From: Fabrice Bellard <fabrice@bellard.org>
Date: Tue, 10 Nov 2026 09:54:22 +0000 (+0100)
Subject: temporal: stricter timezone validation
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=8120a9e1e822f222efd09fafc42b353f2f6a9567;p=quickjs.git

temporal: stricter timezone validation
---

diff --git a/temporal/temporal.c b/temporal/temporal.c
index e6bd521..ccabbbe 100644
--- a/temporal/temporal.c
+++ b/temporal/temporal.c
@@ -196,7 +196,7 @@ int ti_parse_temporal_timezone_string(const char *str, int64_t *offset_ns)
     /* ISO date-time string with ±HHMM or ±HH:MM offset at end */
     if (len >= 5) {
         const char *offset_start = NULL;
-        int offset_len = 0;
+        size_t offset_len = 0;
         int i;
         for (i = (int)(len - 6); i >= 0; i--) {
             if ((str[i] == '+' || str[i] == '-') && str[i + 3] == ':') {
@@ -235,11 +235,7 @@ int ti_parse_temporal_timezone_string(const char *str, int64_t *offset_ns)
                 int hours = h1 * 10 + h2;
                 int mins = m1 * 10 + m2;
                 if (hours <= 23 && mins <= 59) {
-                    if ((int)len > (int)(offset_start - str) + offset_len && offset_start[offset_len] == ':')
-                        return -1;
-                    if ((int)len > (int)(offset_start - str) + offset_len && offset_start[offset_len] == '.')
-                        return -1;
-                    if (len >= 7 && !memcmp(str, "-000000", 7))
+                    if (len > (offset_start - str) + offset_len)
                         return -1;
                     *offset_ns = sign * ((int64_t)hours * 3600 + mins * 60) * 1000000000LL;
                     return 0;
@@ -3877,6 +3873,15 @@ int ti_validate_timezone_identifier(JSContext *ctx, JSValueConst v, const char *
             return JS_ThrowRangeError(ctx, "invalid time zone"), -1;
         }
     }
+    /* An offset time zone identifier or an available named time zone
+       identifier (GetAvailableNamedTimeZoneIdentifier is not empty) */
+    if (str[0] == '+' || str[0] == '-') {
+        int64_t offset_ns;
+        if (ti_parse_temporal_timezone_string(str, &offset_ns) < 0) {
+            JS_FreeCString(ctx, str);
+            return JS_ThrowRangeError(ctx, "invalid time zone"), -1;
+        }
+    }
     *out_str = str;
     return 1;
 }