tighten up Date parsing to not allow 'M/D/YY' (or 'D/M/YY) [SF#1290550]

Author: Richard Jones

CHANGES.txt

@@ -25,6 +25,8 @@ Fixed:
 - HTTP authorization takes precedence over session cookie (sf bug 1396134)
 - fixed documentation of filter() in the case of multiple values in a
   String search (sf bug 1373396)
+- tighten up Date parsing to not allow 'M/D/YY' (or 'D/M/YY) (sf bug
+  1290550)
 
 
 2005-10-07 0.9.0b1

roundup/date.py

@@ -15,7 +15,7 @@
 # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE,
 # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
 #
-# $Id: date.py,v 1.82 2005-06-08 03:47:09 anthonybaxter Exp $
+# $Id: date.py,v 1.83 2006-01-13 00:22:16 richard Exp $
 
 """Date, time and time interval handling.
 """
@@ -39,6 +39,19 @@ def _add_granularity(src, order, value = 1):
             src[gran] = int(src[gran]) + value
             break
 
+# no, I don't know why we must anchor the date RE when we only ever use it
+# in a match()
+date_re = re.compile(r'''^
+    ((?P<y>\d\d\d\d)([/-](?P<m>\d\d?)([/-](?P<d>\d\d?))?)? # yyyy[-mm[-dd]]
+    |(?P<a>\d\d?)[/-](?P<b>\d\d?))?              # or mm-dd
+    (?P<n>\.)?                                   # .
+    (((?P<H>\d?\d):(?P<M>\d\d))?(:(?P<S>\d\d(\.\d+)?))?)?  # hh:mm:ss
+    (?P<o>[\d\smyd\-+]+)?                        # offset
+$''', re.VERBOSE)
+serialised_date_re = re.compile(r'''
+    (\d{4})(\d\d)(\d\d)(\d\d)(\d\d)(\d\d?(\.\d+)?)
+''', re.VERBOSE)
+
 class Date:
     '''
     As strings, date-and-time stamps are specified with the date in
@@ -153,15 +166,8 @@ def __init__(self, spec='.', offset=0, add_granularity=0, translator=i18n):
         except:
             raise ValueError, 'Unknown spec %r' % (spec,)
 
-    def set(self, spec, offset=0, date_re=re.compile(r'''
-            ((?P<y>\d\d\d\d)([/-](?P<m>\d\d?)([/-](?P<d>\d\d?))?)? # yyyy[-mm[-dd]]
-            |(?P<a>\d\d?)[/-](?P<b>\d\d?))?              # or mm-dd
-            (?P<n>\.)?                                     # .
-            (((?P<H>\d?\d):(?P<M>\d\d))?(:(?P<S>\d\d(\.\d+)?))?)?  # hh:mm:ss
-            (?P<o>.+)?                                     # offset
-            ''', re.VERBOSE), serialised_re=re.compile(r'''
-            (\d{4})(\d\d)(\d\d)(\d\d)(\d\d)(\d\d?(\.\d+)?)
-            ''', re.VERBOSE), add_granularity=0):
+    def set(self, spec, offset=0, date_re=date_re,
+            serialised_re=serialised_date_re, add_granularity=0):
         ''' set the date to the value in spec
         '''
 

test/test_dates.py

@@ -15,7 +15,7 @@
 # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE,
 # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
 #
-# $Id: test_dates.py,v 1.36 2005-02-25 17:18:46 a1s Exp $
+# $Id: test_dates.py,v 1.37 2006-01-13 00:22:17 richard Exp $
 from __future__ import nested_scopes
 
 import unittest, time
@@ -64,6 +64,7 @@ def testDateError(self):
         self.assertRaises(ValueError, Date, "12")
         # Date cannot handle dates before UNIX epoch
         self.assertRaises(ValueError, Date, (1, 1, 1, 0, 0, 0.0, 0, 1, -1))
+        self.assertRaises(ValueError, Date, "1/1/06")
 
     def testOffset(self):
         ae = self.assertEqual