From: Brian Yurko <155515-byurko@users.noreply.gitlab.gnome.org> Date: Wed, 11 Jun 2025 11:00:56 -0400 Subject: tests: Add tests for date-time including timezone validation work These tests are built on top of earlier work in a related pull request. Origin: upstream, 3.7.0, commit:8988379984e33dcc7d3aa58551db13e48755959f Bug: https://gitlab.gnome.org/GNOME/libsoup/-/issues/448 Bug-CVE: https://security-tracker.debian.org/tracker/CVE-2025-4945 Bug-Debian: https://bugs.debian.org/1106205 --- libsoup/soup-date-utils.c | 8 ++++---- tests/cookies-test.c | 1 + tests/date-test.c | 37 ++++++++++++++++++++++++++++++------- 3 files changed, 35 insertions(+), 11 deletions(-) diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c index 34ca995..73f80ab 100644 --- a/libsoup/soup-date-utils.c +++ b/libsoup/soup-date-utils.c @@ -40,7 +40,7 @@ soup_date_time_is_past (GDateTime *date) g_return_val_if_fail (date != NULL, TRUE); /* optimization */ - if (g_date_time_get_year (date) < 2020) + if (g_date_time_get_year (date) < 2025) return TRUE; return g_date_time_to_unix (date) < time (NULL); @@ -219,15 +219,15 @@ parse_timezone (GTimeZone **timezone, const char **date_string) } else val = 60 * (val / 100) + (val % 100); offset_minutes = sign * val; - utc = (sign == -1) && !val; + utc = (sign == -1) && !val; } else if (**date_string == 'Z') { offset_minutes = 0; - utc = TRUE; + utc = TRUE; (*date_string)++; } else if (!strcmp (*date_string, "GMT") || !strcmp (*date_string, "UTC")) { offset_minutes = 0; - utc = TRUE; + utc = TRUE; (*date_string) += 3; } else if (strchr ("ECMP", **date_string) && ((*date_string)[1] == 'D' || (*date_string)[1] == 'S') && diff --git a/tests/cookies-test.c b/tests/cookies-test.c index ff809a4..18c9b60 100644 --- a/tests/cookies-test.c +++ b/tests/cookies-test.c @@ -464,6 +464,7 @@ static void do_cookies_parsing_int32_overflow (void) { SoupCookie *cookie = soup_cookie_parse ("Age=1;expires=3Mar9 999:9:9+ 999999999-age=main=gne=", NULL); + g_test_bug ("https://gitlab.gnome.org/GNOME/libsoup/-/issues/448"); g_assert_nonnull (cookie); g_assert_null (soup_cookie_get_expires (cookie)); soup_cookie_free (cookie); diff --git a/tests/date-test.c b/tests/date-test.c index 7eefd7c..abf89dd 100644 --- a/tests/date-test.c +++ b/tests/date-test.c @@ -92,6 +92,11 @@ static const OkDate ok_dates[] = { { "Sat, 06 Nov 2004 08:09:07", NULL }, { "06 Nov 2004 08:09:07 GMT", NULL }, { "SAT, 06 NOV 2004 08:09:07 +1000", "644048" }, + { "Sat, 06-Nov-2004 08:09:07 -10000", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + { "Sat, 06-Nov-2004 08:09:07 +01:30", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + { "Sat, 06-Nov-2004 08:09:07 +0:180", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + { "Sat, 06-Nov-2004 08:09:07 +100:100", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + { "Sat, 06-Nov-2004 08:09:07 Z", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, /* rfc850-date, and broken variants */ { "Saturday, 06-Nov-04 08:09:07 GMT", NULL }, @@ -109,6 +114,8 @@ static const OkDate ok_dates[] = { { "Sat Nov 06 08:09:07 2004", NULL }, { "Sat Nov 6 08:09:07 2004", NULL }, { "Sat Nov 6 08:09:07 2004 GMT", NULL }, + { "Sat Nov 6 08:09:07 2004 NoZone", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + { "Sat Nov 6 08:09:07 2004 UTC", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, /* Netscape cookie spec date, and broken variants */ { "Sat, 06-Nov-2004 08:09:07 GMT", NULL }, @@ -182,7 +189,23 @@ static const BadDate bad_dates[] = { { "Sat Nov 6 08::07 2004", NULL }, { "Sat Nov 6 08:09: 2004", NULL }, { "Sat Nov 6 08:09:07", NULL }, - { "Sat Nov 6 08:09:07 GMT 2004", NULL } + { "Sat Nov 6 08:09:07 GMT 2004", NULL }, + + /* range constraints added "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" */ + { "Sat, 00-Nov-2004 08:09:07 GMT", NULL }, + { "Sat, 32-Nov-2004 08:09:07 GMT", NULL }, + { "Sat, 06-Nov-0 08:09:07 GMT", NULL }, + { "Sat, 06-Nov-9999 08:09:07 GMT", NULL }, + { "Sat, 06-Nov-2004 0-1:09:07 GMT", NULL }, + { "(Sat), Nov 6 -1:09:07 2004", NULL }, + { "Sat, 06-Nov-2004 24:09:07 GMT", NULL }, + { "Sat, 06-Nov-2004 08:-1:07 GMT", NULL }, + { "Sat, 06-Nov-2004 08:60:07 GMT", NULL }, + { "Sat, 06-Nov-2004 08:09:-10 GMT", NULL }, + { "Sat, 06-Nov-2004 08:09:60 GMT", NULL }, + { "Sat, 06-Nov-71 08:09:99 UTC", NULL }, + { "Sat, 31-Feb-2004 08:09:07 UTC", NULL }, + { "2004-11-06T08:09:07Z", NULL } }; static void @@ -198,12 +221,12 @@ check_bad (gconstpointer data) soup_test_assert (date == NULL, "date parsing succeeded for '%s': %d %d %d - %d %d %d", bad->date, - g_date_time_get_year (date), - g_date_time_get_month (date), - g_date_time_get_day_of_month (date), - g_date_time_get_hour (date), - g_date_time_get_minute (date), - g_date_time_get_second (date)); + g_date_time_get_year (date), + g_date_time_get_month (date), + g_date_time_get_day_of_month (date), + g_date_time_get_hour (date), + g_date_time_get_minute (date), + g_date_time_get_second (date)); g_clear_pointer (&date, g_date_time_unref); }