into
python:mainfrom
tonghuaroot:fix-gh-152212-zoneinfo-std-offset

Conversation

@tonghuaroot

@tonghuaroot tonghuaroot commented Jun 25, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

The pure-Python zoneinfo._parse_tz_str defaults a missing std offset to 0 (else: std_offset = 0), so a POSIX TZ footer with a bare std abbreviation and no offset (AAA, A, AA, B) is silently accepted as a fixed offset-0 zone. POSIX requires the offset after std (Issue 8 §8.3), and the C accelerator already raises ValueError: Invalid STD offset, so this makes the pure-Python parser raise to match.

Adds AAA/A/AA/B to test_invalid_tzstr, which runs against both TZStrTest (pure) and CTZStrTest (C). Non-breaking: all 598 IANA zones still parse, and well-formed strings (EST5, <ABC>5, AAA5) are unaffected.

Fixes #152212.

@tonghuaroot
pythongh-152212: Reject a POSIX TZ footer with a missing std offset i…
babe3da 
…n pure-Python zoneinfo

The pure-Python _parse_tz_str defaulted a missing std offset to 0, so a POSIX TZ
footer with a bare std abbreviation and no offset (e.g. 'AAA') was silently accepted
as a fixed offset-0 zone.  POSIX requires the offset after std, and the C accelerator
already rejects it, so the pure-Python parser now raises ValueError to match.
@bedevere-app bedevere-app Bot mentioned this pull request Jun 25, 2026
Closed
@tonghuaroot tonghuaroot mentioned this pull request Jun 26, 2026
Closed
StanFromIreland
StanFromIreland reviewed Jun 26, 2026
View reviewed changes
Comment thread Lib/zoneinfo/_zoneinfo.py
Comment thread Misc/NEWS.d/next/Library/2026-06-25-12-00-00.gh-issue-152212.Zk7Qm2.rst Outdated
Comment thread Lib/test/test_zoneinfo/test_zoneinfo.py
"PST8PDT", # DST but no transition specified
# gh-152212: the std offset is required (POSIX TZ grammar)
"AAA",
"A",

@StanFromIreland StanFromIreland Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was going to say these are rejected for another reason, i.e. because of the spec's required length:

three byte minimum length

But of course, we don't enforce that. However, I'm also not sure if this is just part of the 2024 updated spec, and I don't have time to check right now. I'll put this on my to-do list.

StanFromIreland
StanFromIreland approved these changes Jun 27, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@StanFromIreland StanFromIreland merged commit 93454fe into python:main Jun 27, 2026
58 checks passed
@StanFromIreland StanFromIreland added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Jun 27, 2026
@miss-islington-app

miss-islington-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

Thanks @tonghuaroot for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

Thanks @tonghuaroot for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

Thanks @tonghuaroot for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

GH-152377 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 27, 2026
@bedevere-app

bedevere-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

GH-152378 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 27, 2026
@bedevere-app

bedevere-app Bot commented Jun 27, 2026

Copy link
Copy Markdown

GH-152379 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 27, 2026
StanFromIreland pushed a commit that referenced this pull request Jun 27, 2026
@miss-islington @tonghuaroot
[3.13] gh-152212: Reject a POSIX TZ footer with a missing std offset …
8744d05 
…in pure-Python `zoneinfo` (GH-152213) (#152377)

(cherry picked from commit 93454fe)

Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
StanFromIreland pushed a commit that referenced this pull request Jun 27, 2026
@miss-islington @tonghuaroot
[3.14] gh-152212: Reject a POSIX TZ footer with a missing std offset …
daa378e 
…in pure-Python `zoneinfo` (GH-152213) (#152378)

(cherry picked from commit 93454fe)

Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
StanFromIreland pushed a commit that referenced this pull request Jun 27, 2026
@miss-islington @tonghuaroot
[3.15] gh-152212: Reject a POSIX TZ footer with a missing std offset …
cab3bb8 
…in pure-Python `zoneinfo` (GH-152213) (#152379)

(cherry picked from commit 93454fe)

Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes
@pganssle pganssle Awaiting requested review from pganssle pganssle is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

zoneinfo: pure-Python parser accepts a POSIX TZ footer with no STD offset (C rejects)

2 participants

@tonghuaroot @StanFromIreland